DFIRLab
Intelligence Products

Threat Briefings

Curated intelligence distilled from RSS feeds, CVE databases, abuse.ch, and OSINT sources.

RSS Feed
Latest Briefing
WeeklyOct 12 — Oct 19

Weekly Threat Briefing — 2026-10-12 to 2026-10-19

Edge and remote-access infrastructure dominated this week. CISA added nine entries to KEV. They include a BeyondTrust Remote Support authentication bypass (CVE-2026-102764), a zero-day exploited since late August that Mandiant attributes to the suspected Chinese espionage cluster ARMORY CASTLE. The others are a PAN-OS root code injection (CVE-2026-0322), Ivanti Connect Secure's sixth exploited bug of the year (CVE-2026-104935), a Cisco Secure Email Gateway arbitrary file write, a chained AhsayCBS auth-bypass/command-injection pair, an Atlassian Data Center file exposure flaw, a Windows Shell security-feature bypass fixed in Microsoft's record 1,413-CVE Patch Tuesday, and an older Fortinet path traversal (CVE-2025-61624). Separate reporting describes in-the-wild exploitation of SiteGuard WAF, Collabora/Nextcloud (CVE-2026-110447) and SonicWall SMA 1000. Unit 42 also described PEERSTITCH, a memory-resident FortiGate implant deployed on 500+ firewalls via CVE-2024-47575. Patch internet-facing appliances first and hunt for compromise on BeyondTrust, Ivanti, PAN-OS and FortiGate devices. Supply-chain and trusted-relationship intrusions were the second theme. Attackers abused ConnectWise Cloud Backup application identities to breach Microsoft 365 tenants. GTIG detailed short-burst tampering of AOMEI update infrastructure. Malicious packages also turned up in npm (Apex Accelerator/REF8801) and the Arch User Repository. Lures impersonating AI brands (Claude, ChatGPT, Copilot) and ClickFix-style delivery continue to grow; abuse.ch logged 746 IClickFix and 262 ClearFake indicators alongside 4,622 Vidar stealer indicators. Disruption activity was notable: Microsoft and partners seized YAM Store, CoGUI and Iron Man phishing infrastructure, DOJ raided DPRK IT-worker laptop farms, and arrests were made against OLVX, DataSuckers and a suspect linked to the Synnovis attack. Extortion volume remains high. 324 leak-site and breach entries were ingested; the 40 reviewed are led by N0n, Helix, Qilin and Settra. N0n posts frequently advertise credentials (VPN accounts, plaintext passwords, cloud access keys), and the group threatened 38 shipping and port firms with an October 19 deadline. Large disclosures included Burger King Japan (11.18M records), a claimed 80M-record Ampath Laboratories theft, a 13.7M-record Vibetech credential exposure and a California student-data breach. Beyond the items covered here, 2,636 further NVD CVEs, 78 OSV advisories and 266 WordPress plugin vulnerabilities were published in the window.

90 findings
2699 CVEs
9 KEVs
15865 IOCs
Read full briefing

Severity Breakdown

critical 23
high 34
medium 24
low 5

MITRE ATT&CK

T1190T1566T1059T1071T1539T1195.002
Daily
Oct 18

Daily Threat Briefing — 2026-10-19

The most urgent item this window is active exploitation of an OS command injection flaw in SiteGuard Server Edition. Attackers can run commands as root or SYSTEM on affected servers, so any internet-exposed SiteGuard deployment should be treated as at risk until patched and checked for compromise. NVD published 37 high or critical CVEs. The most notable are: - A hardcoded cluster-admin token in Vanus (CVE-2026-111998, CVSS 9.8). - Unauthenticated access-control bypasses in Google OSS Agent Mesh (CVE-2026-103091 and CVE-2026-102503). - A critical GeoWebServer.exe issue (CVE-2026-108983). - A cluster of Gitea CI/CD and authentication flaws that expose repository secrets, weaken runner container isolation and bypass enrolled MFA. WordPress plugin risk is elevated. Critical object injection, privilege escalation and SQL injection affect QuantumCloud Conversational Forms, OttoKit and Booktics, alongside 14 WPScan entries. No CISA KEV additions or law-enforcement takedowns were recorded. abuse.ch logged 2,126 new indicators across 90 families. Commodity infostealers lead the volume, with Vidar at 329 indicators and AMOS for macOS at 115. They are followed by: - Mirai/Mozi IoT botnet infrastructure. - An unattributed loader cluster. - ClickFix-style lure domains (IClickFix and ClearFake). - C2 servers for Remcos, AsyncRAT, PureRAT, Sliver and Cobalt Strike. Ransomware and extortion leak sites added 32 victims, 30 of them reviewed here. N0n was the most prolific group and is publishing payment-infrastructure secrets, cloud access keys and network maps. A new Settra batch weaponises stolen documents as exposé-style narratives that include executives' SSNs. Qilin, Helix, Cloak, iah6477 and Emperador were also active, with victims including Southwire, American Campus, Belcorp, SMIC's US arm and a Texas school district.

43 findings37 CVEs
T1657T1190T1071
Daily
Oct 17

Daily Threat Briefing — 2026-10-18

Two items lead this window. The first is an active supply-chain intrusion: ConnectWise shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after attackers accessed application identities and used them to compromise Microsoft 365 tenants. The second is a Drupal advisory patching two critical remote code execution flaws affecting every supported version of the CMS, with Drupal warning that exploits may emerge soon. Organisations using ConnectWise Cloud Backup should review Entra ID application consent, service principal activity and M365 audit logs now. Drupal operators should patch as an emergency change. No new CISA KEV additions were ingested. NVD published 22 high or critical CVEs and 17 WordPress-related entries. The most significant is a cluster of phpMyFAQ flaws fixed in 4.1.9 and 4.2.0-beta. They include a CVSS 9.8 unauthenticated WebAuthn passkey-registration account takeover (CVE-2026-111911), TOTP 2FA bypass via Keycloak and Entra ID SSO callbacks, and several authorization bypasses. Other notable fixes cover: - FreeRDP: an unauthenticated server-side NTLM heap out-of-bounds write and a client clipboard integer underflow. - Fleet: unauthenticated denial of service. - Coder: workspace-proxy hostname trust. - WordPress plugins: an unauthenticated stored XSS in the WooCommerce EU VAT plugin. abuse.ch logged 1,719 new indicators across 99 families. Credential theft and fake-browser-prompt delivery dominate. Vidar led with 321 indicators, followed by the IClickFix ClickFix delivery infrastructure (272 domains) and the AMOS macOS stealer (99), with sustained Mirai/Mozi IoT botnet activity. Ransomware and extortion leak sites added 23 victims. Helix posted five organisations including Rheem Global, and N0n published credential-heavy dumps including VPN credentials and plaintext passwords. A hack of a California Department of Education contractor exposed data on millions of students. Separately, the New York and Connecticut AGs secured a $2.7M settlement holding both a provider and its IT vendor liable for a 2024 breach.

33 findings22 CVEs
T1486T1190T1189
Daily
Oct 16

Daily Threat Briefing — 2026-10-17

The window is dominated by exploited remote-access and edge infrastructure. CISA added two entries to KEV on 2026-10-16. The first is BeyondTrust Remote Support CVE-2026-102764, an authentication bypass by spoofing. BeyondTrust says it has been exploited as a zero-day since late August, and reporting attributes the activity to a suspected Chinese state-backed espionage group. The second is a Fortinet path traversal, CVE-2025-61624, affecting FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. Researchers also warn that a maximum-severity Magento/Adobe Commerce flaw dubbed BlockStrap (CVE-2026-103849) could soon be exploited for PHP code execution. Of 214 NVD entries in the window, 40 were reviewed. Beyond that sample, the critical tail is heavy in unauthenticated admin takeover and hard-coded secret flaws in self-hosted web apps, AI tooling (Claude Agent SDK, LMCache, DeepSeek Harness, LangChat) and WordPress plugins. There were 103 WordPress vulnerabilities in total, of which 30 were reviewed. On the actor side, GTIG/Mandiant detailed a short-burst supply chain tampering campaign against AOMEI's update infrastructure (April–July 2026). Separately, Candiru spyware was delivered to Al Jazeera devices through zero-click malicious ads. Law enforcement activity includes the arrest in Germany of a Russian national linked to the 2024 Synnovis attack on NHS pathology services, and Moscow's detention of suspected DataSuckers members. Commodity threat volume remains high: abuse.ch logged 2,332 new indicators across 106 families. Mirai (563), Vidar (419) and VShell (222) lead, and ClearFake/IClickFix delivery infrastructure lines up with reporting on fake Claude/ChatGPT ClickFix lures aimed at developers. Breach activity is significant. Burger King Japan disclosed exposure of 11.18 million customer records, and a cyberattack on contractor BAE Systems took down the US federal bankruptcy court notice system. Ransomware leak sites added 75 victims, of which 30 were reviewed. They include Redact's claims against ONEOK and Parker-Hannifin and Everest's listing of the Brenner Base Tunnel. N0n posted a burst of listings including healthcare practices and a ransomware claim against EnVision Eye Care (13,308 patient records). Priorities: - Patch or isolate BeyondTrust RS and Fortinet appliances, and hunt for prior compromise back to August. - Patch Magento/Adobe Commerce. - Patch Chrome (CVE-2026-110916 sandbox escape). - Block ClickFix-style delivery domains.

50 findings216 CVEs
T1190T1486T1189
Daily
Oct 15

Daily Threat Briefing — 2026-10-16

Active exploitation of internet-facing remote-access and collaboration software dominates this window. Threat actors are exploiting a critical command execution flaw in the Collabora Online built-in CODE Server app for Nextcloud (CVE-2026-110447) to backdoor servers. Mandiant reports that the actor ARMORY CASTLE is exploiting BeyondTrust Remote Support (CVE-2026-102764), which was disclosed on October 15. CISA added an Atlassian Data Center file-exposure flaw (CVE-2026-21589) to KEV, covering Bitbucket, Confluence, Jira, Bamboo, Crowd and Fisheye/Crucible. Google shipped fixes for 37 Chrome flaws, seven of them critical, and Mozilla patched two sandbox escapes. Critical unauthenticated flaws in Nutanix Prism Element, Dell Secure Connect Gateway, Wavlink routers and Podman should be patched as a priority. On the actor front, Unit 42 detailed an AI-assisted espionage campaign that uses web shells and credential theft against government Linux infrastructure. Citizen Lab-linked research shows zero-click spyware being delivered through targeted online ads. A suspected Kazakhstan-origin phishing campaign has run for about two years against governments across former Soviet states. A proxyjacking operation is hijacking D-Link and Ubiquiti devices in 34 countries, and malicious Arch User Repository (AUR) packages impersonating yay and paru delivered root-level malware. abuse.ch logged 2,383 new indicators across 109 families. Vidar infostealer infrastructure accounted for 981 of them, followed by VShell with 301, alongside steady Mirai/Mozi IoT activity and Sliver/Cobalt Strike C2. On breaches, an exposed Vibetech database leaked 13.7M records containing credentials from earlier breaches. The UK Legal Aid Agency disclosed that stolen records date back to 1978, and the US federal bankruptcy courts suffered outages after a contractor was compromised. Ransomware leak sites added 43 victims in the window. Qilin, LockBit5, Akira, INC Ransom, N0n and iah6477 were most active; claims include AT&T-linked data (2 TB), Keio Corporation, Middleby, and a Texas spinal implant manufacturer's FDA quality records.

46 findings330 CVEs
T1190T1486T1505.003
Archive (15)

Get notified the moment it matters

Subscribe to threat-intel vulnerability alerts. Choose exactly what you care about — from actively-exploited CISA KEV entries to the full CVE firehose — and how often you want to hear about it.

Free foreverUnsubscribe anytimeNo spam, ever