DANA / Kanban

generated 2026-10-15 11:11 UTC
auto-refresh 30s
Open
448
ready + todo + blocked
Blocked
332
awaiting decision
Ready
78
workers + human queue
Done
237
all time
686 shown
Blocked 332
Orion: n8n WAF regression — TencentEdgeOne blocks removed, instance fully exposed (n8n@2.16.0 dev-mode)
t_85264677 orion
Orion: Day 30 — 6 persistent HIGH findings unremediated on gateway.ai.dana.id
t_4e9e791d orion
Orion: 2 NEW MGS direct origins exposed without WAF — mgs-gw.sit03.dana.id + mgs-gw.test03.dana.id
t_11997e36 orion
Orion: 3 NEW MGS direct origins exposed without WAF — mgs-gw.sit04/test04/test05.dana.id
t_5c4a9403 orion
Orion: 1 NEW MGS direct origin exposed without WAF — mgs-gw.test06.dana.id
t_30d7d0b7 orion
Phish: kona24285@gmail.com 10th-cycle repeat — spoof still Delivered to help@dana.id (CRITICAL)
t_7609139b phish-intel
Orion: gateway.ai upgraded 1.91.4→1.94.2 but CVE-2026-84377 patch (1.96.2) NOT included — day 23
t_5fc120a7 orion
www.dana.id: CORS origin reflection with credentials on /graphql (HIGH)
t_696b096e luna
Orion: n8n.automation.dana.id — expanded exposure (OpenAPI, Swagger, ReDoc, webhooks, version, settings)
t_a69d08d9 orion
Orion: SECOND exposed n8n instance — mtls.api.test02.dana.id (n8n@2.0.3 dev-mode, no WAF, no client-cert despite mtls name)
t_e4f018d0 orion
Systemic: Cron dispatch crash-loop — worker exits before durable terminal state
t_01e7fcda bos
CRITICAL: tinhochay.org IP-violation lure wave — 8 Delivered to help@dana.id/kapdesk (new local-parts, tripwire fired)
t_49aba98e bos
Orion: mgs-gw direct origins exposed without WAF (sandbox/sit02/outer variants bypass Akamai)
t_baed5f07 orion
Vega: kurniawann@dnid3213l01 — GitHub PAT hardcoded in git clone URL
t_dc205da3 vega
www.dana.id: Strapi GraphQL anonymous exposure cluster (MEDIUM)
t_c8d3f3fc luna
www.dana.id/blog WordPress: xmlrpc multicall + REST user enumeration (MEDIUM)
t_5c95a98c luna
Spica: TLS downgrade escalation — /swagger 307→http:// Day 3 + /plugin-proxy same flaw
t_4de58e69 spica
www.dana.id: 404 JSON-LD path reflection unescaped — breakout blocked only by edge WAF (LOW-MED)
t_19b07ef6 luna
Orion: gateway.ai.dana.id — /login endpoint info disclosure (env variable names in error)
t_48beb018 orion
Orion: Audit DANA internal services for test_1234 credential abuse — auth.paas, kms.paasdev, awx, elk
t_0c813655 orion
Sage: Deploy Pebri.Store IOC patterns to DLP rules (firebase, edgeone.app, operator PII)
t_d21b802e sage
Aura: dimas.nugroho — ACTIVE sign-ins + BF risk indicators — blastini exposure
t_91e49bbd aura
MDE 203rd: yudhi RE-IGNITION + fajri.oktoriandi dedicated cluster + sandra.dewi new spray target
t_620c4689 bos
Echo: Threat intel correlation on DANA password spray campaign (172.50.1.1, 154 IPs)
t_150bd2f3 echo
MDE hunt 20261001-2200: mis@ hardcred STILL ACTIVE (9th) — plaintext re-exposed; spray 50th window 3 fresh (christopher 50053, edward 50126)
t_9ed08ca6 (unassigned)
Vega: audit coreapp8**** password pattern for credential reuse/sprawl
t_c20e61e8 vega
Athena: Apple serial probe persistent across 2 devices + 4 dispositions (#357-#360)
t_1cd0f5be bos
Phish: Qatar Airways vendor-registration BEC campaign — delivered phish (plugandplay.co.id/olloum.com/tabacaleraespert.com)
t_895257fb phish-intel
Nexus: RETIRE Alexa — 16 days dead, Akamai client token expired, no cron registered
t_70184f75 human
Athena: Binary Racks AS59895 4th account sukirman@dana.id — tripwire fired, account DISABLED, watch continues
t_05c967ee athena
Vega: Credential investigation dnid6835l01 — gh keychain account 'arimu1' anomaly + multi-provider AI API key exposure
t_e80bf7bb vega
🔴 Spray campaign widening — christopher fresh + 3 NEW targets (wisnu.wardoyo, i.putra, channel.support)
t_cf6c0b8a bos
Athena: Spray 39th window ACTIVE — US/GB/JM/ES wave: 10 FRESH events/10 accounts post-03:00Z (christopher.soebrata 5x lockout burst, NEW targets alisyah.samosir ES/US + furqon.adhi US + ipan.sitorus ladder); bambang 39ev/34 locks top; CHSUP-3..6 400-bug FIXED + verified; Living Off Land recovered; channel.support MFA URGENT (261st carry); block recs expand
t_f1561c88 bos
Athena: Spray 40th window — US wave +80% acceleration, KYC NEW target, PR geo, christopher exec lockout-thrash, deryan risk row
t_46efc92c (unassigned)
Athena 14:00 — spray campaign 42nd window PAUSED (0 fresh) + HARDCODED CREDENTIAL net use mis@dana.id on jktabc00fsap01p + KYC mailbox MFA gap
t_9dde9e12 bos
Athena 15:00 — spray RE-ENGAGED (channel.support lockout from block-list arm 35.241.224.153 + NEW target fajri.oktoriandi) + HARDCODED CREDENTIAL STILL ACTIVE mis@dana.id
t_d5e6b94a bos
Athena 15:00 — spray RE-ENGAGED (channel.support lockout from block-list arm 35.241.224.153 + NEW target fajri.oktoriandi) + HARDCODED CREDENTIAL STILL ACTIVE mis@dana.id
t_5975415a bos
Athena 16:00 — spray SUSTAINED (it.helpdesk BE-arm 50053 + reghi.rasyidin PK NEW + bambang BD NEW) + HARDCODED CREDENTIAL STILL ACTIVE mis@dana.id 3rd cycle
t_088da392 bos
Athena 17:00 — spray SUSTAINED 45th window (2 fresh: christopher ES + avian NL NEW-GEOs) + HARDCODED CREDENTIAL mis@dana.id 4th cycle
t_c6f585cd bos
Athena 18:00 — spray SUSTAINED 46th window (2 fresh: edward.chandra US + yudhi.susanto US) + HARDCODED CREDENTIAL mis@dana.id 5th cycle
t_3a9f5470 bos
Athena 21:00 — spray 50th window ACTIVE (it.helpdesk/dimas IPv6 + avian double-lockout + SE ipan.sitorus) + mis@ hardcred 32nd carry PLAINTEXT resumed 13:00Z/14:00Z + PERIM-NEW 194.5.82.0/24 legit SG egress
t_1a8053d8 bos
Athena: mis@ hardcred 42nd carry PLAINTEXT (00:01:52Z) STILL NOT ROTATED + spray 60th window (6 fresh, 4 accounts, US/NL/AU/MX arms)
t_70da8616 bos
Athena: NEW DLP RuleMatch (Rendra Perdana @17:53:06Z) + UiPath DLL from Downloads (dnid3247l02) — verify
t_ac1e0043 bos
Alexa: Bot_7DEEE2 growth resumed 2,167 ev 08Z (+48.6% h/h, +342% yy) — pre-registered >2,000 ev/hr kanban trigger fired; all monitor-lane /mgw.htm unblocked
t_3f0a0667 bos
Athena 1800: NEW delivered bit.ly/DANAResolutionCenter lure to merchant.services@dana.id + kapdesk (oshinzal92@gmail.com, Re:, auth pass, 0 clicks)
t_15056c3e bos
Athena 1100: NEW kapdesk phish DELIVERED to help@ mailboxes — icemas@moh.gov.my x4 + xuan.piraux@hotmail.fr x6 + rizkym1507 x2 empty-subject (18 total, ▲2)
t_3488c456 bos
Nova: Claude Code on 268 devices — code exposure risk
t_68b7bb81 nova
Nova: Codex heavy users — 6 accounts, 100K+ events
t_1b0c5eaa nova
Nexus: Track cliveg/dnid2133l01 — 7th active 123456 AD account, pattern growing while blocked
t_952634cb vega
Altair CORR-089: rudy@dnid2255l01 + pardamaiank@dnid3705l01 — JWT enrichment needed
t_9b6a0c94 aura
xcorr C5: Phish 90-cycle zero-change BROKEN — 5/14 kits changed SHA at cycle 91 (incl. ARMED dana-kaget-claim)
t_05e46544 phish-intel
XCRR-0930-C2 (CRITICAL): Sinar Mas vendor impersonation 2 DELIVERED to help@dana.id — Laya threshold MET (related=0.9946, corroborated=0.9558)
