The Hunter's Ledger: Report ChangesWhat changed in a published report after it went out, one entry per revision.2026-10-16T00:00:00+00:00https://the-hunters-ledger.com/changes/The Hunter's Ledgerhttps://the-hunters-ledger.comTurkish ARPA Operator — AI-Augmented State-Insurer Observability Compromise + Insider Recruitment Artifact (UTA-2026-013): revised 16 October 20262026-10-16T00:00:00+00:002026-10-16T00:00:00+00:00https://the-hunters-ledger.com/reports/turkish-arpa-openclaw-state-insurer-209.38.205.158/#revision-2026-10-16-1The Hunter's Ledgerhttps://the-hunters-ledger.comWithheld the stolen token's id in the prose, a table, a code comment and the reverse-pipeline figure; the YARA and Sigma rules carry a placeholder for it, as they already did for the tenant.ShinyHunters Data Leak Site at 91.215.85.22 — Infrastructure, Victims, and Attribution: revised 16 October 20262026-10-16T00:00:00+00:002026-10-16T00:00:00+00:00https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/#revision-2026-10-16-3The Hunter's Ledgerhttps://the-hunters-ledger.comWithheld the name of the one unacknowledged victim throughout, including the section 4.3 heading; the finding and its disclosure record are unchanged.The Middle Tier: A Non-APT Operator's Reach Into Four Southeast Asian Governments: revised 16 October 20262026-10-16T00:00:00+00:002026-10-16T00:00:00+00:00https://the-hunters-ledger.com/reports/seasia-gov-exploitation-toolkit-144-172-106-236/#revision-2026-10-16-1The Hunter's Ledgerhttps://the-hunters-ledger.comWithheld the addresses of the compromised WordPress host and the army SSH endpoint throughout, including the C2 estate figure; findings unchanged.Carrier Credential Harvesting Through a Customer's Router: revised 16 October 20262026-10-16T00:00:00+00:002026-10-16T00:00:00+00:00https://the-hunters-ledger.com/reports/opendirectory-13-140-145-210-weblogic-deserialization-telecom-harvester-20260817/#revision-2026-10-16-1The Hunter's Ledgerhttps://the-hunters-ledger.comWithheld a victim-internal address in the section 4 diagram and the lateral-movement paragraph; findings unchanged.NsMiner: Multi-Stage Operation: revised 16 October 20262026-10-16T00:00:00+00:002026-10-16T00:00:00+00:00https://the-hunters-ledger.com/reports/nsminer-cryptojacker/#revision-2026-10-16-1The Hunter's Ledgerhttps://the-hunters-ledger.comWithheld the 18 credential-stuffing target addresses in the indicator list; they are prospective victims, not operator infrastructure.Enough to Be Dangerous: The Mechanics of an LLM-Assisted Intrusion Campaign: revised 16 October 20262026-10-16T00:00:00+00:002026-10-16T00:00:00+00:00https://the-hunters-ledger.com/reports/multivector-ecommerce-rce-toolkit-192-3-1-116/#revision-2026-10-16-1The Hunter's Ledgerhttps://the-hunters-ledger.comWithheld the three victim platforms' domains and the one company name from the prose, two headings, a table row and a figure filename; findings unchanged.Multi-Actor AI-Agent Framework Abuse: 8 Operators Integrating AI CLIs into Offensive Workflows: revised 16 October 20262026-10-16T00:00:00+00:002026-10-16T00:00:00+00:00https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/#revision-2026-10-16-1The Hunter's Ledgerhttps://the-hunters-ledger.comWithheld the stolen token's id in two places; findings unchanged.ShinyHunters Data Leak Site at 91.215.85.22 — Infrastructure, Victims, and Attribution: revised 24 April 20262026-04-24T00:00:00+00:002026-04-24T00:00:00+00:00https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/#revision-2026-04-24-2The Hunter's Ledgerhttps://the-hunters-ledger.comRe-scan of the DLS: seven additional named victims and one add-then-remove event recorded in a new section 4.7 (post-publication additions, 21 to 24 April), the executive summary carries an update note, and one row of the roster table in section 4.1 corrected.ShinyHunters Data Leak Site at 91.215.85.22 — Infrastructure, Victims, and Attribution: revised 20 April 20262026-04-20T00:00:00+00:002026-04-20T00:00:00+00:00https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/#revision-2026-04-20-1The Hunter's Ledgerhttps://the-hunters-ledger.comOutreach window closed; the disclosure status table in section 4.2 updated to the state as of 20 April.OpenStrike Beacon Toolkit — Open Directory 172.105.0.126: revised 7 April 20262026-04-07T00:00:00+00:002026-04-07T00:00:00+00:00https://the-hunters-ledger.com/reports/open-directory-172-105-0-126-20260406/#revision-2026-04-07-1The Hunter's Ledgerhttps://the-hunters-ledger.comSection 13 added: a follow-up review of the directory found 116 further files, a complete Cobalt Strike operator deployment, triaged and recorded as under investigation; the investigation status line in the summary updated.