{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "The Hunter's Ledger: Report Changes",
  "home_page_url": "https://the-hunters-ledger.com/changes/",
  "feed_url": "https://the-hunters-ledger.com/changes/feed.json",
  "description": "What changed in a published report after it went out, one entry per revision.",
  "icon": "https://the-hunters-ledger.com/assets/images/apple-touch-icon.png",
  "favicon": "https://the-hunters-ledger.com/assets/images/favicon.svg",
  "language": "en",
  "authors": [{ "name": "The Hunter's Ledger", "url": "https://the-hunters-ledger.com" }],
  "items": [
    {
      "id": "https://the-hunters-ledger.com/reports/turkish-arpa-openclaw-state-insurer-209.38.205.158/#revision-2026-10-16-1",
      "url": "https://the-hunters-ledger.com/reports/turkish-arpa-openclaw-state-insurer-209.38.205.158/#revisions",
      "title": "Turkish ARPA Operator — AI-Augmented State-Insurer Observability Compromise + Insider Recruitment Artifact (UTA-2026-013): revised 2026-10-16",
      "content_text": "Withheld the stolen token's id in the prose, a table, a code comment and the reverse-pipeline figure; the YARA and Sigma rules carry a placeholder for it, as they already did for the tenant.",
      "date_published": "2026-10-16T00:00:00+00:00",
      "date_modified": "2026-10-16T00:00:00+00:00",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/#revision-2026-10-16-3",
      "url": "https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/#revisions",
      "title": "ShinyHunters Data Leak Site at 91.215.85.22 — Infrastructure, Victims, and Attribution: revised 2026-10-16",
      "content_text": "Withheld the name of the one unacknowledged victim throughout, including the section 4.3 heading; the finding and its disclosure record are unchanged.",
      "date_published": "2026-10-16T00:00:00+00:00",
      "date_modified": "2026-10-16T00:00:00+00:00",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/reports/seasia-gov-exploitation-toolkit-144-172-106-236/#revision-2026-10-16-1",
      "url": "https://the-hunters-ledger.com/reports/seasia-gov-exploitation-toolkit-144-172-106-236/#revisions",
      "title": "The Middle Tier: A Non-APT Operator's Reach Into Four Southeast Asian Governments: revised 2026-10-16",
      "content_text": "Withheld the addresses of the compromised WordPress host and the army SSH endpoint throughout, including the C2 estate figure; findings unchanged.",
      "date_published": "2026-10-16T00:00:00+00:00",
      "date_modified": "2026-10-16T00:00:00+00:00",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/reports/opendirectory-13-140-145-210-weblogic-deserialization-telecom-harvester-20260817/#revision-2026-10-16-1",
      "url": "https://the-hunters-ledger.com/reports/opendirectory-13-140-145-210-weblogic-deserialization-telecom-harvester-20260817/#revisions",
      "title": "Carrier Credential Harvesting Through a Customer's Router: revised 2026-10-16",
      "content_text": "Withheld a victim-internal address in the section 4 diagram and the lateral-movement paragraph; findings unchanged.",
      "date_published": "2026-10-16T00:00:00+00:00",
      "date_modified": "2026-10-16T00:00:00+00:00",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/reports/nsminer-cryptojacker/#revision-2026-10-16-1",
      "url": "https://the-hunters-ledger.com/reports/nsminer-cryptojacker/#revisions",
      "title": "NsMiner: Multi-Stage Operation: revised 2026-10-16",
      "content_text": "Withheld the 18 credential-stuffing target addresses in the indicator list; they are prospective victims, not operator infrastructure.",
      "date_published": "2026-10-16T00:00:00+00:00",
      "date_modified": "2026-10-16T00:00:00+00:00",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/reports/multivector-ecommerce-rce-toolkit-192-3-1-116/#revision-2026-10-16-1",
      "url": "https://the-hunters-ledger.com/reports/multivector-ecommerce-rce-toolkit-192-3-1-116/#revisions",
      "title": "Enough to Be Dangerous: The Mechanics of an LLM-Assisted Intrusion Campaign: revised 2026-10-16",
      "content_text": "Withheld the three victim platforms' domains and the one company name from the prose, two headings, a table row and a figure filename; findings unchanged.",
      "date_published": "2026-10-16T00:00:00+00:00",
      "date_modified": "2026-10-16T00:00:00+00:00",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/#revision-2026-10-16-1",
      "url": "https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/#revisions",
      "title": "Multi-Actor AI-Agent Framework Abuse: 8 Operators Integrating AI CLIs into Offensive Workflows: revised 2026-10-16",
      "content_text": "Withheld the stolen token's id in two places; findings unchanged.",
      "date_published": "2026-10-16T00:00:00+00:00",
      "date_modified": "2026-10-16T00:00:00+00:00",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/#revision-2026-04-24-2",
      "url": "https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/#revisions",
      "title": "ShinyHunters Data Leak Site at 91.215.85.22 — Infrastructure, Victims, and Attribution: revised 2026-04-24",
      "content_text": "Re-scan of the DLS: seven additional named victims and one add-then-remove event recorded in a new section 4.7 (post-publication additions, 21 to 24 April), the executive summary carries an update note, and one row of the roster table in section 4.1 corrected.",
      "date_published": "2026-04-24T00:00:00+00:00",
      "date_modified": "2026-04-24T00:00:00+00:00",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/#revision-2026-04-20-1",
      "url": "https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/#revisions",
      "title": "ShinyHunters Data Leak Site at 91.215.85.22 — Infrastructure, Victims, and Attribution: revised 2026-04-20",
      "content_text": "Outreach window closed; the disclosure status table in section 4.2 updated to the state as of 20 April.",
      "date_published": "2026-04-20T00:00:00+00:00",
      "date_modified": "2026-04-20T00:00:00+00:00",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/reports/open-directory-172-105-0-126-20260406/#revision-2026-04-07-1",
      "url": "https://the-hunters-ledger.com/reports/open-directory-172-105-0-126-20260406/#revisions",
      "title": "OpenStrike Beacon Toolkit — Open Directory 172.105.0.126: revised 2026-04-07",
      "content_text": "Section 13 added: a follow-up review of the directory found 116 further files, a complete Cobalt Strike operator deployment, triaged and recorded as under investigation; the investigation status line in the summary updated.",
      "date_published": "2026-04-07T00:00:00+00:00",
      "date_modified": "2026-04-07T00:00:00+00:00",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    }
  ]
}