markcardiff.tech:/daily-intel/2026-10-12.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-12 08:00:48 UTC
P1: 0
P2: 2
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-12

Generated: 2026-10-12 08:00:48 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=0, P2=2, P3=62, P4=186.
  • Highest-priority item: RansomLook: Eversource Energy claimed by redact (P2, source: RansomLook Recent Listings).
  • 10 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P2 RansomLook: Eversource Energy claimed by redact — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: redact. Claimed victim/listing: Eversource Energy. Description excerpt: Revenue: $14B USD | Sector: Energy Distribution | Stock Ticker: NYSE:ES | Data Size: 3.8 TB | Files: 751,887

  • P2 RansomLook: TQC S.A. claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: TQC S.A.. Description excerpt: (A release of 750 GB of data, compressed into archives for convenience.) TQC Tecnología Química Comercio S. A. specializes in providing…

    Newly exploited vulnerabilities / CVE watch

  • P3 CVE-2025-12429: Chromium: CVE-2025-12429 Inappropriate implementation in V8 — technologies: not watchlist-specific.
  • P3 CVE-2025-12428: Chromium: CVE-2025-12428 Type Confusion in V8 — technologies: not watchlist-specific.
  • P3 CVE-2025-12727: Chromium: CVE-2025-12727 Inappropriate implementation in V8 — technologies: not watchlist-specific.
  • P3 CVE-2025-12433: Chromium: CVE-2025-12433 Inappropriate implementation in V8 — technologies: not watchlist-specific.
  • P3 CVE-2025-12441: Chromium: CVE-2025-12441 Out of bounds read in V8 — technologies: not watchlist-specific.
  • P3 CVE-2025-12432: Chromium: CVE-2025-12432 Race in V8 — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Eversource Energy claimed by redact — Public RansomLook extortion-site listing claim. Group: redact. Claimed victim/listing: Eversource Energy. Description excerpt: Revenue: $14B USD | Sector: Energy Distribution | Stock Ticker: NYSE:ES | Data Size: 3.8 TB…
  • P2 RansomLook: TQC S.A. claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: TQC S.A.. Description excerpt: (A release of 750 GB of data, compressed into archives for convenience.) TQC Tecnología Química…
  • P3 RansomLook: MGT Lojistik AŞ claimed by nightspire — Public RansomLook extortion-site listing claim. Group: nightspire. Claimed victim/listing: MGT Lojistik AŞ.
  • P3 RansomLook: KP Industries claimed by nightspire — Public RansomLook extortion-site listing claim. Group: nightspire. Claimed victim/listing: KP Industries.
  • P3 RansomLook: Company #24 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #24. Description excerpt: smart building & surveillance integration · California, USA
  • P3 RansomLook: Spelman Logistics claimed by emperador — Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: Spelman Logistics. Description excerpt: Dear Spelman Logistics, We are now in possession of 1.2M contact records (emails and…
  • P3 RansomLook: Company #23 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #23. Description excerpt: smart building & surveillance integration · California, USA
  • P3 RansomLook: Company #22 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #22. Description excerpt: architecture & design · Florida, USA
  • P3 RansomLook: Company #21 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #21. Description excerpt: neurology practice · New South Wales, Australia
  • P3 RansomLook: Company #20 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #20. Description excerpt: cannabis operator · Michigan, USA
  • P3 RansomLook: Company #19 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #19. Description excerpt: confectionery & telehealth · New York, USA
  • P3 RansomLook: Company #14 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #14. Description excerpt: Financial services · Canada

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ContagiousInterview,js,npm; url=https://db-connectors.vercel.app/server/v2
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ContagiousInterview,js,npm; url=https://db-connectify.vercel.app/server/v2
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=SilentNet; url=https://mc-modhub.vercel.app/mods/dupemod-26.x.jar
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=apk ,mamont; url=https://videdtp-rus.vercel.app/?download=1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1BAlUSCPNZCeMy4RL5mAJ3YnfYXKrSM2L
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1l7z_xcVoPUuFUtTXIRSucUuKWe-rnwmw
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://briannacorporation.com/manager/Equiradial.xsn
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=encrypted,GuLoader,rat,RemcosRAT; url=https://briannacorporation.com/manager/MpcZsNiyLyPAfar30.bin
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=downloader,sh; url=http://45.198.224.34/snype.sh
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,luajit,SmartLoader,Stealc,zip;…
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,luajit,SmartLoader,Stealc,zip; url=https://raw.githubusercontent.com/rdjverse/CancerGuardian/HEAD/model/Guardian_Cancer_1.6.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,luajit,SmartLoader,Stealc,zip; url=https://raw.githubusercontent.com/dezqy/core-keeper-mod-menu/HEAD/hydrocele/keeper_mod_core_menu_v3.8.zip

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2025-12429`Chromium: CVE-2025-12429 Inappropriate implementation in V8Microsoft Security Response Center RSS
    cve`CVE-2025-12428`Chromium: CVE-2025-12428 Type Confusion in V8Microsoft Security Response Center RSS
    cve`CVE-2025-12727`Chromium: CVE-2025-12727 Inappropriate implementation in V8Microsoft Security Response Center RSS
    cve`CVE-2025-12433`Chromium: CVE-2025-12433 Inappropriate implementation in V8Microsoft Security Response Center RSS
    cve`CVE-2025-12441`Chromium: CVE-2025-12441 Out of bounds read in V8Microsoft Security Response Center RSS
    cve`CVE-2025-12432`Chromium: CVE-2025-12432 Race in V8Microsoft Security Response Center RSS
    ipv4`45.198.224.34`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`103.170.217.170`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`209.99.184.98`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=54
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=6 fetched=25
  • NVD Recent CVEs: ok new=28 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=1 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation