5 of the Biggest Cyber Attacks in 2026 So Far: DNS Deep Dive
CRN¹ named the biggest cyber attacks and breaches of 2026 so far, and we zoomed in on five of them. Two were zero-day exploitation campaigns against edge infrastructure—Cisco Catalyst SD-WAN and Ivanti EPMM. One was the Stryker wiper attack. The last two were ShinyHunters campaigns against the education sector: the Instructure Canvas breach and the Oracle PeopleSoft zero-day.
Mandiant, Google Threat Intelligence Group, Palo Alto Networks Unit 42, and Protos Labs published the underlying analyses.
We extracted domains from the subdomain IoCs and, aided by the WhoisXML API MCP Server², filtered out those owned by legitimate companies plus one on the Tor network. That left 54 IoCs—five subdomains, 14 domains, and 35 IP addresses.
Original IoCs Analyzed
Domain and IP indicators from the reported campaign
Key Findings
Email-connected domains
Additional IP addresses
IP-connected domains
String-connected domains
These are key highlights from our analysis. The full report contains many more findings and detailed insights.
OUR RESEARCH PROCESS
- Domain IoC legitimacy check
- Client traffic and typosquatting analysis
- Domain IoC WHOIS and DNS history analysis
- Email-connected domain discovery
- IP and IP-connected domain discovery
- String-connected domain discovery
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.crn.com/news/security/2026/10-major-cyberattacks-and-data-breaches-in-2026-so-far?page=1
- [2] https://main.whoisxmlapi.com/ai/mcp-server
Latest Reports
Integrity Technology Group-Backed Actors Combine Automated and Manual Tools in Global Attack
WhoisXML API uncovered 7,100+ additional artifacts linked to the Integrity Tech-enabled global data theft attack. Download the threat research materials now.
Earth Sirrush Espionage Tool Evolution: DNS Facts Unveiled
WhoisXML API uncovered 400+ additional artifacts linked to Earth Sirrush. Download the threat research materials now.
Four hours before PHP2Shell’s Disclosure
A server scouted our honeypots 4 hours before PHP2Shell’s disclosure, then returned with exploit attempts. The report covers its traffic history and IoCs.