[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

hunt idea (Arista Advisory 0199 IOCs and guidance)

Hunt: VeloCloud Orchestrator CVE-2026-114625, two attacker IPs, odd URL paths and new backdoor daemons on the VCO host

Arista's advisory gives enough to start a hunt on on-prem VCO before and after upgrading:

  1. Preserve first: copy VCO web access logs, backend application logs, system logs, database logs and file-system timestamps before remediation.
  2. Known attacker IPs: search web and firewall logs for 74.82.197.86 and 38.54.50.151.
  3. Request shape: flag VCO web requests with unusual URL-like path components, encoded characters, references to local or internal services, and high request rates, especially from low-privilege (Enterprise Read Only) sessions.
  4. Host: look for unexpected outbound connections from the VCO host, backdoor daemons and webshells.
  5. App: review recent administrator and operator-level changes you can't account for.

Sources: Arista Security Advisory 0199