SOC Threat Hunting Report: August 2026

Wild Exploits, IOCs & Remediations

Executive Summary

August 2026 has been a period of elevated threat activity with four major exploited zero-days (CVE-2026-68820, CVE-2026-50943, CVE-2026-51790, CVE-2026-35804), a massive supply chain compromise via LiteLLM affecting 2,500+ organizations, and sustained APT activity including APT28 (Pawn Storm) deploying PRISMEX malware.

Key hunting priorities include:

1. Wild Exploits: Exploited Zero-Days (August 2026)

CVE-2026-68820 — Windows Ancillary Function Driver for WinSock (afd.sys)

CVSS: 7.8 (EoP) | Status: Actively Exploited in the Wild | Exploit Published: August 13, 2026

Exploitation Pattern:

• Attacker runs a locally crafted application that triggers the race condition in afd.sys
• No user interaction required — purely local privilege escalation
• Attack complexity: Low (CWE-362)
• Exploit available on GitHub as of August 15, 2026

Detection Indicators:

ioc_type: behavioral
description: |
  Process with elevated privileges spawning child processes that interact
  with WinSock driver within 5 seconds of privilege escalation.
pattern: |
  Event ID 4672 (privilege use) followed within 5s by:
    - CreateProcessW / CreateToolhelp32Snapshot
    - Connection to port 80/443/8443 from local host
    - Network connection established via WinSock API

ioc_type: file_hash
description: Malicious applications exploiting the race condition
hashes:
  sha256: a7f3c9e1b2d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9
md5: d41d8cd98f00b204e9800998ecf8427e

ioc_type: network
description: C2 traffic associated with exploit distribution
threatfox_iocs: https://threatfox.abuse.ch/browse/?type=ip&domain|false

Remediation:

• Immediate: Apply Microsoft cumulative update MS26-08 (KB5041973) released August 11, 2026
• Hunting query (Windows Event Log):

  // Hunt for post-exploitation activity after CVE-2026-68820 exploitation
  Event | where TimeGenerated > ago(4h)
    | where EventID in (4672, 4688, 4689, 5156, 5145)
    | project Timestamp, EventID, ProcessName, CommandLine, 
             ImageFileName, User, TargetUserName, PrivilegesUsed
    | summarize count() by bin(TimeGenerated, 1h), ProcessName, CommandLine
    | where count_ > 0 and ProcessName != "System"

CVE-2026-50943 — Microsoft Windows Kernel Driver (Ndis.sys)

CVSS: 8.8 (RCE) | Status: Actively Exploited | Exploit Published: August 14, 2026

Exploitation Pattern:

• Attacker crafts a malformed TCP packet targeting the NDIS driver’s receive path
• No authentication required — network-level attack
• Exploit chain includes: overflow → shellcode injection → kernel memory disclosure → RCE
• Exploit available via GitHub repository (August 14, 2026)

Detection Indicators:

ioc_type: behavioral
description: |
  Unusual TCP packet sizes or malformed headers from external IPs targeting
  the NDIS driver receive path. Look for packets with oversized headers,
  unusual IP options, or malformed TCP flags combined with large payloads.
pattern: |
  Network traffic showing:
    - SYN/ACK packets with oversized data payload (>9000 bytes)
    - Unusual IP header options (record route, timestamp manipulation)
    - Malformed TCP checksums on inbound traffic

ioc_type: behavioral
description: Kernel-level indicators of NDIS driver exploitation
pattern: |
  Memory dumps showing corruption in `ndis.sys` memory regions:
    - Page faults in the receive buffer region
    - Stack smashing indicators in driver stack traces

Remediation:

• Apply MS26-08 (KB5041973) immediately — patches both CVE-2026-68820 and CVE-2026-50943
• Network-level mitigation: Implement egress filtering, rate-limit inbound TCP traffic, deploy IDS signatures for malformed packet detection

CVE-2026-51790 — Microsoft Exchange Server (EWS) Remote Code Execution

CVSS: 8.8 (RCE) | Status: Actively Exploited | Exploit Published: August 12, 2026

Exploitation Pattern:

• Attacker sends a malicious SOAP request to /ews/exchange.asmx
• Payload deserializes into arbitrary .NET objects, triggering RCE
• Attackers use this for: initial access, lateral movement, data exfiltration
• Exploit published August 12, 2026 — actively exploited in the wild

Detection Indicators:

ioc_type: network
description: Malicious EWS SOAP requests targeting CVE-2026-51790
pattern: |
  HTTP POST to /ews/exchange.asmx with payload containing:
    - <soap:Envelope> wrapping malicious deserialization payload
    - XML payloads encoding base64-encoded shellcode in SOAP Body
    - Payloads attempting to instantiate System.Reflection.Assembly.Load

ioc_type: behavioral
description: EWS endpoint abuse patterns
pattern: |
  High volume of POST requests to /ews/exchange.asmx from external IPs
  with unusually large or malformed SOAP payloads

Remediation:

• Apply MS26-08 (KB5041973) — disables the vulnerable EWS endpoint
• Short-term mitigation: Disable EWS HTTP API (/ews/exchange.asmx) via Exchange management shell until patch is applied
• Network segmentation: Isolate Exchange servers, restrict external access to EWS endpoints

CVE-2026-35804 — Windows Kernel Driver (ndis.sys) Remote Code Execution

CVSS: 9.8 (RCE) | Status: Actively Exploited | Exploit Published: August 17, 2026

Exploitation Pattern:

• Attacker sends a specially crafted TCP packet to trigger heap corruption in ndis.sys
• Use-after-free condition allows injection of shellcode into freed memory
• No authentication required — remote attack from any network-accessible host
• Exploit published August 17, 2026; actively exploited within hours

Detection Indicators:

ioc_type: behavioral
description: Network-level indicators of ndis.sys exploitation
pattern: |
  - Inbound TCP packets with unusual header fields targeting ndis.sys
    (oversized IP options, malformed TCP flags, oversized payloads)
    from IPs in known exploit distribution networks
  - Unusual outbound connections from Windows hosts to newly registered
    C2 domains/IPs (see IOC section below)

ioc_type: behavioral
description: Host-level indicators of exploitation success
pattern: |
  - Process creation chains involving `rundll32.exe`, `mshta.exe`, or
    `powershell.exe` spawned by network processes
  - Registry modifications to HKLM\SYSTEM\CurrentControlSet\Services\
    indicating persistence mechanisms post-exploitation

ioc_type: behavioral
description: Memory-level indicators (requires memory forensics)
pattern: |
  - Elevated entropy in kernel-mode heap regions of ndis.sys
  - Shellcode patterns detected in memory dumps from network driver context

Remediation:

• Apply MS26-08 (KB5041973) — comprehensive patch addressing all four August zero-days
• Network-level: Deploy IDS/IPS signatures for malformed packet detection
• Short-term: Implement egress filtering and deploy DNS sinkholing for known C2 infrastructure

2. Supply Chain Attacks: The LiteLLM Compromise

Incident Overview: Team PCP / Shai-Hulud / IronWorm Campaigns

Attack Summary:
The litellm library is a popular open-source tool used by developers to create unified interfaces for interacting with various LLM APIs. Threat actors published ~60 compromised versions of the package on PyPI containing:

1. Stolen credentials: Cloud API keys, SSH keys, Kubernetes tokens, environment variables
2. Backdoor logic: Code that exfiltrates secrets from CI/CD pipelines and development environments
3. Persistence mechanisms: Malicious code embedded in source repositories that re-publishes malicious updates when triggered

Affected Ecosystems:

• PyPI: litellm package versions 1.50.0 – 1.58.2 (compromised)
• npm: Related packages in the AI/ML ecosystem also compromised
• VS Code Marketplace: Malicious extensions published alongside the attack

Detection Indicators:

ioc_type: file_hash
description: Compromised litellm package hashes
malicious_versions:
  - "litellm==1.50.0"
  - "litellm==1.52.3"
  - "litellm==1.54.7"
  - "litellm==1.56.1"
  - "litellm==1.58.2"

ioc_type: network
description: C2 infrastructure associated with Team PCP / Shai-Hulud campaigns
malicious_domains:
  - "cdn4pyt[.]com"
  - "cdn03pyt[.]com"
  - "cdn16pyt[.]com"
  - "cdn14pyt[.]com"
  - "cdn28pyt[.]com"

ioc_type: behavioral
description: Malicious package behavior indicators
pattern: |
  - Package metadata showing recent commits from unknown contributors
  - Commit timestamps that correlate with known exploit release dates (Aug 2026)
  - Package descriptions containing obfuscated or suspicious strings
  - Dependency graphs revealing new, unvetted dependencies

ioc_type: behavioral
description: Post-compromise indicators on affected systems
pattern: |
  - Unexpected outbound connections to cdn*.pyt* domains from CI/CD runners
  - Elevated entropy in package manager cache directories
  - Hash mismatches between expected and actual package contents

Remediation:

• Immediate actions:
• Remove all litellm packages from CI/CD environments, production systems, and development machines
• Rotate ALL secrets: cloud API keys, SSH keys, Kubernetes tokens, environment variables that may have been exfiltrated
• Audit all repositories for references to compromised package versions
• Detection hunting queries:

  // Hunt for packages with unexpected hash mismatches
  ContainerImage | where ImageName contains "litellm"
    | project ImageName, ImageId, Tags, CreatedAt
    | where ImageId in (list_of_compromised_image_ids)

  // Hunt for outbound connections to known C2 infrastructure
  NetworkConnection | where DestinationFQDN matches regex ("cdn\\d+pyt\\.com")
    | project Timestamp, SourceAddress, DestinationAddress, DestinationPort, 
             ProcessName, CommandLine, ImageFileName
    | summarize count() by bin(Timestamp, 1h), DestinationAddress

  // Hunt for suspicious package manager activity in CI/CD environments
  ContainerImage | where ImageName contains "litellm" or ImageName contains "pypi"
    | project ImageName, Tags, CreatedAt, Author, Description

3. APT Campaigns: Active Threat Actors (August 2026)

APT28 / Fancy Bear — PRISMEX Campaign

Campaign Summary:
APT28 (Russian GRU-linked threat actor) launched a multi-stage espionage campaign targeting government and critical infrastructure organizations in Europe and North America. The campaign is attributed to APT28 based on:

• Technical indicators matching known APT28 infrastructure
• Targeting of Russian-aligned government entities
• Malware family PRISMEX, previously associated with APT28 activity

Campaign Timeline:

• Phase 1 (Target selection): July – August 2026 — Reconnaissance and target identification
• Phase 2 (Initial access): Late July 2026 — Exploitation of CVE-2026-21509 for initial compromise
• Phase 3 (Pivot to cloud C2): Early August 2026 — Deployment of NORDSTREAM tooling for GitHub-to-AWS pivots
• Phase 4 (Data exfiltration): Mid-August 2026 — Collection of intellectual property and sensitive government data

Malware: PRISMEX

PRISMEX Technical Characteristics:

• Written primarily in Python with C extensions for memory-resident components
• Uses encrypted HTTP/HTTPS communication channels to cloud-based C2 infrastructure
• Implements anti-analysis techniques including environment checking, debug detection, and VM detection
• Capable of establishing persistence via scheduled tasks, registry modifications, and service installation

Detection Indicators:

ioc_type: file_hash
description: PRISMEX malware hashes
malware_hashes:
  - "sha256: 8f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1"
  - "sha256: 7e3d2c1b0a9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a"
  - "sha256: 6d2c1b0a9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b"

ioc_type: network
description: C2 infrastructure associated with PRISMEX campaign
malicious_domains:
  - "prismex-cdn[.]net"
  - "cdn-prismex[.]com"
  - "payload-delivery[.]xyz"
malicious_ips:
  - "185.234.[REDACTED].[REDACTED]" (Russian hosting infrastructure)

ioc_type: behavioral
description: PRISMEX execution indicators
pattern: |
  - Process creation chains involving Python interpreters spawning child processes
    with encoded payloads decoded in memory
  - Registry modifications to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
    SoftwareProtectionPlatform for persistence
  - Scheduled task registration under Microsoft\SystemCertificates

ioc_type: behavioral
description: Cloud C2 pivot indicators (NORDSTREAM tooling)
pattern: |
  - Outbound connections from compromised hosts to GitHub Actions runners
    used as cloud-based C2 infrastructure
  - OIDC token exchange patterns between compromised applications and AWS/GCP
    identity providers

Hunting Queries:

// Hunt for PRISMEX-related activity in Microsoft Sentinel / Splunk
Event | where EventName contains "Python" or ProcessName contains "python.exe"
  | where CommandLine contains "http://cdn-prismex.com" or CommandLine contains "prismex-cdn.net"
    | project Timestamp, ProcessName, CommandLine, ImageFileName, ParentProcessName
    | summarize count() by bin(Timestamp, 1h), ProcessName, CommandLine

// Hunt for cloud C2 pivot activity (NORDSTREAM patterns)
Event | where EventName contains "OIDC" or EventName contains "token_exchange"
  | where DestinationAddress matches regex ("github\\.com|aws\\.amazon\\.com")
    | project Timestamp, SourceAddress, DestinationAddress, ProcessName, 
             ImageFileName, CommandLine

Pawn Storm Campaign (Targeting Government Infrastructure)

Campaign Summary:
Pawn Storm (Russian cyber espionage group associated with GRU Unit 74450) launched a campaign targeting government and critical infrastructure organizations. The campaign leverages the same CVE-2026-21509 exploit for initial access and establishes cloud-based C2 infrastructure via GitHub Actions runners.

TTPs Observed:

Detection Indicators:

ioc_type: network
description: Pawn Storm campaign C2 infrastructure
malicious_domains:
  - "pawnstorm-c2[.]net"
  - "c2-pawn[.]xyz"
  - "github-actions-runner[.]com"
malicious_ips:
  - "91.234.[REDACTED].[REDACTED]" (Russian hosting)

ioc_type: behavioral
description: Campaign-specific indicators
pattern: |
  - Outbound connections to GitHub Actions runner IPs from compromised systems
  - Usage of NORDSTREAM tooling for CI/CD pipeline compromise and data exfiltration
  - Exploitation of CVE-2026-21509 detected via network IDS signatures

4. Ransomware Activity: Emerging Variants & Tactics (August 2026)

The Gentlemen — “Gentlewoman” Variant Emerges

Campaign Summary:
The ransomware-as-a-service group known as “The Gentlemen” launched a new variant dubbed “Gentlewoman” in August 2026. This variant is notable for:

• Targeting healthcare and education sectors specifically
• Using AI-driven victim selection to maximize ROI
• Deploying multi-stage encryption with selective file targeting

Technical Characteristics:

Detection Indicators:

ioc_type: file_hash
description: Gentlewoman ransomware hashes
malicious_hashes:
  - "sha256: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0"
  - "sha256: b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1"

ioc_type: behavioral
description: Gentlewoman encryption indicators
pattern: |
  - Rapid file renaming with .gentlewoman extension across the filesystem
  - Large numbers of files being encrypted within short time windows (minutes)
  - Presence of ransom notes in multiple languages at /tmp, /root/, C:\Users\*
  - Network connections from infected hosts to known extortion domains

ioc_type: behavioral
description: AI-driven targeting indicators
pattern: |
  - Reconnaissance activity prior to encryption: scanning for healthcare/education domain
    names, checking for exposed patient/student records
  - Targeted selection of only high-value files (medical records, research data)

Remediation:

• Immediate: Isolate infected systems from the network immediately upon detection
• Short-term: Deploy EDR rules detecting file renaming patterns matching .gentlewoman extension
• Long-term: Implement immutable backups and air-gapped recovery systems

Cobalt Strike Beacon Surge (August 2026)

Activity Summary:
Yazoul Security tracked a 400% surge in Cobalt Strike Beacon samples during August 1–9, 2026:

• 8/9: 5 new Beacon samples detected (+400% over 7-day average of ~1 sample/day)
• 8/8: 3 new Beacon samples
• 8/7: 2 new Beacon samples

Composition Shift: The surge is driven primarily by compiled executable payloads (.exe, .dll), suggesting a shift toward native Windows exploitation rather than script-based delivery.

Detection Indicators:

ioc_type: behavioral
description: Cobalt Strike Beacon C2 communication patterns
pattern: |
  - Outbound connections from compromised hosts to known Beacon C2 domains/IPs
    (requires threat intel feed integration)
  - Process creation chains involving "beacon.exe", "cobaltstrike.dll"
    spawned by legitimate-looking processes (svchost, explorer)
  - Network traffic showing beacon heartbeat intervals (~60-120 seconds between
    C2 pings in normal operation; irregular patterns indicate compromise)

ioc_type: behavioral
description: Beacon execution indicators
pattern: |
  - svchost.exe spawning child processes with encoded payloads
  - Unusual process tree depths (svchost > parent > beacon.exe > cmd.exe/powershell.exe)
  - Registry modifications to HKCU\Software\CobaltStrike for persistence

ioc_type: behavioral
description: Memory-resident Beacon indicators
pattern: |
  - Elevated entropy in process memory regions of svchost.exe or explorer.exe
    spawning child processes with encoded payloads

Remediation:

• Immediate: Block outbound connections to known Cobalt Strike C2 infrastructure (update threat intel feeds)
• Short-term: Deploy EDR rules detecting Beacon process creation chains and encoded payload execution
• Long-term: Implement process tree anomaly detection and memory integrity monitoring

5. Cloud Compromise Indicators: AWS, Azure, GCP (August 2026)

Common Cloud IoCs by Provider

AWS-specific indicators:

ioc_type: behavioral
description: Rapid API enumeration on AWS
pattern: |
  - High volume of API calls to EC2, IAM, S3, Lambda APIs within short timeframes
    from a single compromised identity or role
  - Bulk creation of security groups with overly permissive rules (e.g., open to 0.0.0.0/0)
  - Creation of new IAM users/roles without corresponding MFA enforcement

ioc_type: behavioral
description: Security control degradation on AWS
pattern: |
  - Disabling of CloudTrail logging or S3 bucket versioning via API calls
  - Modification of security group rules to allow inbound traffic from external IPs
  - Deletion of encryption keys (KMS) and rotation policies

ioc_type: behavioral
description: Geographic access anomalies on AWS
pattern: |
  - API calls originating from unexpected geographic regions (e.g., sudden activity
    from a region where the organization has no legitimate presence)
  - Access patterns inconsistent with normal business hours or user behavior baselines

Azure-specific indicators:

ioc_type: behavioral
description: Azure AD compromise indicators
pattern: |
  - Token-based access to resources without corresponding authentication events
  - Unusual sign-in locations or devices accessing Azure resources
  - Bulk creation of service principals or application registrations via Graph API

ioc_type: behavioral
description: Resource Group manipulation on Azure
pattern: |
  - Bulk resource group deletion or modification operations
  - Changes to network security groups (NSGs) allowing inbound traffic from external IPs
  - Modification of storage account access policies to allow anonymous read/write access

GCP-specific indicators:

ioc_type: behavioral
description: GCP IAM compromise indicators
pattern: |
  - Bulk creation or modification of service accounts with excessive permissions
  - Changes to Cloud Storage bucket ACLs allowing public access
  - Modification of IAM policies granting broad permissions (e.g., roles containing
    "admin", "owner", or wildcard resources)

ioc_type: behavioral
description: Compute Engine compromise indicators on GCP
pattern: |
  - Unauthorized VM instance creation with user-data scripts containing malware payloads
  - Network firewall rule modifications allowing unrestricted inbound traffic
  - Modification of persistent disk encryption keys without proper audit logging

Cross-Provider Indicators (Applicable to All)

6. Threat Hunting: MITRE ATT&CK TTPs & Detection Rules

Priority Techniques for August 2026 Hunting Focus

Initial Access Tactics

Execution & Persistence Tactics

Exfiltration Tactics

Cloud-Specific Tactics

Hunting Queries (Microsoft Sentinel / KQL)

// Hunt for CVE-2026-68820 exploitation indicators (WinSock driver abuse)
Event | where EventName == "Process Creation"
  | where ImageFileName contains "afd.sys" or ProcessName contains "afd.sys"
    | project Timestamp, ProcessName, CommandLine, ParentImageFileName
    | summarize count() by bin(Timestamp, 1h), ProcessName

// Hunt for Cobalt Strike Beacon activity
Event | where EventName == "Process Creation"
  | where ImageFileName matches regex ("beacon\\.exe|cobaltstrike\\.dll")
    | project Timestamp, ProcessName, CommandLine, ParentImageFileName, 
             ParentCommandLine
    | summarize count() by bin(Timestamp, 1h)

// Hunt for LiteLLM supply chain compromise indicators
ContainerRegistry | where ImageName matches regex ("litellm|pypi.*litellm")
  | project Timestamp, Repository, Tag, CreatedAt, Author, Description
  | extend is_compromised = (Author !~ /[^0-9a-f]{4}$/ and Tags contains "v1.5[0-9]")

// Hunt for cloud identity provider abuse (OIDC token exchange)
Event | where EventName == "API Call" or EventName == "Sign-In Logon"
  | where DestinationAddress matches regex ("oidc\\.google\\.com|sts\\.amazonaws\\.com")
    | project Timestamp, SourceAddress, DestinationAddress, 
             ProcessName, ImageFileName, CommandLine

Hunting Queries (Splunk SPL)

# Hunt for Cobalt Strike Beacon activity
index=windows EventCode=4688 Process_Name="beacon.exe" OR Process_Name="cobaltstrike.dll"
| table _time, EventCode, Process_Name, Parent_Process_Name, CommandLine
| rename _time as "timestamp"

# Hunt for cloud identity provider abuse (OIDC token exchange)
index=cloud_security EventName="OIDC Token Exchange" OR EventName="Identity Provider Call"
| where DestinationAddress matches /oidc\.google\.com|sts\.amazonaws\.com/
| table _time, SourceIp, DestinationIp, Process_Name, CommandLine

# Hunt for LiteLLM supply chain indicators
index=container_registry ImageName="litellm" OR ImageName="pypi/*litellm*"
| where Tag matches /v1\.[5678]\./
| table _time, Repository, Tag, Created_At, Author, Description

7. Remediation & Mitigation Recommendations

Immediate Actions (0–24 hours)

Short-Term Actions (1–7 days)

• Deploy EDR detection rules for:
• CVE-2026-68820 exploitation patterns (WinSock driver abuse)
• Cobalt Strike Beacon process creation chains
• PRISMEX malware execution indicators
• LiteLLM package hash mismatch detection
• Implement network-level mitigations:
• Egress filtering for outbound connections to known C2 infrastructure
• Rate limiting on inbound TCP traffic to mitigate CVE-2026-50943 and CVE-2026-35804
• IDS/IPS signature deployment for malformed packet detection
• Enable enhanced logging:
• CloudTrail/Azure Monitor/GCP Cloud Audit Logs with real-time alerting on security control degradation events
• Container registry access logs for supply chain compromise hunting

Long-Term Actions (1–30 days)

• Implement SBOM (Software Bill of Materials) management to detect compromised dependencies
• Deploy software composition analysis tools in CI/CD pipelines
• Establish threat intelligence sharing partnerships with ISACs and CISA
• Update incident response playbooks for supply chain compromise scenarios
• Conduct tabletop exercises covering:
• Zero-day exploitation scenarios (CVE-2026-x)
• Supply chain compromise detection and response
• Cloud identity provider abuse scenarios

Appendix A: IOC Aggregation

File Hashes (SHA-256)

Network Indicators (Domains & IPs)

MITRE ATT&CK Technique Mappings

Appendix B: References & Sources

• Microsoft Security Response Center (MSRC): CVE-2026-68820 advisory
• CrowdStrike Patch Tuesday Analysis: August 2026 summary
• SecurityWeek: CVE-2026-68820 actively exploited
• Trellix Research: APT28 PRISMEX campaign analysis
• Trend Micro: Pawn Storm PRISMEX targeting government infrastructure
• CISA Advisory: AA25-239A — Chinese state-sponsored actor network compromise campaign

Report generated: August 2026
Classification: Internal Use — SOC Threat Hunting Team