markcardiff.tech:/daily-intel/2026-09-27.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-09-27 08:00:18 UTC
P1: 0
P2: 8
Items: 250

Daily Cyber Threat Intel Brief — 2026-09-27

Generated: 2026-09-27 08:00:18 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=0, P2=8, P3=113, P4=129.
  • Highest-priority item: RansomLook: 🇮🇩 claimed by killsec3 (P2, source: RansomLook Recent Listings).
  • 28 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P2 RansomLook: 🇮🇩 claimed by killsec3 — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇮🇩. Description excerpt: PT Pertamina is a state-owned enterprise in Indonesia dedicated to providing integrated energy solutions across the upstream and downstream…

  • P2 RansomLook: 🇸🇬 claimed by killsec3 — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇸🇬. Description excerpt: Nimbus Facility Services provides professional cleaning and facility management solutions for offices and homes in Singapore. The company offers…

  • P2 RansomLook: 🇨🇭 claimed by killsec3 — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇨🇭. Description excerpt: Brügger Architekten AG, specializes in designing and executing architectural projects ranging from small-scale renovations to large urban…

  • P2 RansomLook: 🇨🇺 claimed by killsec3 — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇨🇺. Description excerpt: DUC App is a leading financial technology platform that empowers individuals and businesses to manage global payments and currency exchange…

  • P2 RansomLook: Fanatics (global sports commerce platform) claimed by n0n — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Fanatics (global sports commerce platform). Description excerpt: Sports commerce / e-commerce · United States

  • P2 RansomLook: Visual Intelligence, Inc. claimed by metaencryptor — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: metaencryptor. Claimed victim/listing: Visual Intelligence, Inc.. Description excerpt: Visual Intelligence is a managed services company that applies advances in drones, computing, and AI to assess and…

  • P2 RansomLook: eTeam claimed by endzone — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: endzone. Claimed victim/listing: eTeam. Description excerpt: eTeam Inc. is a privately held global workforce solutions and business transformation company. Founded in 1999 by Ben Thakur, the company is…

  • P2 RansomLook: Gomomentum.com claimed by endzone — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: endzone. Claimed victim/listing: Gomomentum.com. Description excerpt: Momentum is a telecommunications company founded in 2001 that provides cloud-based communication solutions for businesses,…

    Newly exploited vulnerabilities / CVE watch

  • P3 CVE-2026-35273: ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: 🇮🇩 claimed by killsec3 — Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇮🇩. Description excerpt: PT Pertamina is a state-owned enterprise in Indonesia dedicated to providing integrated energy solutions…
  • P2 RansomLook: 🇸🇬 claimed by killsec3 — Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇸🇬. Description excerpt: Nimbus Facility Services provides professional cleaning and facility management solutions for offices and…
  • P2 RansomLook: 🇨🇭 claimed by killsec3 — Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇨🇭. Description excerpt: Brügger Architekten AG, specializes in designing and executing architectural projects ranging from…
  • P2 RansomLook: 🇨🇺 claimed by killsec3 — Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇨🇺. Description excerpt: DUC App is a leading financial technology platform that empowers individuals and businesses to manage…
  • P2 RansomLook: Fanatics (global sports commerce platform) claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Fanatics (global sports commerce platform). Description excerpt: Sports commerce / e-commerce · United States
  • P2 RansomLook: Visual Intelligence, Inc. claimed by metaencryptor — Public RansomLook extortion-site listing claim. Group: metaencryptor. Claimed victim/listing: Visual Intelligence, Inc.. Description excerpt: Visual Intelligence is a managed services company that applies advances in…
  • P2 RansomLook: eTeam claimed by endzone — Public RansomLook extortion-site listing claim. Group: endzone. Claimed victim/listing: eTeam. Description excerpt: eTeam Inc. is a privately held global workforce solutions and business transformation company. Founded…
  • P2 RansomLook: Gomomentum.com claimed by endzone — Public RansomLook extortion-site listing claim. Group: endzone. Claimed victim/listing: Gomomentum.com. Description excerpt: Momentum is a telecommunications company founded in 2001 that provides cloud-based…
  • P3 RansomLook: First Secure Bank Group claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: First Secure Bank Group. Description excerpt: FinTech | Joliet, Illinois, United States | First Secure Bank Group is a U.S.-based…
  • P3 RansomLook: 🇹🇷 claimed by killsec3 — Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇹🇷. Description excerpt: No description given.
  • P3 RansomLook: 🇿🇦 claimed by killsec3 — Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇿🇦. Description excerpt: Sumitomo Rubber South Africa (Pty) Ltd. is a subsidiary of Sumitomo Rubber Industries, headquartered in…
  • P3 RansomLook: 🇵🇹 claimed by killsec3 — Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇵🇹. Description excerpt: No description given.

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=IRAHook; url=https://www.dropbox.com/scl/fi/4pkxw4de68qbk9t3rced6/bundle-5.zip?rlkey=o8kjw2k16hwbfca6dibdmm1mk&st=pi0v3bot&dl=1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.arm7
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.x86
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.mips
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.arm5
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.arm6
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.ppc440
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.i686
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.mpsl
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.ppc
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.i486
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.m68k

    • IOC highlights

    TypeValueContextSource
    hash`be3a532952f873d40716685ebfed40be`RansomLook: Visual Intelligence, Inc. claimed by metaencryptorRansomLook Recent Listings
    cve`CVE-2026-35273`ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacksBleepingComputer Ransomware News
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    hash`b54cc90c9143f757e0ac59356414f14447d5f9cbbae0b0e61cf6b4e8ced28f42`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`193.178.158.107`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    hash`706c034a19e3800dad2aa5b2271c7e563948f182a3fd0fd60a73afd7aadd9f0c`RansomLook: Corona Corporation claimed by metaencryptorRansomLook Recent Listings
    hash`818fcced67313dba80d08831e33b7b8b53196fea2df5783f6ca9b87a5fc53f87`RansomLook: Corona Corporation claimed by metaencryptorRansomLook Recent Listings
    hash`02a040cd1f50161f468875272b42548c`RansomLook: FactoryFive claimed by metaencryptorRansomLook Recent Listings
    hash`cee4b88f977cbeacaae4262c1ef4d6b48eda156bf169aab5c0d8db9e0ba99405`RansomLook: FactoryFive claimed by metaencryptorRansomLook Recent Listings
    hash`641518b203530fb983b395d05ffa8d240668405f8ca32796eb5b1e24f436864c`RansomLook: Aquamar Inc claimed by metaencryptorRansomLook Recent Listings
    hash`efac55a910f6b62857374abbd606afe1ceb8ce077ecdf32a7bfb11f63e94d6e8`RansomLook: Aquamar Inc claimed by metaencryptorRansomLook Recent Listings
    hash`3454a5748a289aa553e02fe678841afdc052eae04c6c520a23349a06d17ffbf5`RansomLook: Astemo, Ltd. claimed by metaencryptorRansomLook Recent Listings
    hash`a03621de1ec42197ea31b6afa57b62d2f67c4f476fbe09aaa65f765a6c8ab957`RansomLook: Astemo, Ltd. claimed by metaencryptorRansomLook Recent Listings
    hash`5789b0000910e3d55c60ea0cd1ef882886bf35b870b7c3884c5ad813210128f3`RansomLook: Beckman Coulter, Inc claimed by metaencryptorRansomLook Recent Listings
    hash`60f7bafa53386a540727bcb9bdf12f00c4e9c3ca34193c1a56706d1a279a8783`RansomLook: Beckman Coulter, Inc claimed by metaencryptorRansomLook Recent Listings
    hash`6e962334b3f9bd3665d4ea496be26396562b8bb7cce3b91d49e2319de0ddec80`RansomLook: EllisDon Corporation claimed by metaencryptorRansomLook Recent Listings
    hash`2577e932120ca5787368b75fa3570e47ebddbd45411d41ee1896cf1370ea772b`RansomLook: Nippon Steel Corporation claimed by metaencryptorRansomLook Recent Listings
    hash`451f6b2a8137bc2d7b02b14d5838c86a9f151e800a31def064102f5546d009aa`RansomLook: AECOM claimed by metaencryptorRansomLook Recent Listings
    hash`5939279f6f14a1e54803eb2278914fcc400d32b204822075e57f96a1f610e2aa`RansomLook: AECOM claimed by metaencryptorRansomLook Recent Listings
    hash`856a43822e31fb07b441f41dfca61ebad2200f893a983b27d257d77c2eabe98c`RansomLook: HyVision System. Inc claimed by metaencryptorRansomLook Recent Listings
    hash`09e46963f42a122c79e4d031cf80305871ae53353f8c273ca7d9454915340157`RansomLook: Flex Ltd claimed by metaencryptorRansomLook Recent Listings
    hash`45134c14495386b1fa17d2d54420e4b524348558af022e3c9a8ae63424e9cf39`RansomLook: Flex Ltd claimed by metaencryptorRansomLook Recent Listings
    hash`4a7b055b90cbb10552b82837b0d6e65a11eee267401c831dd9795a5bf572e286`RansomLook: Hudson MD Group, LLC claimed by metaencryptorRansomLook Recent Listings
    hash`3d6734b82f56a84396007101a0b0d50af8545981451cf583328646960d93aa08`RansomLook: GE Vernova Inc. claimed by metaencryptorRansomLook Recent Listings
    hash`a072b27a172720f4d2418ab1dcedf029cb63726c7484358a247ab904b4ac68bd`RansomLook: PKF Hadiwinata claimed by metaencryptorRansomLook Recent Listings
    hash`c584cad78066a19e0de9dadf4b4eff2053e76cc087980ca1cbb52c307079b2ae`RansomLook: PKF Hadiwinata claimed by metaencryptorRansomLook Recent Listings
    hash`d30214349ebc8f53bf248ad7cda82eaba57fec44facbedc2e05d97df4eaf7f2e`RansomLook: BRUKER CORPORATION claimed by metaencryptorRansomLook Recent Listings
    hash`a5cab210e1b54fde9ad71d9b289ca230`RansomLook: Platinum Healthcare Staffing claimed by metaencryptorRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=29 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=1 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation