markcardiff.tech:/daily-intel/2026-09-28.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-09-28 08:00:22 UTC
P1: 3
P2: 6
Items: 250

Daily Cyber Threat Intel Brief — 2026-09-28

Generated: 2026-09-28 08:00:22 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=3, P2=6, P3=86, P4=155.
  • Highest-priority item: CISA orders feds to patch exploited Citrix flaws by Wednesday (P1, source: BleepingComputer Ransomware News).
  • 7 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 CISA orders feds to patch exploited Citrix flaws by Wednesday — BleepingComputer Ransomware News; score 79; technologies: Citrix NetScaler.

    • - The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities. [...]

  • P1 Citrix admins warned to shut down NetScalers over 2 exploited zero-days — BleepingComputer Ransomware News; score 79; technologies: Citrix NetScaler.

    • - Two unpatched Citrix NetScaler zero-day vulnerabilities are reportedly being exploited in attacks, with cybersecurity agencies, security researchers, and IT providers privately warning organizations about the flaws ahead of patches expected next week. [...]

  • P1 Citrix confirms two NetScaler RCE zero-days exploited in attacks — BleepingComputer Ransomware News; score 74; technologies: none explicitly matched.

    • - Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. [...]

  • P2 RansomLook: Ressources Si claimed by panzer — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: panzer. Claimed victim/listing: Ressources Si. Description excerpt: Ressources Si is a company that operates in the Movie Theaters industry. It employs 10to19 people and has 1Mto5M of revenue.

  • P2 RansomLook: Asesoría FAR claimed by panzer — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: panzer. Claimed victim/listing: Asesoría FAR. Description excerpt: Asesoría FAR is a Barcelona-based firm providing property management, accounting, tax, and business advisory services.

  • P2 RansomLook: 🇮🇩 claimed by killsec3 — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇮🇩. Description excerpt: PT Pertamina is a state-owned enterprise in Indonesia dedicated to providing integrated energy solutions across the upstream and downstream…

  • P2 RansomLook: 🇸🇬 claimed by killsec3 — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇸🇬. Description excerpt: Nimbus Facility Services provides professional cleaning and facility management solutions for offices and homes in Singapore. The company offers…

  • P2 RansomLook: 🇨🇭 claimed by killsec3 — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇨🇭. Description excerpt: Brügger Architekten AG, specializes in designing and executing architectural projects ranging from small-scale renovations to large urban…

  • P2 RansomLook: 🇨🇺 claimed by killsec3 — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇨🇺. Description excerpt: DUC App is a leading financial technology platform that empowers individuals and businesses to manage global payments and currency exchange…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-88771, CVE-2026-88772: Citrix confirms two NetScaler RCE zero-days exploited in attacks — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Ressources Si claimed by panzer — Public RansomLook extortion-site listing claim. Group: panzer. Claimed victim/listing: Ressources Si. Description excerpt: Ressources Si is a company that operates in the Movie Theaters industry. It employs 10to19…
  • P2 RansomLook: Asesoría FAR claimed by panzer — Public RansomLook extortion-site listing claim. Group: panzer. Claimed victim/listing: Asesoría FAR. Description excerpt: Asesoría FAR is a Barcelona-based firm providing property management, accounting, tax, and…
  • P2 RansomLook: 🇮🇩 claimed by killsec3 — Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇮🇩. Description excerpt: PT Pertamina is a state-owned enterprise in Indonesia dedicated to providing integrated energy solutions…
  • P2 RansomLook: 🇸🇬 claimed by killsec3 — Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇸🇬. Description excerpt: Nimbus Facility Services provides professional cleaning and facility management solutions for offices and…
  • P2 RansomLook: 🇨🇭 claimed by killsec3 — Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇨🇭. Description excerpt: Brügger Architekten AG, specializes in designing and executing architectural projects ranging from…
  • P2 RansomLook: 🇨🇺 claimed by killsec3 — Public RansomLook extortion-site listing claim. Group: killsec3. Claimed victim/listing: 🇨🇺. Description excerpt: DUC App is a leading financial technology platform that empowers individuals and businesses to manage…
  • P3 RansomLook: Dediserve Ltd claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Dediserve Ltd. Description excerpt: Cloud infrastructure provider (iomart group) · Dublin, Ireland / FRA1 Frankfurt DC
  • P3 RansomLook: SMCare claimed by panzer — Public RansomLook extortion-site listing claim. Group: panzer. Claimed victim/listing: SMCare. Description excerpt: Scenario Management is a specialist support provider based in Lancashire, serving areas including…
  • P3 RansomLook: Electrolux 2... claimed by emperador — Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: Electrolux 2.... Description excerpt: Hi Electrolux, im getting kind of inpatient, therefore i might just leak something. If i…
  • P3 RansomLook: SiteProRentals claimed by emperador — Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: SiteProRentals. Description excerpt: SitePro Rentals is a Texas-based construction and industrial equipment rental company…
  • P3 RansomLook: XICO claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: XICO. Description excerpt: Building Materials
  • P3 RansomLook: Island claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Island. Description excerpt: Business Services

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=91-92-40-165,elf,mirai,ua-wget; url=http://91.92.40.165/release/loader
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=91-92-40-165,elf,mirai,ua-wget; url=http://91.92.40.165/bins/loader
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags= android, botnet, ddos,adb,apk ,opendir; url=http://176.65.139.250/FF1.apk
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags= android, botnet, ddos,adb,apk ,opendir; url=http://176.65.139.250/payloads.txt
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ActiveMQ; url=http://94.154.43.7:8899/poc/q28f1a8dd.xml
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ActiveMQ; url=http://94.154.43.7:8899/poc/qe8be141e.xml
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=23-94-145-112,exe,ua-wget; url=http://23.94.145.112/loader.exe
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.arm7
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.x86
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.mips
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,swatting-wiki,ua-wget; url=http://swatting.wiki/manji.arm5

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-88771`Citrix confirms two NetScaler RCE zero-days exploited in attacksBleepingComputer Ransomware News
    cve`CVE-2026-88772`Citrix confirms two NetScaler RCE zero-days exploited in attacksBleepingComputer Ransomware News
    ipv4`91.92.40.165`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`176.65.139.250`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`94.154.43.7`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`23.94.145.112`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=2 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=32 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=2 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation