markcardiff.tech:/daily-intel/2026-10-06.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-06 08:00:57 UTC
P1: 1
P2: 8
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-06

Generated: 2026-10-06 08:00:57 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=1, P2=8, P3=161, P4=80.
  • Highest-priority item: GitHub release: Nuclei Templates v10.5.0 - Release Notes (P1, source: ProjectDiscovery Nuclei Templates Releases).
  • 17 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 GitHub release: Nuclei Templates v10.5.0 - Release Notes — ProjectDiscovery Nuclei Templates Releases; score 90; technologies: WordPress.

    • - ### New Templates Added: `295` | CVEs Added: `36` | First-time contributions: `11` ### 🔥 Release Highlights 🔥 - [CVE-2026-87902] WordPress Core - PHP Template Path Traversal (@Hadrian,FLX) [critical] (kev) (vKEV) 🔥 - [CVE-2026-86218] N-able N-central Login |…

  • P2 Rejetto HFS servers now actively scanned for critical RCE flaw — BleepingComputer Ransomware News; score 62; technologies: none explicitly matched.

    • - Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code execution (RCE). [...]

  • P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/aaamaxito-prog/deadeye/main/Sources/Deadeye/Software-2.6.zip

  • P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/Afrikandercensor3087/Hunt-Showdown-1896-DLC-Unlocker/main/twanginess/Unlocker_Showdown_Hunt_DL_1.1-beta.5.zip

  • P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip;…

  • P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/ngu132/eiken-vocab/HEAD/steps/4-build-wordlist-source/vocab-eiken-2.7-beta.1.zip

  • P2 RansomLook: Saskatoon Tribal Council claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Saskatoon Tribal Council. Description excerpt: sktc.sk.ca zoominfo.com/c/saskatoon-tribal-council-inc/215335121 Saskatoon Tribal Council (STC) is a non-profit tribal…

  • P2 RansomLook: Infomedia A/S claimed by aurora — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: aurora. Claimed victim/listing: Infomedia A/S. Description excerpt: Infomedia A/S — Denmark's premier media monitoring company, co-owned by the country's two largest media conglomerates (JP/Politikens Hus…

  • P2 RansomLook: Fluge Audiovisuales claimed by lamashtu — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: lamashtu. Claimed victim/listing: Fluge Audiovisuales. Description excerpt: fluge.es - Fluge Audiovisuales is a Spanish company and market leader in AV equipment rental (sound, lighting, video, staging)…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2018-7600, CVE-2024-33832, CVE-2024-45440, CVE-2026-31807, CVE-2026-86218, CVE-2026-87902: GitHub release: Nuclei Templates v10.5.0 - Release Notes — technologies: WordPress.
  • P2 CVE-2026-61500: Rejetto HFS servers now actively scanned for critical RCE flaw — technologies: not watchlist-specific.
  • P3 CVE-2026-69267: CVE-2026-69267 Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Saskatoon Tribal Council claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Saskatoon Tribal Council. Description excerpt: sktc.sk.ca zoominfo.com/c/saskatoon-tribal-council-inc/215335121 Saskatoon…
  • P2 RansomLook: Infomedia A/S claimed by aurora — Public RansomLook extortion-site listing claim. Group: aurora. Claimed victim/listing: Infomedia A/S. Description excerpt: Infomedia A/S — Denmark's premier media monitoring company, co-owned by the country's two…
  • P2 RansomLook: Fluge Audiovisuales claimed by lamashtu — Public RansomLook extortion-site listing claim. Group: lamashtu. Claimed victim/listing: Fluge Audiovisuales. Description excerpt: fluge.es - Fluge Audiovisuales is a Spanish company and market leader in AV equipment…
  • P3 RansomLook: Philander Smith University claimed by endzone — Public RansomLook extortion-site listing claim. Group: endzone. Claimed victim/listing: Philander Smith University. Description excerpt: Philander Smith University is a private, historically Black liberal arts…
  • P3 RansomLook: TheraCare claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: TheraCare. Description excerpt: Healthcare | White Plains, New York, United States | TheraCare is a multi-service healthcare,…
  • P3 RansomLook: Agri Industrial claimed by everest — Public RansomLook extortion-site listing claim. Group: everest. Claimed victim/listing: Agri Industrial. Description excerpt: 2 posts - 2h
  • P3 RansomLook: B-accountants claimed by everest — Public RansomLook extortion-site listing claim. Group: everest. Claimed victim/listing: B-accountants. Description excerpt: 2 posts - 1h
  • P3 RansomLook: Morcon Developments claimed by everest — Public RansomLook extortion-site listing claim. Group: everest. Claimed victim/listing: Morcon Developments. Description excerpt: 2 posts - 1h
  • P3 RansomLook: Watermark Retirement Communities claimed by payoutsking — Public RansomLook extortion-site listing claim. Group: payoutsking. Claimed victim/listing: Watermark Retirement Communities.
  • P3 RansomLook: A...n claimed by leakeddata — Public RansomLook extortion-site listing claim. Group: leakeddata. Claimed victim/listing: A...n. Description excerpt: To be announced...
  • P3 RansomLook: Global Security Concepts claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Global Security Concepts. Description excerpt: Business Services
  • P3 RansomLook: dd-automation.ch claimed by safepay — Public RansomLook extortion-site listing claim. Group: safepay. Claimed victim/listing: dd-automation.ch. Description excerpt: The company was entered into the Swiss commercial register in 1997 and specializes in…

