Daily Cyber Threat Intel Brief — 2026-08-06
Generated: 2026-08-06 08:00:56 UTC
Executive summary
Collected 250 recent public-source CTI items for technology-only monitoring.
Priority distribution: P1=1, P2=7, P3=70, P4=172.
Highest-priority item: CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws (P1, source: BleepingComputer Ransomware News).
3 public IOC highlights selected for analyst awareness.
Priority technology watch items
P1 CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws — BleepingComputer Ransomware News; score 79; technologies: Apache.
- The U.S. Cybersecurity and Infrastructure Security Agency is giving federal agencies three days to mitigate vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, all actively exploited. [...]
P2 RansomLook: One Community FCU claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: One Community FCU. Description excerpt: (UPD: Added additional internal documentation and longer-term customer data. Also included data showing low network security…
P2 RansomLook: P. A. Inc. (Performance Alloys) claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: P. A. Inc. (Performance Alloys). Description excerpt: P.A. Inc. is a leading distributor of high nickel alloy and specialty stainless steel piping products, based in…
P2 RansomLook: Mike Graham Heating And Air Conditioning claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Mike Graham Heating And Air Conditioning. Description excerpt: Mike Graham Heating, Air Conditioning & Plumbing is a trusted HVAC and plumbing service provider based…
P2 RansomLook: tomorrowsoffice.com claimed by chaos — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: chaos. Claimed victim/listing: tomorrowsoffice.com. Description excerpt: URGENT DATA LEAK NOTICE: TOMORROW'S OFFICE Target: Tomorrow’s Office (tomorrowsoffice.com) Status: Ongoing Data Publication…
P2 RansomLook: eSysTech claimed by orova — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: orova. Claimed victim/listing: eSysTech. Description excerpt: Software Company URL Open https://www.esystech.com.br/ in a new tab| May 24, 2026 19,321 files| 32.20 GB| Watch Data Open watch data link for…
P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 53; technologies: WordPress.
- Public URLhaus recent URL. Threat=malware_download; tags=rat,RemcosRAT; url=https://www.hqsblog.com/wordpress/wp-content/plugins/zxzxzx/stego_p0ci0zln28.png
P2 URLhaus: malware_download URL observed (offline) — URLhaus Recent URLs; score 53; technologies: WordPress.
- Public URLhaus recent URL. Threat=malware_download; tags=rat,RemcosRAT; url=https://www.hqsblog.com/wordpress/wp-content/plugins/zxzxzx/stego_p0ci0zln28.png
Newly exploited vulnerabilities / CVE watch
None observed.
Ransomware and extortion trend notes
P2 RansomLook: One Community FCU claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: One Community FCU. Description excerpt: (UPD: Added additional internal documentation and longer-term customer data. Also…
P2 RansomLook: P. A. Inc. (Performance Alloys) claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: P. A. Inc. (Performance Alloys). Description excerpt: P.A. Inc. is a leading distributor of high nickel alloy and specialty…
P2 RansomLook: Mike Graham Heating And Air Conditioning claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Mike Graham Heating And Air Conditioning. Description excerpt: Mike Graham Heating, Air Conditioning & Plumbing is a trusted…
P2 RansomLook: tomorrowsoffice.com claimed by chaos — Public RansomLook extortion-site listing claim. Group: chaos. Claimed victim/listing: tomorrowsoffice.com. Description excerpt: URGENT DATA LEAK NOTICE: TOMORROW'S OFFICE Target: Tomorrow’s Office (tomorrowsoffice.com)…
P2 RansomLook: eSysTech claimed by orova — Public RansomLook extortion-site listing claim. Group: orova. Claimed victim/listing: eSysTech. Description excerpt: Software Company URL Open https://www.esystech.com.br/ in a new tab| May 24, 2026 19,321 files| 32.20…
P3 Ransom Cartel ransomware creator sentenced to 16 years in prison — Maksim Silnikau, the creator and administrator of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison for his role in ransomware attacks against at least 18 companies worldwide. [...]
P3 RansomLook: PT All Cosmos Biotek claimed by gunra — Public RansomLook extortion-site listing claim. Group: gunra. Claimed victim/listing: PT All Cosmos Biotek.
P3 RansomLook: Data Exfiltration Diaries: The Shocking Stories Inside NYC Health + Hospitals claimed by leaknet — Public RansomLook extortion-site listing claim. Group: leaknet. Claimed victim/listing: Data Exfiltration Diaries: The Shocking Stories Inside NYC Health + Hospitals. Description excerpt: #NYCHealthHospitals…
P3 RansomLook: vprj.org claimed by inc ransom — Public RansomLook extortion-site listing claim. Group: inc ransom. Claimed victim/listing: vprj.org.
P3 RansomLook: clubonecasino.com claimed by 3am — Public RansomLook extortion-site listing claim. Group: 3am. Claimed victim/listing: clubonecasino.com. Description excerpt: Club One Casino is the premier poker room in Central California, featuring 51 table games, a…
P3 RansomLook: Mera Metal claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Mera Metal. Description excerpt: Furniture
P3 RansomLook: https://www.nitrex.in claimed by orion — Public RansomLook extortion-site listing claim. Group: orion. Claimed victim/listing: https://www.nitrex.in.
Malware / infrastructure / abuse feed highlights
P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=rat,RemcosRAT; url=https://www.hqsblog.com/wordpress/wp-content/plugins/zxzxzx/stego_p0ci0zln28.png
P2 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=rat,RemcosRAT; url=https://www.hqsblog.com/wordpress/wp-content/plugins/zxzxzx/stego_p0ci0zln28.png
P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=PhantomStealer,rev-base64-loader; url=http://216.9.224.48/xz/genera-raw-fileupload.txt
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=encrypted,GuLoader,opendir,rat,RemcosRAT; url=https://hwykplqn.xyz/merry/64bit-remcos_a.bin
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=AgentTesla,encrypted,GuLoader; url=https://lenotecadiarqua.it/eGuqAVa104.bin
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=AgentTesla,ascii,Encoded,GuLoader; url=https://lenotecadiarqua.it/Lbskesl.u32
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader; url=https://lenotecadiarqua.it/Unselec.pfm
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=AgentTesla,ascii,Encoded,GuLoader; url=https://lenotecadiarqua.it/Phyllo.lzh
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=AgentTesla,encrypted,GuLoader; url=https://lenotecadiarqua.it/CHvWdTBpYyjtaVvoRehzda105.bin
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=rat,RemcosRAT; url=https://pocopaco.co.za/img_144534.png
P4 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=32-bit,arm,elf,Mozi; url=http://122.231.69.248:51043/i
IOC highlights
| Type | Value | Context | Source |
| ipv4 | `50.16.16.211` | Feodo Tracker: 1 recommended botnet C2 IPs listed | Feodo Tracker Recommended Blocklist |
| ipv4 | `216.9.224.48` | URLhaus: malware_download URL observed (online) | URLhaus Recent URLs |
| hash | `cdb90636b6749657025c1dce3441180a` | RansomLook: briggsplc.com claimed by lockbit5 | RansomLook Recent Listings |
Defensive takeaways
Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.
Sources checked
BleepingComputer Ransomware News: ok new=0 fetched=15
CISA Known Exploited Vulnerabilities: ok new=0 fetched=38
Cisco Talos Blog: ok new=0 fetched=15
Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
Huntress Blog: ok new=0 fetched=25
Microsoft Security Response Center RSS: ok new=0 fetched=25
NVD Recent CVEs: ok new=46 fetched=80
ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
RansomLook Recent Listings: ok new=2 fetched=50
Rapid7 Blog: ok new=0 fetched=20
SANS Internet Storm Center: ok new=0 fetched=10
Sophos X-Ops: ok new=0 fetched=15
The DFIR Report: ok new=0 fetched=10
URLhaus Recent URLs: ok new=103 fetched=120
Unit 42 Threat Research: ok new=0 fetched=15
Limitations
Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
Technology-only matching can miss relevant items that do not name a tracked product explicitly.
Ransomware victim claims are actor/source claims unless independently corroborated.
IOC highlights are publicly sourced and should be validated before enforcement in production controls.