markcardiff.tech:/daily-intel/2026-09-25.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-09-25 08:00:56 UTC
P1: 4
P2: 6
Items: 250

Daily Cyber Threat Intel Brief — 2026-09-25

Generated: 2026-09-25 08:00:56 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=4, P2=6, P3=56, P4=184.
  • Highest-priority item: CVE-2026-69282 Microsoft Office SharePoint Remote Code Execution Vulnerability (P1, source: Microsoft Security Response Center RSS).
  • 17 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 CVE-2026-69282 Microsoft Office SharePoint Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 100; technologies: SharePoint.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-69409 Microsoft Office SharePoint Information Disclosure Vulnerability — Microsoft Security Response Center RSS; score 75; technologies: SharePoint.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-69590 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-81951 Microsoft Excel Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P2 CISA: Ransomware gangs now exploiting critical TeamCity flaw — BleepingComputer Ransomware News; score 57; technologies: none explicitly matched.

    • - ​The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July. [...]

  • P2 RansomLook: winfashion claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: winfashion. Description excerpt: ══════════════════════════ ══════════════════════════ ══════════════════════════ WINFASHION TECHNOLOGIES DUMP: DATA LEAK ANALYSIS OF A…

  • P2 RansomLook: Arizona Vascular Medical Equipment, Inc claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Arizona Vascular Medical Equipment, Inc. Description excerpt: Arizona Vascular Medical Equipment, Inc. is a trusted provider of specialized medical devices, focusing…

  • P2 RansomLook: BMGP Groupe claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: BMGP Groupe. Description excerpt: BMGP Groupe (Polyresine) is an established French manufacturer specializing in the formulation, production, and distribution of…

  • P2 RansomLook: Elite Industech Co., Ltd claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Elite Industech Co., Ltd. Description excerpt: Elite Industech Co., Ltd. (established in 2003) is a certified Class-A waste treatment plant based in Kaohsiung, Taiwan.…

  • P2 RansomLook: HEC Group claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: HEC Group. Description excerpt: On August 30, HEC Group issued an official statement addressed to shareholders of TPE:3032 and other stakeholders, announcing that the…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-69282: CVE-2026-69282 Microsoft Office SharePoint Remote Code Execution Vulnerability — technologies: SharePoint.
  • P1 CVE-2026-69409: CVE-2026-69409 Microsoft Office SharePoint Information Disclosure Vulnerability — technologies: SharePoint.
  • P1 CVE-2026-69590: CVE-2026-69590 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-81951: CVE-2026-81951 Microsoft Excel Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2025-2135: Chromium: CVE-2025-2135 Type Confusion in V8 — technologies: not watchlist-specific.
  • P3 CVE-2026-4450: Chromium: CVE-2026-4450 Out of bounds write in V8 — technologies: not watchlist-specific.
  • P3 CVE-2026-69681: CVE-2026-69681 Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability — technologies: not watchlist-specific.
  • P3 CVE-2026-71337: CVE-2026-71337 Windows Storage Management Provider Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-81357: CVE-2026-81357 Visual Studio Code Security Feature Bypass Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69637: CVE-2026-69637 Windows DHCP Server Denial of Service Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69803: CVE-2026-69803 Windows DHCP Server Information Disclosure Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-80073: CVE-2026-80073 Microsoft Office Outlook Information Disclosure Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 CISA: Ransomware gangs now exploiting critical TeamCity flaw — ​The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July. [...]
  • P2 RansomLook: winfashion claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: winfashion. Description excerpt: ══════════════════════════ ══════════════════════════ ══════════════════════════ WINFASHION…
  • P2 RansomLook: Arizona Vascular Medical Equipment, Inc claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Arizona Vascular Medical Equipment, Inc. Description excerpt: Arizona Vascular Medical Equipment, Inc. is a trusted provider of…
  • P2 RansomLook: BMGP Groupe claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: BMGP Groupe. Description excerpt: BMGP Groupe (Polyresine) is an established French manufacturer specializing in the…
  • P2 RansomLook: Elite Industech Co., Ltd claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Elite Industech Co., Ltd. Description excerpt: Elite Industech Co., Ltd. (established in 2003) is a certified Class-A waste…
  • P2 RansomLook: HEC Group claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: HEC Group. Description excerpt: On August 30, HEC Group issued an official statement addressed to shareholders of TPE:3032 and…
  • P3 RansomLook: efada.sa claimed by krybit — Public RansomLook extortion-site listing claim. Group: krybit. Claimed victim/listing: efada.sa. Description excerpt: efada.sa...
  • P3 RansomLook: NEAD Pro claimed by rhysida — Public RansomLook extortion-site listing claim. Group: rhysida. Claimed victim/listing: NEAD Pro. Description excerpt: NEAD Pro Nead Pro is a professional multidisciplinary firm based in Gorizia and Udine, Italy, that…
  • P3 RansomLook: welgenone.com claimed by inc ransom — Public RansomLook extortion-site listing claim. Group: inc ransom. Claimed victim/listing: welgenone.com.
  • P3 RansomLook: ukbjja.org claimed by inc ransom — Public RansomLook extortion-site listing claim. Group: inc ransom. Claimed victim/listing: ukbjja.org.
  • P3 RansomLook: bnlawmacau.com www.bn-ip.com claimed by inc ransom — Public RansomLook extortion-site listing claim. Group: inc ransom. Claimed victim/listing: bnlawmacau.com www.bn-ip.com.
  • P3 RansomLook: Prater & Ridley Attorneys At Law claimed by wallstreet — Public RansomLook extortion-site listing claim. Group: wallstreet. Claimed victim/listing: Prater & Ridley Attorneys At Law. Description excerpt: Prater, Ridley & Llamas – Attorneys at Law is a law firm based in Temple,…