t_9f568a76 bos
XCRR-0930-C4 (CRITICAL): Perimeter CRITICAL spikes + MDE spray 22nd window — sustained Day 16-17 coordinated campaign, Laya priority=2.7045
t_b8ffe600 bos
Athena 0000: Spray 33rd window — bambang fresh DE IPv6 arm 2a12:edc0:5:1430::1 + sugiharso NEW top-5 entrant + 187.15.101.x SG-office range correction
t_0928b3ef bos
Phish: MDE 400 root-caused + fixed — invalid |||/|| KQL pipe style (c243 regression); all 21 lanes restored; t_75e75bf6 closable
t_e74cff89 phish-intel
Aura: Perimeter alert-lane burst 2nd record hour (126K/55min, 24x yday) + deny139044 collapse — app rollout vs bot wave unresolved
t_07dc61bf bos
Nexus: cron deliver target misconfig — Trend Analyst + abliterated-routing-guard 'live adapter send failed: No valid session_webhook' → --deliver local
t_9ec0e8a8 bos
Nova: Ollama local LLM on dnid4090l01 — 520 events, no DLP
t_81ec7e31 nova
Nova: Local model compilation burst on 5 devices (Aug 6)
t_d74cb3f5 nova
Escalation: Ollama local LLM on dnid4090l01 (kamarzf) — audit downgraded to HIGH, needs allow/block decision
t_1d5acb4b aura
Nexus: dana-dns-patrol 891 runs, 36 errors — InvalidClientTokenId, AWS token invalid (P0 credential regen)
t_7adee780 human
🔴 CRITICAL: Shadow-AI — Grok CLI (x.ai) live on dnid6835l01 (nawfal.fardana, Bright-Dev SDE Lead) — dual external AI bypass (x.ai + api.anthropic.com), MCP channel to internal aidea/torchlight.dana.id, 941 claude keychain reads
t_eb9a14f0 nova
Phish: Coordinated IP-tracking upgrade across 3 EXTREME DANA kits + NEW Putrax camera kit
t_2cfdb8e2 phish-intel
M247-ID-Stuffing: yudhi.susanto campaign expanding (7 countries, +57%)
t_b1aca7dc bos
MDE 204th: sukirman credential stuffing EXPLOSION (30x50126/30IPs/10ctry) + fajri cluster merger (2.57.170.x shared)
t_6822323c (unassigned)
🔴 puguh.susilo — spray escalation (4x50126, CRITICAL comp=1.0)
t_5e1a0ab5 aura
Athena: christopher fresh 08:22Z (Aura prediction double-confirmed), bambang MX 4th+ — Laya 0.84 CRITICAL
t_309f673f bos
Athena 232nd (22:00 WIB): bambang.ardiansyah spray lockout PERSISTENT — 8th+ window, 20 events/24h (15x50053+5x50126), 19 IPs/12 countries, ACTIVE 15:04Z — block list 12+ IPs pending Bos (6th-cycle carry)
t_2e69f985 bos
XCRR-0930-C1: it.helpdesk MFA-less service account under 3-arm spray (MX+IN+CA-IPv6) — 22nd window, 29 accounts, 244th clean but one guess from compromise
t_bf55be19 bos
XCRR-0930-C3 (HIGH): 123456 AD provisioning password fleet debt grows — 8th device dnid3214l01 FRESH
t_20b6ee0a bos
XCRR-0930-C5 (CRITICAL): dana-kaget-kohl.vercel.app + TG C2 8720203814 confirmed by 2 agents (bot-invest + phish-intel) — kit LIVE harvesting
t_04913dd0 bos
api-audit: CRITICAL — LiteLLM admin panel /ui/ publicly exposed (Laya abuse=0.893, data_exposure=1.000) — Day 29
t_e7432f89 orion
Phish: tinhochay.org NEW local-part efadlrejj (20th in 14d, CRITICAL tripwire)
t_0e38a838 phish-intel
MDE runHuntingQuery 400 — ALL 21 phish-intel lanes blocked (2nd cycle)
t_75e75bf6 phish-intel
Nexus: blocked queue at 300 — needs Bos triage pass
t_faded23a bos
Phish: NEW DANA-branded credential kit dana-help.official-indonesia.my.id (LIVE, 3-stage harvest)
t_f19fd80f synthesis
Vega: Hardcoded AD password 123456 on 6 devices
t_e337b04d vega
Alexa: 132 POST /mgw.htm from botnet — NOT blocked
t_cd477988 alexa
Vega: VPN password extraction + code password search — tampuboloni
t_7aceeb60 vega
Spica: gateway.ai.dana.id — 5 CRITICAL findings unremediated (audit #2)
t_7942808e spica
Luna: dana.co.id domain parked/for-sale (brand squatting risk)
t_e3e09e8e luna
Aura: Triage coordinated local LLM (llama.cpp + Ollama) on 5 macOS workstations
t_a8773d48 aura
Nova: New untracked AI agent 'rtk' — 52 devices / 216K events, hooks into Claude/Cursor, egress to internal vault
t_ac45202a nova
🔴 HUMAN: Regenerate Akamai client token — resme Alexa
t_41356e4b human
Vega: New device dnid2133l01 (cliveg) using AD password 123456
t_bc53f24f vega
Echo: Verify blastini.com engagement — authorized DANA pentest or shadow IT?
t_7037c036 echo
Orion: Audit DANA internal infrastructure for test_1234 credential abuse
t_91330d1d orion
Vega: kurniay/dnid3282l01 — 15 .env reads in 24h (threshold breach)
t_30355ea3 vega
Echo: radikari B2B partner credential leak — DAN7-27855
t_793d87c2 echo
Phish: Settlement DMARC Wave 8 — 40 new undetected, groupleviathan activated
t_bfe49516 aura
Vega: priyowibowof/dnid3067l01 — 123456 AD password (-remove)
t_9670e5f6 vega
Echo: esra.purba — ESCALATED to CRITICAL (SRE Manager, 100% failure rate, 14 days active)
t_a7d565ca echo
Vega: pratamap/dnid3091l01 — 123456 AD password (2026-08-14)
t_2b2471aa vega
Vega: pratamaar/dnid3018l01 — 123456 AD password (2026-08-16)
t_c72eb44c vega
Vega: munawarh/dnid2256l01 — 123456 AD password (2026-08-07)
t_40483e0a vega
Nova: fajaru NEW keychain dump 30x — macOS credential exposure
t_481e6aa2 nova
Luna: dana-vip.com lookalike STILL ACTIVE (2nd week after marked handled)
t_6e673378 luna
Nexus: fajaru (dnid3155l01) — 30x macOS keychain dumps FIRST DETECTION — investigate credential exposure & DLP scope
t_3bd22e51 nova
Vega: dnid4050l01 - new default password 123456 device + sysadminctl admin password exposure
t_39df4432 vega
Vega: guminga@dnid2387l01 - active lateral movement with exposed SSH/WinRM credentials
t_e3e73ee2 vega
Vega: dnid4050l01 - sysadminctl admin password exposure via secureTokenOn/Off
t_a6aaeace vega
Aura/Bos: shared provisioning password 123456 — 7th device (Security-team acct) + itoperation admin password in cleartext
t_93b67889 aura
Spica: CORS wildcard - 17d+ unremediated on gateway.ai.dana.id
t_5e67adac spica
Spica: No rate limiting on /login - 17d+ brute-force risk
t_f60e4f5d spica
Spica: SSO/MFA disabled - 17d+ single-factor auth on gateway
t_96427cfe spica
Spica: OpenAPI spec public - 17d+ full API inventory leak
t_d17841c8 spica
Spica: Admin UI exposed - 17d+ LiteLLM dashboard public
t_80594e53 spica
Orion: gateway.ai.dana.id — Routes endpoint exposes 80+ admin/management endpoints
t_fa7bbcde orion
Vega: dnid2667l01.dana.local - new device with default password 123456
t_290088d7 vega
Echo: CORR-068 — 4 Settlement recipients with 100% failure rate (bondan/razka/septian/renaldi)
t_b54c9359 echo
Vega: sudrajatm/dnid2856l01 — hardcoded LiteLLM production master key + /get/config dump
t_93dcb08c vega
Vega: juana/dnid3694l01 — admin_password_arg first-ever combo (generateAdminPassword code search)
t_386c77fd vega
Nova: matius.budi/utamam dnid3215l01 - Claude Code keychain security -i exploration + direct Anthropic API bypass
t_2d8d6b99 nova
Luna: n8n automation platform exposed via default catch-all vhost — automate.ai.dana.id / ppw-test04.mtls.dana.id (149.129.240.91)
t_242d1ff9 luna
🔴 Escalation: OJK campaign hour 39 — burst-11 interval COMPRESSED to 44m59s (09:58:06 WIB), OTP-20 recipient PIVOT to dasep.arifin, +volume CLIMB in-flight (16ev/10min) — trigger review threshold
t_de763265 bos
Echo: help@/kapdesk mailbox-audit consolidation — 5 signal classes incl. nxcli.io verdict-blind phish pair
t_ef03e60f echo
Bos: Decision - credential-test cluster response (11 accounts, t_d4f2fe3b follow-up)
t_f356a40d bos
Echo: Credential-test campaign expanded 11→18 (CEO+CTO named), AADInternals 2nd lane, executive hit-list verdict
t_1177901f echo
Vega: adryamarthaninoa/dnid3147l01 — hardcoded JWT recurrence (3rd event, NEW token, repoagent MCP probe)
t_4b801dba vega
Aura: Rotate + vault gitlab-token on shared cloud-admin@10.4.34.77 (exposed GitLab PAT, read+write scope)
t_50f2f537 aura
Echo: Multi-infra campaign is LEAK-DERIVED — 17/23 probed names leak-listed (incl. bambang x7, it.helpdesk)
t_917d03b2 echo
Altair C1: fardanan@dnid6835l01 Shadow-AI + Internal MCP + Credential Exposure Attack Chain
t_88d3a8cf aura
Altair: C1 fardanan/dnid6835l01 — 9d unresolved Grok MCP to internal services
t_4948596d aura
Vega: umara@dnid3589l01 — Bearer tokens + HMAC signatures exposed in test03 API curl cmds
t_200594c1 vega
Vega: jktabc00crtx01p — root editing .env on production CRTX server (vim swap files)
t_5ff3a0ec vega
Altair C1: fardanan@dnid6835l01 — Day 10 unresolved, Grok MCP still live
t_b556a5aa aura
Vega: rudy@dnid2255l01 — hardcoded JWT in sshpass+ssh cloud-admin workflow
t_d8b69741 vega
Vega: nafisr@dnid2868l01 — hardcoded JWT Bearer token in curl to api-sre.dana.id
t_467fc6fc vega
Vega: pardamaiank@dnid3705l01 — hardcoded JWT Authorization header to SIT gateway
t_55b6c922 vega
Vega: panjaitanj@dnid3190l01 — Notion MCP file upload tokens in ci_tokens_secrets
t_e2d7a3f2 vega
Echo: blastini.com MySQL password exposed in MDE telemetry (dimas.nugroho)
t_0484718d echo
Vega: blastini.com MySQL password — credential sprawl check (dimas.nugroho)
t_4b0701ec vega
Orion: blastini.com infrastructure — authorization context (dimas.nugroho)
t_25f53faf orion
Vega: GOCSPX (Google OAuth client secret) on 3 DANA workstations — follow-up
t_97717e02 nova
Orion: n8n.automation.dana.id 3-cycle persistence — escalate for Bos access review
t_906d1102 orion
Orion: gateway.ai.dana.id — /public/v1/model_hub exposes 113-model inventory (providers, pricing, capabilities)
t_9e2b763c orion
Aura: 7DEE 886/h — Above 500 escalation threshold (approaching 922 peak)
t_6fd3f7f4 aura
Nova: 🔴 CRITICAL — purnomoj/jeffry.sandy dnid2886l01 — 2,121 security -i interactive keychain events via Cursor+Claude (4x prior record)
t_033b5e5a nova
Nova: 🔴 HIGH — Fleet-wide interactive keychain (security -i) — 168 users / 4,843 events in 7d, 62 via Claude Code parent
t_f4dfea3c nova
Nova: 🔴 HIGH — Grok Bot (xAI) fleet expansion — 31 users / 2,423 events in 14d (was single-user fardanan)
t_438a2e7f nova
Nova: 🔴 HIGH — OpenAI Codex Computer Use (SkyComputerUse) — 160 users / 7,577 events in 14d — desktop-control agentic risk
t_c31b886f nova
Nova: 🔴 HIGH — NEW: paramahasthak/kautsar.paramahastha dnid3216l01 — rtk 37,674 events (14d) + .env.test read via rtk
t_60671389 nova
Vega: dnid3243l01 — new default password 123456 (fauzii)
t_a933dcb8 vega
Vega: qastharie@dnid3601l01 — hardcoded NocoDB admin JWT (xc-auth) in 23 curl cmds
t_abd290f9 vega
Altair C1: Multi-vector 03-05Z attack window — 7DEE+FNS botnet+Impossible Travel
t_a366a75c aura
Altair C2: Phish perimeter dual structural gap — WAF 49th P0 + 7 cycles zero takedowns
t_75561a7a aura
Phish: dana-kaget-six.vercel.app — new [Lehzz] GPS/IP profiler
t_efbede93 phish-intel
Phish: dana-kaget-link NEW active Telegram C2 credential funnel (bot 8659207482, chat 6099205297)
t_4fe2a56c phish-intel
Phish: danakaget.netlify.app UPGRADED EXTREME — Armed TG C2 @Bedudhdbot
t_659fc2be phish-intel
Athena: edward.chandra E=4 NEW spray escalation (4 IPs/4 countries, 3/4 Azure CLI)
t_df28c16b aura
CRITICAL: Perimeter/Alexa 21h+ dead — 114.10.x rig 50-IP trigger window passed blind
t_0ef48417 bos
CRITICAL: 114.10.x rig 115 IPs/41 subnets — block POST /mgw.htm lane
t_a2cd39be aura
christopher.soebrata: 50126 spray convergence — tracked ATO case now under password spray
t_4fcde714 echo
nugrohowi dnid3720l01 keychain dump investigation
t_dfeda36f bos
Athena: Sustained credential stuffing campaign — sukirman@dana.id (74 fails/66 IPs/14 countries, Tor exit node, cross-account JP subnet)
t_3576c7bd bos
CredAudit: ezeelogin@jktabc00rbms01p — RBMS .env reads (CRITICAL)
t_a138b086 cred-audit
Athena: bambang.ardiansyah Laya CRITICAL escalation — spray PRIMARY
t_563ea370 (unassigned)
🔴 CRITICAL: fajri.oktoriandi IQ source comp=0.9602 + 4 concurrent CRITICAL spray Laya decisions (18:01 cycle)
t_502237bb bos
Phish: crazygame-eight ARMED EXTREME camera+GPS+Telegram C2
t_dd3a35ec phish-intel
Phish: dnid-two.vercel.app — NEW Google Apps Script exfil DANA Aktivasi Saldo kit
t_866bff72 phish-intel
Phish: NEW live domain danakaget.com (BotInvest find, 202KB DANA-branded, TG C2 8720203814)
t_c2ac9f73 phish-intel
Phish: dana-anniversarygift.com — NEW OpenPhish DANA giveaway (phone+PIN wheel)
t_a42a3ce1 phish-intel
Phish: dana-kaget-claim.netlify.app UPGRADED to EXTREME ARMED camera+GPS+TG+credential exfil
t_c2b980e2 phish-intel
CredAudit: nugrohodi@dnid6686l01 — Blastini SSH private key reference (recurring HIGH)
t_f259a385 cred-audit
OSINT: kyb-coach-rc1/rc2 new live SIT hosts in automation.dana.id
t_0cd719a4 bos
Nova: hasibuanm git credential hunting via Cursor sandbox
t_f53d24d4 shadow-ai
Athena: christopher.soebrata NEW spray target (26x50126, 8 countries, CRITICAL comp=0.9787)
t_eb8f6497 aura
Nova: sudrajatm API key exposure in AI context
t_9841923d shadow-ai
Athena: Wilson New-InboxRule exfil indicator (05:48Z, CRITICAL comp=0.8496)
t_637e2f3f aura
CredAudit: farrelg@dnid2760l01 — GitLab PAT glpat-ZZz3 in git history search (CRITICAL)
t_f0ab7b6e cred-audit
CredAudit: rohmani@dnid3486l01 — hardcoded JWT in curl Authorization header (CRITICAL)
t_92fd9db5 cred-audit
CredAudit: root@jktabc00crtx01p — production Cortex .env read (CRITICAL)
t_b4a8ac63 cred-audit
CredAudit: fikriguskab@dnid3113l01 — GitHub PAT in git push URL (HIGH)
t_9469a933 cred-audit
Phish: 7/14 DANA kits mass SHA update + NEW 'Akun Dana Di Bekukan' scare lure
t_9a5e8f85 phish-intel
Phish: kaget-dana.netlify.app 'Akun Dana Di Bekukan' scare-lure kit — Laya CRITICAL (phishing=1.0), 2nd SHA change in 2 cycles
t_f0507c80 phish-intel
Phish: menangkap REVIVED — takedown failed, camera+TG kit back live
t_fd644283 phish-intel
Phish: menangkap REVIVED re-churned (5th change) + 14/14 100% cluster churn — 4 EXTREME kits still armed, zero takedowns
t_2ecf06d1 phish-intel
avian.primantifa follow-on probe — CRITICAL escalation
t_88d5024a bos
Athena: CRITICAL spray surge — bambang.ardiansyah 28 events/24h (Laya 0.9277)
t_1fa55ae5 bos
🔴 CRITICAL: avian.primantifa spray escalation — directive #2 triggered (4 events, Laya 0.8865)
t_86a29e6c bos
Phish: [Lehzz] twin kits ARMED via webhook.site
t_2494869f phish-intel
Phish: dana-reward.vercel.app [Putrax] camera biometric surveillance kit
t_09a8dc26 phish-intel
CredAudit: sarosal@dnid3473l01 — DANA AI Gateway key inline export (CRITICAL)
t_5045bd51 cred-audit
Phish: dana-kaget-menangkap-dan-dapatkan.vercel.app RE-ARMED with NEW C2 bot token
t_46039b3c phish-intel
Phish: aktivasi-saldo-dana.netlify.app NET NEW C2 arming — bot 8313247082, full credential harvest
t_81c20241 phish-intel
Enrich: aktivasi-saldo-dana NET NEW C2 — GitHub Pages migration trail (texme1up, aktivasi-saldo-dana-id)
t_7c1eae43 bos
Athena: bambang 5th+ window ACTION TRIGGER MET (fresh 09:58Z NL), yudhi +1 FR, oktri NEW census, 2 phish campaigns — Laya 1.0 CRITICAL
t_c45f7f94 bos
Athena: bambang LOCKOUT ESCALATION (13x 50053, 7th+ window, 10 IPs block list) — 3rd-cycle RE-ESCALATION per Aura directive
t_7405c9d8 bos
🔴 MDE 233rd: bambang.ardiansyah spray lockout 9th+ window — block list 12+ IPs pending Bos (6th-cycle carry)
t_b351d7b4 bos
Phish: claim-dana.biz.id NEW DANA login kit (Vercel /masuk.html) — Laya CRITICAL
t_32c5d69f phish-intel
Phish: phish.report CF-bypass task — 21st consecutive blocked cycle
t_22cbec60 phish-intel
Phish: NEW delivered Hindi sextortion to help@dana.kapdesk.com (siregarbalab6@gmail.com)
t_5c00e391 phish-intel
Phish: Sinar Mas vendor-procurement lure #2 (laymandennison) CRITICAL
t_91bd9451 phish-intel
CredAudit: dnid3214l01 — NEW device with default AD password 123456 (CRITICAL)
t_5c9d7950 cred-audit
CredAudit: efendid@dnid3390l01 — hardcoded JWT in node -e to automate.ai.dana.id MCP (HIGH)
t_35bb674b cred-audit
Phish: Sinar Mas lure variant 'Peluang Kemitraan Pemasok' DELIVERED to help@dana.id
t_6321604a phish-intel
Athena: it.helpdesk 3-arm spray escalation — CA block MX/IN/CA-IPv6 + MFA registration (22nd campaign window)
t_555f06eb bos
Phish: NEW CRITICAL Sinar Mas variant C delivered — subject evades 'Kemitraan Pemasok' block rule (3 undetected delivered rows)
t_4e661913 phish-intel
Phish: Sinar Mas sender #3 CONFIRMED (johnnycashss525@gmail.com) — 2 undetected delivered
t_f8c0b1b3 phish-intel
Phish: riabaki12 'Did you receive my email?' DELIVERED to help@dana.id (TT=Phish,Spam)
t_4a2d12cc phish-intel
Phish: Sender #4 prettyvina202601 Spanish vendor lure — 2 delivered, Laya CRITICAL
t_6b39d9f7 phish-intel
Phish: Sender #4 prettyvina202601 Spanish vendor lure — 2 delivered, Laya CRITICAL
t_e6189755 phish-intel
Athena 253rd: Spray 29th window — RO arm PAUSED ~2h (first lull), it.helpdesk MFA still absent, perimeter 194.5.82.x closed as user-VPN
t_450b8396 bos
Athena 253rd: Spray 29th window — RO arm PAUSED ~2h (first lull), it.helpdesk MFA still absent, perimeter 194.5.82.x closed as user-VPN
t_6c6ea6f7 bos
Phish: DANA account-deletion scam delivered to kapdesk surface (satriaandeski174)
t_1d24824c phish-intel
Athena 254th: Spray 30th window — Laya DOWNGRADED to LOW (0.3776), RO arm paused ~3h, skywalker/GSL closed, it.helpdesk MFA still absent
t_65343149 bos
Athena 254th: Spray 30th window — Laya DOWNGRADED to LOW (0.3776), RO arm paused ~3h, skywalker/GSL closed, it.helpdesk MFA still absent
t_8c2a36cb bos
MDE 255th: NEW IN spray arm 139.59.82.0/24 (DigitalOcean) — oktri 50053 @13:46:33Z, first fresh probe since 11:04Z, Laya re-escalated 0.9999 CRITICAL
t_b8f24a7a bos
Phish: Penghapusan Akun DANA wave — 8.8k victim replies/7d NDR backscatter + 2.1k help@ delivered (Laya CRITICAL)
t_1d4267dc phish-intel
Athena 256th: Spray burst 14:28-15:02Z — bambang 40ev/38IPs/12ctry, 4 NEW country arms (AR/EC/IL/BR), dormant IN arm returned
t_4cb01d3a human
Athena 2300: Spray campaign active 32nd window — ppoc.team NEW target + bambang JP arm + dimas Tor exit
t_338f85a0 bos
Athena 0100: Spray 34th window — fresh SE/IQ/US arms post-16:00Z (sukirman 17:52Z/reza 17:48Z/diah 17:51Z), bambang 38ev/32 lockouts/37 IPs/12 ctry/5 apps, ppoc.team carry, 0 compromise 256th clean
t_4fd233ac bos
Athena 0200: Spray 35th window — 5 FRESH post-18:00Z events incl NEW targets channel.support (PE 179.6.57.65) + test1.nintex (US 20.55.17.25); bambang ladder holds 38ev/32 locks; block-list recs expand; 0 compromise 257th clean
t_72336685 bos
Athena 0800: Spray 36th window — channel.support functional mailbox LOCKED OUT (BE 35.241.224.153); 45.91.20.0/22 confirmed attacker provider block; ppoc.team GB arm; bambang 40ev/36locks/39IP/15ctry
t_ba6be6ee bos
Athena 0900: Spray 37th window — Tor arm hits NEW target adhiwira.lokacarya (171.25.193.46 SE); channel.support lockout recovered; 0 compromise 258th clean
t_b8a5ea1d bos
Athena: Spray 38th window ACTIVE — US-wave re-engagement: 10 FRESH events/10 accounts post-02:00Z (dimas 5x lockout, 6 NEW targets incl. gavin.clive/i.putra/lisa.indraputri/sandra.dewi/lia.gusthiana/khairani) + Tor arm adhiwira carry; 171.25.193.0/24 + US wave IPs block rec; channel.support MFA URGENT (260th carry)
t_339c27da bos
CredAudit: agush@dnid3142l01 — inline Python Bearer JWT (HIGH)
t_ae99245d cred-audit
CredAudit: adryamarthaninoa@dnid3147l01 — OpenRouter key sk-or-...f68b in herdr pane (HIGH)
t_7f107dcf cred-audit
CredAudit: dnid2706l02 — bulk ~700 @dana.id UPN list written to opencode temp file (WATCH/HIGH)
t_221763ba cred-audit
Phish: peoplyee.com recruitment phish — NEW sender, Laya CRITICAL, quarantined
t_df47164d phish-intel
Phish: peoplyee.com recruitment phish — NEW sender, Laya CRITICAL, quarantined
t_c11298b3 phish-intel
Athena: Spray 41st window — fresh decel but NEW target diah.amalia + VE geo, KYC mailbox MFA gap, sukirman disabled-acct climb
t_f80965d6 (unassigned)
Phish: Astra Vendor registration lure — NEW brand pivot, 4 delivered to help@ aliases
t_a10d2375 phish-intel
Phish: Astra Vendor registration lure — NEW brand pivot, 4 delivered to help@ aliases
t_fcb95b5a phish-intel
Phish: kapdesk alias gap quantified — 2 NEW phish senders delivered with empty ThreatTypes (florencepence555 + athenamanagement.site)
t_bbcfbbb9 phish-intel
Nexus: Akamai Perimeter Alert pusher BROKEN — finding template drift (## HEADLINES → ## Headline), DingTalk silent since 09:07Z
t_c5d85a6e bos
Phish: tinhochay.org appeal-scam campaign — 13 rotating senders DELIVERED to help@ aliases (7d, active today)
t_ab49c529 phish-intel
Athena 19:00 — spray campaign QUIET 47th window (0 fresh, first clean) + HARDCODED CREDENTIAL mis@dana.id 6th cycle
t_dc458293 bos
Athena 20:00 — HARDCODED CREDENTIAL mis@dana.id 7th cycle (plaintext re-exposed 13:01:52Z) + spray QUIET 2nd clean window
t_388ca2f3 bos
Athena 2100: mis@ hardcred STILL ACTIVE 8th cycle (plaintext P@ssM1sF1n 14:01:52Z) + spray RE-ENGAGED (avian US 216.131.79.219, oktri EC 45.188.229.169 NEW)
t_a658cbd1 bos
Athena: christopher ACTIVE lockout wave (15x50053/51st window) + mis@ hardcred 10th + new targets muzaki/channel.support
t_ec689247 bos
Athena 0000: mis@ hardcred STILL ACTIVE 11th (plaintext 17:01:52Z, 140/7d) + christopher lockout wave fan-out cleared + muzaki PRIVILEGED VENDOR target + bambang BE fresh
t_5eabc3e0 bos
Nexus: SOC Alerts — DingTalk Push BROKEN 24h+ — backend sqlite readonly, HTTP 500 on auth
t_b0588fc0 bos
Athena 0100: mis@ hardcred STILL ACTIVE 12th (plaintext 18:01:52Z, 140/7d) + yudhi re-ignition 4x50053 + fajri Tor + test1 GR fresh + muzaki privileged 245 single-factor OK rows
t_4732bae2 bos
Athena 0200: mis@ hardcred STILL ACTIVE 13th (plaintext 19:01:52Z, 140/7d) + oktri.wahyudi NEW NL IPv6 spray + RustDesk install dnid3325l02
t_beb8d79f (unassigned)
Athena 0300: mis@ hardcred STILL ACTIVE 14th (plaintext 19:01:52Z) + spray 55th 2 FRESH arms (adhiwira EG, khairani KE) + oktri NL IPv6 confirmed attacker arm
t_9f4b8f56 (unassigned)
Athena 0400: mis@ hardcred STILL ACTIVE 15th (plaintext 21:01:52Z) + spray 56th ACCELERATING 5 fresh arms (edward US, fajri BM, test1 PL, agung US, septi MA) + RustDesk/AnyDesk confirmed dnid3325l02
t_9975f7cc (unassigned)
Athena 0500: test1.nintex stale test account under active spray — 118 ev/30d, 95 IPs/45 countries, 0 legitimate use; verify/disable
t_b8a730b5 bos
Athena 0900: Spray 61st window ACTIVE — khairani.malau NEW US IPv6 2a0e:cbc0:56df:38bb:88e0:be88:c549:1a76 @01:50:14Z + puguh.susilo NEW NL 86.54.28.49 x2 @01:02:56Z; mis@ plaintext hardcred ACTIVE 20th cycle (01:01:52Z); 0 compromise 282nd clean
t_d0423e31 bos
Athena 1000: Spray 62nd window ACTIVE — NEW sukirman GB BT 86.146.136.50 (UK residential) + NL arm CONFIRMED Tor exit 86.54.28.49 + US v6 Windstream; mis@ hardcred 21st carry UNROTATED
t_3dc58b33 bos
Athena 1000: Spray 62nd window ACTIVE — NEW sukirman GB BT 86.146.136.50 (UK residential) + NL arm CONFIRMED Tor exit 86.54.28.49 + US v6 Windstream; mis@ hardcred 21st carry UNROTATED
t_4355e3c5 bos
CredAudit: manurungj@dnid2610l01 — Akamai-EW-Trace JWT burst in curl commands (first-ever, HIGH)
t_bd7e648d cred-audit
CredAudit: hasanahb@dnid3233l01 — internal AI gateway Bearer key in curl (first-ever, WATCH)
t_06712653 cred-audit
Athena 1100: Spray 63rd window ACTIVE — NEW SA arm bambang 50.60.82.103 (Saudi Telecom) + Tor re-engage septi 192.42.116.51; mis@ hardcred 22nd carry UNROTATED
t_21de0314 (unassigned)
Athena 12:00 — christopher wave RE-IGNITED (EG/AT OfficeHome burst) + mis@ hardcred 23rd + septi MFA gap
t_530b2212 bos
XCorr: 173.239.211.0/24 dual-plane block decision (Akamai stuffing + Entra spray)
t_bc5901ab aura
XCorr: christopher.soebrata wave re-ignited + UPN-list overlap — block-list & MFA verify
t_e8561ec7 aura
Athena 13:00 — Spray active 42nd window: EG/AT VPN-broker arms + sukirman NL IPv6 expansion + mis@ hardcred 24th + septi MFA gap
t_414d2a2a bos
Athena 13:00 — Spray active 42nd window: EG/AT VPN-broker arms + sukirman NL IPv6 expansion + mis@ hardcred 24th + septi MFA gap
t_b47682f4 bos
Athena 1400: Spray 43rd window ACTIVE — NEW PK arm 124.29.221.46 on christopher; unmanaged device DESKTOP-18127U7 EDR blind spot; septi MFA gap confirmed; mis@ hardcred 25th carry
t_cb95d8ef (unassigned)
Athena 15:00 — spray 44th window ACTIVE (christopher fresh lockout AS206092 FNS IT 64.64.108.60) + hardcred mis@ 26th carry + SG arms=own device confirmed (SessionId linkage)
t_2a22d4fd bos
Athena 16:00 — spray 45th window ACTIVE (muzaki GB probe) + hardcred mis@ 27th carry + AS212238 overlap ruled out
t_8a8199f6 bos
Athena 16:00 — spray 45th window ACTIVE (muzaki GB probe) + hardcred mis@ 27th carry + AS212238 overlap ruled out
t_68f61f3e bos
MDE hunt 20261002-1700: christopher RE-ENGAGED Tor burst (192.42.116.115) + mis@ hardcred 28th carry
t_533e4d6c (unassigned)
MDE hunt 20261002-1800: sukirman fresh TR lockout + mis@ hardcred 29th carry + B3 residuals cleared
t_07ac5745 bos
MDE hunt 20261002-1800: sukirman fresh TR lockout + mis@ hardcred 29th carry + B3 residuals cleared
t_634f75a8 bos
MDE hunt 20261002-1900: sukirman TR lane single (not repeated) + mis@ hardcred 30th carry (root cause: task edit) + spray quiet this hour
t_67397bd8 (unassigned)
Athena 20:00 — spray 49th window RESUMED (bambang 10x lockout burst 9 countries + IPv6 2a0a:8dc0 US arm) + mis@ hardcred 31st carry MASKING REVERTED to plaintext @13:01:52Z + PERIM FNS 85.203.21.50 success (ade.royani MED)
t_d58d0a95 bos
Athena 20:00 — spray 49th window RESUMED (bambang 10x lockout burst 9 countries + IPv6 2a0a:8dc0 US arm) + mis@ hardcred 31st carry MASKING REVERTED to plaintext @13:01:52Z + PERIM FNS 85.203.21.50 success (ade.royani MED)
t_c12377fd bos
Phish: tinhochay.org wave RE-SIZED 40 Delivered/14d (t_49aba98e was 8/48h)
t_ab18a178 phish-intel
MDE hunt 20261002-2200: mis@ hardcred 33rd carry PLAINTEXT (two-cadence) + spray 51st window ACTIVE (7 fresh, eki.rizki NEW IPv6, sukirman FNS/24) + tinhochay re-delivery today
t_5cccc44a (unassigned)
Athena 20261002-2300: mis@ hardcred 34th carry PLAINTEXT 16:01:52Z + spray 52nd window RE-ESCALATING (christopher 10-lockout/8s burst, NEW IPv6 oktri.wahyudi+lisa.indraputri, NEW FNS 211.x fajri.oktoriandi)
t_d6a8e622 (unassigned)
MDE hunt 20261003-0000: mis@ hardcred 35th carry PLAINTEXT (17:01:52Z) + spray 53rd window (plateau broken)
t_13210c94 (unassigned)
MDE hunt 20261003-0100: mis@ hardcred 36th carry PLAINTEXT (18:01:52Z) + spray 54th window RE-ESCALATED (13/h: dimas lockout TR/CL, NEW diah.amalia PK, ipan CH)
t_86fb222a (unassigned)
Athena: mis@ hardcred 37th carry PLAINTEXT (19:01:52Z) + spray 55th window — 3 NEW targets incl. sugiharso lockout; perimeter sweep clean
t_66cd861c bos
Athena: mis@ hardcred 38th carry PLAINTEXT (20:01:52Z) + spray 56th window (2 NEW targets incl. KYC mailbox) + perimeter sweep clean
t_c5f92c36 bos
Athena: mis@ hardcred 39th carry PLAINTEXT (21:01:52Z) + spray 57th window (adhiwira MA fresh) + KYC MFA-gap confirmed + 8-IP perimeter sweep clean
t_cef09f46 bos
Athena: mis@ hardcred 40th carry PLAINTEXT (22:01:52Z) + spray 58th window (test1.nintex 50053 from 45.137.126.6 IN) + 6-IP hosting-infra perimeter CLEAN
t_8a9f3cf3 bos
Athena: mis@ hardcred 40th carry PLAINTEXT (22:01:52Z) + spray 58th window (test1.nintex 50053 from 45.137.126.6 IN) + 6-IP hosting-infra perimeter CLEAN
t_82753d6c bos
Athena: mis@ hardcred 41st carry PLAINTEXT (23:01:52Z) + spray 59th window (sugiharso NEW DE arm) + money-path sweep CLEAN
t_2856b69e bos
Athena: mis@ hardcred 42nd carry CONFIRMED (persisted evidence, STILL NOT ROTATED) + dimas admin-tooling spray persistent 7d
t_54de99c2 bos
CredAudit: sugiharso@dnid3597l01 — Notion MCP Bearer token in curl commands (first-ever, HIGH)
t_5617f3f9 cred-audit
Meta: Housekeeping TTL does not cover agent-comm inboxes — mde-hunter 209, phish-intel 153, perimeter 122
t_c1a2f9af bos
Meta: Athena hardcred carry kanban spam — 24 tasks in 24h, dedup regression (canonical t_9ed08ca6 exists)
t_c3d98ce6 bos
xcorr C2: sugiharso@ multi-channel pressure — Notion MCP Bearer (Vega t_5617f3f9) + DE/CL lockout arms (Athena) + first phish tripwire hit ctcco.com.sg (Phish c199)
t_9a514619 bos
Phish: kona24285 Android Registration/Login lure — 9th cycle Delivered to help@ mailboxes
t_5136c8dc phish-intel
Phish: kona24285 Android Registration/Login lure — 9th cycle Delivered to help@ mailboxes
t_f9140bf0 phish-intel
MDE hunt 20261003-1900: mis@ hardcred 54th carry NOT rotated + spray 3 NEW arms (oktri BD, dimas TR, wisnu US-v6 NL)
t_f59fd4a4 bos
MDE hunt 20261003-1900: mis@ hardcred 54th carry NOT rotated + spray 3 NEW arms (oktri BD, dimas TR, wisnu US-v6 NL)
t_10da6751 bos
Phish: registration-bait forwards from capcila892@gmail.com delivered to help@dana.id
t_599cda63 phish-intel
XCorr C3: api.saas.dana.id DOSATCK 14th cycle rebounding — AS16509 pair 0 deny on money paths
t_cacb377d bos
Phish: inryjulianus@gmail.com DANA-refund lure + JPG attachments — delivered to help@ (CRITICAL-class, gate fired)
t_2067271f phish-intel
Synthesis & Alert Hub content_policy_blocked — 18:10 WIB cycle missed, recurring (05:15/11:10 UTC)
t_b0e834a3 bos
abliterated-routing-guard: abliterated model routed via dana-gateway (DingTalk session 20261004_152737_2c634c13) + guard DingTalk delivery target broken (job 18abce75c330)
t_f748b6df bos
Phish: agustrimulyono197@gmail.com refund-bait wave — 4 Delivered to help@dana.id/kapdesk (Phish-tagged, +3 PNG attachments)
t_0fef727a phish-intel
CredAudit: Notion integration tokens (ntn_) hardcoded in cmdlines — fleet scale (HIGH)
t_f425c0bb cred-audit
Phish: tinhochay NEW local-part qgkkvjixq with beacons.page URL — CRITICAL tripwire FIRED (10-05T08:31Z)
t_abde6cb8 phish-intel
Athena: jenkins-hydra-dev.dana.id embedded API token in zsh cmdline (dnid2856l01 sudrajatm, mirdan.syahid token)
t_c4a5b274 bos
Phish: LIVE DANA credential-harvesting panel on cluster variant layanan-gopay.official-indonesia.my.id
t_b588b50a phish-intel
MDE 0700: lisa.indraputri 4th CA-IPv6 spray event — dedicated targeting of ENABLED account (4/24h); CA-IPv6 cadence tightening (20th cluster, 21-min gap)
t_c6521129 bos
CredAudit: dnid3406l01 — NEW device with default AD password 123456 (CRITICAL)
t_959892c7 cred-audit
Phish-intel outbox write-path regression — cycles 257+ write evidence/ only, outbox stale since c256 (Oct 5 21:00 WIB)
t_1800a434 bos
Phish: SUCCESSOR PIVOT — bantuan-dana.official-indonesia.my.id LIVE DANA OTP/PIN harvester (layanan-gopay takedown confirmed NXDOMAIN)
t_05ccf620 phish-intel
Phish: GoPay sibling harvester LIVE on official-indonesia.my.id (help subdomain, brand #2)
t_702f181b phish-intel
Phish: SUCCESSOR PIVOT 2 — bantuan.official-indonesia.my.id LIVE DANA phone→PIN→OTP harvester (help NXDOMAIN, same farm)
t_d8692db6 phish-intel
Phish: FARM EXPANSION — official-indonesia.my.id now 5 LIVE harvesters (DANA×2 + GoPay + OVO×2), 3 new labels in one cycle
t_e7ad2f43 phish-intel
CredAudit: wilsonw@dnid2894l01 — hardcoded JWT bearer Cookie in curl to api.rise.dana.id recruitment API (first-ever, HIGH)
t_fc078a51 cred-audit
CredAudit: alfiantot@dnid1598l01 — hardcoded goat-catalog session JWTs in curl cookies (first-ever, HIGH)
t_4a3e5ff6 cred-audit
Phish: FARM EXPANSION RESUMED — gopay-official.official-indonesia.my.id = 6th LIVE harvester (GoPay kit twin, byte-identical to official-g0pay)
t_86e457e6 phish-intel
Phish: NEW live label layanan-shopee.official-indonesia.my.id — DANA kit clone (farm 5→6, expansion resumed)
t_6f29f8a8 phish-intel
Phish: FARM RE-ARM — dana.official-indonesia.my.id LIVE (DANA phone→PIN→OTP harvester), farm 6→8-wide
t_59c00c1d phish-intel
Phish: official-indonesia.my.id farm RE-ARMED — 2 live harvesters (GoPay layanan-help + ShopeePay shopee)
t_f741af62 phish-intel
Phish: official-indonesia.my.id farm RE-ARMED — 2 live harvesters (GoPay layanan-help + ShopeePay shopee)
t_eaf3890f phish-intel
Phish: farm RE-ARM #2 — ovo-bantuan.official-indonesia.my.id 3rd LIVE harvester (OVO ID login page)
t_b8ca0f2d phish-intel
CredAudit: nugrohowi@dnid3720l01 — hardcoded JWT in launchctl setenv TRAFFICPEAK_MCP_TOKEN (first-ever, HIGH)
t_618813f9 cred-audit
Phish: official-indonesia.my.id farm RE-ARM #3 — 2 NEW live harvesters (bantuan-gopay GoPay clone + ovo OVO clone)
t_d205903b phish-intel
Phish: official-indonesia.my.id farm RE-ARM #3 — 2 NEW live harvesters (bantuan-gopay GoPay clone + ovo OVO clone)
t_28549289 phish-intel
Athena 20261009-0500: mailzx.eu.cc unsubscribe lane — census CORRECTED: 19 distinct dana.id recipients in 24h (ALL Blocked from setda.organisasi@badungkab.go.id Malware+Spam, 0 clicks) — NMID 85671be2 alone = 13 recipients; recommend block-list mailzx.eu.cc/click-*.eu.cc + sender
t_a6c4f553 bos
Phish: mailzx.eu.cc delivery infra CONFIRMED LIVE — tj.mailzx.eu.cc bulk-mailer panel operational (27 dana.id recipients/24h, all blocked)
t_f5ef0ada phish-intel
Athena 20261009-1300: synchronized TikTok Ads OTP to 3 prior-OJK-flood recipients (farrel/riste/arief) — credential-exposure signature
t_9810dee5 human
Phish: farm RE-ARM 4 - help-gopay.official-indonesia.my.id LIVE GoPay phone harvester (5 old labels HTTP 522 origin dead)
t_75e967d0 phish-intel
MDE hunt 20261009-1500: NEW angga.musin success on 185.220.68.37 SG (M247 VPN egress) — 4th user on arm, user confirmation requested
t_2feb6ae6 bos
Phish: FARM ROTATION #2 — RE-ARM #5/#6 LIVE: layanan-ovo OVO login/OTP harvester + layanan-shopee ShopeePay + dana staging (help-gopay de-armed)
t_33d0632a phish-intel
Phish: FARM ROTATION #3 — dana LIVE DANA-branded OTP/PIN harvester + g0pay armed with relocated GoPay kit
t_cb889d8e phish-intel
Athena 20261009-2000: VPN Datacenter Auth 3 genuine — theo.kartawijaya 26ev (156.146.56.119 SG) + deniyanto.sorip 8ev (146.70.29.31 SG) + NEW latrisha.mintarya 2ev @13:09:54-55Z (149.88.106.148 SG M247)
t_cb32ac45 bos
Athena 20261009-2100: KeychainTheft dnid3583l01 devicefarm token reads + OJK flood re-ignition
t_2c4de966 (unassigned)
Athena 20261009-2200: NEW delivered bit.ly/mbdin 'Laporan salah transfer' lure — help@dana.id + help@dana.kapdesk.com @14:23:12Z (alifvia.azzahra99@gmail.com; Delivered; watch + consider block-list)
t_797f9dbd bos
Athena 20261010-0400: purge gap 70th — rmddeska4/ricky.ferino threat mail still Delivered (Exchange purge NOT done)
t_b9d4e48f bos
Athena 20261010-0600: NEW delivered phish — zolfir.shop shorturl.at survey lure → lianda.nelwan (Delivered, 0 ZAP)
t_4b7fdf56 bos
Phish: RE-ARM #5 — dana OTP/PIN harvester resurrected on layanan-dana.official-indonesia.my.id (CRITICAL)
t_5f832ccd phish-intel
Athena 20261010-1200: NEW VPN-DC sighting — daniel.christian single-factor Exchange from 146.70.244.116 AT (M247 datacenter, first-ever 7d)
t_42547e44 bos
Phish: SUCCESSOR ARMED — layanan-dana-official.official-indonesia.my.id LIVE DANA OTP/PIN harvester (CRITICAL)
t_b1c1f536 phish-intel
Phish: OVO harvester RE-ARMED — ovo.official-indonesia.my.id live (kit sha 3cad246d25b77050, farm 5→6)
t_4d8ced5b phish-intel
Phish: NEW label ARMED — ovo-indonesia.official-indonesia.my.id LIVE OVO harvester twin (kit sha 3cad246d25b77050, farm 6→7)
t_8232c491 phish-intel
xcorr 20261012: sudrajatm gateway-key-in-cmdline x exposed gateway.ai.dana.id management surface
t_890741c1 bos
Phish: dana-help.official-indonesia.my.id STILL LIVE 2nd cycle — c436 CRITICAL not yet actioned (armed 00:43Z, live 2.5h+)
t_3cf5e95a synthesis
Phish: dana-help.official-indonesia.my.id STILL LIVE 3rd cycle — c436/437 CRITICAL not yet actioned (armed 00:43Z, live 3.5h+)
t_6a8b3f04 phish-intel
Phish: dana-help.official-indonesia.my.id STILL LIVE 4th cycle — DANA OTP/PIN harvester, no takedown ~4.5h
t_dca80196 phish-intel
Phish: dana-help.official-indonesia.my.id STILL LIVE 5th cycle — DANA OTP/PIN harvester, no takedown ~5.5h
t_d707eaf4 phish-intel
Phish: official-indonesia.my.id TAKEN DOWN (clientHold) — dana-help CRITICAL resolved; entire farm NXDOMAIN
t_cb56a3d1 phish-intel
Athena: reelscash2211.top gambling lure delivered to help@dana.id + help@dana.kapdesk.com (NEW host, rajaputralingraja@gmail.com, 0 clicks)
t_0320a9ac (unassigned)
xcorr H1: Aura synthesis STALL ~47h — Synthesis cron 1cad707d1b4c PAUSED (content_policy_blocked Oct 13 09:10Z)
t_ffad3725 synthesis
Ready 78
Athena: 30m cadence breach — runtime 33-41m exceeds slot, 5 slots suppressed in 31h (single-flight)
t_7023558f bos
Laya: 3 publishers stalled — no decisions in 17h despite active findings
t_f1da380c bos
Vulnerability Scanner dispatch silent — 3 missed daily fires since Sep 22
t_ec4d15f9 bos
Enrich: agent-comm outbox stale 112h — output path regression since Sep 22 + Sep-26 run no output
t_1bf43db6 bos
Rigel: weekly trend report generated but DingTalk delivery failed (Sep 14)
t_e7d1c0f0 bos
blastini-WEB: active development of external WhatsApp-blast panel on DANA laptop (dimas.nugroho)
t_fb73d0a1 bos
Bos Decision: Pebri.Store QR freeze + WAF deploy + LE reporting (30h+ unresolved)
t_e30a2402 bos
sukirman: disabled user 14x50126 spray explosion (13 IPs/10 countries)
t_492f5070 bos
Bos: Confirm .orca/agent-hooks / Orca.app sanction status
t_2ab6a4b0 bos
🟡 MEDIUM: Add total_hits, total_findings, fp_count, last_checkin to agent_health schema
t_2cb747d6 bos
🟡 STALLED INVESTIGATION: Nova OpenCode sanctioned/unsanctioned determination — 19 cycles absent, 08:05 WIB Sep 8 decision point passed silent
t_0c2df105 bos
Bos: Rotate command.center@dana.id client secret — 'Automation Project (EK)' app (1,550 auth failures/24h, 100% ErrorCode 7000215, secret unrotated since 06:30Z Sep 7 — 4th consecutive cycle flagged)
t_d30b362e bos
Cross-ref CRITICAL: sukirman re-ignition + Perimeter stuffing = same campaign (C1)
t_2f0058d4 aura
MDE Threat Hunter: C3 spray widening ACCELERATING — bambang primary, yudhi re-ignited, sukirman 14-ctr infra + 50053 lockouts
t_eaa27fc4 aura
MDE follow-up: esc01/esc02 stale creds + dimas coverage + notion-automation token review
t_a50aff1f aura
Nexus: Fix nexus-collector.py path divergence — legacy healer DB + legacy agentdeck path
t_d90dfb6d bos
Athena: Spray 40th window — US wave +80% acceleration, KYC NEW target, PR geo, christopher exec lockout-thrash, deryan risk row
t_996c48f3 (unassigned)
Nexus: Allow/block decision for rtk AI agent — 52 devices, 216K events, hooks Claude/Cursor, egress to internal vault
t_29b20a99 human
Altair CORR-047: esra.purba — Echo credential leak victim now actively sprayed (NEW)
t_b3a5ef29 aura
🔴 CRITICAL: CISO ESCALATION — 6 credential stuffing victims, NO MFA, 18d+ unresolved
t_769f1248 human
Nexus: Healer DB schema migration — add total_hits, total_findings, false_positives, heartbeat columns (13 days blind, 26/26 agents)
t_c76c27bd human
Nexus: Gateway restart 2026-09-07 18:50Z lost ~/.hermes/.env vars — env-only scripts break silently
t_d3007c66 human
Pebri.Store: Freeze DANA QR 281012012023072977540146 + document operator Pebri Yanuari
t_bf5be1c1 bos
Intel X: jeffrey.saputra + fahrizal.husein credential exposure — 27 events, infostealer logs, route to intel team
t_a1d6843b echo
yudhi.susanto RE-IGNITED — credential stuffing (Laya comp=1.0)
t_153bdd07 aura
bambang.ardiansyah CRITICAL spray escalation — new primary target (8/7/6)
t_54b31bd1 echo
Nexus: dana.co.id domain parked/for-sale — ACQUIRE or LEGAL action
t_d816e287 human
🔴 CRITICAL — bambang.ardiansyah: 4+ leaked passwords, active credential stuffing, NO MFA, infostealer (18+ DAYS UNRESOLVED)
t_e3026e79 human
🔴 CRITICAL — dimas.nugroho: corporate password leak (test_1234), 318 lockouts, NO MFA, blastini.com insider concern
t_1b12d860 human
🔴 diah.amalia: leaked credentials + brute-force from internal DC (172.27.71.71) + impossible travel (Bangladesh) + NO MFA
t_88339bac human
🔴 yudhi.susanto (Deputy Finance Director): leaked credentials + brute-force + lockouts — high-value target
t_eebee4f0 human
🔴 avian.primantifa: cleartext password + persistent stuffing (cycle #10) + ESC stale credential + NO MFA
t_ef601319 human
🔴 hadidya/dnid4012l01: 6+ plaintext infra credentials in atuin history + Shadow AI + possible endpoint compromise
t_71ac3451 human
🟡 nugrohoa/dnid3275l01: Claude Code dangerously-skip-permissions + keychain 350x + opencode Shadow AI
t_0d9c7dde human
🟡 adryamarthaninoa/dnid3147l01: hardcoded JWT in SSH command line to 5 cloud-admin hosts (HIGH)
t_f3a9db2f human
🔴 CRITICAL — christopher.soebrata: 44k credential-stuffing events, 61 countries, NO MFA (10+ days)
t_fe09a8d1 human
🔴 CRITICAL — reza.setiadi (Head of SRE): leaked SRE credential + active stuffing + Notion Calendar shadow SaaS MFA noise
t_8bcd140c human
Permata spoofer 3rd identity fired - domain gateway blocklist ask (settlement lane)
t_56bd4dbc bos
Bos: Akamai fingerprint-scoped mitigation — 158.140.167.120 MyRepublic dual-fp relay (Aura-endorsed, single-IP scope only)
t_d50fe91f bos
Bos: Akamai collector storage-sampling decision — STORE_PAGES=1 caps DB at ~2-12% of true stream (Alexa cycle-30 discovery)
t_a4a78081 bos
Bos: Akamai fp+IP-scoped mitigation — 47.129.43.38 action-evasion adapter (AWS-SG, risk 82)
t_ea95d2c4 bos
🔴 ESCALATION (Day 8 / 96h+): CVE-2026-84377 unremediated — gateway.ai.dana.id still LiteLLM 1.91.4 — ship-it-or-escalate decision now owed
t_6889b9ee bos
🔴 ESCALATION: Entra risk-engine blindness 35h+ — 4 of 10 leak-replay fires unscored (QA4 booked)
t_a85cfeab bos
🟡 MEDIUM: test1.nintex@dana.id test-account policy — MFA/password-rotation/CA exclusion + canary proposal (identity team)
t_1cd6bf64 human
🔴 BLOCK RECOMMENDATION: 89.222.90.0/24 — entire class-7 credentialed-replay lane (one operator, 16 IPs / 11 targets, 48 ev/7d, 9/11 leak-listed)
t_f13c572c bos
Healer: athena auto-paused after 1 failures
t_d842bdc5 healer
Healer: alexa auto-paused after 1 failures
t_8b1738b0 healer
Healer: vega auto-paused after 1 failures
t_7667ea40 healer
Cost Guard: CRON FLEET HALTED — spend limit hit
t_8e292a67 healer
Cost Guard: Cost Guard CRITICAL — gateway budget wall
t_41a4bdb4 healer
Cost Guard: Cost Guard CRITICAL — gateway budget wall
t_def0f051 healer
Cost Guard: Cost Guard CRITICAL — gateway budget wall
t_100c84c2 healer
Healer: siem-daily auto-paused after 1 failures
t_566ae763 healer
Cost Guard: Cost Guard CRITICAL — gateway budget wall
t_2fc3c0f9 healer
CRITICAL: DANA AI Gateway budget cap hit 506.66/1506.95 — nova+luna blocked
t_088c42b2 bos
Spray ladder escalation — sukirman E=3 + oktri.wahyudi E=3 (NEW, threshold met)
t_e7a50ddc aura
Athena: sugiharso spray ESCALATED to E=4 — 4 IPs/4 countries (CA/US/AU/MA) — NEW Morocco node AS214716 WellHouse
t_2a10c875 echo
Athena: sugiharso spray ESCALATED to E=4 — 4 IPs/4 countries (CA/US/AU/MA) — NEW Morocco node AS214716 WellHouse
t_b2b52e55 echo
Healer: credential-auditor auto-paused after 1 failures
t_3d1aabd5 heal
Laya: Automated Laya decision publishing silent across agent fleet — 0 agents publishing post-Sep-22 fix
t_5a544062 nexus
Credential Auditor: Investigate TimeoutError auto-pause — daily 04:00 UTC job timing out on terminal tool >600s
t_64279a6d vega
CRITICAL: nugrohowi (dnid3720l01) — full keychain dump + pgstag staging creds
t_7bc67d0c athena
puguh.susilo NEW spray target Laya CRITICAL comp=0.8955
t_5ed62cc0 bos
Cost Guard: Cost Guard WARNING — cost baseline / prompt cache
t_7d88a5db heal
Cost Guard: CRON FLEET HALTED — spend limit hit
t_4b07c0d9 heal
Cost Guard: CRON FLEET HALTED — spend limit hit
t_5ed928c8 heal
Cost Guard: CRON FLEET HALTED — spend limit hit
t_91f0f9ce heal
Cost Guard: CRON FLEET HALTED — spend limit hit
t_18b82e98 heal
Healer: shared-surface-publisher auto-paused after 1 failures
t_5ca2dd3d heal
Healer: bot-abuse-investigator auto-paused after 1 failures
t_ef5e1185 heal
Cost Guard: Cost Guard CRITICAL — gateway budget wall
t_30267234 heal
Cost Guard: Cost Guard CRITICAL — gateway budget wall
t_04d12de9 heal
Athena 0800: Spray 36th window — channel.support functional mailbox LOCKED OUT (BE 35.241.224.153); 45.91.20.0/22 confirmed attacker provider block; ppoc.team GB arm; bambang 40ev/36locks/39IP/15ctry
t_eec93b90 bos
Athena 1100: Spray 63rd window ACTIVE — NEW SA arm bambang 50.60.82.103 (Saudi Telecom) + Tor re-engage septi 192.42.116.51; mis@ hardcred 22nd carry UNROTATED
t_f1aabc53 bos
Healer: synthesis-&-alert-hub auto-paused after 1 failures
t_c5225953 heal
Healer: abliterated-routing-guard auto-paused after 1 failures
t_78d1dd7e heal
Cost Guard: Cost Guard WARNING — cost baseline / prompt cache
t_93e8d9c8 heal
Cost Guard: Cost Guard WARNING — cost baseline / prompt cache
t_84aeee07 heal
Todo + Running 38
Aura: Triage coordinated local LLM burst — 5 macOS workstations (retry from t_a8773d48)
t_eb5358b3 aura
Aura: DAN7-27855 — radikari B2B partner JSESSIONID session token leak (3rd recurrence)
t_56be5f24 aura
Altair CORR-045: hasibuanm credential hunting — Shadow AI + Cred Audit cross-correlation
t_01c4c64e aura
Altair CORR-046: sarosal DANA AI Gateway key + SRE/AI Ops Shadow AI team pattern
t_81e080a6 aura
XCRR-1001-C2 (HIGH): Perimeter 130646 peak 3821/hr x spray 40th window - Day 18 campaign
t_5f988449 synthesis
XCRR-1001-C3 (HIGH): MGS direct-origin WAF bypass - 10 live variants Day 20, exec summary due
t_58c99229 synthesis
XCorr C2: AAD spray 104.234.x — yudhi arm 104.234.19.121 AS206092 = same ASN as Perimeter 104.234.32.0/24 (ASN-level tie)
t_7056e010 synthesis
XCorr CORR-20261008-C2: dnid3720l01 two-agent credential exposure cluster (Keychain #832 + TRAFFICPEAK_MCP_TOKEN JWT)
t_04ffe300 synthesis
xcorr CORR-20261013: scanner 138.199.60.185 hit NEW host ifctscenter.saas.dana.id hunting DB backups — add to vuln family sweep
t_cd474217 synthesis
xcorr CORR-20261014-C1: OJK/IASC campaign RE-IGNITED — 24h=1,793 16th new high, 3h=344 re-acceleration, 04:00Z=152, form still accepting 93rd
t_4c5525b3 synthesis
Altair CORR-029: Settlement DMARC Wave 11 — 24h gap then resumed, 53 undetected
t_4a658957 aura
Altair CORR-072: LiteLLM gateway cluster — hardcoded production master key + 5-agent exposed surface
t_c3c43451 aura
Altair CORR-086: dimas.nugroho insider-risk convergence (blastini-WEB Shadow-IT + test_1234 leak + 318 lockouts + NO MFA)
t_804d3951 aura
XCRR-1001-C1 (CRITICAL): Qatar Airways BEC x credential spray convergence on shared accounts
t_e294e6e5 synthesis
XCRR-1001-C4 (CRITICAL): Bulk ~700 UPN list (opencode on dnid2706l02) x spray census growth
t_8b1a75a8 synthesis
XCRR-1001-C5 (CRITICAL): adryamarthaninoa dual credential cluster - 64c JWT NOT rotated + OpenRouter key
t_52147818 synthesis
XCRR-1001-C6 (CRITICAL): Sinar Mas single-operator x Qatar BEC pivot + AS63859 infra tie
t_cd601969 synthesis
Aura: 6 unauthorized OpenAI Codex agents exfiltrating code to OpenAI API — no DLP, engage DLP team
t_06e7060e aura
Athena: endpoint deep-dive — OpenAI Codex Computer Use (agentic control) on 6 dev workstations
t_f812415f athena
Orion: Investigate 172.29.1.1 — 555 failed AD logons against 198 accounts (internal anomaly)
t_3a8211ea orion
Vega: iddana1234 shared password audit — edward.chandra + ariyandi.widarto (Bright-Dev)
t_122815d1 vega
Orion: esra.purba — ESC server stale credential investigation (jktcp00esc01/02)
t_f0fa780c orion
Vega: esra.purba — credential validation (DAN7-27849)
t_13bd0d9b vega
Vega: fajaru (dnid3155l01) — SSH key + AI OAuth tokens aggregated in dev.omp.devtools.* keychain
t_51ac8c96 vega
Athena: fajaru (dnid3155l01) — Antigravity (Google agentic IDE) + devtools-wails endpoint deep-dive
t_4b03236a athena
Athena: dnid2387l01 (guminga) — endpoint investigation of HTB offensive tooling + AI kill-chain on work laptop
t_1c16719a athena
Athena: dnid4050l01 — verify secure token state + Mobile-to-Local conversion of julians
t_9ce2e124 athena
Orion: gateway.ai.dana.id — OIDC discovery + Swagger downgrade to plaintext HTTP (TLS misconfig)
t_8264ab5d aura
Echo: Attribute christopher.soebrata non-Indonesian Entra sign-in IPs (VPN vs attacker)
t_de62f88f echo
Athena: repoagent MCP token storage pattern — Claude Code scratchpad exposure team-wide
t_975d3b90 athena
Vega: Credential sprawl check — blastini.com MySQL password reuse (dimas.nugroho)
t_adb6e733 vega
Echo: Monitor blastini VPS for DANA credential usage / lateral movement indicators
t_de52a025 echo
Luna: OSINT deep dive — blastini.com business registration and dimas216 digital footprint
t_de10983f luna
Nova follow-up: athena — dnid2886l01 endpoint deep-dive (Cursor/rtk/Codex keychain exfil risk)
t_2bfd052e athena
Nova follow-up: vega — jeffry.sandy gh:github.com PAT credential exposure assessment
t_c4fab9b8 vega
XCorr C3 20261005: yudhi.susanto 3-agent compound — spray RE-IGNITED (US ACOM arm) + M365 MCP Client (dnid3308l02) + 0 MFA
t_ba504b47 bos
XCorr CORR-062: dnid3406l01 — 123456 AD-bind password on security-engineer scanner host
t_50fb29c4 synthesis
xcorr 20261011: Actuator heapdump probe HTTP 200 on mgs-gw.test02.dana.id — secrets-in-memory exposure risk on MGS pass-through variants
t_5f258a54 synthesis