markcardiff.tech:/daily-intel/2026-10-23.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-23 08:00:32 UTC
P1: 4
P2: 2
Items: 59

Daily Cyber Threat Intel Brief — 2026-10-23

Generated: 2026-10-23 08:00:32 UTC

Executive summary

  • Collected 59 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=4, P2=2, P3=44, P4=9.
  • Highest-priority item: CVE-2026-96185 Microsoft Exchange Online Remote Code Execution Vulnerability (P1, source: Microsoft Security Response Center RSS).
  • 16 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 CVE-2026-96185 Microsoft Exchange Online Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 100; technologies: Microsoft Exchange.

    • - Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

  • P1 CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

  • P1 CVE-2026-83938 Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

  • P1 CVE-2026-96251 Microsoft PowerShell Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Corrected Fixed Build Number and Download links in the Security Updates table. This is an informational change only.

  • P2 Authorities disrupt nearly 11,000 cybercrime networks in Africa — BleepingComputer Ransomware News; score 57; technologies: none explicitly matched.

    • - Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams. [...]

  • P2 RansomLook: SGLA (Schwartz, Giannini, Lantsberger & Adamson) claimed by space bears — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: space bears. Claimed victim/listing: SGLA (Schwartz, Giannini, Lantsberger & Adamson). Description excerpt: Schwartz, Giannini, Lantsberger & Adamson (SGLA) Accountancy Corporation is a full-service…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-96185: CVE-2026-96185 Microsoft Exchange Online Remote Code Execution Vulnerability — technologies: Microsoft Exchange.
  • P1 CVE-2026-105014: CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-83938: CVE-2026-83938 Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-96251: CVE-2026-96251 Microsoft PowerShell Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-108456: CVE-2026-108456 Azure AI Foundry Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-97785: CVE-2026-97785 AAD App Proxy Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-110063: CVE-2026-110063 VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-96303: CVE-2026-96303 Microsoft PowerShell Security Feature Bypass Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 Authorities disrupt nearly 11,000 cybercrime networks in Africa — Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams. [...]
  • P2 RansomLook: SGLA (Schwartz, Giannini, Lantsberger & Adamson) claimed by space bears — Public RansomLook extortion-site listing claim. Group: space bears. Claimed victim/listing: SGLA (Schwartz, Giannini, Lantsberger & Adamson). Description excerpt: Schwartz, Giannini, Lantsberger & Adamson (SGLA)…
  • P3 RansomLook: Coop Italia claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Coop Italia. Description excerpt: Grocery Retail
  • P3 RansomLook: SunTechnics Fabrisolar AG claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: SunTechnics Fabrisolar AG. Description excerpt: solar energy company · Switzerland
  • P3 RansomLook: B2Chat claimed by emperador — Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: B2Chat. Description excerpt: B2Chat is a business communication platform based in Spain that provides tools for customer support,…
  • P3 RansomLook: United Restaurant Supply claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: United Restaurant Supply. Description excerpt: Industrial Machinery & Equipment
  • P3 RansomLook: SEPIVER claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: SEPIVER. Description excerpt: Accounting Services
  • P3 RansomLook: M... C... claimed by leakeddata — Public RansomLook extortion-site listing claim. Group: leakeddata. Claimed victim/listing: M... C.... Description excerpt: To be announced...
  • P3 RansomLook: Bethany Press International claimed by akira — Public RansomLook extortion-site listing claim. Group: akira. Claimed victim/listing: Bethany Press International. Description excerpt: Bethany Press partners with authors, ministries, and publishers to create, produce,…
  • P3 RansomLook: Medienwerkstatt claimed by akira — Public RansomLook extortion-site listing claim. Group: akira. Claimed victim/listing: Medienwerkstatt. Description excerpt: Medienwerkstatt stands for digital and printed communication of the highest quality and…
  • P3 RansomLook: Annapath claimed by akira — Public RansomLook extortion-site listing claim. Group: akira. Claimed victim/listing: Annapath. Description excerpt: Annapath, Inc. is a privately owned surgical and cytopathology laboratory that primarily focuses on…
  • P3 RansomLook: M...r claimed by leakeddata — Public RansomLook extortion-site listing claim. Group: leakeddata. Claimed victim/listing: M...r. Description excerpt: To be announced...

    • Malware / infrastructure / abuse feed highlights

  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P4 LiteLLM release pipeline hacked to distribute info-stealer malware — Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. [...]

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-96185`CVE-2026-96185 Microsoft Exchange Online Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-105014`CVE-2026-105014 Azure Pipelines Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-83938`CVE-2026-83938 Azure Kubernetes Configuration Service Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-96251`CVE-2026-96251 Microsoft PowerShell Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-108456`CVE-2026-108456 Azure AI Foundry Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-97785`CVE-2026-97785 AAD App Proxy Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-110063`CVE-2026-110063 VM Inspector for Azure Virtual Machines Elevation of Privilege VulnerabiliMicrosoft Security Response Center RSS
    cve`CVE-2026-96303`CVE-2026-96303 Microsoft PowerShell Security Feature Bypass VulnerabilityMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    hash`cc721543382c0d008c07a3d34d109662`RansomLook: istanbultrading.com claimed by lockbit5RansomLook Recent Listings
    hash`7c6fe4484732b452c49e7fb43e2c0b44`RansomLook: Hecker Holzsystembau claimed by lamashtuRansomLook Recent Listings
    hash`b23808f4f924e441ec58891cb18fb6c4`RansomLook: FuG-Gruppe claimed by lamashtuRansomLook Recent Listings
    hash`6b08b44b54e028d4fa14065150b08494`RansomLook: MECA-PRECIS claimed by lamashtuRansomLook Recent Listings
    hash`22a8552383fdf42535512a5019ac49bc`RansomLook: WEPOS Chemie claimed by lamashtuRansomLook Recent Listings
    hash`f8a127a637f3db88cfe314cd01f97637`RansomLook: Gräfliches Hofbrauhaus Freising claimed by lamashtuRansomLook Recent Listings
    hash`ac6c36b4a325ff0f108ba220b70e6ec9`RansomLook: VERGI Muenster claimed by lamashtuRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=59
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=17 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=3 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: error: HTTP 410 for https://urlhaus.abuse.ch/downloads/csv_recent/: b'<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">\n<html><head>\n<title>410 Gone</title>\n</head><body>\n<h1>Gone</h1>\n<p>The requested resource is no longer avail'
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation