Daily Cyber Threat Intel Brief — 2026-10-04
Generated: 2026-10-04 08:00:27 UTC
Executive summary
Collected 250 recent public-source CTI items for technology-only monitoring.
Priority distribution: P1=0, P2=1, P3=109, P4=140.
Highest-priority item: RansomLook: Skaff Group claimed by rhysida (P2, source: RansomLook Recent Listings).
4 public IOC highlights selected for analyst awareness.
Priority technology watch items
P2 RansomLook: Skaff Group claimed by rhysida — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: rhysida. Claimed victim/listing: Skaff Group. Description excerpt: Skaff Group SKAFF is a leader in Lebanon in the field of decorative fabrics. Files: 139,377Data volume: ~268 GB**Full HR dossiers - ~40…
Newly exploited vulnerabilities / CVE watch
P3 CVE-2025-10502: Chromium: CVE-2025-10502 Heap buffer overflow in ANGLE — technologies: not watchlist-specific.
Ransomware and extortion trend notes
P2 RansomLook: Skaff Group claimed by rhysida — Public RansomLook extortion-site listing claim. Group: rhysida. Claimed victim/listing: Skaff Group. Description excerpt: Skaff Group SKAFF is a leader in Lebanon in the field of decorative fabrics. Files: 139,377Data…
P3 RansomLook: Center State Engineering claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Center State Engineering. Description excerpt: centerstateengineering.com zoominfo.com/c/center-state-engineering/368448599…
P3 RansomLook: A**n claimed by payoutsking — Public RansomLook extortion-site listing claim. Group: payoutsking. Claimed victim/listing: A**n.
P3 RansomLook: World Cup 2034 claimed by wallstreet — Public RansomLook extortion-site listing claim. Group: wallstreet. Claimed victim/listing: World Cup 2034. Description excerpt: We compromised the network of the China Railway Construction CorporationSaudi Branch / Sama…
P3 RansomLook: St. Francis Healthcare Systems of Hawaii claimed by wallstreet — Public RansomLook extortion-site listing claim. Group: wallstreet. Claimed victim/listing: St. Francis Healthcare Systems of Hawaii. Description excerpt: St. Francis Healthcare System of Hawaiʻi is a Catholic, nonprofit…
P3 RansomLook: Genesis Credit Management claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Genesis Credit Management. Description excerpt: Banking
P3 RansomLook: SEVEN SEAS GROUP claimed by spirals — Public RansomLook extortion-site listing claim. Group: spirals. Claimed victim/listing: SEVEN SEAS GROUP. Description excerpt: https://sevenseasgroup.com/ Seven Seas is a global maritime services group that specializes…
P3 RansomLook: Forma Therapeutics Holdings, Inc. claimed by nightspire — Public RansomLook extortion-site listing claim. Group: nightspire. Claimed victim/listing: Forma Therapeutics Holdings, Inc..
Malware / infrastructure / abuse feed highlights
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=None; url=http://168.93.199.51:8080/rau_rce.dll
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ps1,script; url=http://43.155.203.106:8899/loader.ps1
P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,ua-wget; url=http://chibomaydan.devs.surf/mips
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,ua-wget; url=http://chibomaydan.devs.surf/debug.dbg
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,ua-wget; url=http://chibomaydan.devs.surf/m68k
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,ua-wget; url=http://chibomaydan.devs.surf/arm5
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,ua-wget; url=http://chibomaydan.devs.surf/ppc
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,ua-wget; url=http://chibomaydan.devs.surf/arm7
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,ua-wget; url=http://chibomaydan.devs.surf/sh4
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,ua-wget; url=http://chibomaydan.devs.surf/arm6
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,ua-wget; url=http://chibomaydan.devs.surf/arm
IOC highlights
| Type | Value | Context | Source |
| ipv4 | `168.93.199.51` | URLhaus: malware_download URL observed (online) | URLhaus Recent URLs |
| cve | `CVE-2025-10502` | Chromium: CVE-2025-10502 Heap buffer overflow in ANGLE | Microsoft Security Response Center RSS |
| ipv4 | `43.155.203.106` | URLhaus: malware_download URL observed (online) | URLhaus Recent URLs |
| ipv4 | `50.16.16.211` | Feodo Tracker: 1 recommended botnet C2 IPs listed | Feodo Tracker Recommended Blocklist |
Defensive takeaways
Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.
Sources checked
BleepingComputer Ransomware News: ok new=0 fetched=15
CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
Cisco Talos Blog: ok new=0 fetched=15
Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
Huntress Blog: ok new=0 fetched=25
Microsoft Security Response Center RSS: ok new=0 fetched=25
NVD Recent CVEs: ok new=50 fetched=80
ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
RansomLook Recent Listings: ok new=0 fetched=50
Rapid7 Blog: ok new=0 fetched=20
SANS Internet Storm Center: ok new=1 fetched=10
Sophos X-Ops: ok new=0 fetched=15
The DFIR Report: ok new=0 fetched=10
URLhaus Recent URLs: ok new=120 fetched=120
Unit 42 Threat Research: ok new=0 fetched=15
Limitations
Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
Technology-only matching can miss relevant items that do not name a tracked product explicitly.
Ransomware victim claims are actor/source claims unless independently corroborated.
IOC highlights are publicly sourced and should be validated before enforcement in production controls.