    • Malware / infrastructure / abuse feed highlights

  • P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/aaamaxito-prog/deadeye/main/Sources/Deadeye/Software-2.6.zip
  • P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip;…
  • P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip;…
  • P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/ngu132/eiken-vocab/HEAD/steps/4-build-wordlist-source/vocab-eiken-2.7-beta.1.zip
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ContagiousInterview,DPRK,githook; url=https://brightlaunch-ext75642.vercel.app/api/l
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ContagiousInterview,DPRK,githook; url=https://brightlaunch-ext75642.vercel.app/api/m
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ContagiousInterview,DPRK,githook; url=https://brightlaunch-ext75642.vercel.app/api/w
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/sadik12-3/cc-wrapped/HEAD/src/utils/cc-wrapped-v1.8.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/vinzyy1/docker-mcp/HEAD/impreventability/mcp_docker_1.9.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip;…
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/wipeu7148/specc.sh/refs/heads/main/packages/server/sh-specc-3.4-alpha.1.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/Pixeltruth/bess-benchmark/main/extraembryonic/bess-benchmark.zip

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2018-7600`GitHub release: Nuclei Templates v10.5.0 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2024-33832`GitHub release: Nuclei Templates v10.5.0 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2024-45440`GitHub release: Nuclei Templates v10.5.0 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-31807`GitHub release: Nuclei Templates v10.5.0 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-86218`GitHub release: Nuclei Templates v10.5.0 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-87902`GitHub release: Nuclei Templates v10.5.0 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-61500`Rejetto HFS servers now actively scanned for critical RCE flawBleepingComputer Ransomware News
    hash`42f6d4a5d3d8dfcfda3daf8e3f8759ad`RansomLook: Fluge Audiovisuales claimed by lamashtuRansomLook Recent Listings
    cve`CVE-2026-69267`CVE-2026-69267 Windows Connected User Experiences and Telemetry Information Disclosure VulMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`185.29.10.68`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`185.29.9.42`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`46.19.140.40`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    hash`80fac6e9eca7accf742f3630f685f50c`RansomLook: Bender Tribunenbau claimed by lamashtuRansomLook Recent Listings
    hash`baf6c6d832b18d97df91a312b838dfb8`RansomLook: TRANS LOGROÑO SOCIEDAD ANONIMA claimed by lamashtuRansomLook Recent Listings
    hash`94bec4570a64a5136e8dd59ee1ff72de`RansomLook: Grupo Industrial Tauro claimed by lamashtuRansomLook Recent Listings
    hash`e91bde5d23a06de3073e06146cee7c09`RansomLook: capitalbankhaiti.biz claimed by lockbit5RansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=64 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=2 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation