markcardiff.tech:/daily-intel/2026-10-02.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-02 08:00:56 UTC
P1: 1
P2: 4
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-02

Generated: 2026-10-02 08:00:56 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=1, P2=4, P3=55, P4=190.
  • Highest-priority item: Fortinet warns of critical FortiMail flaw exploited in zero-day attacks (P1, source: BleepingComputer Ransomware News).
  • 8 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 Fortinet warns of critical FortiMail flaw exploited in zero-day attacks — BleepingComputer Ransomware News; score 104; technologies: Fortinet.

    • - Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. [...]

  • P2 Police dismantle KillSec ransomware gang allegedly led by 16-year-old — BleepingComputer Ransomware News; score 57; technologies: none explicitly matched.

    • - An international law enforcement operation dubbed "Operation KillSwitch" seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged administrator. [...]

  • P2 RansomLook: Hospital de la Santa Creu i Sant Pau claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Hospital de la Santa Creu i Sant Pau. Description excerpt: santpau.cat zoominfo.com/c/hospital-de-la-santa-creu-i-sant-pau/372615247 Hospital de la Santa Creu i Sant…

  • P2 RansomLook: Rotamac claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Rotamac. Description excerpt: rotamac.ca Rotamac Inc. is a privately held industrial equipment distributor founded in November 2019 and based in Rosemère/Montreal,…

  • P2 RansomLook: Laboratorios Roemmers SAICF claimed by aurora — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: aurora. Claimed victim/listing: Laboratorios Roemmers SAICF. Description excerpt: Laboratorios Roemmers SAICF — Argentina's #1 pharmaceutical company by revenue, with €1.669 billion in consolidated…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-104286: Fortinet warns of critical FortiMail flaw exploited in zero-day attacks — technologies: Fortinet.

    • Ransomware and extortion trend notes

  • P2 Police dismantle KillSec ransomware gang allegedly led by 16-year-old — An international law enforcement operation dubbed "Operation KillSwitch" seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged…
  • P2 RansomLook: Hospital de la Santa Creu i Sant Pau claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Hospital de la Santa Creu i Sant Pau. Description excerpt: santpau.cat…
  • P2 RansomLook: Rotamac claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Rotamac. Description excerpt: rotamac.ca Rotamac Inc. is a privately held industrial equipment distributor founded in…
  • P2 RansomLook: Laboratorios Roemmers SAICF claimed by aurora — Public RansomLook extortion-site listing claim. Group: aurora. Claimed victim/listing: Laboratorios Roemmers SAICF. Description excerpt: Laboratorios Roemmers SAICF — Argentina's #1 pharmaceutical company by revenue,…
  • P3 RansomLook: Mandurah State Emergency Service claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Mandurah State Emergency Service. Description excerpt: mandurahses.org.au Mandurah State Emergency Service is a volunteer…
  • P3 RansomLook: Westrop Primary & Nursery School claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Westrop Primary & Nursery School. Description excerpt: westropprimaryschool.co.uk Westrop Primary & Nursery School is a…
  • P3 RansomLook: Sangre de Cristo Electric Association claimed by inc ransom — Public RansomLook extortion-site listing claim. Group: inc ransom. Claimed victim/listing: Sangre de Cristo Electric Association.
  • P3 RansomLook: Allied Machine & Engineering claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Allied Machine & Engineering. Description excerpt: Manufacturing | Dover, Ohio, United States | Allied Machine & Engineering is a…
  • P3 RansomLook: Step By Step claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Step By Step. Description excerpt: Consulting | Wilkes-Barre, Pennsylvania, United States | Step By Step, Inc. is a private nonprofit…
  • P3 RansomLook: Hospital Hermilio Valdizán claimed by ransomhouse — Public RansomLook extortion-site listing claim. Group: ransomhouse. Claimed victim/listing: Hospital Hermilio Valdizán.
  • P3 RansomLook: Slate Valley Unified School District claimed by kairos — Public RansomLook extortion-site listing claim. Group: kairos. Claimed victim/listing: Slate Valley Unified School District. Description excerpt: The Slate Valley Unified Union School District is a public school…
  • P3 RansomLook: Superior Plating Technology CO claimed by morpheus — Public RansomLook extortion-site listing claim. Group: morpheus. Claimed victim/listing: Superior Plating Technology CO. Description excerpt: Website: superiortec.com Revenue: $30 Million Superior Plating Technology…

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://polksvo.vercel.app/?download=1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://pomorutecvo.vercel.app/?download=1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/a1b2c3
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=PythonStealer,shadowproject,stealer; url=https://downloader.exeexe.workers.dev/u4i7o1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/n7m3q6
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/r2t5y8
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/l8z2x5
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/q7w8e9
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/z8y7w6
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/h1j4k7
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=rev-base64-loader; url=http://216.9.224.48/300/rdIdrif.txt

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-104286`Fortinet warns of critical FortiMail flaw exploited in zero-day attacksBleepingComputer Ransomware News
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`216.9.224.48`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    hash`a75137e5a3f45aacaa1ed5259e81ad8dcbcc0c1b767d8fc46dc42d2ef548b449`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`45.207.157.28`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    hash`cd414b5bf5768351dd89f66e476d2c7b8d633f62`RansomLook: Hospital Hermilio Valdizán claimed by ransomhouseRansomLook Recent Listings
    hash`60b37541f96de3a35d59b575ad5754ed2b71f2d2`RansomLook: Terca claimed by ransomhouseRansomLook Recent Listings
    hash`bada5fadf7278daeaef4d6c037b6a5f3`RansomLook: consilio.com claimed by lockbit5RansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=1 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=16 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=5 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=116 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation