The Gentlemen posted 363 victims in 90 days.
96 groups have posted at least three victims in the last 90 days. thrunt.me builds a hunt package for each one from what's been published about them, and writes Sigma rules from those reports. It's free and there's no login.
Who's hunting
all 96 →| # | Actor | Victims | Covered |
|---|---|---|---|
| 01 | The GentlemenG1058 S9051 | 363 | 54/64 |
| 02 | QilinS1242 | 342 | 45/52 |
| 03 | N0n | 204 | no ttps |
| 04 | AkiraG1024 S1129 | 116 | 24/27 |
| 05 | INC RansomG1032 | 96 | 23/24 |
| 06 | Storm | 83 | no ttps |
| 07 | Silent Ransom Group | 76 | 7/12 |
| 08 | krybit | 76 | no ttps |
| 09 | Settra | 75 | no ttps |
| 10 | direwolf | 67 | no ttps |
| 11 | safepay | 66 | no ttps |
| 12 | LockBit 5.0S1202 | 64 | 29/34 |
New rules
all 19 →-
Process Launched from the PeopleSoft PSEMHUB.war Directory
A process whose image, or whose command line, points into the PeopleSoft PSEMHUB.war application directory.
-
Oracle PeopleSoft PSEMHUB Request via a Non-Canonical Path (UNC6240 WAF Bypass)
A web request for the PeopleSoft Environment Management Hub (PSEMHUB) written any way other than the literal /PSEMHUB/: a percent-encoded letter (/%50SEMHUB/hub), mixed or lower case (/psemhub/hub), an encoded slash or a path parameter after it, or a JSP under PSEMHUB or PORTAL.
-
Web Shell or Payload Written into PeopleSoft PSEMHUB.war or PORTAL.war, or MeshAgent Staged in /tmp
File creation of a JSP, JSPX, executable or DLL inside the PeopleSoft PSEMHUB.war or PORTAL.war application directories, or of MeshAgent binaries and configuration in /tmp.
-
Okta Verify Enrollment from a Hypervisor Guest
Enrollment or activation of an Okta MFA authenticator from a virtual-machine guest, the persistence step of the ShinyHunters "The Com" claims campaign.
-
Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel
An Okta authentication or MFA event whose client connection is flagged as a remote-desktop, proxy, or Tor tunnel: the network origin of the adversary-in-the-middle relay in the ShinyHunters "The Com" claims campaign.
Sigma YAML, TLP:CLEAR. Pull rules.lock.json in CI and you get every change with a hash.
Confirmed
how →Named by two independent parties in the last two weeks:
- 11-07Insight Credit Union leak + notice + press
- 11-07Photon Health leak + litigation + notice
- 11-07Fisher59, LLC leak + notice
- 11-07Park Dental Partners, Inc. leak + notice
- 11-07The Nueva School leak + notice
- 11-07Troutman Pepper Locke LLP leak + notice
- 11-07BASS Medical Group leak + notice
Patch first
KEV →| CVE | Product | EPSS |
|---|---|---|
| CVE-2024-3400 | Palo Alto Networks PAN-OSR | 1.000 |
| CVE-2024-21887 | Ivanti Connect Secure and Policy SecureR | 1.000 |
| CVE-2021-44228 | Apache Log4j2R | 1.000 |
| CVE-2020-5902 | F5 BIG-IPR | 1.000 |
| CVE-2026-109619 | PHP Group PHP | 1.000 |
| CVE-2026-109618 | PHP Group PHP | 1.000 |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and NeuronsR | 1.000 |
| CVE-2019-0708 | Microsoft Remote Desktop ServicesR | 1.000 |
Known exploited, ranked by EPSS. R: used by ransomware.
Nobody has a rule for these
the map →ATT&CK techniques with exploitation, research or malware activity this window and no rule in SigmaHQ, Elastic, Splunk or here. The next thrunt rules come from this list.
T1573.001T1056.003T1678T1001.001T1027.007T1027.012T1027.016T1070.009T1480.002T1497.002T1542.005T1564.010T1659T1665T1667T1680T1684T1684.001T1684.002
8-K disclosures
all 85 →- 2026-10-30Koil Energy Solutions, Inc. KLNG
- 2026-10-26Agassi Sports Entertainment Corp. AASP
- 2026-10-13Park Dental Partners, Inc. PARK
- 2026-09-11Nutex Health Inc. NUTX
- 2026-09-08BOSTON SCIENTIFIC CORP BSX
Pipeline
sources →15 of 15 feeds healthy at build. Data as of 2026-11-07 12:17Z.
Latest brief: 2026-11-01, 8 sections with something in them.