Skip to content
THE HUNTER’S LEDGER
Changes
Revisions to published reports
A report that was revised after it went out says so, and says what changed. This page collects those notes in one place, newest first, so you can see what moved without rereading every report. Follow it as an Atom feed or a JSON Feed.
  1. Turkish ARPA Operator — AI-Augmented State-Insurer Observability Compromise + Insider Recruitment Artifact (UTA-2026-013) Withheld the stolen token's id in the prose, a table, a code comment and the reverse-pipeline figure; the YARA and Sigma rules carry a placeholder for it, as they already did for the tenant.
  2. ShinyHunters Data Leak Site at 91.215.85.22 — Infrastructure, Victims, and Attribution Withheld the name of the one unacknowledged victim throughout, including the section 4.3 heading; the finding and its disclosure record are unchanged.
  3. The Middle Tier: A Non-APT Operator's Reach Into Four Southeast Asian Governments Withheld the addresses of the compromised WordPress host and the army SSH endpoint throughout, including the C2 estate figure; findings unchanged.
  4. Carrier Credential Harvesting Through a Customer's Router Withheld a victim-internal address in the section 4 diagram and the lateral-movement paragraph; findings unchanged.
  5. NsMiner: Multi-Stage Operation Withheld the 18 credential-stuffing target addresses in the indicator list; they are prospective victims, not operator infrastructure.
  6. Enough to Be Dangerous: The Mechanics of an LLM-Assisted Intrusion Campaign Withheld the three victim platforms' domains and the one company name from the prose, two headings, a table row and a figure filename; findings unchanged.
  7. Multi-Actor AI-Agent Framework Abuse: 8 Operators Integrating AI CLIs into Offensive Workflows Withheld the stolen token's id in two places; findings unchanged.
  8. ShinyHunters Data Leak Site at 91.215.85.22 — Infrastructure, Victims, and Attribution Re-scan of the DLS: seven additional named victims and one add-then-remove event recorded in a new section 4.7 (post-publication additions, 21 to 24 April), the executive summary carries an update note, and one row of the roster table in section 4.1 corrected.
  9. ShinyHunters Data Leak Site at 91.215.85.22 — Infrastructure, Victims, and Attribution Outreach window closed; the disclosure status table in section 4.2 updated to the state as of 20 April.
  10. OpenStrike Beacon Toolkit — Open Directory 172.105.0.126 Section 13 added: a follow-up review of the directory found 116 further files, a complete Cobalt Strike operator deployment, triaged and recorded as under investigation; the investigation status line in the summary updated.

Revised before revision notes were kept

5 older reports were revised before revision lists were kept, so the date of the last revision is all that was recorded. Each report’s own revision note says the same.