markcardiff.tech:/daily-intel/2026-09-26.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-09-26 08:00:57 UTC
P1: 3
P2: 1
Items: 250

Daily Cyber Threat Intel Brief — 2026-09-26

Generated: 2026-09-26 08:00:57 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=3, P2=1, P3=53, P4=193.
  • Highest-priority item: CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks (P1, source: BleepingComputer Ransomware News).
  • 26 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks — BleepingComputer Ransomware News; score 104; technologies: SharePoint.

    • - The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]

  • P1 CVE-2026-100208 Microsoft Office Outlook Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in August 2026, but the CVE was inadvertently omitted from the August 2026 Security Updates. This is an informational change only. Customers who have already installed the August 2026…

  • P1 CVE-2026-32157 Remote Desktop Client Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated product information in the Software Update table. This is an informational change only.

  • P2 RansomLook: Ar Valve Resources claimed by wallstreet — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: wallstreet. Claimed victim/listing: Ar Valve Resources. Description excerpt: AR Valve Resources is a UK-based distributor of industrial valves, actuators, regulators, instrumentation, and spare parts.…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-5430: CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks — technologies: SharePoint.
  • P1 CVE-2026-100208: CVE-2026-100208 Microsoft Office Outlook Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-32157: CVE-2026-32157 Remote Desktop Client Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-100206: CVE-2026-100206 Microsoft Office Information Disclosure Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-95274: Chromium CVE-2026-95274: Improper output encoding in DevTools — technologies: not watchlist-specific.
  • P3 CVE-2026-95275: Chromium CVE-2026-95275: Incorrect reference resolution in MediaStream — technologies: not watchlist-specific.
  • P3 CVE-2026-95276: Chromium CVE-2026-95276: Improper input validation in Themes — technologies: not watchlist-specific.
  • P3 CVE-2026-95277: Chromium CVE-2026-95277: Use after free in Views — technologies: not watchlist-specific.
  • P3 CVE-2026-95278: Chromium CVE-2026-95278: Missing authorization in WakeLock — technologies: not watchlist-specific.
  • P3 CVE-2026-95279: Chromium CVE-2026-95279: UI misrepresentation in Omnibox — technologies: not watchlist-specific.
  • P3 CVE-2026-95280: Chromium CVE-2026-95280: Race condition in V8 — technologies: not watchlist-specific.
  • P3 CVE-2026-95281: Chromium CVE-2026-95281: Buffer overflow in ANGLE — technologies: not watchlist-specific.
  • P3 CVE-2026-95282: Chromium CVE-2026-95282: Use after free in Platform — technologies: not watchlist-specific.
  • P3 CVE-2026-95283: Chromium CVE-2026-95283: Buffer overflow in Tint — technologies: not watchlist-specific.
  • P3 CVE-2026-95284: Chromium CVE-2026-95284: Buffer overflow in ANGLE — technologies: not watchlist-specific.
  • P3 CVE-2026-95285: Chromium CVE-2026-95285: Missing authorization in WebView — technologies: not watchlist-specific.
  • P3 CVE-2026-95286: Chromium CVE-2026-95286: Type confusion in Bindings — technologies: not watchlist-specific.
  • P3 CVE-2026-95287: Chromium CVE-2026-95287: Missing authorization in Navigation — technologies: not watchlist-specific.
  • P3 CVE-2026-95288: Chromium CVE-2026-95288: UI misrepresentation in Mobile — technologies: not watchlist-specific.
  • P3 CVE-2026-95289: Chromium CVE-2026-95289: Incorrect authorization in Scroll — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Ar Valve Resources claimed by wallstreet — Public RansomLook extortion-site listing claim. Group: wallstreet. Claimed victim/listing: Ar Valve Resources. Description excerpt: AR Valve Resources is a UK-based distributor of industrial valves, actuators,…
  • P3 ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw — The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an…
  • P3 RansomLook: https://www.crossettinc.com/ claimed by termite — Public RansomLook extortion-site listing claim. Group: termite. Claimed victim/listing: https://www.crossettinc.com/. Description excerpt: Crossett
  • P3 RansomLook: N... claimed by leakeddata — Public RansomLook extortion-site listing claim. Group: leakeddata. Claimed victim/listing: N.... Description excerpt: To be announced...
  • P3 RansomLook: Tobin & Company claimed by wallstreet — Public RansomLook extortion-site listing claim. Group: wallstreet. Claimed victim/listing: Tobin & Company. Description excerpt: Tobin & Company, CPA’s is a small accounting firm based in Harrison, New York, providing…
  • P3 RansomLook: GTFM claimed by wallstreet — Public RansomLook extortion-site listing claim. Group: wallstreet. Claimed victim/listing: GTFM. Description excerpt: GTFM LLC is a company operating through gtfmllc.com. Its website currently provides limited publicly…
  • P3 RansomLook: Beatus Cartons claimed by wallstreet — Public RansomLook extortion-site listing claim. Group: wallstreet. Claimed victim/listing: Beatus Cartons. Description excerpt: Beatus Cartons is a UK-based, privately owned manufacturer of printed folding cartons and…
  • P3 RansomLook: Morula IVF claimed by everest — Public RansomLook extortion-site listing claim. Group: everest. Claimed victim/listing: Morula IVF. Description excerpt: 2 posts - 1h
  • P3 RansomLook: Securitas Group claimed by everest — Public RansomLook extortion-site listing claim. Group: everest. Claimed victim/listing: Securitas Group. Description excerpt: 2 posts - 1h
  • P3 RansomLook: Breast Implant Center of Hawaii claimed by wallstreet — Public RansomLook extortion-site listing claim. Group: wallstreet. Claimed victim/listing: Breast Implant Center of Hawaii. Description excerpt: Breast Implant Center of Hawaii is a plastic surgery and aesthetics clinic…
  • P3 RansomLook: Reliance Audit claimed by everest — Public RansomLook extortion-site listing claim. Group: everest. Claimed victim/listing: Reliance Audit. Description excerpt: 2 posts - 1h
  • P3 RansomLook: UNIRITA claimed by everest — Public RansomLook extortion-site listing claim. Group: everest. Claimed victim/listing: UNIRITA. Description excerpt: 2 posts - 1h

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://fastingegoogru.vercel.app/?download=1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://proishestviyagoodru.vercel.app/?download=1
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=backdoor,ClickFix,Mach-O,macOS,MacSync,stealer,token-b54cc90c,UnstoppableDomains;…
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=579cd0,dropped-by-amadey; url=http://193.178.158.107/bin/e71a0f57c64355ef_syshost_loader.exe
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,Loader,powershell; url=https://sail.autolabsouthgate.com/update.ps1
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,DEU,exe,Loader,powershell; url=https://nordertextil.de/room
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,DEU,exe,Loader,powershell; url=https://nordertextil.de/t/pcmd2
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,DEU,exe,Loader,powershell; url=https://nordertextil.de/enter
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,DEU,exe,Loader,powershell; url=https://nordertextil.de/t/dokument281
  • P3 A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th) — Introduction
  • P4 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=elf,ua-wget; url=http://143.20.185.213/armv5

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-5430`CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacksBleepingComputer Ransomware News
    cve`CVE-2026-100208`CVE-2026-100208 Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-32157`CVE-2026-32157 Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-100206`CVE-2026-100206 Microsoft Office Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-95274`Chromium CVE-2026-95274: Improper output encoding in DevToolsMicrosoft Security Response Center RSS
    cve`CVE-2026-95275`Chromium CVE-2026-95275: Incorrect reference resolution in MediaStreamMicrosoft Security Response Center RSS
    cve`CVE-2026-95276`Chromium CVE-2026-95276: Improper input validation in ThemesMicrosoft Security Response Center RSS
    cve`CVE-2026-95277`Chromium CVE-2026-95277: Use after free in ViewsMicrosoft Security Response Center RSS
    cve`CVE-2026-95278`Chromium CVE-2026-95278: Missing authorization in WakeLockMicrosoft Security Response Center RSS
    cve`CVE-2026-95279`Chromium CVE-2026-95279: UI misrepresentation in OmniboxMicrosoft Security Response Center RSS
    cve`CVE-2026-95280`Chromium CVE-2026-95280: Race condition in V8Microsoft Security Response Center RSS
    cve`CVE-2026-95281`Chromium CVE-2026-95281: Buffer overflow in ANGLEMicrosoft Security Response Center RSS
    cve`CVE-2026-95282`Chromium CVE-2026-95282: Use after free in PlatformMicrosoft Security Response Center RSS
    cve`CVE-2026-95283`Chromium CVE-2026-95283: Buffer overflow in TintMicrosoft Security Response Center RSS
    cve`CVE-2026-95284`Chromium CVE-2026-95284: Buffer overflow in ANGLEMicrosoft Security Response Center RSS
    cve`CVE-2026-95285`Chromium CVE-2026-95285: Missing authorization in WebViewMicrosoft Security Response Center RSS
    cve`CVE-2026-95286`Chromium CVE-2026-95286: Type confusion in BindingsMicrosoft Security Response Center RSS
    cve`CVE-2026-95287`Chromium CVE-2026-95287: Missing authorization in NavigationMicrosoft Security Response Center RSS
    cve`CVE-2026-95288`Chromium CVE-2026-95288: UI misrepresentation in MobileMicrosoft Security Response Center RSS
    cve`CVE-2026-95289`Chromium CVE-2026-95289: Incorrect authorization in ScrollMicrosoft Security Response Center RSS
    cve`CVE-2026-95290`Chromium CVE-2026-95290: Missing authorization in NFCMicrosoft Security Response Center RSS
    cve`CVE-2025-2135`Chromium: CVE-2025-2135 Type Confusion in V8Microsoft Security Response Center RSS
    cve`CVE-2026-4450`Chromium: CVE-2026-4450 Out of bounds write in V8Microsoft Security Response Center RSS
    hash`b54cc90c9143f757e0ac59356414f14447d5f9cbbae0b0e61cf6b4e8ced28f42`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`193.178.158.107`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=1 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=53 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=0 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation