markcardiff.tech:/daily-intel/2026-10-01.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-01 08:00:28 UTC
P1: 7
P2: 3
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-01

Generated: 2026-10-01 08:00:28 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=7, P2=3, P3=89, P4=151.
  • Highest-priority item: Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504) (P1, source: Rapid7 Blog).
  • 30 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504) — Rapid7 Blog; score 77; technologies: none explicitly matched.

    • - Overview On September 30, 2026, Cisco published a security advisory for CVE-2026-76504 , a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper…

  • P1 Cisco warns of new SD-WAN zero-day exploited in attacks — BleepingComputer Ransomware News; score 74; technologies: none explicitly matched.

    • - Cisco released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as CVE-2026-76504) that attackers are actively exploiting to escalate to admin privileges. [...]

  • P1 CVE-2026-69712 Windows Key Distribution Center Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-69586 Microsoft Windows PDF Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-70125 Microsoft Office Outlook Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - CWE added. Informational change only.

  • P1 CVE-2026-62699 Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-62784 Microsoft Local Security Authority Server (lsasrv) Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P2 Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) — Unit 42 Threat Research; score 54; technologies: none explicitly matched.

    • - Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated…

  • P2 RansomLook: Zelham claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Zelham. Description excerpt: zelham.com rocketreach.co/zelham-inc-profile_b580fe5ef66e1a3f Zelham, Inc. is a U.S. hospitality renovation general contractor…

  • P2 RansomLook: Silvercup Studios claimed by storm — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Silvercup Studios. Description excerpt: Media | Long Island City, New York, United States | Silvercup Studios also provides facilities for still photography including shoots…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-76504: Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504) — technologies: not watchlist-specific.
  • P1 CVE-2026-76504: Cisco warns of new SD-WAN zero-day exploited in attacks — technologies: not watchlist-specific.
  • P1 CVE-2026-69712: CVE-2026-69712 Windows Key Distribution Center Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-69586: CVE-2026-69586 Microsoft Windows PDF Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-70125: CVE-2026-70125 Microsoft Office Outlook Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-62699: CVE-2026-62699 Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-62784: CVE-2026-62784 Microsoft Local Security Authority Server (lsasrv) Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P2 CVE-2026-88771, CVE-2026-88772: Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) — technologies: not watchlist-specific.
  • P3 CVE-2026-69504: CVE-2026-69504 Windows NTFS Information Disclosure Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69288: CVE-2026-69288 Windows GDI+ Information Disclosure Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69328: CVE-2026-69328 Windows Storage Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-61938: CVE-2026-61938 Windows Installer Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-49800: CVE-2026-49800 Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69451: CVE-2026-69451 Windows Management Instrumentation Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-70562: CVE-2026-70562 Windows Audio Service Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-62758: CVE-2026-62758 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Zelham claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Zelham. Description excerpt: zelham.com rocketreach.co/zelham-inc-profile_b580fe5ef66e1a3f Zelham, Inc. is a U.S. hospitality…
  • P2 RansomLook: Silvercup Studios claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Silvercup Studios. Description excerpt: Media | Long Island City, New York, United States | Silvercup Studios also provides…
  • P3 Higher education is under siege, and fragmented security is making it harder to respond — Higher education faces a difficult security equation. Universities hold large volumes of sensitive student, financial, health, and research data while supporting open networks, distributed users, legacy infrastructure,…
  • P3 RansomLook: consilio.com claimed by lockbit5 — Public RansomLook extortion-site listing claim. Group: lockbit5. Claimed victim/listing: consilio.com. Description excerpt: Consilio is a global legal software and services company that provides technology solutions for…
  • P3 RansomLook: engic tech claimed by black x — Public RansomLook extortion-site listing claim. Group: black x. Claimed victim/listing: engic tech.
  • P3 RansomLook: Software Answers, a Banyan Software Company claimed by pear — Public RansomLook extortion-site listing claim. Group: pear. Claimed victim/listing: Software Answers, a Banyan Software Company. Description excerpt: Software company serving the long-term stay accommodation industry,…
  • P3 RansomLook: Houston Thyroid & Endocrine Specialists claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Houston Thyroid & Endocrine Specialists. Description excerpt: Healthcare - Endocrinology (US) · Houston, Texas
  • P3 RansomLook: The Japan Times claimed by eclipse — Public RansomLook extortion-site listing claim. Group: eclipse. Claimed victim/listing: The Japan Times. Description excerpt: The Japan Times is a leading English-language news outlet that provides comprehensive…
  • P3 RansomLook: Summit Electric Supply claimed by vexy — Public RansomLook extortion-site listing claim. Group: vexy. Claimed victim/listing: Summit Electric Supply. Description excerpt: Summit Electric Supply supplies electrical products and solutions for commercial,…
  • P3 RansomLook: wolfusofsky.de claimed by safepay — Public RansomLook extortion-site listing claim. Group: safepay. Claimed victim/listing: wolfusofsky.de. Description excerpt: The group provides a broad range of construction and infrastructure services to public and…
  • P3 RansomLook: Le Centre National de l'Expertise Hospitalière (CNEH) claimed by kairos — Public RansomLook extortion-site listing claim. Group: kairos. Claimed victim/listing: Le Centre National de l'Expertise Hospitalière (CNEH). Description excerpt: Le Centre National de l'Expertise Hospitalière (CNEH)…
  • P3 RansomLook: Titus claimed by play — Public RansomLook extortion-site listing claim. Group: play. Claimed victim/listing: Titus.

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1qjzMdGn-w0YYAgdJ6zcD7jCzqDtaokB3
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1ckCcpcK-lCAKi1lGZ0tnj5yynsi6uBla
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,Loader,Mach-O,macOS; url=https://sandiegomobiletire.com/loader/agent/a75137e5a3f45aacaa1ed5259e81ad8dcbcc0c1b767d8fc46dc42d2ef548b449
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=downloader,sh; url=http://45.207.157.28/backdoor.sh
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=579cd0,dropped-by-amadey,SolarisLoader; url=http://193.178.158.57/bin/0a844b9203ac2602_bot_x64.exe
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1csBpqeLvVXlby1H-hXTi8JliwAFl12rv
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=encrypted,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=10AWwKSrnQMACC4ncSlYE5JpO3IBcKB9j
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1FfYa-23u8RfO81ZUHkJwiPC6K33bi0RR
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1ysFwuUCWQeuX4JyKgdd-KOuVz8Q1YKvI
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=encrypted,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1F2NH4aHFJUI5ElrjOsLTslAl-qcHabnC
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1rE6ntRsaq7laH-PpBXoh3iyKOxSvEbeI

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-76504`Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVRapid7 Blog
    cve`CVE-2026-69712`CVE-2026-69712 Windows Key Distribution Center Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69586`CVE-2026-69586 Microsoft Windows PDF Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-70125`CVE-2026-70125 Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-62699`CVE-2026-62699 Windows Universal Disk Format File System Driver (UDFS) Remote Code ExecutiMicrosoft Security Response Center RSS
    cve`CVE-2026-62784`CVE-2026-62784 Microsoft Local Security Authority Server (lsasrv) Remote Code Execution VuMicrosoft Security Response Center RSS
    cve`CVE-2026-88771`Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the WildUnit 42 Threat Research
    cve`CVE-2026-88772`Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the WildUnit 42 Threat Research
    cve`CVE-2026-69504`CVE-2026-69504 Windows NTFS Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69288`CVE-2026-69288 Windows GDI+ Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69328`CVE-2026-69328 Windows Storage Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-61938`CVE-2026-61938 Windows Installer Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-49800`CVE-2026-49800 Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege VulMicrosoft Security Response Center RSS
    cve`CVE-2026-69451`CVE-2026-69451 Windows Management Instrumentation Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-70562`CVE-2026-70562 Windows Audio Service Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-62758`CVE-2026-62758 Windows Remote Access Connection Manager Elevation of Privilege VulnerabiliMicrosoft Security Response Center RSS
    hash`a75137e5a3f45aacaa1ed5259e81ad8dcbcc0c1b767d8fc46dc42d2ef548b449`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`45.207.157.28`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`193.178.158.57`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    hash`bada5fadf7278daeaef4d6c037b6a5f3`RansomLook: consilio.com claimed by lockbit5RansomLook Recent Listings
    hash`b29c5a196c8ea13a73c358cc956325b3`RansomLook: Dr Damiel Pugliese claimed by lamashtuRansomLook Recent Listings
    hash`72fbe5ef408a6fd050ff07aadb4f5635`RansomLook: Astidental di Sabbione claimed by lamashtuRansomLook Recent Listings
    hash`2a27022fff68b701cb91e26832eb69b4`RansomLook: Vinco Energy claimed by lamashtuRansomLook Recent Listings
    hash`3a22c6f6e9ef850466b5faa884731074`RansomLook: Becker Logistik claimed by lamashtuRansomLook Recent Listings
    hash`8200d20d1dfb66cceca4aaad92292dbb`RansomLook: Wilhelm Kühne claimed by lamashtuRansomLook Recent Listings
    hash`eb0edc0f82864cce5e7de5ee755f7bee`RansomLook: FIDUCIAL claimed by lamashtuRansomLook Recent Listings
    hash`bc07d8695a687caef3c35e3848ff0112`RansomLook: Virtual Ideas claimed by lamashtuRansomLook Recent Listings
    hash`51b24c80214547c1e4636a2e1ccbd340`RansomLook: PROJAHN claimed by lamashtuRansomLook Recent Listings
    hash`99a5632408884e412ec7e38a87d611ea`RansomLook: Altmannshofer Sicherheits-Videotechnik claimed by lamashtuRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=1 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=28 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=0 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=1 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=115 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation