markcardiff.tech:/daily-intel/2026-10-21.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-21 08:01:22 UTC
P1: 1
P2: 7
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-21

Generated: 2026-10-21 08:01:22 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=1, P2=7, P3=128, P4=114.
  • Highest-priority item: CVE-2026-83782 Windows Shell Remote Code Execution Vulnerability (P1, source: Microsoft Security Response Center RSS).
  • 13 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 CVE-2026-83782 Windows Shell Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P2 Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) — Huntress Blog; score 65; technologies: none explicitly matched.

    • - Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.

  • P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/cursorjerry01-source/renodx/raw/HEAD/tests/3.9.zip

  • P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/tjagnade27/intellij-lumos/raw/HEAD/src/main/resources/META-INF/intellij_lumos_v2.1.zip

  • P2 OVHcloud CLI releases backdoored on GitHub to steal developer secrets — BleepingComputer Ransomware News; score 57; technologies: none explicitly matched.

    • - French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. [...]

  • P2 Stolen UpdraftCentral keys used to backdoor WordPress sites — BleepingComputer Ransomware News; score 54; technologies: WordPress.

    • - A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. [...]

  • P2 Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20) — Unit 42 Threat Research; score 54; technologies: none explicitly matched.

    • - Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20) appeared first on Unit 42 .

  • P2 RansomLook: (SELL) Lucid Motors Data Auction: 5 TB of Engineering Data & Source Code claimed by sovcali — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: sovcali. Claimed victim/listing: (SELL) Lucid Motors Data Auction: 5 TB of Engineering Data & Source Code. Description excerpt: To international automakers, technology-hungry competitors in China and the…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-83782: CVE-2026-83782 Windows Shell Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P2 CVE-2026-109618, CVE-2026-109619: Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) — technologies: not watchlist-specific.
  • P2 CVE-2026-0257: Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20) — technologies: not watchlist-specific.
  • P3 CVE-2026-96913: CVE-2026-96913 Windows Kernel Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-70074: CVE-2026-70074 Windows DNS Information Disclosure Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-83839: CVE-2026-83839 Windows Hyper-V Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-102204: CVE-2026-102204 Windows Subsystem for Linux Elevation of Privilege Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: (SELL) Lucid Motors Data Auction: 5 TB of Engineering Data & Source Code claimed by sovcali — Public RansomLook extortion-site listing claim. Group: sovcali. Claimed victim/listing: (SELL) Lucid Motors Data Auction: 5 TB of Engineering Data & Source Code. Description excerpt: To international automakers,…
  • P3 RansomLook: Xylanpicks claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Xylanpicks. Description excerpt: online sports betting analytics · United States
  • P3 RansomLook: LEGAL-RECORDS.US claimed by clop — Public RansomLook extortion-site listing claim. Group: clop. Claimed victim/listing: LEGAL-RECORDS.US.
  • P3 RansomLook: GSE-M Technology Sdn. Bhd. 🇲🇾 claimed by bravox — Public RansomLook extortion-site listing claim. Group: bravox. Claimed victim/listing: GSE-M Technology Sdn. Bhd. 🇲🇾. Description excerpt: Industrial Engineering, Manufacturing Automation and Custom Machinery Solutions.
  • P3 RansomLook: genesys.com claimed by scarlettgroup — Public RansomLook extortion-site listing claim. Group: scarlettgroup. Claimed victim/listing: genesys.com. Description excerpt: Genesys Cloud Services, Inc. is a Cloud-based customer experience software specializing in…
  • P3 RansomLook: nbcuniversal.com claimed by scarlettgroup — Public RansomLook extortion-site listing claim. Group: scarlettgroup. Claimed victim/listing: nbcuniversal.com. Description excerpt: NBCUniversal is a global entertainment company producing films, television, news,…
  • P3 RansomLook: The Complete Engineering Data Chain in ADAS and Automotive Structural Projects: What Usual claimed by sovcali — Public RansomLook extortion-site listing claim. Group: sovcali. Claimed victim/listing: The Complete Engineering Data Chain in ADAS and Automotive Structural Projects: What Usual. Description excerpt: Companies prefer…
  • P3 RansomLook: They Failed. 100GB Drops in 2 Days claimed by sovcali — Public RansomLook extortion-site listing claim. Group: sovcali. Claimed victim/listing: They Failed. 100GB Drops in 2 Days. Description excerpt: Despite giving the Lucid Motors company more than enough time to respond…
  • P3 RansomLook: leak #1 lucidmotors claimed by sovcali — Public RansomLook extortion-site listing claim. Group: sovcali. Claimed victim/listing: leak #1 lucidmotors. Description excerpt: In line with our previously discussed approach, the proposed strategy to formally…
  • P3 RansomLook: THE ENDGAME OF LUCID MOTORS’ PSYCHOLOGICAL GAME claimed by sovcali — Public RansomLook extortion-site listing claim. Group: sovcali. Claimed victim/listing: THE ENDGAME OF LUCID MOTORS’ PSYCHOLOGICAL GAME. Description excerpt: Addressed to Lucid Motors management, deceived investors, and…
  • P3 RansomLook: THE ANATOMY OF A COMPROMISED ARCHITECTURE: LUCID’S SECRETS ARE UNRAVELED claimed by sovcali — Public RansomLook extortion-site listing claim. Group: sovcali. Claimed victim/listing: THE ANATOMY OF A COMPROMISED ARCHITECTURE: LUCID’S SECRETS ARE UNRAVELED. Description excerpt: We have observed that you have…
  • P3 RansomLook: HollywoodHair.pl claimed by sovcali — Public RansomLook extortion-site listing claim. Group: sovcali. Claimed victim/listing: HollywoodHair.pl. Description excerpt: List of data packages ready for public release If the wallet is not charged by the end of…

    • Malware / infrastructure / abuse feed highlights

  • P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/cursorjerry01-source/renodx/raw/HEAD/tests/3.9.zip
  • P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/tjagnade27/intellij-lumos/raw/HEAD/src/main/resources/META-INF/intellij_lumos_v2.1.zip
  • P2 OVHcloud CLI releases backdoored on GitHub to steal developer secrets — French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. [...]
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,SalatStealer,zip; url=https://github.com/SourcePharaoh87/proxY/releases/download/1.10.2/proxy.zip
  • P3 URLhaus: malware_download URL observed (offline) — Public URLhaus recent URL. Threat=malware_download; tags=ActiveMQ; url=http://166.0.100.70/poc.xml
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/Aakanksha011/Personalised-TODO-with-AI/raw/master/creatrix/Personalised-TOD-with-AI-v1.9.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/Readwanul/Laravel-proj/raw/main/myosarcomatous/Laravel-proj.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/mohamed-magdy-1/CodexBar/raw/main/js/Codex-Bar-Bob.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/benja0191928/awesome-llm-prompts/raw/refs/heads/main/Kris/prompts_llm_awesome_v2.8-alpha.3.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/DhouiouiCharfeddine/FBB-BI-Platform/raw/main/__pycache__/Platform-B-FB-3.0.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/kevinpangdude/psxrecomp-ports/raw/main/screenshots/v0.2.0/mdk/1.8.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/aidentelega/malmar/raw/refs/heads/main/tallyman/Software_v3.7.zip

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-83782`CVE-2026-83782 Windows Shell Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-109618`Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026Huntress Blog
    cve`CVE-2026-109619`Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026Huntress Blog
    cve`CVE-2026-0257`Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20)Unit 42 Threat Research
    cve`CVE-2026-96913`CVE-2026-96913 Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-70074`CVE-2026-70074 Windows DNS Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-83839`CVE-2026-83839 Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-102204`CVE-2026-102204 Windows Subsystem for Linux Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    ipv4`166.0.100.70`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`198.44.46.58`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`130.94.3.67`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    hash`4d65aac70167a1053a02b2c05dd075ae`RansomLook: chooseultimate.com claimed by lockbit5RansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=59
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=1 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=22 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=13 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: ok new=120 fetched=120
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation