markcardiff.tech:/daily-intel/2026-10-10.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-10 08:00:29 UTC
P1: 7
P2: 1
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-10

Generated: 2026-10-10 08:00:29 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=7, P2=1, P3=99, P4=143.
  • Highest-priority item: Max severity SonicWall SMA1000 flaw now exploited in attacks (P1, source: BleepingComputer Ransomware News).
  • 21 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 Max severity SonicWall SMA1000 flaw now exploited in attacks — BleepingComputer Ransomware News; score 79; technologies: SonicWall.

    • - Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. [...]

  • P1 CVE-2026-68875 Windows NTFS Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-72979 Windows DHCP Server Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-72982 Windows Netlogon Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-69566 Windows NTFS Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-72987 Windows DNS Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-69598 Windows iSCSI Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P2 URLhaus: malware_download URL observed (offline) — URLhaus Recent URLs; score 53; technologies: WordPress.

    • - Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,EtherHiding,FakeCaptcha,js,Polygon,proliv2929,WordPress; url=https://brows-check.codes/api.php

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-102255: Max severity SonicWall SMA1000 flaw now exploited in attacks — technologies: SonicWall.
  • P1 CVE-2026-68875: CVE-2026-68875 Windows NTFS Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-72979: CVE-2026-72979 Windows DHCP Server Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-72982: CVE-2026-72982 Windows Netlogon Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-69566: CVE-2026-69566 Windows NTFS Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-72987: CVE-2026-72987 Windows DNS Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-69598: CVE-2026-69598 Windows iSCSI Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-68878: CVE-2026-68878 Windows Fast FAT Driver Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69281: CVE-2026-69281 Windows License Manager Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69337: CVE-2026-69337 Windows Registry Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69693: CVE-2026-69693 Windows Device Association Broker Service Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69277: CVE-2026-69277 Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69301: CVE-2026-69301 Windows Win32k Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69322: CVE-2026-69322 Microsoft Windows Search Component Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69324: CVE-2026-69324 Windows Performance Monitor Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69340: CVE-2026-69340 Windows NTFS Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69385: CVE-2026-69385 Windows TCP/IP Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69433: CVE-2026-69433 Windows Error Reporting Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69571: CVE-2026-69571 Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69688: CVE-2026-69688 Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P3 Germany arrests alleged core Qilin ransomware member after extradition — Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan earlier this month. [...]
  • P3 RansomLook: Saber1 claimed by deadlock — Public RansomLook extortion-site listing claim. Group: deadlock. Claimed victim/listing: Saber1. Description excerpt: Saber1 Technologies LLC is a American supplier and distributor of machine vision components,…
  • P3 RansomLook: idi pharma claimed by deadlock — Public RansomLook extortion-site listing claim. Group: deadlock. Claimed victim/listing: idi pharma. Description excerpt: idi pharma is an Italian pharmaceutical company specializing in the research and development of…
  • P3 RansomLook: hoteldelfinolugano.ch claimed by safepay — Public RansomLook extortion-site listing claim. Group: safepay. Claimed victim/listing: hoteldelfinolugano.ch. Description excerpt: The hotel was founded in 1972 and has been managed directly by the Haas family for four…
  • P3 RansomLook: dwi-bau.de claimed by safepay — Public RansomLook extortion-site listing claim. Group: safepay. Claimed victim/listing: dwi-bau.de. Description excerpt: The company specializes in building systems for metal roofs and facades, serving customers in the…
  • P3 RansomLook: astranahealth.com claimed by chaos — Public RansomLook extortion-site listing claim. Group: chaos. Claimed victim/listing: astranahealth.com. Description excerpt: The company's management decided to pull out of the deal with us in order to save money. The…
  • P3 RansomLook: Anne Arundel County claimed by rhysida — Public RansomLook extortion-site listing claim. Group: rhysida. Claimed victim/listing: Anne Arundel County. Description excerpt: Anne Arundel County Established in 1964, Anne Arundel County is a governmental body,…
  • P3 RansomLook: Vadeto Group claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Vadeto Group. Description excerpt: Electronics
  • P3 RansomLook: huntcompanies.com claimed by brain cipher — Public RansomLook extortion-site listing claim. Group: brain cipher. Claimed victim/listing: huntcompanies.com. Description excerpt: We have 80 GB of data. The data includes: military facilities, the military housing…
  • P3 RansomLook: Tepcomp claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Tepcomp. Description excerpt: Electronics
  • P3 RansomLook: Mynd claimed by anubis — Public RansomLook extortion-site listing claim. Group: anubis. Claimed victim/listing: Mynd. Description excerpt: Property owners’ personal data.
  • P3 RansomLook: Shalom Christian Academy claimed by interlock — Public RansomLook extortion-site listing claim. Group: interlock. Claimed victim/listing: Shalom Christian Academy. Description excerpt: https://www.shalomca.com/ As a school, Shalom Christian Academy is legally and…

    • Malware / infrastructure / abuse feed highlights

  • P2 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,EtherHiding,FakeCaptcha,js,Polygon,proliv2929,WordPress; url=https://brows-check.codes/api.php
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://videosnw-ru.vercel.app/?download=1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://dttjjkkllzbvesjzndtp.vercel.app/?download=1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://gibddru.vercel.app/?download=1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=golang,Loader,rat; url=https://situations-clarity-pill-preceding.trycloudflare.com/dl/thwin_ev.exe
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=GuLoader; url=https://drive.google.com/uc?export=download&id=1_UZcQfkdBH4WncF92tW54H57khybkee4
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=exe; url=https://github.com/Nine23423423/Reload1/raw/refs/heads/main/loader.exe
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://briannacorporation.com/cap/Chored.cur
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=encrypted,GuLoader,rat,RemcosRAT; url=https://briannacorporation.com/cap/eZlHodoWq46.bin
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=CheatSheet,exe,github; url=https://github.com/riddents/EulenCheats/raw/HEAD/Loader.exe
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=CheatSheet,exe,github; url=https://github.com/stehts/EulenCheats/raw/HEAD/Loader.exe

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-102255`Max severity SonicWall SMA1000 flaw now exploited in attacksBleepingComputer Ransomware News
    cve`CVE-2026-68875`CVE-2026-68875 Windows NTFS Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-72979`CVE-2026-72979 Windows DHCP Server Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-72982`CVE-2026-72982 Windows Netlogon Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69566`CVE-2026-69566 Windows NTFS Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-72987`CVE-2026-72987 Windows DNS Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69598`CVE-2026-69598 Windows iSCSI Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-68878`CVE-2026-68878 Windows Fast FAT Driver Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69281`CVE-2026-69281 Windows License Manager Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69337`CVE-2026-69337 Windows Registry Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69693`CVE-2026-69693 Windows Device Association Broker Service Elevation of Privilege VulnerabilMicrosoft Security Response Center RSS
    cve`CVE-2026-69277`CVE-2026-69277 Microsoft Local Security Authority (LSA) Server Elevation of Privilege VulnMicrosoft Security Response Center RSS
    cve`CVE-2026-69301`CVE-2026-69301 Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69322`CVE-2026-69322 Microsoft Windows Search Component Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69324`CVE-2026-69324 Windows Performance Monitor Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69340`CVE-2026-69340 Windows NTFS Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69385`CVE-2026-69385 Windows TCP/IP Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69433`CVE-2026-69433 Windows Error Reporting Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69571`CVE-2026-69571 Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege VulnerMicrosoft Security Response Center RSS
    cve`CVE-2026-69688`CVE-2026-69688 Windows Encrypting File System (EFS) Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=31 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=0 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=109 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation