markcardiff.tech:/daily-intel/2026-10-18.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-18 08:00:28 UTC
P1: 0
P2: 0
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-18

Generated: 2026-10-18 08:00:28 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=0, P2=0, P3=29, P4=221.
  • No P1/P2 items were identified in this run.
  • 3 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • None.

    • Newly exploited vulnerabilities / CVE watch

  • None observed.

    • Ransomware and extortion trend notes

  • P3 RansomLook: U**IN* Group claimed by nightspire — Public RansomLook extortion-site listing claim. Group: nightspire. Claimed victim/listing: U**IN* Group.
  • P3 RansomLook: First Brothers Co., Ltd claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: First Brothers Co., Ltd. Description excerpt: Business Services
  • P3 RansomLook: polisee Inc claimed by vexy — Public RansomLook extortion-site listing claim. Group: vexy. Claimed victim/listing: polisee Inc. Description excerpt: polisee Inc. is a Japanese technology company that develops and operates an AI-powered policy…
  • P3 RansomLook: Decorolala - 500 Line Sample claimed by byod — Public RansomLook extortion-site listing claim. Group: byod. Claimed victim/listing: Decorolala - 500 Line Sample. Description excerpt: Canaidan based home essentials, 60,544 customers, Home addresses + ZIP Code,…
  • P3 RansomLook: Company #86 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #86. Description excerpt: real estate and land development · United States
  • P3 RansomLook: Company #85 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #85. Description excerpt: IT services · USA
  • P3 RansomLook: Company #84 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #84. Description excerpt: construction (custom homes) · USA
  • P3 RansomLook: Company #82 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #82. Description excerpt: special-effects fog fluid manufacturer and distributor (orde · Tennessee, USA
  • P3 RansomLook: Asia Market Ltd claimed by majinahanashi — Public RansomLook extortion-site listing claim. Group: majinahanashi. Claimed victim/listing: Asia Market Ltd. Description excerpt: PENDING Publication scheduled: 2026-10-20T07:14:00Z Attachments: 1
  • P3 RansomLook: Chugoku Bend claimed by everest — Public RansomLook extortion-site listing claim. Group: everest. Claimed victim/listing: Chugoku Bend. Description excerpt: 2 posts - 2h
  • P3 RansomLook: Taekwang Network claimed by everest — Public RansomLook extortion-site listing claim. Group: everest. Claimed victim/listing: Taekwang Network. Description excerpt: 2 posts - 2h
  • P3 RansomLook: Brenner Base Tunnel claimed by everest — Public RansomLook extortion-site listing claim. Group: everest. Claimed victim/listing: Brenner Base Tunnel. Description excerpt: 2 posts - 2h

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=mirai; url=http://45.153.34.235:8765/loader
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=31-56-209-86,elf,ua-wget; url=http://31.56.209.86/realtek_exploit
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=31-56-209-86,python,ua-wget; url=http://31.56.209.86/rt_ac86u_poc.py
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=31-56-209-86,python,ua-wget; url=http://31.56.209.86/vbulletin_poc.py
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=31-56-209-86,python,ua-wget; url=http://31.56.209.86/splunk_poc.py
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=31-56-209-86,python,ua-wget; url=http://31.56.209.86/syno_poc.py
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ActiveMQ; url=http://app-artifacts-1305923417.cos.ap-guangzhou.myqcloud.com/zzp/poc.xml
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ActiveMQ; url=http://app-artifacts-1305923417.cos.ap-guangzhou.myqcloud.com/zzp/poc_win.xml
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,LegionLoader,malware,ROMULUS; url=https://cloubflare.net/1003
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ClickFix,LegionLoader,malware,ROMULUS; url=https://cloubflare.net/login
  • P4 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=None; url=http://220.161.160.148:39073/i

    • IOC highlights

    TypeValueContextSource
    ipv4`45.153.34.235`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`31.56.209.86`URLhaus: malware_download URL observed (online)URLhaus Recent URLs

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=54
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=67 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=0 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation