markcardiff.tech:/daily-intel/2026-10-09.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-09 08:00:45 UTC
P1: 3
P2: 5
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-09

Generated: 2026-10-09 08:00:44 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=3, P2=5, P3=65, P4=177.
  • Highest-priority item: Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer (P1, source: Huntress Blog).
  • 16 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer — Huntress Blog; score 77; technologies: none explicitly matched.

    • - Threat actors are exploiting AhsayCBS flaws, including CVE-2026-105133 and CVE-2026-105134, to deploy webshells and XMRig cryptominers. Update to 10.3.4 and restrict access now.

  • P1 CVE-2026-77900 Azure App Service Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.

  • P1 CVE-2026-88131 Microsoft Dataverse Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.

  • P2 RansomLook: SOCOCO claimed by umbra — RansomLook Recent Listings; score 58; technologies: WordPress.

    • - Public RansomLook extortion-site listing claim. Group: umbra. Claimed victim/listing: SOCOCO. Description excerpt: [PSA] SOCOCO — A Brazilian mid-sized food company with 40 employees, blending tradition and modern marketing through WordPress-driven platforms.…

  • P2 RansomLook: IIT Roorkee claimed by umbra — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: umbra. Claimed victim/listing: IIT Roorkee. Description excerpt: [PSA] IIT Roorkee — India’s oldest institute excelling in Engineering, Architecture, Computer Science, Water Resources, Energy, and Applied…

  • P2 RansomLook: Boullard Musique claimed by payload — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: payload. Claimed victim/listing: Boullard Musique. Description excerpt: Boullard Musique (boullard.ch) is one of Switzerland's premier specialty retailers of musical instruments and audio gear, founded in…

  • P2 RansomLook: RÉSO claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: RÉSO. Description excerpt: Réso specializes in secondary works, offering a wide range of products including ceilings, partitions, floors, technical floors, and…

  • P2 RansomLook: Petrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda. claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Petrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda.. Description excerpt: Petrosul is a Brazilian company established in 1994, specializing in fuel…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-105133, CVE-2026-105134: Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer — technologies: not watchlist-specific.
  • P1 CVE-2026-77900: CVE-2026-77900 Azure App Service Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-88131: CVE-2026-88131 Microsoft Dataverse Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69581: CVE-2026-69581 Windows Device Association Service Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-58528: CVE-2026-58528 Windows USB Audio Class Driver Information Disclosure Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69270: CVE-2026-69270 Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-77904: CVE-2026-77904 Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69435: CVE-2026-69435 Azure SRE Agent Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-83943: CVE-2026-83943 Azure API Center Information Disclosure Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-83947: CVE-2026-83947 Azure Event Grid Spoofing Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-94510: CVE-2026-94510 Microsoft Bookings Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-96207: CVE-2026-96207 Microsoft Partner Center Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2025-11215: Chromium: CVE-2025-11215 Off by one error in V8 — technologies: not watchlist-specific.
  • P3 CVE-2025-11219: Chromium: CVE-2025-11219 Use after free in V8 — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: SOCOCO claimed by umbra — Public RansomLook extortion-site listing claim. Group: umbra. Claimed victim/listing: SOCOCO. Description excerpt: [PSA] SOCOCO — A Brazilian mid-sized food company with 40 employees, blending tradition and modern…
  • P2 RansomLook: IIT Roorkee claimed by umbra — Public RansomLook extortion-site listing claim. Group: umbra. Claimed victim/listing: IIT Roorkee. Description excerpt: [PSA] IIT Roorkee — India’s oldest institute excelling in Engineering, Architecture, Computer…
  • P2 RansomLook: Boullard Musique claimed by payload — Public RansomLook extortion-site listing claim. Group: payload. Claimed victim/listing: Boullard Musique. Description excerpt: Boullard Musique (boullard.ch) is one of Switzerland's premier specialty retailers of…
  • P2 RansomLook: RÉSO claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: RÉSO. Description excerpt: Réso specializes in secondary works, offering a wide range of products including ceilings,…
  • P2 RansomLook: Petrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda. claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Petrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda.. Description excerpt: Petrosul is a Brazilian company…
  • P3 Ransomware attack disrupts Japan's IDCF Cloud used by govt clients — IDC Frontier, a major Japanese cloud and digital infrastructure company, disclosed that its IDCF Cloud service was targeted in a ransomware attack that caused an outage at a data center cluster serving the eastern part…
  • P3 RansomLook: Fondy Food Pantry claimed by nightspire — Public RansomLook extortion-site listing claim. Group: nightspire. Claimed victim/listing: Fondy Food Pantry.
  • P3 RansomLook: The Bernard Osher Foundation claimed by nightspire — Public RansomLook extortion-site listing claim. Group: nightspire. Claimed victim/listing: The Bernard Osher Foundation.
  • P3 RansomLook: PMG Project Management Group claimed by nightspire — Public RansomLook extortion-site listing claim. Group: nightspire. Claimed victim/listing: PMG Project Management Group.
  • P3 RansomLook: Mäntelhaus Kaiser GmbH & Co. KG claimed by nightspire — Public RansomLook extortion-site listing claim. Group: nightspire. Claimed victim/listing: Mäntelhaus Kaiser GmbH & Co. KG.
  • P3 RansomLook: INAPI claimed by nightspire — Public RansomLook extortion-site listing claim. Group: nightspire. Claimed victim/listing: INAPI.
  • P3 RansomLook: Medcom Tech Information claimed by nightspire — Public RansomLook extortion-site listing claim. Group: nightspire. Claimed victim/listing: Medcom Tech Information.

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags= BeaverTail,ContagiousInterview; url=https://trickgs-demo.vercel.app/api/settings/linux
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags= BeaverTail,ContagiousInterview; url=https://trickgs-demo.vercel.app/api/settings/env
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags= BeaverTail,ContagiousInterview; url=https://trickgs-demo.vercel.app/api/settings/windows
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags= BeaverTail,ContagiousInterview; url=https://trickgs-demo.vercel.app/api/settings/mac
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1L_cku7GNkFeUfFiU2VEsvHDZJbSvzJMx
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=14oEkhhftO_xx6X0Db-qpZwUl_arXfhIO
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=CheatSheet,exe,gitlab; url=https://gitlab.com/RockyStars/fivem-external-cheat-33102/-/raw/main/Loader.exe
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=CheatSheet,exe,gitlab; url=https://gitlab.com/vampscore/fivem-external-cheat/-/raw/main/Loader.exe
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=CheatSheet,exe,gitlab; url=https://gitlab.com/ladycage/eulencheats-fivem/-/raw/main/Loader.exe
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=CheatSheet,exe,gitlab; url=https://gitlab.com/amnesiacalms/fivem-external-cheat/-/raw/main/Loader.exe
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=CheatSheet,exe,github,rustystealer; url=https://raw.githubusercontent.com/lampage3/FIVEM-Cheat-with-Lua-Executor-and-dumper/HEAD/Loader.exe

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-105133`Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig CryptominerHuntress Blog
    cve`CVE-2026-105134`Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig CryptominerHuntress Blog
    cve`CVE-2026-77900`CVE-2026-77900 Azure App Service Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-88131`CVE-2026-88131 Microsoft Dataverse Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69581`CVE-2026-69581 Windows Device Association Service Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-58528`CVE-2026-58528 Windows USB Audio Class Driver Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69270`CVE-2026-69270 Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege VulnerMicrosoft Security Response Center RSS
    cve`CVE-2026-77904`CVE-2026-77904 Windows Volume Manager Extension Driver Elevation of Privilege VulnerabilitMicrosoft Security Response Center RSS
    cve`CVE-2026-69435`CVE-2026-69435 Azure SRE Agent Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-83943`CVE-2026-83943 Azure API Center Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-83947`CVE-2026-83947 Azure Event Grid Spoofing VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-94510`CVE-2026-94510 Microsoft Bookings Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-96207`CVE-2026-96207 Microsoft Partner Center Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2025-11215`Chromium: CVE-2025-11215 Off by one error in V8Microsoft Security Response Center RSS
    cve`CVE-2025-11219`Chromium: CVE-2025-11219 Use after free in V8Microsoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=1 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=1 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=47 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=3 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=1 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=95 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation