markcardiff.tech:/daily-intel/2026-10-03.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-03 08:00:55 UTC
P1: 1
P2: 3
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-03

Generated: 2026-10-03 08:00:55 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=1, P2=3, P3=56, P4=190.
  • Highest-priority item: CVE-2026-96940 Microsoft Exchange Server Elevation of Privilege Vulnerability (P1, source: Microsoft Security Response Center RSS).
  • 9 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 CVE-2026-96940 Microsoft Exchange Server Elevation of Privilege Vulnerability — Microsoft Security Response Center RSS; score 75; technologies: Microsoft Exchange.

    • - Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.

  • P2 Warlock ransomware breach SharePoint in water, telecom operator attacks — BleepingComputer Ransomware News; score 62; technologies: SharePoint.

    • - The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. [...]

  • P2 RansomLook: Hospital de la Santa Creu i Sant Pau claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Hospital de la Santa Creu i Sant Pau. Description excerpt: santpau.cat zoominfo.com/c/hospital-de-la-santa-creu-i-sant-pau/372615247 Hospital de la Santa Creu i Sant…

  • P2 RansomLook: Rotamac claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Rotamac. Description excerpt: rotamac.ca Rotamac Inc. is a privately held industrial equipment distributor founded in November 2019 and based in Rosemère/Montreal,…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-96940: CVE-2026-96940 Microsoft Exchange Server Elevation of Privilege Vulnerability — technologies: Microsoft Exchange.
  • P3 CVE-2025-10502: Chromium: CVE-2025-10502 Heap buffer overflow in ANGLE — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 Warlock ransomware breach SharePoint in water, telecom operator attacks — The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. [...]
  • P2 RansomLook: Hospital de la Santa Creu i Sant Pau claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Hospital de la Santa Creu i Sant Pau. Description excerpt: santpau.cat…
  • P2 RansomLook: Rotamac claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Rotamac. Description excerpt: rotamac.ca Rotamac Inc. is a privately held industrial equipment distributor founded in…
  • P3 The First 24 Hours: What Happens When Ransomware Lands — Nazar Tymoshyk from UnderDefense shares his thoughts on what ransomware attacks look like during the all-important opening hours.
  • P3 RansomLook: SEVEN SEAS GROUP claimed by spirals — Public RansomLook extortion-site listing claim. Group: spirals. Claimed victim/listing: SEVEN SEAS GROUP. Description excerpt: https://sevenseasgroup.com/ Seven Seas is a global maritime services group that specializes…
  • P3 RansomLook: Forma Therapeutics Holdings, Inc. claimed by nightspire — Public RansomLook extortion-site listing claim. Group: nightspire. Claimed victim/listing: Forma Therapeutics Holdings, Inc..
  • P3 RansomLook: Paessolucoes claimed by panzer — Public RansomLook extortion-site listing claim. Group: panzer. Claimed victim/listing: Paessolucoes. Description excerpt: paessolucoes.com.br is the website of Paes Soluções, a Brazilian IT company offering business…
  • P3 RansomLook: Mat Bao Corporation claimed by rhysida — Public RansomLook extortion-site listing claim. Group: rhysida. Claimed victim/listing: Mat Bao Corporation. Description excerpt: Mat Bao Corporation Mat Bao Corporation offers a range of services including domain…
  • P3 RansomLook: Thai Lion Air claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Thai Lion Air. Description excerpt: Business Services
  • P3 RansomLook: Electro Heat Sweden AB claimed by rhysida — Public RansomLook extortion-site listing claim. Group: rhysida. Claimed victim/listing: Electro Heat Sweden AB. Description excerpt: Electro Heat Sweden AB ElectroHeat industrial furnaces are used in manufacturing…
  • P3 RansomLook: Sports Events365 claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Sports Events365. Description excerpt: Business Services
  • P3 RansomLook: DexCom, Inc. claimed by shinyhunters — Public RansomLook extortion-site listing claim. Group: shinyhunters. Claimed victim/listing: DexCom, Inc.. Description excerpt: Data is being published by end of day Friday if you do not reach out to us. Make the right…

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://polksvo.vercel.app/?download=1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://pomorutecvo.vercel.app/?download=1
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=176-65-139-78,sh,ua-wget; url=http://176.65.139.78/loader.sh
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/a1b2c3
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=PythonStealer,shadowproject,stealer; url=https://downloader.exeexe.workers.dev/u4i7o1
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/a1b2c3
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=PythonStealer,shadowproject,stealer; url=https://downloader.exeexe.workers.dev/u4i7o1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/n7m3q6
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/n7m3q6
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/r2t5y8
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=shadowproject,stealer; url=https://downloader.exeexe.workers.dev/r2t5y8

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-96940`CVE-2026-96940 Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2025-10502`Chromium: CVE-2025-10502 Heap buffer overflow in ANGLEMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`176.65.139.78`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    hash`474c9899fc664639ef026dd1b3189d937d3f5ade`RansomLook: PT Indo Tambangraya Megah claimed by ransomhouseRansomLook Recent Listings
    hash`13c7043c26410b6568290e470887eac03d5639a5ff14afe5bf3b7cb0ba73b917`RansomLook: www.raajratna.com claimed by krybitRansomLook Recent Listings
    hash`8b4ba9a7921f9cedc14275f97019a1c2717ee9d99a108241fbb94368079647c2`RansomLook: www.pierrefeu.fr claimed by krybitRansomLook Recent Listings
    hash`e943639855000990446eaa8983d11a769d2dc9b19378bb27776e26dc6740c1dd`RansomLook: sai.org.in claimed by krybitRansomLook Recent Listings
    hash`61fffeb8ec1d413002af1f338482fd753323e7b10ebac516701ce12b69f9d440`RansomLook: www.kres.cz claimed by krybitRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=2 fetched=25
  • Microsoft Security Response Center RSS: ok new=1 fetched=25
  • NVD Recent CVEs: ok new=37 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=0 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=104 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation