markcardiff.tech:/daily-intel/2026-10-19.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-19 08:00:22 UTC
P1: 0
P2: 5
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-19

Generated: 2026-10-19 08:00:22 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=0, P2=5, P3=41, P4=204.
  • Highest-priority item: RansomLook: Patriot Maritime claimed by storm (P2, source: RansomLook Recent Listings).
  • 7 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P2 RansomLook: Patriot Maritime claimed by storm — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Patriot Maritime. Description excerpt: Aerospace & Defense | Concord, California, United States | Patriot Maritime is a leading maritime contractor in the United States,…

  • P2 RansomLook: oakgrovetech claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: oakgrovetech. Description excerpt: The company specializes in multi-domain training, unmanned systems & robotics, cyber/space operations, learning/courseware…

  • P2 URLhaus: malware_download URL observed (offline) — URLhaus Recent URLs; score 52; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=ActiveMQ,CVE-2023-46604,exploit; url=http://45.115.26.23:8012/poc_amq2.xml

  • P2 URLhaus: malware_download URL observed (offline) — URLhaus Recent URLs; score 52; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=ActiveMQ,CVE-2023-46604,exploit; url=http://45.115.26.23:8012/poc_amq.xml

  • P2 URLhaus: malware_download URL observed (offline) — URLhaus Recent URLs; score 52; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=ActiveMQ,CVE-2023-46604,exploit; url=http://45.115.26.23:8012/poc_amq3.xml

    Newly exploited vulnerabilities / CVE watch

  • P2 CVE-2023-46604: URLhaus: malware_download URL observed (offline) — technologies: not watchlist-specific.
  • P2 CVE-2023-46604: URLhaus: malware_download URL observed (offline) — technologies: not watchlist-specific.
  • P2 CVE-2023-46604: URLhaus: malware_download URL observed (offline) — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Patriot Maritime claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Patriot Maritime. Description excerpt: Aerospace & Defense | Concord, California, United States | Patriot Maritime is a leading…
  • P2 RansomLook: oakgrovetech claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: oakgrovetech. Description excerpt: The company specializes in multi-domain training, unmanned systems & robotics, cyber/space…
  • P3 RansomLook: Baltimore Tank Lines claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Baltimore Tank Lines. Description excerpt: Energy | Glen Burnie, Maryland, United States | Baltimore Tank Lines is a leading…
  • P3 RansomLook: Merit Financial Group claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Merit Financial Group. Description excerpt: FinTech | Alpharetta, Georgia, United States | Merit Financial Group, LLC, doing business…
  • P3 RansomLook: Belcorp claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Belcorp. Description excerpt: Business Services
  • P3 RansomLook: Telecom Egypt claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Telecom Egypt. Description excerpt: computer training academy · Egypt
  • P3 RansomLook: All Business Technologies (Fox Hill bookkeeping and tax practice) claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: All Business Technologies (Fox Hill bookkeeping and tax practice). Description excerpt: Accounting & Tax Preparation (US) ·…
  • P3 RansomLook: SMIC US Company (Sunnyvale, CA — US arm of Semiconductor Manufacturing International Corpo claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: SMIC US Company (Sunnyvale, CA — US arm of Semiconductor Manufacturing International Corpo. Description excerpt: Semiconductor…
  • P3 RansomLook: Llano Independent School District claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Llano Independent School District. Description excerpt: Education
  • P3 RansomLook: mckenneys claimed by iah647 — Public RansomLook extortion-site listing claim. Group: iah647. Claimed victim/listing: mckenneys. Description excerpt: size: 295.9 GiB | status: soon | hosting: 2d 21h left
  • P3 RansomLook: PART2 Global AirFreight International claimed by eclipse — Public RansomLook extortion-site listing claim. Group: eclipse. Claimed victim/listing: PART2 Global AirFreight International. Description excerpt: PART 2 Global Airfreight International is a logistics solution provider…
  • P3 RansomLook: ******rta.ch claimed by cloak — Public RansomLook extortion-site listing claim. Group: cloak. Claimed victim/listing: ******rta.ch. Description excerpt: Country: Switzerland | Size: 87GB | Private | Views: 1

    • Malware / infrastructure / abuse feed highlights

  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,powershell,ps1,stager; url=https://power-shell.cc/powershell/Loader.ps1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=deserialization,exploit; url=http://45.115.26.23:8012/payload.raw
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,cowrie; url=http://38.43.93.61/loader.sh
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=deserialization,exploit; url=http://45.115.26.23:8012/deser.cs
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,powershell,ps1,stager; url=https://ps-ps.cc/powershell/Loader.ps1
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=GuLoader,nsis; url=http://33841-28554.dchost.com/vDsuzsiIMAiwv69.bin
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=AsyncRAT,botnet,malware; url=http://64.235.41.83/AI
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,cowrie; url=http://203.161.41.148:8088/iranbot-ultimate.$a
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,cowrie; url=http://203.161.41.148:8088/iranbot-ultimate.aarch64
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,cowrie; url=http://203.161.41.148:8088/iranbot-ultimate.armv4l
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,cowrie; url=http://203.161.41.148:8088/iranbot-ultimate.mipsel

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2023-46604`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`45.115.26.23`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`38.43.93.61`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`64.235.41.83`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`203.161.41.148`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`45.153.34.235`URLhaus: malware_download URL observed (online)URLhaus Recent URLs

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=54
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=80 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=0 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation