Daily Cyber Threat Intel Brief — 2026-10-07
Generated: 2026-10-07 08:00:54 UTC
Executive summary
Collected 250 recent public-source CTI items for technology-only monitoring.
Priority distribution: P1=4, P2=8, P3=235, P4=3.
Highest-priority item: Ninja Forms plugin flaw exploited to hack WordPress sites (P1, source: BleepingComputer Ransomware News).
15 public IOC highlights selected for analyst awareness.
Priority technology watch items
P1 Ninja Forms plugin flaw exploited to hack WordPress sites — BleepingComputer Ransomware News; score 79; technologies: WordPress.
- Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. [...]
P1 Atlassian warns of critical file-access flaw in Jira, Confluence — BleepingComputer Ransomware News; score 74; technologies: none explicitly matched.
- Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. [...]
P1 CVE-2026-71343 Windows Remote Access Connection Manager Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.
- Updated an acknowledgement. This is an informational change only.
P1 CVE-2026-73009 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.
- Updated an acknowledgement. This is an informational change only.
P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.
- Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://github.com/shahriarrafi/petrichor-environment-testing/raw/refs/heads/main/components/petrichor-environment-testing-ultraenforcement.zip
P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.
- Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/aaamaxito-prog/deadeye/main/Sources/Deadeye/Software-2.6.zip
P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.
- Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/Afrikandercensor3087/Hunt-Showdown-1896-DLC-Unlocker/main/twanginess/Unlocker_Showdown_Hunt_DL_1.1-beta.5.zip
P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.
- Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip;…
P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.
- Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/ngu132/eiken-vocab/HEAD/steps/4-build-wordlist-source/vocab-eiken-2.7-beta.1.zip
P2 RansomLook: Potomac Animal Hospital claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Potomac Animal Hospital. Description excerpt: potomacanimalhospital.com zoominfo.com/c/potomac-animal-hospital/183255483 Potomac Animal Hospital is a family-owned,…
P2 RansomLook: Palma claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Palma. Description excerpt: palmainc.com zoominfo.com/c/palma-inc/344828237 Palma, Inc. is a private, family-owned epoxy flooring manufacturer and installer founded…
P2 Blinder Tunnel Campaign Targets Iraqi Infrastructure — Unit 42 Threat Research; score 50; technologies: none explicitly matched.
- Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42 .
Newly exploited vulnerabilities / CVE watch
P1 CVE-2026-21589: Atlassian warns of critical file-access flaw in Jira, Confluence — technologies: not watchlist-specific.
P1 CVE-2026-71343: CVE-2026-71343 Windows Remote Access Connection Manager Remote Code Execution Vulnerability — technologies: not watchlist-specific.
P1 CVE-2026-73009: CVE-2026-73009 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability — technologies: not watchlist-specific.
P3 CVE-2025-0611, CVE-2025-0612: Chromium: CVE-2025-0611 Object corruption in V8 — technologies: not watchlist-specific.
P3 CVE-2026-69582: CVE-2026-69582 Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
P3 CVE-2026-69265: CVE-2026-69265 Windows NTFS Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
P3 CVE-2026-69844: CVE-2026-69844 Windows Win32k Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
P3 CVE-2026-72999: CVE-2026-72999 Windows USB Hub Driver Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
P3 CVE-2026-61927: CVE-2026-61927 Windows Bind Filter Driver Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
P3 CVE-2026-61936: CVE-2026-61936 Windows Defender Firewall Service Security Feature Bypass Vulnerability — technologies: not watchlist-specific.
P3 CVE-2026-62698: CVE-2026-62698 Microsoft Digest Authentication Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
Ransomware and extortion trend notes
P2 RansomLook: Potomac Animal Hospital claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Potomac Animal Hospital. Description excerpt: potomacanimalhospital.com zoominfo.com/c/potomac-animal-hospital/183255483…
P2 RansomLook: Palma claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Palma. Description excerpt: palmainc.com zoominfo.com/c/palma-inc/344828237 Palma, Inc. is a private, family-owned epoxy…
P3 Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack — How Huntress researchers reconstructed an Akira ransomware attack using Registry artifacts, Akira logs, and other post-compromise evidence.
P3 Engineer sentenced for locking over 3,000 devices on employer network — A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer's network in a ransomware-style attack.…
P3 RansomLook: Merrill Iron & Steel claimed by payoutsking — Public RansomLook extortion-site listing claim. Group: payoutsking. Claimed victim/listing: Merrill Iron & Steel.
P3 RansomLook: Andersen Group claimed by leakeddata — Public RansomLook extortion-site listing claim. Group: leakeddata. Claimed victim/listing: Andersen Group. Description excerpt: To be announced...
P3 RansomLook: KOOKABARRA JUICE claimed by vexy — Public RansomLook extortion-site listing claim. Group: vexy. Claimed victim/listing: KOOKABARRA JUICE. Description excerpt: French manufacturer specializing in fresh-pressed fruit juices, detox juices, smoothies,…
P3 RansomLook: Beni Suef Technological University – BTU claimed by umbra — Public RansomLook extortion-site listing claim. Group: umbra. Claimed victim/listing: Beni Suef Technological University – BTU. Description excerpt: Beni Suef Technological University (BTU) is Egypt’s first…
P3 RansomLook: grunenwald.com claimed by lockbit5 — Public RansomLook extortion-site listing claim. Group: lockbit5. Claimed victim/listing: grunenwald.com. Description excerpt: GRUNENWALD Créateur français d'afficheurs sportifs haute performance depuis 1960, vous…
P3 RansomLook: avsa.com.ar claimed by lockbit5 — Public RansomLook extortion-site listing claim. Group: lockbit5. Claimed victim/listing: avsa.com.ar. Description excerpt: Argentina Valores S.A. is a financial services company focused on capital markets, registered…
P3 RansomLook: Majestic Holidays India Private Limited claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Majestic Holidays India Private Limited. Description excerpt: ajesticindiaholidays.com…
P3 RansomLook: The Law Office of James R Walsh claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: The Law Office of James R Walsh. Description excerpt: jrwalshlaw.com The Law Office of James R. Walsh is a small…
Malware / infrastructure / abuse feed highlights
P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip;…
P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/aaamaxito-prog/deadeye/main/Sources/Deadeye/Software-2.6.zip
P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip;…
P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip;…
P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/ngu132/eiken-vocab/HEAD/steps/4-build-wordlist-source/vocab-eiken-2.7-beta.1.zip
P2 Blinder Tunnel Campaign Targets Iraqi Infrastructure — Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure…
P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip;…
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/Jts36/LanguageModel/main/alphabetist/Model-Language-v2.6.zip
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://github.com/Sam1032/rust-macro-magic/raw/refs/heads/branch/coprojector/macro-rust-magic-v3.8.zip
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip;…
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,LuaJIT-loader,SmartLoader,zip; url=https://raw.githubusercontent.com/oliverquaye23/ai-directories/main/Pholadacea/ai_directories_3.9.zip
IOC highlights
| Type | Value | Context | Source |
| cve | `CVE-2026-21589` | Atlassian warns of critical file-access flaw in Jira, Confluence | BleepingComputer Ransomware News |
| cve | `CVE-2026-71343` | CVE-2026-71343 Windows Remote Access Connection Manager Remote Code Execution Vulnerabilit | Microsoft Security Response Center RSS |
| cve | `CVE-2026-73009` | CVE-2026-73009 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulne | Microsoft Security Response Center RSS |
| cve | `CVE-2025-0611` | Chromium: CVE-2025-0611 Object corruption in V8 | Microsoft Security Response Center RSS |
| cve | `CVE-2025-0612` | Chromium: CVE-2025-0611 Object corruption in V8 | Microsoft Security Response Center RSS |
| cve | `CVE-2026-69582` | CVE-2026-69582 Windows Volume Manager Extension Driver Elevation of Privilege Vulnerabilit | Microsoft Security Response Center RSS |
| cve | `CVE-2026-69265` | CVE-2026-69265 Windows NTFS Elevation of Privilege Vulnerability | Microsoft Security Response Center RSS |
| cve | `CVE-2026-69844` | CVE-2026-69844 Windows Win32k Elevation of Privilege Vulnerability | Microsoft Security Response Center RSS |
| cve | `CVE-2026-72999` | CVE-2026-72999 Windows USB Hub Driver Elevation of Privilege Vulnerability | Microsoft Security Response Center RSS |
| cve | `CVE-2026-61927` | CVE-2026-61927 Windows Bind Filter Driver Elevation of Privilege Vulnerability | Microsoft Security Response Center RSS |
| cve | `CVE-2026-61936` | CVE-2026-61936 Windows Defender Firewall Service Security Feature Bypass Vulnerability | Microsoft Security Response Center RSS |
| cve | `CVE-2026-62698` | CVE-2026-62698 Microsoft Digest Authentication Elevation of Privilege Vulnerability | Microsoft Security Response Center RSS |
| ipv4 | `50.16.16.211` | Feodo Tracker: 1 recommended botnet C2 IPs listed | Feodo Tracker Recommended Blocklist |
| hash | `1b972f45820dd30cbf92c88816007780` | RansomLook: grunenwald.com claimed by lockbit5 | RansomLook Recent Listings |
| hash | `7ea291f1cdc12ccee23f9267a1968a50` | RansomLook: avsa.com.ar claimed by lockbit5 | RansomLook Recent Listings |
Defensive takeaways
Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.
Sources checked
BleepingComputer Ransomware News: ok new=0 fetched=15
CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
Cisco Talos Blog: ok new=0 fetched=15
Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
Huntress Blog: ok new=2 fetched=25
Microsoft Security Response Center RSS: ok new=1 fetched=25
NVD Recent CVEs: ok new=12 fetched=80
ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
RansomLook Recent Listings: ok new=1 fetched=50
Rapid7 Blog: ok new=0 fetched=20
SANS Internet Storm Center: ok new=0 fetched=10
Sophos X-Ops: ok new=0 fetched=15
The DFIR Report: ok new=0 fetched=10
URLhaus Recent URLs: error: HTTP 503 for https://urlhaus.abuse.ch/downloads/csv_recent/: b'<?xml version="1.0" encoding="utf-8"?>\n<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"\n "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">\n<html>\n <head>\n <title>503 Service Unavailable'
Unit 42 Threat Research: ok new=0 fetched=15
Limitations
Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
Technology-only matching can miss relevant items that do not name a tracked product explicitly.
Ransomware victim claims are actor/source claims unless independently corroborated.
IOC highlights are publicly sourced and should be validated before enforcement in production controls.