DFIRLab
All Briefings
dailyOctober 11, 2026 — October 12, 2026Published 06:02 UTC

Daily Threat Briefing — 2026-10-12

34 findings2 articles5 sections

Updated 04:27 UTCSubscribe
Critical findings
0
High findings
0
New since 06:02 UTC
0
CISA KEV additions
0
First seen in this period
2 Articles79 CVEs1,253 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 71
Browse all 34 findings

Executive summary · as of 06:02 UTC

The situation

This window was dominated by ransomware and data-extortion leak-site activity, a large batch of WordPress plugin disclosures, and steady commodity malware infrastructure. TheGentlemen listed five high-profile victims within about two minutes: MoneyGram, KFC, Confluent (now IBM-owned), BigID and Placer AI. Redact claimed US utility Eversource Energy, and Qilin listed CNESTEN. Emperador claimed a large theft from Spelman Logistics that allegedly includes 245K carrier profiles with SSNs and EINs and 57K bank accounts. Separately, Daiichi Kosho disclosed that a malware infection at its contractor Nippon Columbia exposed more than 8.7 million customer and employee records. DataBreaches.net reported that the 'Luna Moth Files' attributed to Silent Ransom Group are genuine, despite the group's denials. All 29 breach entries in the window are reported.

Live updates

16 updates since 06:02 UTC

  1. CVE-2026-109758: Perforce Helix Authentication Service ships default SCIM bearer token enabling unauthorized access (CVSS 9.3)

  2. SAP discloses a CVSS 10 OAuth2 SSRF in its Cloud SDK for Python, alongside three critical NetWeaver, S/4HANA and MII flaws

  3. IBM i HTTP Server Administration flaw (CVE-2026-96119, CVSS 9.9) allows authenticated remote code execution

Updates are added during the day when material new intelligence arrives. They are not part of the executive summary; the next daily briefing recaps them.

Browse the full briefing

34 findings · 5 sections
Findings by severity
  • 8 critical
  • 22 high
  • 4 medium
Vulnerabilities8 critical · 5 high

Vulnerabilities

No new CISA KEV additions this window. Of 79 NVD and 64 WordPress vulnerability entries, 40 and 30 respectively were supplied. Priorities: - Remote command injection in TOZED X300 and OpenSpug Spug (public exploit). - An over-the-air baseband overflow. - Hard-coded secrets in AI platforms. - A large cluster of unauthenticated WordPress plugin takeover, upload, SQLi and XSS flaws.

Malware4 high · 3 medium

Malware & Indicator Activity

abuse.ch logged 1,243 new indicators from 101 families (ThreatFox 823, URLhaus 420); 777 were supplied. Vidar dominated. IoT botnet payloads, DanaBot C2, commodity RATs and ClearFake web-inject infrastructure followed.

  • High severity
    Vidar infostealer: 237 new indicators

    Vidar was the top abuse.ch family this window with 237 new ThreatFox indicators. - Indicator types: URLs, domains, MD5/SHA1/SHA256 hashes, ip:port. - Threat types: botnet_cc, payload. - Samples: hxxps://gp[.]54toto[.]org, hs[.]54toto[.]org, hxxps://hs[.]54toto[.]org/. Block C2 domains and hunt for browser credential theft followed by session hijacking.

    Source: abuse.ch
  • High severity
    Mirai/Mozi IoT botnets: ~220 new payload and C2 indicators

    IoT botnet families: - Mirai: 94 ThreatFox indicators (sha256, ip:port, URL, domain; payload, botnet_cc, payload_delivery). - URLhaus ELF downloads: 'elf, ua-wget' (50), Mozi MIPS (48), Mozi ARM (19), and a Cowrie-captured 'akuma' DVR set (12). - Samples: hxxp://209[.]99[.]184[.]98/bins/sora[.]ppc, hxxp://42[.]233[.]104[.]85:36775/bin[.]sh, hxxp://85[.]137[.]53[.]167:24380/bins/dvr/akuma_mpsl.

    Source: abuse.ch
  • High severity
    DanaBot banking trojan/loader: 41 C2 servers

    DanaBot had 41 new ThreatFox botnet_cc indicators, all ip:port. Samples: 66[.]253[.]84[.]79:443, 154[.]82[.]149[.]30:25219, 154[.]86[.]11[.]118:25201. Feed these into egress blocklists and NDR watchlists.

    Source: abuse.ch
  • High severity
    ClearFake web-inject delivery and PHP webshell infrastructure

    ClearFake: 27 payload_delivery domains, used for fake browser-update and paste-to-run lures on compromised sites. Samples: payload1717[.]pro, 7aigp3my[.]lunza[.]store, zj9s97wb[.]jp168amp-super[.]com. Separately, 48 php.shin_webshell payload_delivery domains were reported, including workers[.]dev hosts such as lakyxopa[.]workers[.]dev.

    Source: abuse.ch
  • Medium severity
    Commodity RATs: AsyncRAT, Remcos and Quasar C2 and payloads

    Commodity RATs remained active: - AsyncRAT: 27 indicators (botnet_cc, payload, malware_download; ThreatFox and URLhaus). Samples: hxxp://174[.]138[.]21[.]29/csgo[.]exe, 104[.]243[.]248[.]63:3602. - Remcos: 24 C2 indicators (ip:port, domain). Sample: 103[.]83[.]86[.]126:14641. - Quasar RAT: 15 indicators.

    Source: abuse.ch
  • Medium severity
    AMOS macOS stealer: 20 new indicators

    AMOS (Atomic macOS Stealer) had 20 ThreatFox indicators (sha256, URL, domain; payload, payload_delivery, botnet_cc). Sample hash: 656c960966c12f507a7d80c59bb377be09ac14c16903f7a933d3ef32a4210c53. Monitor macOS fleets for unsigned DMG installs and keychain access.

    Source: abuse.ch
  • Medium severity
    SmartLoader, IRAHook (Dropbox/Discord-hosted) and Antidot activity

    - SmartLoader: 11 payload hashes, e.g. 2def5f3586564612e03fa8b57bf3e8f2c4aede6f3be47001890c472b87ff79ee. - IRAHook: 10 malware_download URLs staged on legitimate cloud services as bundle.zip archives, e.g. hxxps://www[.]dropbox[.]com/scl/fi/ovgcqrqvo601c4xrgrsso/bundle[.]zip?rlkey=jpo47d62rtkevfrwz5yfsx93x&st=ic2dii77&dl=1. - Antidot (Android banking trojan): 10 C2 ip:port entries, e.g. 146[.]103[.]38[.]59:28116.

    Source: abuse.ch
Tools & Techniques1 high

Offensive Frameworks & C2

Adversary emulation and post-exploitation frameworks continue to be stood up at volume.

  • High severity
    Sliver, VShell and Cobalt Strike C2 infrastructure

    New ThreatFox C2 indicators for three frameworks: - Sliver: 26 C2 servers (ip:port). Samples: 35[.]229[.]230[.]203:50051, 38[.]54[.]110[.]142:31337, 45[.]9[.]149[.]180:31337. - VShell: 25 indicators (URL, ip:port, hashes). Sample: 120[.]26[.]120[.]83:9214. - Cobalt Strike: 23 C2 servers. Samples: 49[.]235[.]158[.]141:7777, 101[.]35[.]247[.]212:80. Outbound connections to these hosts warrant immediate triage as likely hands-on-keyboard activity.

    Source: abuse.ch
Threat Actors3 high

Threat Actors

No law-enforcement takedowns were recorded this window. Actor activity centered on a reported leak of Silent Ransom Group's own files, a burst of high-profile TheGentlemen victim listings, and N0n's countdown-based extortion.

  • High severity
    'Luna Moth Files' leak exposes Silent Ransom Group despite denials (opens the source in a new tab)

    DataBreaches.net reports that the 'Luna Moth Files', which appeared on an onion site, are genuine. Silent Ransom Group (Luna Moth), known for callback phishing and data extortion, had called the files fake and denied any leak or breach. According to the report, the files leaked rather than being hacked. The material may offer insight into SRG operations relevant to defenders tracking callback-phishing campaigns.

    Source: RSS
  • High severity
    TheGentlemen ransomware lists five high-profile victims in a single burst

    Between 04:38 and 04:40 UTC on 2026-10-12, TheGentlemen posted five large organizations to its leak site: - MoneyGram (global money transfer) - KFC - Confluent (Kafka data streaming, IBM-owned) - BigID (data security platform) - Placer AI (foot-traffic analytics) Claims are unverified and no data classes were listed. The vendor victims (Confluent, BigID) raise potential downstream supply-chain concerns for their customers.

    Source: Manual
  • High severity
    N0n extortion group posts anonymized victims with publication countdowns

    N0n posted numerous 'Company #N' listings: smart building/surveillance integrators (California), an architecture firm (Florida), a neurology practice (NSW, Australia), a cannabis operator (Michigan) and a confectionery/telehealth firm (New York). Many listings appear to be duplicates across re-posts. Data publication is countdown-scheduled for 2026-10-13 to 2026-10-14. The group marked a Canadian financial services firm (Company #14) as having 'settled' on 2026-10-07.

    Source: Manual
Data Breaches & Leaks9 high · 1 medium

Data Breaches & Leaks

29 breach entries were recorded, all ransomware/extortion leak-site claims, plus one confirmed media-reported incident. Spelman Logistics and the Rhysida law-firm leaks are the most credential- and financial-data-exposing claims. No pwnCount or structured data classes were supplied for the leak-site entries.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.