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://fastingegoogru.vercel.app/?download=1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://proishestviyagoodru.vercel.app/?download=1
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,Loader,powershell; url=https://sail.autolabsouthgate.com/update.ps1
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,DEU,exe,Loader,powershell; url=https://nordertextil.de/room
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,DEU,exe,Loader,powershell; url=https://nordertextil.de/t/pcmd2
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,DEU,exe,Loader,powershell; url=https://nordertextil.de/enter
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,DEU,exe,Loader,powershell; url=https://nordertextil.de/t/dokument281
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=579cd0,dropped-by-amadey; url=http://193.178.158.107/bin/6d8a0b064d16bd18_syshost_loader.exe
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=AgentTesla,ascii,Encoded,GuLoader; url=http://urbanpro.mycpanel.rs/Ringeklokkes.aaf
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=AgentTesla,encrypted,GuLoader; url=http://urbanpro.mycpanel.rs/ucPNX9.bin
  • P3 New Carbonato malware uses AI agents to hijack exposed Docker hosts — A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. [...]

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-69282`CVE-2026-69282 Microsoft Office SharePoint Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69409`CVE-2026-69409 Microsoft Office SharePoint Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69590`CVE-2026-69590 Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnMicrosoft Security Response Center RSS
    cve`CVE-2026-81951`CVE-2026-81951 Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2025-2135`Chromium: CVE-2025-2135 Type Confusion in V8Microsoft Security Response Center RSS
    cve`CVE-2026-4450`Chromium: CVE-2026-4450 Out of bounds write in V8Microsoft Security Response Center RSS
    cve`CVE-2026-69681`CVE-2026-69681 Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege VulernabilitMicrosoft Security Response Center RSS
    cve`CVE-2026-71337`CVE-2026-71337 Windows Storage Management Provider Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-81357`CVE-2026-81357 Visual Studio Code Security Feature Bypass VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69637`CVE-2026-69637 Windows DHCP Server Denial of Service VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69803`CVE-2026-69803 Windows DHCP Server Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-80073`CVE-2026-80073 Microsoft Office Outlook Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`193.178.158.107`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    hash`f8c4f7c6a7391261777e5fd384e84832`RansomLook: corisricambi.it claimed by lockbit5RansomLook Recent Listings
    hash`9755c9faff3607735f97615d9d02cd0a142a0f08cbeae166e4c52c10440d63fd`RansomLook: airtanzania.co.tz / airtanzania.com claimed by krybitRansomLook Recent Listings
    hash`61c296f634b4440d87861fe0b0bcf551887f99e8af76726d17d010da30598e08`RansomLook: www.jonesthegrocer.com claimed by krybitRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=2 fetched=25
  • NVD Recent CVEs: ok new=0 fetched=0
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=0 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=1 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=105 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation