markcardiff.tech:/daily-intel/2026-10-20.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-20 08:00:32 UTC
P1: 4
P2: 7
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-20

Generated: 2026-10-20 08:00:32 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=4, P2=7, P3=43, P4=196.
  • Highest-priority item: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 (P1, source: Rapid7 Blog).
  • 11 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 — Rapid7 Blog; score 82; technologies: Citrix NetScaler.

    • - Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments. The…

  • P1 Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 — Rapid7 Blog; score 82; technologies: Citrix NetScaler.

    • - Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments. The…

  • P1 CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild — Rapid7 Blog; score 77; technologies: none explicitly matched.

    • - Overview On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS) , its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764 and assigned a CVSSv4 score of 9.3 , the…

  • P1 CVE-2026-70197 .NET Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Microsoft is aware that the vulnerability for which this CVE was assigned has not been addressed. We are working to prepare and test a complete mitigation. We will update this document when there is more information.

  • P2 WordPress SEO plugin Rank Math compromised to backdoor websites — BleepingComputer Ransomware News; score 62; technologies: WordPress.

    • - Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week. [...]

  • P2 Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) — Unit 42 Threat Research; score 54; technologies: none explicitly matched.

    • - Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) appeared first on Unit 42 .

  • P2 RansomLook: Patriot Maritime claimed by storm — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Patriot Maritime. Description excerpt: Aerospace & Defense | Concord, California, United States | Patriot Maritime is a leading maritime contractor in the United States,…

  • P2 Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED) — Rapid7 Blog; score 52; technologies: none explicitly matched.

    • - Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus . A legacy API endpoint could be exploited to bypass authentication and run various functions…

  • P2 URLhaus: malware_download URL observed (offline) — URLhaus Recent URLs; score 52; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=ActiveMQ,CVE-2023-46604,exploit; url=http://45.115.26.23:8012/poc_amq2.xml

  • P2 URLhaus: malware_download URL observed (offline) — URLhaus Recent URLs; score 52; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=ActiveMQ,CVE-2023-46604,exploit; url=http://45.115.26.23:8012/poc_amq.xml

  • P2 URLhaus: malware_download URL observed (offline) — URLhaus Recent URLs; score 52; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=ActiveMQ,CVE-2023-46604,exploit; url=http://45.115.26.23:8012/poc_amq3.xml

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-88771, CVE-2026-88779: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 — technologies: Citrix NetScaler.
  • P1 CVE-2026-88771, CVE-2026-88779: Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 — technologies: Citrix NetScaler.
  • P1 CVE-2026-102764: CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild — technologies: not watchlist-specific.
  • P1 CVE-2026-70197: CVE-2026-70197 .NET Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P2 CVE-2026-0257: Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) — technologies: not watchlist-specific.
  • P2 CVE-2023-46604: URLhaus: malware_download URL observed (offline) — technologies: not watchlist-specific.
  • P2 CVE-2023-46604: URLhaus: malware_download URL observed (offline) — technologies: not watchlist-specific.
  • P2 CVE-2023-46604: URLhaus: malware_download URL observed (offline) — technologies: not watchlist-specific.
  • P3 CVE-2026-80092: CVE-2026-80092 Microsoft Identity Web Elevation of Privilege Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Patriot Maritime claimed by storm — Public RansomLook extortion-site listing claim. Group: storm. Claimed victim/listing: Patriot Maritime. Description excerpt: Aerospace & Defense | Concord, California, United States | Patriot Maritime is a leading…
  • P3 RansomLook: Fisher59 claimed by anubis — Public RansomLook extortion-site listing claim. Group: anubis. Claimed victim/listing: Fisher59. Description excerpt: Beverage distributor data breach.
  • P3 RansomLook: Baker Donelson claimed by redact — Public RansomLook extortion-site listing claim. Group: redact. Claimed victim/listing: Baker Donelson. Description excerpt: Sector: Law Firm | Data Size: 355 GB | Files: 102,390
  • P3 RansomLook: GardaWorld claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: GardaWorld. Description excerpt: Business Services
  • P3 RansomLook: BW Office World claimed by payload — Public RansomLook extortion-site listing claim. Group: payload. Claimed victim/listing: BW Office World. Description excerpt: BW Office World (bw-officeworld.de) is a German specialized online retailer providing…
  • P3 RansomLook: Brüninghoff Group claimed by payload — Public RansomLook extortion-site listing claim. Group: payload. Claimed victim/listing: Brüninghoff Group. Description excerpt: Brüninghoff Group (brueninghoff.de) is a German construction and manufacturing company…
  • P3 RansomLook: Vormittag Associates Inc claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Vormittag Associates Inc. Description excerpt: ERP software and hosting company · USA
  • P3 RansomLook: Froggys Fog claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Froggys Fog. Description excerpt: special-effects fog fluid manufacturer and distributor (order management and shipping operations) ·…
  • P3 RansomLook: Toyota Canarias claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Toyota Canarias. Description excerpt: Business Services
  • P3 RansomLook: Grupo Cronica claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Grupo Cronica. Description excerpt: Business Services
  • P3 RansomLook: Salauno claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Salauno. Description excerpt: 0
  • P3 RansomLook: CREDIN claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: CREDIN. Description excerpt: Food & Beverage

    • Malware / infrastructure / abuse feed highlights

  • P2 WordPress SEO plugin Rank Math compromised to backdoor websites — Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week. [...]
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=Action1,PDF-link-phishing,rmm; url=https://user-iota-lake.vercel.app/wafaction1.msi
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=Action1,PDF-link-phishing,rmm; url=https://user-iota-lake.vercel.app/adobe_updaters.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=Action1,PDF-link-phishing,rmm; url=https://user-iota-lake.vercel.app/payment_receipt.pdf
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=579cd0,dropped-by-amadey; url=http://193.178.158.57/bin/7e2e3164f26a442a_syshost_loader.exe
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,powershell,ps1,stager; url=https://power-shell.cc/powershell/Loader.ps1
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=deserialization,exploit; url=http://45.115.26.23:8012/payload.raw
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=botnet,cowrie; url=http://38.43.93.61/loader.sh
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=deserialization,exploit; url=http://45.115.26.23:8012/deser.cs
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,powershell,ps1,stager; url=https://ps-ps.cc/powershell/Loader.ps1
  • P4 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=32-bit,elf,mips,Mozi; url=http://42.228.32.100:37587/bin.sh

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-88771`NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Rapid7 Blog
    cve`CVE-2026-88779`NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Rapid7 Blog
    cve`CVE-2026-102764`CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in thRapid7 Blog
    cve`CVE-2026-70197`CVE-2026-70197 .NET Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-0257`Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)Unit 42 Threat Research
    cve`CVE-2023-46604`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`45.115.26.23`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    cve`CVE-2026-80092`CVE-2026-80092 Microsoft Identity Web Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`193.178.158.57`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`38.43.93.61`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=53
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=28 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=0 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation