Update observed IOC rules - 2026-09-09

[github-actions]

Summary

Automated IOC update (Last updated: 2026-09-09)

Cumulative Changes Since Last Merge

• Total Active IOCs: 267
• Added: 6 IOCs
• Expired: 112 IOCs

New IOCs

• ea32f0fb78dd6c13... (sender_emails) — Compromised Turkish manufacturer service account - thread hijacking with credential phishing redirect
• 40742af9c50cbbdd... (sender_emails) — Attacker registered domain - fake billing review credential phishing
• f693fc266ddb8249... (sender_emails) — Compromised Puerto Rico nonprofit account - image-based legal subpoena lure targeting accounts payable
• 8d0a6552bc32f370... (sender_emails) — Compromised Vietnamese bank account - advance fee fraud gift and prize campaigns
• 99563d51af8f00be... (sender_emails) — Compromised account - German language inheritance advance fee fraud impersonating Bank of England
• 04dccb790fc71da6... (sender_emails) — Compromised Russian domain - USPS survey reward phishing hosted on Google Cloud Storage

---

Update History

• 2026-09-09: Added 6 IOC(s) — 267 active IOC(s)
• 2026-09-09: Initial sync — 261 active IOC(s)

---

Generated by automated IOC management system
Source: Private threat intel repository

[github-actions]

Test Rules Sync - Action Required

This PR was not automatically synced to test-rules because the author is not a member of the sublime-security organization.

To enable syncing, an organization member can comment /update-test-rules on this PR.

Once triggered, the rules will be synced on the next scheduled run (every 10 minutes).

[github-actions]

Automated update — 2026-09-09
Rules regenerated from latest IOC CSVs. Force-pushed to automated-ioc-updates.