markcardiff.tech:/daily-intel/2026-10-16.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-16 08:00:34 UTC
P1: 20
P2: 5
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-16

Generated: 2026-10-16 08:00:33 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=20, P2=5, P3=159, P4=66.
  • Highest-priority item: Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers (P1, source: BleepingComputer Ransomware News).
  • 30 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers — BleepingComputer Ransomware News; score 74; technologies: none explicitly matched.

    • - Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]

  • P1 CVE-2026-105599 Microsoft Office PowerPoint Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Microsoft is announcing the availability of the security updates for Microsoft Office for Mac. Customers running affected Mac software should install the update for their product to be protected from this vulnerability. Customers running other Microsoft…

  • P1 CVE-2026-105715 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Microsoft is announcing the availability of the security updates for Microsoft Office for Mac. Customers running affected Mac software should install the update for their product to be protected from this vulnerability. Customers running other Microsoft…

  • P1 CVE-2026-105718 Microsoft Excel Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Microsoft is announcing the availability of the security updates for Microsoft Office for Mac. Customers running affected Mac software should install the update for their product to be protected from this vulnerability. Customers running other Microsoft…

  • P1 CVE-2026-108426 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108427 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108428 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108429 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108430 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108431 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108432 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108437 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108439 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108440 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108441 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108442 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108443 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108444 Microsoft Office Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108445 Microsoft Office Word Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

  • P1 CVE-2026-108446 Microsoft Office Excel Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-110447: Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers — technologies: not watchlist-specific.
  • P1 CVE-2026-105599: CVE-2026-105599 Microsoft Office PowerPoint Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-105715: CVE-2026-105715 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-105718: CVE-2026-105718 Microsoft Excel Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108426: CVE-2026-108426 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108427: CVE-2026-108427 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108428: CVE-2026-108428 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108429: CVE-2026-108429 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108430: CVE-2026-108430 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108431: CVE-2026-108431 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108432: CVE-2026-108432 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108437: CVE-2026-108437 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108439: CVE-2026-108439 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108440: CVE-2026-108440 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108441: CVE-2026-108441 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108442: CVE-2026-108442 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108443: CVE-2026-108443 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108444: CVE-2026-108444 Microsoft Office Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108445: CVE-2026-108445 Microsoft Office Word Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-108446: CVE-2026-108446 Microsoft Office Excel Remote Code Execution Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: police.rajasthan.gov.in claimed by scarlettgroup — Public RansomLook extortion-site listing claim. Group: scarlettgroup. Claimed victim/listing: police.rajasthan.gov.in. Description excerpt: Rajasthan Police is the official law enforcement agency of Rajasthan, India,…
  • P2 RansomLook: Harness Inc. claimed by the seven deadly sins — Public RansomLook extortion-site listing claim. Group: the seven deadly sins. Claimed victim/listing: Harness Inc.. Description excerpt: harness.io Company value ~$5B val · DevOps CI/CD Rows exfiltrated 2.5M+ Affected…
  • P2 RansomLook: iHeartJane claimed by the seven deadly sins — Public RansomLook extortion-site listing claim. Group: the seven deadly sins. Claimed victim/listing: iHeartJane. Description excerpt: iheartjane.com Company value $400M+ raised · cannabis marketplace Rows exfiltrated…
  • P2 RansomLook: Canva Pty Ltd claimed by the seven deadly sins — Public RansomLook extortion-site listing claim. Group: the seven deadly sins. Claimed victim/listing: Canva Pty Ltd. Description excerpt: canva.com Company value ~$40B val · design platform Rows exfiltrated 200M+…
  • P3 RansomLook: Via Credit Union claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Via Credit Union. Description excerpt: Banking
  • P3 RansomLook: www.coopecaja.fi.cr claimed by inc ransom — Public RansomLook extortion-site listing claim. Group: inc ransom. Claimed victim/listing: www.coopecaja.fi.cr.
  • P3 RansomLook: nowaszkola.com claimed by inc ransom — Public RansomLook extortion-site listing claim. Group: inc ransom. Claimed victim/listing: nowaszkola.com.
  • P3 RansomLook: fairfeelegalservices.com claimed by inc ransom — Public RansomLook extortion-site listing claim. Group: inc ransom. Claimed victim/listing: fairfeelegalservices.com.
  • P3 RansomLook: verveba.com \ www.att.com claimed by inc ransom — Public RansomLook extortion-site listing claim. Group: inc ransom. Claimed victim/listing: verveba.com \ www.att.com.
  • P3 RansomLook: Keio Corporation claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Keio Corporation. Description excerpt: Business Services
  • P3 RansomLook: Kemlows Diecasting Products Limited claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Kemlows Diecasting Products Limited. Description excerpt: Business Services
  • P3 RansomLook: TGM Manufacturing, Inc claimed by wallstreet — Public RansomLook extortion-site listing claim. Group: wallstreet. Claimed victim/listing: TGM Manufacturing, Inc. Description excerpt: TGM Manufacturing provides machining services, including automobile machine-shop…

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=SilentNet; url=https://mc-modhub.vercel.app/mods/LarpClient-1.21.11.jar
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=SilentNet; url=https://mc-modhub.vercel.app/mods/GoobaaClient-1.21.11.jar
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=SilentNet; url=https://mc-modhub.vercel.app/mods/OrchardClient-1.21.11.jar
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=SilentNet; url=https://mc-modhub.vercel.app/mods/KrispyClient-1.21.11.jar
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=SilentNet; url=https://mc-modhub.vercel.app/mods/GrimClient-1.21.11.jar
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=SilentNet; url=https://mc-modhub.vercel.app/mods/DqrkisClient-1.21.11.jar
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=SilentNet; url=https://mc-modhub.vercel.app/mods/67client-1.21.11.jar
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=SilentNet; url=https://mc-modhub.vercel.app/mods/ClarityClient-26.1.2.jar
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=SilentNet; url=https://mc-modhub.vercel.app/mods/4eClient-1.21.jar
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ascii,Encoded,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=1zejSPyWGejAr5gTQViaOKk7CxyIA7XWY
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=encrypted,GuLoader,rat,RemcosRAT; url=https://drive.google.com/uc?export=download&id=10ICemtxdkr_yOgc4NZiDkbkzOwJddq22
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=CheatSheet,exe,gitlab; url=https://gitlab.com/YoungBro/fivem-external-cheat/-/raw/HEAD/Loader.exe

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-110447`Hackers exploit Collabora RCE flaw to backdoor Nextcloud serversBleepingComputer Ransomware News
    cve`CVE-2026-105599`CVE-2026-105599 Microsoft Office PowerPoint Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-105715`CVE-2026-105715 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-105718`CVE-2026-105718 Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108426`CVE-2026-108426 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108427`CVE-2026-108427 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108428`CVE-2026-108428 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108429`CVE-2026-108429 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108430`CVE-2026-108430 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108431`CVE-2026-108431 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108432`CVE-2026-108432 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108437`CVE-2026-108437 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108439`CVE-2026-108439 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108440`CVE-2026-108440 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108441`CVE-2026-108441 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108442`CVE-2026-108442 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108443`CVE-2026-108443 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108444`CVE-2026-108444 Microsoft Office Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108445`CVE-2026-108445 Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108446`CVE-2026-108446 Microsoft Office Excel Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108433`CVE-2026-108433 Microsoft Office Word Security Feature Bypass VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108434`CVE-2026-108434 Microsoft Office Word Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108435`CVE-2026-108435 Microsoft Office Word Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108436`CVE-2026-108436 Microsoft Office Word Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108438`CVE-2026-108438 Microsoft Office Word Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`91.92.43.221`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    hash`34634bc8cc016fac205240a20f2770b1`RansomLook: karix.com claimed by lockbit5RansomLook Recent Listings
    hash`6ecacfad25ee6527ec3fa87ca744ef20`RansomLook: torcivialaw.com claimed by lockbit5RansomLook Recent Listings
    hash`8d34b608644114d6e45dd1b947435179`RansomLook: kidzrkooldental.com claimed by lockbit5RansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=2 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=59
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=24 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=1 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: error: syntax error: line 1, column 0
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=114 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation