markcardiff.tech:/daily-intel/2026-10-13.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-13 08:00:36 UTC
P1: 0
P2: 4
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-13

Generated: 2026-10-13 08:00:36 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=0, P2=4, P3=99, P4=147.
  • Highest-priority item: URLhaus: malware_download URL observed (online) (P2, source: URLhaus Recent URLs).
  • 12 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags= CommonsCollections6, deserialization, exploit, java, RCE, reverse-shell, Sliver,ysoserial; url=http://38.60.179.31:9999/payload.bin

  • P2 RansomLook: Rechtsanwaltskanzlei Dr. Bien claimed by aurora — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: aurora. Claimed victim/listing: Rechtsanwaltskanzlei Dr. Bien. Description excerpt: Rechtsanwaltskanzlei Dr. Bien — a specialist insolvency law firm in Hamm, NRW, appointed as insolvency administrator by…

  • P2 RansomLook: SA BAUFER V.F claimed by majinahanashi — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: majinahanashi. Claimed victim/listing: SA BAUFER V.F. Description excerpt: LEAK 2026-10-04 SA BAUFER VF is a Swiss company that specializes in the processing, supply, and installation of reinforcing steel…

  • P2 RansomLook: Eversource Energy claimed by redact — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: redact. Claimed victim/listing: Eversource Energy. Description excerpt: Revenue: $14B USD | Sector: Energy Distribution | Stock Ticker: NYSE:ES | Data Size: 3.8 TB | Files: 751,887

    Newly exploited vulnerabilities / CVE watch

  • P3 CVE-2025-12429: Chromium: CVE-2025-12429 Inappropriate implementation in V8 — technologies: not watchlist-specific.
  • P3 CVE-2025-12428: Chromium: CVE-2025-12428 Type Confusion in V8 — technologies: not watchlist-specific.
  • P3 CVE-2025-12727: Chromium: CVE-2025-12727 Inappropriate implementation in V8 — technologies: not watchlist-specific.
  • P3 CVE-2025-12433: Chromium: CVE-2025-12433 Inappropriate implementation in V8 — technologies: not watchlist-specific.
  • P3 CVE-2025-12441: Chromium: CVE-2025-12441 Out of bounds read in V8 — technologies: not watchlist-specific.
  • P3 CVE-2025-12432: Chromium: CVE-2025-12432 Race in V8 — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Rechtsanwaltskanzlei Dr. Bien claimed by aurora — Public RansomLook extortion-site listing claim. Group: aurora. Claimed victim/listing: Rechtsanwaltskanzlei Dr. Bien. Description excerpt: Rechtsanwaltskanzlei Dr. Bien — a specialist insolvency law firm in Hamm, NRW,…
  • P2 RansomLook: SA BAUFER V.F claimed by majinahanashi — Public RansomLook extortion-site listing claim. Group: majinahanashi. Claimed victim/listing: SA BAUFER V.F. Description excerpt: LEAK 2026-10-04 SA BAUFER VF is a Swiss company that specializes in the processing,…
  • P2 RansomLook: Eversource Energy claimed by redact — Public RansomLook extortion-site listing claim. Group: redact. Claimed victim/listing: Eversource Energy. Description excerpt: Revenue: $14B USD | Sector: Energy Distribution | Stock Ticker: NYSE:ES | Data Size: 3.8 TB…
  • P3 RansomLook: hiqbio.com claimed by safepay — Public RansomLook extortion-site listing claim. Group: safepay. Claimed victim/listing: hiqbio.com. Description excerpt: The company focuses on applying marine biotechnology to human health, animal health, functional…
  • P3 RansomLook: Trailerbridge.com claimed by brain cipher — Public RansomLook extortion-site listing claim. Group: brain cipher. Claimed victim/listing: Trailerbridge.com. Description excerpt: 76200 files containing customer data: invoices, remittances, commercial relations with…
  • P3 RansomLook: The Park Lane Hong Kong claimed by orova — Public RansomLook extortion-site listing claim. Group: orova. Claimed victim/listing: The Park Lane Hong Kong. Description excerpt: The Park Lane Hong Kong, Autograph Collection - A Signature Hotel in the Marriott…
  • P3 RansomLook: Libre Wireless Technologies claimed by orova — Public RansomLook extortion-site listing claim. Group: orova. Claimed victim/listing: Libre Wireless Technologies. Description excerpt: Explore our certified platforms, ranging from MAVID, renowned for being the…
  • P3 RansomLook: Amantya Technologies claimed by orova — Public RansomLook extortion-site listing claim. Group: orova. Claimed victim/listing: Amantya Technologies. Description excerpt: Amantya brings together deep expertise in AI, software, data, cloud, telecom, GIS, and…
  • P3 RansomLook: Gatetech Technology claimed by orova — Public RansomLook extortion-site listing claim. Group: orova. Claimed victim/listing: Gatetech Technology. Description excerpt: Gatetech have dedicated light metal casting industry for over 20 years, be able to offer…
  • P3 RansomLook: RingSide Creative claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: RingSide Creative. Description excerpt: Business Services
  • P3 RansomLook: Franklin Miller Inc. claimed by dark project — Public RansomLook extortion-site listing claim. Group: dark project. Claimed victim/listing: Franklin Miller Inc.. Description excerpt: As a result of the attack on "Franklin Miller", more than 250 GB of confidential…
  • P3 RansomLook: Claire's Inc. claimed by dark project — Public RansomLook extortion-site listing claim. Group: dark project. Claimed victim/listing: Claire's Inc.. Description excerpt: Claire's Inc. suffered a cyberattack that disrupted its operations and compromised…

    • Malware / infrastructure / abuse feed highlights

  • P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags= CommonsCollections6, deserialization, exploit, java, RCE, reverse-shell, Sliver,ysoserial; url=http://38.60.179.31:9999/payload.bin
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=None; url=https://tms.hazentransferllc.com/GeneralRequirementsV2.aspx_files/saved_resource.html
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=None; url=https://vejnqoajk1soxy1x.public.blob.vercel-storage.com/OpenWordDocument.ps1
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ContagiousInterview,js,npm; url=https://db-connectors.vercel.app/server/v2
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ContagiousInterview,js,npm; url=https://db-connectify.vercel.app/server/v2
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=dropper-job,github; url=https://github.com/MajorRaikage45/MimiLokinil/releases/download/v2.6/Loader.v2.6.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=downloader,sh; url=http://45.198.224.34/snypesh.sh
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,DEU,exe,FileFix,Loader,powershell; url=https://krause-fahrzeuge.de/api/poly-token
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,DEU,exe,FileFix,Loader,powershell; url=https://krause-fahrzeuge.de/api/poly-token
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,DEU,exe,FileFix,Loader,powershell; url=https://krause-fahrzeuge.de/api/cm-token
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,DEU,exe,FileFix,Loader,powershell; url=https://krause-fahrzeuge.de/api/cm-token

    • IOC highlights

    TypeValueContextSource
    ipv4`38.60.179.31`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    cve`CVE-2025-12429`Chromium: CVE-2025-12429 Inappropriate implementation in V8Microsoft Security Response Center RSS
    cve`CVE-2025-12428`Chromium: CVE-2025-12428 Type Confusion in V8Microsoft Security Response Center RSS
    cve`CVE-2025-12727`Chromium: CVE-2025-12727 Inappropriate implementation in V8Microsoft Security Response Center RSS
    cve`CVE-2025-12433`Chromium: CVE-2025-12433 Inappropriate implementation in V8Microsoft Security Response Center RSS
    cve`CVE-2025-12441`Chromium: CVE-2025-12441 Out of bounds read in V8Microsoft Security Response Center RSS
    cve`CVE-2025-12432`Chromium: CVE-2025-12432 Race in V8Microsoft Security Response Center RSS
    ipv4`45.198.224.34`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    hash`fd42c40204f038686ab0243f5f2cc33b7e4dd033c34319aaad4fd0557e70d89c`RansomLook: MyMichigan Health claimed by metaencryptorRansomLook Recent Listings
    hash`15e8790a255b2761b74110431d3f96f460e5e3eb2a7afb547b084fe9c5169f62`RansomLook: VIATechnik claimed by metaencryptorRansomLook Recent Listings
    hash`222c14ecc18ad6c9bfad5e426ab3028273ab587161552a5ccc2926218991e362`RansomLook: VIATechnik claimed by metaencryptorRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=54
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=80 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=0 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=101 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation