markcardiff.tech:/daily-intel/2026-10-05.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-05 08:00:26 UTC
P1: 2
P2: 0
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-05

Generated: 2026-10-05 08:00:26 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=2, P2=0, P3=26, P4=222.
  • Highest-priority item: GitHub release: Nuclei Templates v10.5.0 - Release Notes (P1, source: ProjectDiscovery Nuclei Templates Releases).
  • 17 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 GitHub release: Nuclei Templates v10.5.0 - Release Notes — ProjectDiscovery Nuclei Templates Releases; score 90; technologies: WordPress.

    • - ### New Templates Added: `295` | CVEs Added: `36` | First-time contributions: `11` ### 🔥 Release Highlights 🔥 - [CVE-2026-87902] WordPress Core - PHP Template Path Traversal (@Hadrian,FLX) [critical] (kev) (vKEV) 🔥 - [CVE-2026-86218] N-able N-central Login |…

  • P1 Citrix patches NetScaler SAML zero-day exploited in attacks — BleepingComputer Ransomware News; score 74; technologies: none explicitly matched.

    • - Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. [...]

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2018-7600, CVE-2024-33832, CVE-2024-45440, CVE-2026-31807, CVE-2026-86218, CVE-2026-87902: GitHub release: Nuclei Templates v10.5.0 - Release Notes — technologies: WordPress.
  • P1 CVE-2026-88779: Citrix patches NetScaler SAML zero-day exploited in attacks — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P3 RansomLook: capitalbankhaiti.biz claimed by lockbit5 — Public RansomLook extortion-site listing claim. Group: lockbit5. Claimed victim/listing: capitalbankhaiti.biz. Description excerpt: Capital Bank SA provides a comprehensive range of traditional and online banking…
  • P3 RansomLook: Bold Spring Nursery claimed by play — Public RansomLook extortion-site listing claim. Group: play. Claimed victim/listing: Bold Spring Nursery.
  • P3 RansomLook: Silicon Valley Glass claimed by play — Public RansomLook extortion-site listing claim. Group: play. Claimed victim/listing: Silicon Valley Glass.
  • P3 RansomLook: Unident Group claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Unident Group. Description excerpt: Healthcare Services
  • P3 RansomLook: Chadwick Switchboards claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Chadwick Switchboards. Description excerpt: Electronics
  • P3 RansomLook: Emser claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Emser. Description excerpt: Architecture, Engineering & Design
  • P3 RansomLook: Cotesma claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Cotesma. Description excerpt: Advertising & Marketing
  • P3 RansomLook: Softruck claimed by direwolf — Public RansomLook extortion-site listing claim. Group: direwolf. Claimed victim/listing: Softruck.
  • P3 RansomLook: MorseLife Health System, Inc. claimed by booba team — Public RansomLook extortion-site listing claim. Group: booba team. Claimed victim/listing: MorseLife Health System, Inc.. Description excerpt: Hospitals and Health Care Website: www.morselife.org Stolen data: 344 GB.
  • P3 RansomLook: OMUR HIRDAVAT LTD claimed by emperador — Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: OMUR HIRDAVAT LTD. Description excerpt: A Turkish company engaged in the wholesale and retail trade of construction and household…
  • P3 RansomLook: Nipigon District Memorial Hospital claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Nipigon District Memorial Hospital. Description excerpt: Healthcare | Nipissing District, Ontario, Canada | Nipigon District Memorial…
  • P3 RansomLook: Mutsumi Group claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Mutsumi Group. Description excerpt: Construction

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ContagiousInterview,DPRK,githook; url=https://brightlaunch-ext75642.vercel.app/api/l
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ContagiousInterview,DPRK,githook; url=https://brightlaunch-ext75642.vercel.app/api/m
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ContagiousInterview,DPRK,githook; url=https://brightlaunch-ext75642.vercel.app/api/w
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix; url=http://77.110.102.43/ed04570fa?force=1
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix; url=http://77.110.102.43/ed04570fa?force=1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix; url=http://77.221.153.100/d2503d96a3?force=1
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix; url=http://77.221.153.100/d2503d96a3?force=1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=None; url=http://168.93.199.51:8080/rau_rce.dll
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=exe,Sliver; url=http://46.19.140.40:8443/loader.exe
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ps1,script; url=http://43.155.203.106:8899/loader.ps1
  • P4 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=None; url=http://116.140.161.144:43891/bin.sh

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2018-7600`GitHub release: Nuclei Templates v10.5.0 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2024-33832`GitHub release: Nuclei Templates v10.5.0 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2024-45440`GitHub release: Nuclei Templates v10.5.0 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-31807`GitHub release: Nuclei Templates v10.5.0 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-86218`GitHub release: Nuclei Templates v10.5.0 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-87902`GitHub release: Nuclei Templates v10.5.0 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-88779`Citrix patches NetScaler SAML zero-day exploited in attacksBleepingComputer Ransomware News
    ipv4`77.110.102.43`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`77.221.153.100`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`168.93.199.51`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`46.19.140.40`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`43.155.203.106`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    hash`e91bde5d23a06de3073e06146cee7c09`RansomLook: capitalbankhaiti.biz claimed by lockbit5RansomLook Recent Listings
    hash`27493989ead6f1ebaa7f57d106ce8fc61e1d15cbee51562d9af6a683fe544f53`RansomLook: euroditel.com claimed by krybitRansomLook Recent Listings
    hash`a3ddb365f1307e9df5b9e0c16ceaf025b9af209f95465f95fba9f0f11ee65962`RansomLook: superpack.com.co claimed by krybitRansomLook Recent Listings
    hash`aca6f28085ad9c62056267f1ed82b5ae0da3a3b9ef4d30654028306e7ae7892d`RansomLook: daralteb.com claimed by krybitRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=43 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=1 fetched=10
  • RansomLook Recent Listings: ok new=0 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation