markcardiff.tech:/daily-intel/2026-08-05.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-08-05 08:00:42 UTC
P1: 0
P2: 4
Items: 250

Daily Cyber Threat Intel Brief — 2026-08-05

Generated: 2026-08-05 08:00:42 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=0, P2=4, P3=62, P4=184.
  • Highest-priority item: Botnet Hunting for Vulnerabilities in Diagnostic Tools, (Tue, Aug 4th) (P2, source: SANS Internet Storm Center).
  • 5 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P2 Botnet Hunting for Vulnerabilities in Diagnostic Tools, (Tue, Aug 4th) — SANS Internet Storm Center; score 62; technologies: none explicitly matched.

    • - This morning, I noticed specific sources "hunting" for vulnerabilities in URLs that I haven&#;x26;#;39;t noticed before. All of these URLs appear to be associated with diagnostic tools:

  • P2 RansomLook: Integrated Site Management claimed by orova — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: orova. Claimed victim/listing: Integrated Site Management. Description excerpt: Real Estate Company URL Open https://www.ism-sc.com/ in a new tab| Aug 2, 2026 76,758 files| 15.90 GB| Watch Data Open watch…

  • P2 CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild — Rapid7 Blog; score 52; technologies: none explicitly matched.

    • - Overview On August 2, 2026, N-able published a security advisory for CVE-2026-18577 , an authentication bypass vulnerability affecting N-central that was discovered being exploited in-the-wild after an incomplete fix for an earlier authentication bypass…

  • P2 Almost Half of Malware Samples Communicate Direct to IP — Unit 42 Threat Research; score 50; technologies: none explicitly matched.

    • - Nearly half of C2 malware bypasses DNS by connecting directly to IP addresses. Zero trust IP enforcement secures networks against these threats. The post Almost Half of Malware Samples Communicate Direct to IP appeared first on Unit 42 .

    Newly exploited vulnerabilities / CVE watch

  • P2 CVE-2026-18556, CVE-2026-18577: CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Integrated Site Management claimed by orova — Public RansomLook extortion-site listing claim. Group: orova. Claimed victim/listing: Integrated Site Management. Description excerpt: Real Estate Company URL Open https://www.ism-sc.com/ in a new tab| Aug 2, 2026…
  • P3 RansomLook: lantisnet.com claimed by inc ransom — Public RansomLook extortion-site listing claim. Group: inc ransom. Claimed victim/listing: lantisnet.com.
  • P3 RansomLook: Galvin Brothers claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Galvin Brothers. Description excerpt: Civil Engineering Construction
  • P3 RansomLook: RUPP Spritzguss claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: RUPP Spritzguss. Description excerpt: Manufacturing
  • P3 RansomLook: First Tek claimed by play — Public RansomLook extortion-site listing claim. Group: play. Claimed victim/listing: First Tek.
  • P3 RansomLook: Preferred Financial Group claimed by play — Public RansomLook extortion-site listing claim. Group: play. Claimed victim/listing: Preferred Financial Group.
  • P3 RansomLook: H**r claimed by payoutsking — Public RansomLook extortion-site listing claim. Group: payoutsking. Claimed victim/listing: H**r.
  • P3 RansomLook: cesmac.edu.br claimed by krybit — Public RansomLook extortion-site listing claim. Group: krybit. Claimed victim/listing: cesmac.edu.br. Description excerpt: Centro Universitário CESMAC (CESMAC University Center) is the largest private higher education…
  • P3 RansomLook: Loyalist College claimed by inc ransom — Public RansomLook extortion-site listing claim. Group: inc ransom. Claimed victim/listing: Loyalist College.
  • P3 RansomLook: TRULITE GLASS & ALUMINUM SOLUTIONS claimed by inc ransom — Public RansomLook extortion-site listing claim. Group: inc ransom. Claimed victim/listing: TRULITE GLASS & ALUMINUM SOLUTIONS.
  • P3 RansomLook: Keysight claimed by everest — Public RansomLook extortion-site listing claim. Group: everest. Claimed victim/listing: Keysight. Description excerpt: 2 posts - 1h
  • P3 RansomLook: healthcarehighways.com claimed by chaos — Public RansomLook extortion-site listing claim. Group: chaos. Claimed victim/listing: healthcarehighways.com. Description excerpt: WARNING / DATA LEAK NOTICE Target: Healthcare Highways (healthcarehighways.com)…

    • Malware / infrastructure / abuse feed highlights

  • P2 Botnet Hunting for Vulnerabilities in Diagnostic Tools, (Tue, Aug 4th) — This morning, I noticed specific sources "hunting" for vulnerabilities in URLs that I haven&#;x26;#;39;t noticed before. All of these URLs appear to be associated with diagnostic tools:
  • P2 Almost Half of Malware Samples Communicate Direct to IP — Nearly half of C2 malware bypasses DNS by connecting directly to IP addresses. Zero trust IP enforcement secures networks against these threats. The post Almost Half of Malware Samples Communicate Direct to IP appeared…
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,opendir; url=http://104.161.46.87/grace/Outsplen.pfb
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=AgentTesla,ascii,GuLoader,opendir; url=http://104.161.46.87/grace/Umoralsk.lzh
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=AgentTesla,encrypted,GuLoader,opendir; url=http://104.161.46.87/grace/bJcUMBU57.bin
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=AgentTesla,encrypted,GuLoader,opendir; url=http://104.161.46.87/grace/PQmuNHPXPNa71.bin
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=AgentTesla,encrypted,GuLoader,opendir; url=http://104.161.46.87/grace/kaaqgvFm226.bin
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,rev-base64-loader; url=https://raw.githubusercontent.com/wgalliebuilder/v/refs/heads/main/fhdohmm.txt
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,rev-base64-loader; url=https://raw.githubusercontent.com/wgalliebuilder/tr/refs/heads/main/jkIakkS.txt
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,rev-base64-loader; url=https://raw.githubusercontent.com/wgalliebuilder/ng/refs/heads/main/ApndFfe.txt
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,rev-base64-loader; url=https://raw.githubusercontent.com/wgalliebuilder/rw/refs/heads/main/mfIdFaI.txt

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-18556`CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the WildRapid7 Blog
    cve`CVE-2026-18577`CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the WildRapid7 Blog
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`104.161.46.87`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    hash`98034986f71e8a5131e7280b8b7c57546b838f6e5a11d9f1424929837cc56b23`RansomLook: cesmac.edu.br claimed by krybitRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=37
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=32 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=0 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation