markcardiff.tech:/daily-intel/2026-09-30.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-09-30 08:00:21 UTC
P1: 1
P2: 7
Items: 250

Daily Cyber Threat Intel Brief — 2026-09-30

Generated: 2026-09-30 08:00:21 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=1, P2=7, P3=74, P4=168.
  • Highest-priority item: Hackers exploit Citrix NetScaler zero-day to deploy web shells (P1, source: BleepingComputer Ransomware News).
  • 13 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 Hackers exploit Citrix NetScaler zero-day to deploy web shells — BleepingComputer Ransomware News; score 104; technologies: Citrix NetScaler.

    • - Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]

  • P2 RansomLook: Silvercup Studios claimed by storm — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Silvercup Studios. Description excerpt: Media | Long Island City, New York, United States | Silvercup Studios also provides facilities for still photography including shoots…

  • P2 RansomLook: Pulmonary Services Group claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Pulmonary Services Group. Description excerpt: pulmonaryservicesgrouppr.com zoominfo.com/c/pulmonary-services-group/442368923 Pulmonary Services Group…

  • P2 RansomLook: Tekko Enterprises, Inc claimed by interlock — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: interlock. Claimed victim/listing: Tekko Enterprises, Inc. Description excerpt: https://tekkoinc.com/ Tekko Enterprises, Inc., a Tooele, Utah-based prime contractor with a U.S. Air Force contract at…

  • P2 RansomLook: Don Hierro claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Don Hierro. Description excerpt: donhierro.com zoominfo.com/c/don-hierro-sl/347708573 Don Hierro Corporation, S.A. (roots to 1969, Panama City) is a Panama-based…

  • P2 RansomLook: Webb Electric Company of Florida claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Webb Electric Company of Florida. Description excerpt: webbelectric.com Webb Electric Company of Florida (founded 1957, Cantonment/Pensacola, FL) is a veteran-owned…

  • P2 RansomLook: Edcon claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Edcon. Description excerpt: edcon.co.za zoominfo.com/c/edcon/36900910 Edcon (roots from 1929, Johannesburg) was South Africa's largest non-food retailer — owner of…

  • P2 RansomLook: Defencebit claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Defencebit. Description excerpt: defencebit.com zoominfo.com/c/defencebit/532842616 DefenceBit (founded 2018, Lisbon) is a boutique cybersecurity consulting firm —…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-88772: Hackers exploit Citrix NetScaler zero-day to deploy web shells — technologies: Citrix NetScaler.
  • P3 CVE-2026-69307: CVE-2026-69307 Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-56172: CVE-2026-56172 Windows VHD miniport driver Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-68880: CVE-2026-68880 Windows Win32k Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-61930: CVE-2026-61930 Windows Kernel Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-50332: CVE-2026-50332 Windows Kernel Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-50400: CVE-2026-50400 Windows App Package Installer Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-50414: CVE-2026-50414 Windows Media Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-57095: CVE-2026-57095 Win32k Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-91728: Chromium CVE-2026-91728: Integer overflow — technologies: not watchlist-specific.
  • P3 CVE-2026-91745: Chromium CVE-2026-91745: Use after free — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Silvercup Studios claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Silvercup Studios. Description excerpt: Media | Long Island City, New York, United States | Silvercup Studios also provides…
  • P2 RansomLook: Pulmonary Services Group claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Pulmonary Services Group. Description excerpt: pulmonaryservicesgrouppr.com zoominfo.com/c/pulmonary-services-group/442368923…
  • P2 RansomLook: Tekko Enterprises, Inc claimed by interlock — Public RansomLook extortion-site listing claim. Group: interlock. Claimed victim/listing: Tekko Enterprises, Inc. Description excerpt: https://tekkoinc.com/ Tekko Enterprises, Inc., a Tooele, Utah-based prime contractor…
  • P2 RansomLook: Don Hierro claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Don Hierro. Description excerpt: donhierro.com zoominfo.com/c/don-hierro-sl/347708573 Don Hierro Corporation, S.A. (roots to…
  • P2 RansomLook: Webb Electric Company of Florida claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Webb Electric Company of Florida. Description excerpt: webbelectric.com Webb Electric Company of Florida (founded 1957,…
  • P2 RansomLook: Edcon claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Edcon. Description excerpt: edcon.co.za zoominfo.com/c/edcon/36900910 Edcon (roots from 1929, Johannesburg) was South…
  • P2 RansomLook: Defencebit claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Defencebit. Description excerpt: defencebit.com zoominfo.com/c/defencebit/532842616 DefenceBit (founded 2018, Lisbon) is a…
  • P3 RansomLook: Poca Valley Bank claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Poca Valley Bank. Description excerpt: FinTech | Roane County, West Virginia, United States | Poca Valley Bank offers a range of…
  • P3 RansomLook: West County Health Centers claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: West County Health Centers. Description excerpt: Healthcare | Guerneville, California, United States | West County Health Centers…
  • P3 RansomLook: Gardeners' Guild claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Gardeners' Guild. Description excerpt: Manufacturing | Richmond, California, United States | Gardeners' Guild is a full-service…
  • P3 RansomLook: North Hills Facility Services claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: North Hills Facility Services. Description excerpt: FinTech | Plainview, New York, United States | North Hills Facility Services…
  • P3 RansomLook: Olnick Rentals claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Olnick Rentals. Description excerpt: FinTech | New York City, New York, United States | Olnick Rentals specializes in exceptional…

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1_3lqajyFDw3v64f5xtQFlJYp1elu3y5a
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=encrypted,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1cGpgs5YA_BKydacrkSWHg2QE8ys39LpO
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=10Wq0Z-VbSdbx4ZVNI64ByaeOLnWEg3QD
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P4 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=mirai; url=http://36.71.17.24:39847/i
  • P4 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=mirai; url=http://181.174.231.21:33868/i
  • P4 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=32-bit,elf,mips,Mozi; url=http://27.215.127.195:41248/i
  • P4 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=Formbook,stego; url=http://107.172.235.223/img/3.jpg
  • P4 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,Formbook; url=https://tutpaste.com/raw/Q88luv
  • P4 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Formbook,js; url=http://172.245.209.172/55/img_94905005050.JPG.jS
  • P4 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=elf,mirai,ua-wget; url=http://176.65.139.135/bins/sh4
  • P4 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=elf,mirai,ua-wget; url=http://176.65.139.135/m68k

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-88772`Hackers exploit Citrix NetScaler zero-day to deploy web shellsBleepingComputer Ransomware News
    cve`CVE-2026-69307`CVE-2026-69307 Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege VulnerMicrosoft Security Response Center RSS
    cve`CVE-2026-56172`CVE-2026-56172 Windows VHD miniport driver Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-68880`CVE-2026-68880 Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-61930`CVE-2026-61930 Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-50332`CVE-2026-50332 Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-50400`CVE-2026-50400 Windows App Package Installer Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-50414`CVE-2026-50414 Windows Media Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-57095`CVE-2026-57095 Win32k Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-91728`Chromium CVE-2026-91728: Integer overflowMicrosoft Security Response Center RSS
    cve`CVE-2026-91745`Chromium CVE-2026-91745: Use after freeMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    hash`781c2e51ed8c224e240196c0e0227191`RansomLook: spg.co.kr claimed by lockbit5RansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=1 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=20 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=2 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation