markcardiff.tech:/daily-intel/2026-09-24.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-09-24 08:00:29 UTC
P1: 4
P2: 4
Items: 250

Daily Cyber Threat Intel Brief — 2026-09-24

Generated: 2026-09-24 08:00:29 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=4, P2=4, P3=80, P4=162.
  • Highest-priority item: Hackers start exploiting critical WordPress flaw for code execution (P1, source: BleepingComputer Ransomware News).
  • 13 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 Hackers start exploiting critical WordPress flaw for code execution — BleepingComputer Ransomware News; score 104; technologies: WordPress.

    • - Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. [...]

  • P1 CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM — Rapid7 Blog; score 77; technologies: none explicitly matched.

    • - Overview On September 22, 2026, F5 published a security advisory for CVE-2026-94127 , a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a CVSS v3.1 score of 9.8. An unauthenticated…

  • P1 Check Point warns of hackers exploiting Security Gateway VPN RCE flaw — BleepingComputer Ransomware News; score 74; technologies: none explicitly matched.

    • - Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. [...]

  • P1 CVE-2026-70125 Microsoft Outlook Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in September 2026, but the CVE was inadvertently omitted from the September 2026 Security Updates. This is an informational change only. Customers who have already installed the…

  • P2 RansomLook: KVHELI-WORDPRESS.COM claimed by clop — RansomLook Recent Listings; score 58; technologies: WordPress.

    • - Public RansomLook extortion-site listing claim. Group: clop. Claimed victim/listing: KVHELI-WORDPRESS.COM.

  • P2 Rogue RMM Abuse: How Attackers Exploit Remote Access Tools — Huntress Blog; score 57; technologies: RMM tools.

    • - The Huntress SOC uncovered phishing attacks that trick employees into installing rogue RMM tools like ScreenConnect for persistent access. Learn how to spot it.

  • P2 RansomLook: OnTrac claimed by emperador — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: OnTrac. Description excerpt: OnTrac is a major last-mile e-commerce delivery company formed by the 2021 merger of LaserShip and OnTrac. It positions itself as a direct…

  • P2 RansomLook: Legis claimed by rhysida — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: rhysida. Claimed victim/listing: Legis. Description excerpt: Legis Legis is a well-known Latin American publisher that creates specialized legal and business information resources. Founded over 60 years…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-87902: Hackers start exploiting critical WordPress flaw for code execution — technologies: WordPress.
  • P1 CVE-2026-94127: CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM — technologies: not watchlist-specific.
  • P1 CVE-2026-85102: Check Point warns of hackers exploiting Security Gateway VPN RCE flaw — technologies: not watchlist-specific.
  • P1 CVE-2026-70125: CVE-2026-70125 Microsoft Outlook Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-87564: Chromium CVE-2026-87564: Type confusion in V8 — technologies: not watchlist-specific.
  • P3 CVE-2026-87587: Chromium CVE-2026-87587: Use after free in V8 — technologies: not watchlist-specific.
  • P3 CVE-2026-87612: Chromium CVE-2026-87612: Type confusion in V8 — technologies: not watchlist-specific.
  • P3 CVE-2026-87536: Chromium CVE-2026-87536: Use after free in V8 — technologies: not watchlist-specific.
  • P3 CVE-2026-87625: Chromium CVE-2026-87625: Use after free in V8 — technologies: not watchlist-specific.
  • P3 CVE-2026-87601: Chromium CVE-2026-87601: Race condition in V8 — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: KVHELI-WORDPRESS.COM claimed by clop — Public RansomLook extortion-site listing claim. Group: clop. Claimed victim/listing: KVHELI-WORDPRESS.COM.
  • P2 RansomLook: OnTrac claimed by emperador — Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: OnTrac. Description excerpt: OnTrac is a major last-mile e-commerce delivery company formed by the 2021 merger of LaserShip and…
  • P2 RansomLook: Legis claimed by rhysida — Public RansomLook extortion-site listing claim. Group: rhysida. Claimed victim/listing: Legis. Description excerpt: Legis Legis is a well-known Latin American publisher that creates specialized legal and business…
  • P3 Ryuk ransomware member sentenced to 24 months in prison — An Armenian man was sentenced to 24 months in prison and 3 years of supervised release for hacking U.S. companies and encrypting their systems in Ryuk ransomware attacks. [...]
  • P3 RansomLook: Charles Keith claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Charles Keith. Description excerpt: charleskeith.com zoominfo.com/c/charles--keith-pte-ltd/347827969 CHARLES & KEITH…
  • P3 RansomLook: Ligue se Grupo claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Ligue se Grupo. Description excerpt: grupoligue-se.pt Ligue-se Grupo is a Portuguese IT and business-services group founded…
  • P3 RansomLook: Tomix / Grupo JOPER claimed by space bears — Public RansomLook extortion-site listing claim. Group: space bears. Claimed victim/listing: Tomix / Grupo JOPER. Description excerpt: Tomix – Indústria de Equipamentos Agrícolas e Industriais, Lda. is a Portuguese…
  • P3 RansomLook: goldstarfinancial.com claimed by brain cipher — Public RansomLook extortion-site listing claim. Group: brain cipher. Claimed victim/listing: goldstarfinancial.com. Description excerpt: We have approximately 10,300 (10.3k) documents from this company, with a total…
  • P3 RansomLook: M**n claimed by payoutsking — Public RansomLook extortion-site listing claim. Group: payoutsking. Claimed victim/listing: M**n.
  • P3 RansomLook: anery.com.br claimed by lockbit5 — Public RansomLook extortion-site listing claim. Group: lockbit5. Claimed victim/listing: anery.com.br. Description excerpt: Somos a Anery Home Care Temos paixão por cuidar Nossa especialidade é cuidar de pessoas, com…
  • P3 RansomLook: PRESS RELEASE RE PSA claimed by shinyhunters — Public RansomLook extortion-site listing claim. Group: shinyhunters. Claimed victim/listing: PRESS RELEASE RE PSA. Description excerpt: We are currently not distributing samples to any media agencies. Furthermore, our…
  • P3 RansomLook: ALDOGROUP.COM(ALDOSHOES.COM) claimed by clop — Public RansomLook extortion-site listing claim. Group: clop. Claimed victim/listing: ALDOGROUP.COM(ALDOSHOES.COM).

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=dropped-by-Stealc,fr,ZigClipper; url=https://kupunasvolpiano.com/g/static/s/cinzel/v23/Taskforce.exe
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1wQeOlHRJFrYBOhRlmG_7bDAnGfy7DrE3
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1c-bLtoODj59nLzb41a-pqCBvoqmoxv6C
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,opendir,rev-base64-loader; url=https://bratarfood.com/new/agentupload.txt
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,opendir,rev-base64-loader; url=https://bratarfood.com/new/playload12upload.txt
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader; url=https://drive.google.com/uc?export=download&id=1-f5hTZYw0BMqcKOLpKsBJ0wsRsjF4ZEK
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1L0pz8tYMjHMQUXGqix3dV7LYHZbIFiJZ
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1nRdoRYqQg21RdCGGAtPu1m0J92IzGb9p
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=encrypted,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1OvomrIAKvtqs-jqChpcZ4UMjO1yoWePK
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=encrypted,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=14VPmkgvMw_P4C8yjTyg5Zad1aftQvzmK
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=encrypted,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1GBJNL7Z0BNvqntuMB4xihb-v5O4g00tk

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-87902`Hackers start exploiting critical WordPress flaw for code executionBleepingComputer Ransomware News
    cve`CVE-2026-94127`CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APMRapid7 Blog
    cve`CVE-2026-85102`Check Point warns of hackers exploiting Security Gateway VPN RCE flawBleepingComputer Ransomware News
    cve`CVE-2026-70125`CVE-2026-70125 Microsoft Outlook Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-87564`Chromium CVE-2026-87564: Type confusion in V8Microsoft Security Response Center RSS
    cve`CVE-2026-87587`Chromium CVE-2026-87587: Use after free in V8Microsoft Security Response Center RSS
    cve`CVE-2026-87612`Chromium CVE-2026-87612: Type confusion in V8Microsoft Security Response Center RSS
    cve`CVE-2026-87536`Chromium CVE-2026-87536: Use after free in V8Microsoft Security Response Center RSS
    cve`CVE-2026-87625`Chromium CVE-2026-87625: Use after free in V8Microsoft Security Response Center RSS
    cve`CVE-2026-87601`Chromium CVE-2026-87601: Race condition in V8Microsoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`94.154.43.7`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    hash`d2ecb5a0516faf84bfe47e60d1d3ed52`RansomLook: anery.com.br claimed by lockbit5RansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=59
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=1 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=15 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=2 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=1 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=90 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation