DFIRLab
All Briefings
dailyOctober 8, 2026 — October 9, 2026Published 06:03 UTC

Daily Threat Briefing — 2026-10-09

73 findings38 articles8 sections

Updated 00:27 UTCSubscribe
Critical findings
0
High findings
0
New since 06:03 UTC
0
CISA KEV additions
0
First seen in this period
38 Articles250 CVEs1,942 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 71
Browse all 73 findings

Executive summary · as of 06:03 UTC

The situation

Law enforcement and patching pressure dominate this window. The FBI, with international partners, seized seven domains and tooling (MicroScan and FishHub) operated by Beijing-based Integrity Tech in support of the Chinese state-sponsored Flax Typhoon campaign, which had enabled widespread vulnerability scanning and intrusions against critical infrastructure. Russian-aligned UAC-0099 continues to refine its MatchBoil dropper against Ukrainian transport, manufacturing and energy firms. Leaked chats also show a Russian extortion gang directing US-based 'agents' against American law firms. In parallel, SilentRansomGroup listed Baker McKenzie, O'Hagan Meyer and Andersen Group on its leak site.

Live updates

16 updates since 06:03 UTC

  1. Critical SQL injection in JetBrains Exposed Kotlin ORM (CVE-2026-108474, CVSS 9.8) fixed in version 1.5.1

  2. Chaos ransomware gang publishes 1.5 TB of Astrana Health data, claiming patient records and diagnoses for millions of people

    • Critical severityChaos Leaks 1.5 TB Allegedly Stolen from Astrana Health (opens the source in a new tab)

  3. Astron Agent AI workflow platform flaw (CVE-2026-108263, CVSS 9.9) allows code execution through the default local code executor

Updates are added during the day when material new intelligence arrives. They are not part of the executive summary; the next daily briefing recaps them.

Browse the full briefing

73 findings · 8 sections
Findings by severity
  • 22 critical
  • 21 high
  • 20 medium
  • 5 low
  • 5 info
Vulnerabilities4 high · 1 medium

CISA KEV Additions

Five older CVEs were newly added to the CISA KEV catalog on 2026-10-08, indicating active exploitation of legacy internet-facing services (FTP, collaboration, web frameworks, DNS).

Vulnerabilities16 critical · 1 high · 1 medium

Critical Vulnerabilities: Infrastructure, Enterprise and Cloud

Critical, mostly unauthenticated RCE and auth-bypass disclosures were reported across: - network infrastructure (Cisco NX-OS, NetScaler, GPON ONTs); - IBM security and gateway products; - Microsoft cloud services; - AI inference tooling; - WordPress plugins. NVD published 230 CVEs in the window, of which 40 were reviewed here; a further 190 were not reviewed.

Vulnerabilities6 critical · 2 high

Open-Source and AI Framework Advisories

OSV published 101 advisories in the window (30 reviewed). They were dominated by AI agent frameworks executing untrusted code and by bypasses of earlier fixes in widely used JWT and templating libraries.

Threat Actors3 high · 2 medium · 1 low

Threat Actors and Disruptions

Activity includes: - a coordinated takedown of Flax Typhoon tooling; - continued Russian-aligned espionage against Ukraine; - insight into an extortion gang running US-based operatives; - disruption of AI-enabled influence operations.

Malware3 high · 9 medium · 1 low

Malware Campaigns and Indicators

Commodity malware delivery leans on trusted platforms: GitHub, GitLab, Discord and Cloudflare Workers. A hardware supply-chain campaign targets cheap Android devices. abuse.ch recorded 1,609 new indicators across 105 families, of which 1,024 were reviewed here.

  • High severity
    FakeGit Returns with 17,610 Malicious GitHub Repos Spreading SmartLoader/StealC (opens the source in a new tab)

    The FakeGit campaign reactivated earlier this month to push the StealC infostealer. More than 17,610 fake GitHub repositories now distribute SmartLoader. Developers and users downloading tools from unverified repositories are the primary targets.

    Source: RSS
  • High severity
    'Midnight Mimosa' Firmware Malware Preinstalled on Low-Cost Android Phones (opens the source in a new tab)

    Malware embedded in the firmware of low-cost Android smartphones silently installs apps, performs ad fraud and turns devices into residential proxies. Bitdefender found it on thousands of devices; it is present before first boot and cannot be uninstalled. Block such devices from corporate and BYOD networks.

    Source: RSS
  • High severity
    Attackers Hijack Country-Code Domains to Obtain Certificates Impersonating Google (opens the source in a new tab)

    Cybercriminals compromised three country-code namespaces and obtained certificates that could be used to impersonate Google and other trusted services. Monitor Certificate Transparency logs for your brands.

    Source: RSS
  • Medium severity
    abuse.ch: Unattributed Loader Infrastructure Leads New Indicators

    Unknown Loader: 221 new ThreatFox indicators (domain, sha256_hash) tagged payload_delivery, payload and botnet_cc. Samples: distrostation[.]cfd, zypupmp[.]xyz, zuma789-z[.]com.

    Source: abuse.ch
  • Medium severity
    abuse.ch: Mirai Botnet Activity

    Mirai: 181 indicators (sha256_hash, url, ip:port) across ThreatFox and URLhaus for payload, malware_download and botnet_cc, plus a further ~47 URLhaus elf/mirai/ua-wget download URLs. Samples: 66[.]29[.]151[.]122:80, 176[.]65[.]139[.]217:1999, hxxp://119[.]178[.]216[.]181:56386/i.

    Source: abuse.ch
  • Medium severity
    abuse.ch: Mozi IoT Botnet Distribution

    Mozi: 99 URL indicators (malware_download, payload_delivery) from URLhaus and ThreatFox, plus 53 further MIPS/ARM Mozi download URLs. Samples: hxxp://103[.]176[.]16[.]129:54736/Mozi[.]m, hxxp://42[.]57[.]166[.]198:39954/Mozi[.]a, hxxp://125[.]44[.]59[.]247:46345/bin[.]sh.

    Source: abuse.ch
  • Medium severity
    abuse.ch: Vidar and Unattributed Infostealer C2

    Vidar: 43 ThreatFox indicators (url, domain, md5/sha1/sha256 hashes) for botnet_cc and payload; samples hxxps://ss[.]3toto[.]com/, ss[.]3toto[.]com, hxxps://ss[.]333vip[.]org. Unknown Stealer adds 87 indicators (url, domain, sha256); sample hxxps://tony-sopranos[.]club/.

    Source: abuse.ch
  • Medium severity
    abuse.ch: ClearFake Fake-Update Lures

    ClearFake: 31 ThreatFox domain/URL indicators for payload_delivery via compromised sites. Samples: nhuel2vu[.]tanyavondegurechaff[.]fit, couteaux-fontaine[.]com, servtechh[.]com[.]br.

    Source: abuse.ch
  • Medium severity
    abuse.ch: IClickFix Copy-Paste Lures

    IClickFix: 27 ThreatFox domain/URL payload_delivery indicators, including Cloudflare Workers hosting. Samples: tight-dew-df89[.]esbpomiqpz[.]workers[.]dev, verify[.]proxy08[.]com, fireipsrevolt[.]top.

    Source: abuse.ch
  • Medium severity
    abuse.ch: php.shin Web Shell Infrastructure

    php.shin_webshell: 78 ThreatFox domain indicators (payload_delivery), heavily on AWS EC2 and workers.dev. Samples: qokomuqi[.]workers[.]dev, ec2-16-146-96-209[.]us-west-2[.]compute[.]amazonaws[.]com, ec2-44-242-253-11[.]us-west-2[.]compute[.]amazonaws[.]com.

    Source: abuse.ch
  • Medium severity
    abuse.ch: AsyncRAT C2 Servers

    AsyncRAT: 17 ThreatFox ip:port botnet_cc indicators. Samples: 78[.]40[.]209[.]158:7707, 67[.]86[.]75[.]244:8080, 67[.]86[.]75[.]244:80.

    Source: abuse.ch
  • Medium severity
    abuse.ch: AMOS macOS Stealer Payloads

    AMOS (Atomic macOS Stealer): 15 ThreatFox sha256 payload hashes. Samples: f73b74f41b4c98d6a7acfdaecfdf82253c8437270fb74c8588e8c49983b667b7, 250f842af70d1d8ff251f94e3dc44c5ddb4397f673f6bd1df2430921926a0e59, fb0bf040d7a643ebb9a032f71d12db43b5c82141dc4f4fdd084445398f54b3d7.

    Source: abuse.ch
  • Low severity
    abuse.ch: Game-Cheat Lures on GitLab and Discord (CheatSheet, SilentNet)

    Game-cheat lures are being staged on GitLab and Discord: - CheatSheet: 14 GitLab-hosted ZIP lures (malware_download). Samples: hxxps://gitlab[.]com/FuriousFade/quantv-sp-fivem-ragemp-altv/-/raw/main/QuantV_Latest_2026[.]zip, hxxps://gitlab[.]com/jennybenz/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack[.]zip. - SilentNet: 13 cracked Minecraft-client JAR lures hosted on Discord CDN.

    Source: abuse.ch
Data Breaches & Leaks8 high · 4 medium

Data Breaches & Leaks

Thirty leak-site postings were recorded, none carrying pwnCount or structured dataClasses. The most notable confirmed incidents are: - the ASOS breach, rooted in credential theft; - a ransomware outage at Japan's IDCF Cloud; - a government data claim against Croatia's Ministry of Agriculture. Legal, healthcare and education sectors feature prominently.

Policy2 medium · 3 low

Policy, Regulation and Prosecutions

Developments include: - prosecutions involving a ransomware recovery firm and dark web and crypto cybercriminals; - emerging AI agent liability legislation; - regulatory fallout from the Coupang breach.

Tools & Techniques1 medium · 5 info

Tools, Techniques and Defensive Developments

Items cover: - defensive guidance on OAuth grant sprawl; - SOC automation and AI-agent guardrail tooling; - post-quantum readiness; - deepfake protections.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.