Daily Cyber Threat Intel Brief — 2026-10-11
Generated: 2026-10-11 08:00:17 UTC
Executive summary
Collected 250 recent public-source CTI items for technology-only monitoring.
Priority distribution: P1=0, P2=4, P3=35, P4=211.
Highest-priority item: RansomLook: Confluent claimed by the gentlemen (P2, source: RansomLook Recent Listings).
5 public IOC highlights selected for analyst awareness.
Priority technology watch items
P2 RansomLook: Confluent claimed by the gentlemen — RansomLook Recent Listings; score 58; technologies: Apache.
- Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Confluent. Description excerpt: confluent.io Revenue $1.16 Billion Confluent is the enterprise data streaming platform built on Apache Kafka that lets companies…
P2 RansomLook: TEXMA International Co., Ltd claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: TEXMA International Co., Ltd. Description excerpt: TEXMA International Co., Ltd. is a leading Taiwanese apparel manufacturer specializing in high-quality women's woven…
P2 RansomLook: Royal Thai Air Force claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Royal Thai Air Force. Description excerpt: rtaf.mi.th is the official portal of the Royal Thai Air Force, one of Asia's oldest air forces (founded November 2, 1913;…
P2 URLhaus: malware_download URL observed (offline) — URLhaus Recent URLs; score 53; technologies: WordPress.
- Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,EtherHiding,FakeCaptcha,js,Polygon,proliv2929,WordPress; url=https://brows-check.codes/api.php
Newly exploited vulnerabilities / CVE watch
None observed.
Ransomware and extortion trend notes
P2 RansomLook: Confluent claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Confluent. Description excerpt: confluent.io Revenue $1.16 Billion Confluent is the enterprise data streaming platform built…
P2 RansomLook: TEXMA International Co., Ltd claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: TEXMA International Co., Ltd. Description excerpt: TEXMA International Co., Ltd. is a leading Taiwanese apparel manufacturer…
P2 RansomLook: Royal Thai Air Force claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Royal Thai Air Force. Description excerpt: rtaf.mi.th is the official portal of the Royal Thai Air Force, one of Asia's…
P3 RansomLook: Charles E. Tabor AAL LLC claimed by rhysida — Public RansomLook extortion-site listing claim. Group: rhysida. Claimed victim/listing: Charles E. Tabor AAL LLC. Description excerpt: Charles E. Tabor AAL LLC 96,456 files / ~114.5 GBSettlement checks � 2026: $600,000…
P3 RansomLook: Confipetrol claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Confipetrol. Description excerpt: Business Services
P3 RansomLook: Supreme Energy claimed by panzer — Public RansomLook extortion-site listing claim. Group: panzer. Claimed victim/listing: Supreme Energy. Description excerpt: Supreme Energy is an Indonesian renewable-energy company that develops geothermal power…
P3 RansomLook: solutend claimed by panzer — Public RansomLook extortion-site listing claim. Group: panzer. Claimed victim/listing: solutend. Description excerpt: Bolivian technology company that provides audiovisual systems, digital signage, interactive displays,…
P3 RansomLook: maltest claimed by shiba — Public RansomLook extortion-site listing claim. Group: shiba. Claimed victim/listing: maltest. Description excerpt: Construction - Algeria awdwa daw daw dawdwa
P3 RansomLook: BigID claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: BigID. Description excerpt: bigid.com Revenue $100 Million BigID is the enterprise data security platform that finds and…
P3 RansomLook: MoneyGram claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: MoneyGram. Description excerpt: moneygram.com Revenue $1.24 Billion MoneyGram global money transfer network moving nearly…
P3 RansomLook: Placer AI claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Placer AI. Description excerpt: placer.ai Revenue $136.5 Million private US company valued at $1.5 billion that sells foot…
P3 RansomLook: KFC claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: KFC. Description excerpt: kfc.com Revenue $36.4 Billion KFC runs 34,747 restaurants across 150+ countries and about 99% are…
Malware / infrastructure / abuse feed highlights
P2 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,EtherHiding,FakeCaptcha,js,Polygon,proliv2929,WordPress; url=https://brows-check.codes/api.php
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://videdtp-rus.vercel.app/?download=1
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://videosnw-ru.vercel.app/?download=1
P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://videosnw-ru.vercel.app/?download=1
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://dttjjkkllzbvesjzndtp.vercel.app/?download=1
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://gibddru.vercel.app/?download=1
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=Amos,ClickFix,Foxveil,Loader,Mach-O,macOS,ua-curl; url=https://fable-shine.com/f/9ksbxnvwoj7pts0uxop4sa/01pemlfd
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=downloader,sh; url=http://103.170.217.170/sora.sh
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=CheatSheet,exe,gitlab; url=https://gitlab.com/SpinRain/warzoneexternalcheat/-/raw/HEAD/Loader.exe
P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=downloader,sh; url=http://209.99.184.98/sora.sh
P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=CheatSheet,exe,gitlab; url=https://gitlab.com/downshifts/valorantexternalcheat/-/raw/HEAD/Loader.exe
P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
IOC highlights
| Type | Value | Context | Source |
| ipv4 | `103.170.217.170` | URLhaus: malware_download URL observed (online) | URLhaus Recent URLs |
| ipv4 | `209.99.184.98` | URLhaus: malware_download URL observed (offline) | URLhaus Recent URLs |
| ipv4 | `50.16.16.211` | Feodo Tracker: 1 recommended botnet C2 IPs listed | Feodo Tracker Recommended Blocklist |
| hash | `4921568819c3e589cc145d506fe0939e` | RansomLook: poolegroup.com.au claimed by lockbit5 | RansomLook Recent Listings |
| hash | `203103916a7e57f725aefa8a3a371d0a` | RansomLook: saintpierredescorps.fr claimed by lockbit5 | RansomLook Recent Listings |
Defensive takeaways
Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.
Sources checked
BleepingComputer Ransomware News: ok new=0 fetched=15
CISA Known Exploited Vulnerabilities: ok new=0 fetched=57
Cisco Talos Blog: ok new=0 fetched=15
Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
Huntress Blog: ok new=0 fetched=25
Microsoft Security Response Center RSS: ok new=0 fetched=25
NVD Recent CVEs: ok new=72 fetched=80
ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
RansomLook Recent Listings: ok new=1 fetched=50
Rapid7 Blog: ok new=0 fetched=20
SANS Internet Storm Center: ok new=0 fetched=10
Sophos X-Ops: ok new=0 fetched=15
The DFIR Report: ok new=0 fetched=10
URLhaus Recent URLs: ok new=120 fetched=120
Unit 42 Threat Research: ok new=0 fetched=15
Limitations
Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
Technology-only matching can miss relevant items that do not name a tracked product explicitly.
Ransomware victim claims are actor/source claims unless independently corroborated.
IOC highlights are publicly sourced and should be validated before enforcement in production controls.