markcardiff.tech:/daily-intel/2026-10-15.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-15 08:00:51 UTC
P1: 6
P2: 4
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-15

Generated: 2026-10-15 08:00:51 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=6, P2=4, P3=80, P4=160.
  • Highest-priority item: Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks (P1, source: BleepingComputer Ransomware News).
  • 26 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks — BleepingComputer Ransomware News; score 104; technologies: Palo Alto.

    • - Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]

  • P1 CISA warns admins to immediately fix Ivanti flaw exploited as zero-day — BleepingComputer Ransomware News; score 79; technologies: Ivanti.

    • - The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...]

  • P1 Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce — Rapid7 Blog; score 77; technologies: none explicitly matched.

    • - Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered CVE-2026-108065 , an SQL Injection vulnerability (CWE-89) in Channel Software WebAlliance eCommerce.The exploit allows a malicious actor to…

  • P1 CVE-2026-70095 Windows iSCSI Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-69676 Windows Kerberos Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-81352 Web Media Extensions Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated product information in the Software Update table. This is an informational change only.

  • P2 Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant — Unit 42 Threat Research; score 54; technologies: none explicitly matched.

    • - We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant appeared first on Unit 42 .

  • P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 53; technologies: Apache.

    • - Public URLhaus recent URL. Threat=malware_download; tags=elf,ua-wget; url=http://45.61.164.81/apache2

  • P2 RansomLook: Estrategias BigMat S.L.U. claimed by aurora — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: aurora. Claimed victim/listing: Estrategias BigMat S.L.U.. Description excerpt: Estrategias BigMat S.L.U. — the Spanish master franchisee of BigMat International, a French cooperative and one of Europe's…

  • P2 RansomLook: Lane Equipment claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Lane Equipment. Description excerpt: Lane Equipment Company has been a trusted food service partner in Texas since 1966, specializing in the sales, leasing, repairs,…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-0322: Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks — technologies: Palo Alto.
  • P1 CVE-2026-108065: Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce — technologies: not watchlist-specific.
  • P1 CVE-2026-70095: CVE-2026-70095 Windows iSCSI Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-69676: CVE-2026-69676 Windows Kerberos Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-81352: CVE-2026-81352 Web Media Extensions Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P2 CVE-2024-47575: Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant — technologies: not watchlist-specific.
  • P3 CVE-2026-105723: CVE-2026-105723 Windows Distributed File System (DFS) Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-70245: CVE-2026-70245 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-84019: CVE-2026-84019 Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-85868: CVE-2026-85868 Windows Common Log File System Driver Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-85870: CVE-2026-85870 Windows Common Log File System Driver Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-102188: CVE-2026-102188 Windows Storage Port Driver Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69366: CVE-2026-69366 Windows Kernel Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-70584: CVE-2026-70584 Windows Core Messaging Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-72937: CVE-2026-72937 Windows Storage Port Driver Information Disclosure Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-62697: CVE-2026-62697 Windows Push Notifications Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69351: CVE-2026-69351 Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-32176: CVE-2026-32176 SQL Server Elevation of Privilege Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Estrategias BigMat S.L.U. claimed by aurora — Public RansomLook extortion-site listing claim. Group: aurora. Claimed victim/listing: Estrategias BigMat S.L.U.. Description excerpt: Estrategias BigMat S.L.U. — the Spanish master franchisee of BigMat International, a…
  • P2 RansomLook: Lane Equipment claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Lane Equipment. Description excerpt: Lane Equipment Company has been a trusted food service partner in Texas since 1966,…
  • P3 RansomLook: E-Z Pack Trucks claimed by wallstreet — Public RansomLook extortion-site listing claim. Group: wallstreet. Claimed victim/listing: E-Z Pack Trucks. Description excerpt: E-Z Pack Trucks (E-Z Pack Manufacturing) is a U.S. maker of refuse and recycling truck…
  • P3 7 Key Manufacturing Cybersecurity Trends for 2027 | Huntress — Explore the latest manufacturing cybersecurity trends, from ransomware to OT takeovers, and real-world risks to production. Learn how to secure your plant.
  • P3 What Cybersecurity Leaders Must Prioritize in 2027 — The threat landscape has shifted. Here's what cybersecurity leaders need to know about RMM abuse, AI-powered attacks, ransomware, and identity threats in 2026.
  • P3 RansomLook: Alma Center Servizi Medicali S.r.l. claimed by space bears — Public RansomLook extortion-site listing claim. Group: space bears. Claimed victim/listing: Alma Center Servizi Medicali S.r.l.. Description excerpt: Alma Center is a private multi-specialty diagnostic and outpatient…
  • P3 RansomLook: Holistic Health Group, Inc. (d/b/a Suncrafted) claimed by space bears — Public RansomLook extortion-site listing claim. Group: space bears. Claimed victim/listing: Holistic Health Group, Inc. (d/b/a Suncrafted). Description excerpt: A vertically integrated cannabis company based in…
  • P3 RansomLook: Company #69 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #69. Description excerpt: Software / fundraising services · California, USA
  • P3 RansomLook: Company #67 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #67. Description excerpt: FX liquidity and trading technology · Netherlands
  • P3 RansomLook: Company #68 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #68. Description excerpt: manufacturing · USA
  • P3 RansomLook: alera claimed by iah647 — Public RansomLook extortion-site listing claim. Group: iah647. Claimed victim/listing: alera. Description excerpt: status: public | hosting: preparing…
  • P3 RansomLook: Company #66 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #66. Description excerpt: software quality assurance (tax and accounting software test · California, USA

    • Malware / infrastructure / abuse feed highlights

  • P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=elf,ua-wget; url=http://45.61.164.81/apache2
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=rat;…
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=AsyncRAT,botnet,c2,gate,payload;…
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet; url=http://151.242.30.142/NebulaC2-main.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet; url=http://151.242.30.142/bBOTNET.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet; url=http://151.242.30.142/Fathir--C2.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet; url=http://151.242.30.142/Botnet.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=exploit; url=http://151.242.30.142/ExpShell.zip
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=botnet; url=http://177.3.213.149/eclipse.arm
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=botnet; url=http://177.3.213.149/eclipse.m68k
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=exploit; url=http://151.242.30.142/exploit.js

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-0322`Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacksBleepingComputer Ransomware News
    cve`CVE-2026-108065`Unauthenticated SQL Injection In Channel Software WebAlliance eCommerceRapid7 Blog
    cve`CVE-2026-70095`CVE-2026-70095 Windows iSCSI Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69676`CVE-2026-69676 Windows Kerberos Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-81352`CVE-2026-81352 Web Media Extensions Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2024-47575`Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate ImplantUnit 42 Threat Research
    ipv4`45.61.164.81`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    cve`CVE-2026-105723`CVE-2026-105723 Windows Distributed File System (DFS) Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-70245`CVE-2026-70245 Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerMicrosoft Security Response Center RSS
    cve`CVE-2026-84019`CVE-2026-84019 Windows Advanced Rasterization Platform Elevation of Privilege VulnerabilitMicrosoft Security Response Center RSS
    cve`CVE-2026-85868`CVE-2026-85868 Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-85870`CVE-2026-85870 Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-102188`CVE-2026-102188 Windows Storage Port Driver Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69366`CVE-2026-69366 Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-70584`CVE-2026-70584 Windows Core Messaging Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-72937`CVE-2026-72937 Windows Storage Port Driver Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-62697`CVE-2026-62697 Windows Push Notifications Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69351`CVE-2026-69351 Windows Universal Plug and Play (UPnP) Device Host Information Disclosure VMicrosoft Security Response Center RSS
    cve`CVE-2026-32176`CVE-2026-32176 SQL Server Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`151.242.30.142`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`177.3.213.149`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`185.113.10.26`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`185.117.91.6`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`47.92.205.158`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    hash`3501b906ca194c9e3a349c29ac277fe4`RansomLook: kordhotels.gr claimed by lockbit5RansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=60
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=1 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=60 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=1 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=48 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation