markcardiff.tech:/daily-intel/2026-09-29.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-09-29 08:00:57 UTC
P1: 2
P2: 8
Items: 250

Daily Cyber Threat Intel Brief — 2026-09-29

Generated: 2026-09-29 08:00:57 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=2, P2=8, P3=85, P4=155.
  • Highest-priority item: Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 (P1, source: Rapid7 Blog).
  • 10 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 — Rapid7 Blog; score 107; technologies: Citrix NetScaler.

    • - Overview On September 27, 2026, Citrix disclosed eight new vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including two critical remote code execution (RCE) vulnerabilities: CVE-2026-88771 and CVE-2026-88772 . Both of these RCE vulnerabilities…

  • P1 CISA orders feds to patch exploited Citrix flaws by Wednesday — BleepingComputer Ransomware News; score 79; technologies: Citrix NetScaler.

    • - The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities. [...]

  • P2 JadePuffer agentic AI attacks target Azure, destroy cloud resources — BleepingComputer Ransomware News; score 57; technologies: none explicitly matched.

    • - The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components. [...]

  • P2 Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th) — SANS Internet Storm Center; score 54; technologies: none explicitly matched.

    • - Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploited. iOS and macOS 27 are not affected.…

  • P2 Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild — Unit 42 Threat Research; score 54; technologies: none explicitly matched.

    • - Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild appeared…

  • P2 RansomLook: Sutton Public Schools claimed by global cybernetic collective — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: global cybernetic collective. Claimed victim/listing: Sutton Public Schools. Description excerpt: The Sutton Public Schools website (Sutton, MA) is the key resource for the local school district, serving…

  • P2 RansomLook: Vintners Distributors claimed by storm — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Vintners Distributors. Description excerpt: Retail & E-commerce | Fremont, California, United States | Vintners Distributors is a family-owned branded retailer of fuels…

  • P2 RansomLook: apexus.com claimed by 3am — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: 3am. Claimed victim/listing: apexus.com. Description excerpt: Apexus, founded in 2007, is a business services company that manages the 340B Prime Vendor Program supporting the 340B Drug Pricing Program.…

  • P2 RansomLook: Ressources Si claimed by panzer — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: panzer. Claimed victim/listing: Ressources Si. Description excerpt: Ressources Si is a company that operates in the Movie Theaters industry. It employs 10to19 people and has 1Mto5M of revenue.

  • P2 RansomLook: Asesoría FAR claimed by panzer — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: panzer. Claimed victim/listing: Asesoría FAR. Description excerpt: Asesoría FAR is a Barcelona-based firm providing property management, accounting, tax, and business advisory services.

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-88771, CVE-2026-88772: Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 — technologies: Citrix NetScaler.
  • P2 CVE-2026-86950: Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th) — technologies: not watchlist-specific.
  • P2 CVE-2026-88771, CVE-2026-88772: Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild — technologies: not watchlist-specific.
  • P3 CVE-2026-91728: Chromium CVE-2026-91728: Integer overflow — technologies: not watchlist-specific.
  • P3 CVE-2026-91745: Chromium CVE-2026-91745: Use after free — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 JadePuffer agentic AI attacks target Azure, destroy cloud resources — The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components. [...]
  • P2 RansomLook: Sutton Public Schools claimed by global cybernetic collective — Public RansomLook extortion-site listing claim. Group: global cybernetic collective. Claimed victim/listing: Sutton Public Schools. Description excerpt: The Sutton Public Schools website (Sutton, MA) is the key resource…
  • P2 RansomLook: Vintners Distributors claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Vintners Distributors. Description excerpt: Retail & E-commerce | Fremont, California, United States | Vintners Distributors is a…
  • P2 RansomLook: apexus.com claimed by 3am — Public RansomLook extortion-site listing claim. Group: 3am. Claimed victim/listing: apexus.com. Description excerpt: Apexus, founded in 2007, is a business services company that manages the 340B Prime Vendor Program…
  • P2 RansomLook: Ressources Si claimed by panzer — Public RansomLook extortion-site listing claim. Group: panzer. Claimed victim/listing: Ressources Si. Description excerpt: Ressources Si is a company that operates in the Movie Theaters industry. It employs 10to19…
  • P2 RansomLook: Asesoría FAR claimed by panzer — Public RansomLook extortion-site listing claim. Group: panzer. Claimed victim/listing: Asesoría FAR. Description excerpt: Asesoría FAR is a Barcelona-based firm providing property management, accounting, tax, and…
  • P3 RansomLook: Poca Valley Bank claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Poca Valley Bank. Description excerpt: FinTech | Roane County, West Virginia, United States | Poca Valley Bank offers a range of…
  • P3 Japan's Keio confirms ransomware attack disrupted business systems — Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting some of its business systems. [...]
  • P3 RansomLook: Netech (Neeser Technik AG) claimed by payload — Public RansomLook extortion-site listing claim. Group: payload. Claimed victim/listing: Netech (Neeser Technik AG). Description excerpt: Netech (Neeser Technik AG) is a Swiss engineering and industrial services company…
  • P3 RansomLook: Precision Facades Ltd claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Precision Facades Ltd. Description excerpt: Facade engineering and construction (UK) · United Kingdom
  • P3 RansomLook: MinMor Industries claimed by cry0 — Public RansomLook extortion-site listing claim. Group: cry0. Claimed victim/listing: MinMor Industries. Description excerpt: Coming soon...
  • P3 RansomLook: camorim.com.br claimed by lockbit5 — Public RansomLook extortion-site listing claim. Group: lockbit5. Claimed victim/listing: camorim.com.br. Description excerpt: Camorim Serviços Marítimos has over 30 years of expertise in the maritime sector, providing a…

    • Malware / infrastructure / abuse feed highlights

  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix — Huntress researchers reveal how attackers are exploiting ChatGPT Custom GPTs to spread ClickFix lures and DLL-sideloaded malware. See the full breakdown.
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,botnet,elf,javasense,ua-wget; url=http://194.50.16.15:4561/
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,elf,kushnet,mirai; url=http://45.198.224.102/kushnet.x64-test
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,elf,kushnet,mirai; url=http://45.198.224.102/kushnet.mips
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,elf,kushnet; url=http://45.198.224.102/kushnet.mipsel
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,elf,kushnet; url=http://45.198.224.102/kushnet.sh4
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,elf,kushnet; url=http://45.198.224.102/kushnet.arm4tl
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,elf,kushnet; url=http://45.198.224.102/kushnet.arm4l
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,elf,kushnet; url=http://45.198.224.102/kushnet.arm5
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,elf,kushnet; url=http://45.198.224.102/kushnet.ppc440
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,elf,kushnet; url=http://45.198.224.102/kushnet.ppc

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-88771`Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-887Rapid7 Blog
    cve`CVE-2026-88772`Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-887Rapid7 Blog
    cve`CVE-2026-86950`Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)SANS Internet Storm Center
    cve`CVE-2026-91728`Chromium CVE-2026-91728: Integer overflowMicrosoft Security Response Center RSS
    cve`CVE-2026-91745`Chromium CVE-2026-91745: Use after freeMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`194.50.16.15`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`45.198.224.102`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`91.92.40.165`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    hash`30c6cb9f5d80f0e5bdc2a414552bea98`RansomLook: camorim.com.br claimed by lockbit5RansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=1 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=2 fetched=25
  • Microsoft Security Response Center RSS: ok new=2 fetched=25
  • NVD Recent CVEs: ok new=16 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=2 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation