DFIRLab
All Briefings
dailyOctober 17, 2026 — October 18, 2026Published 06:02 UTC

Daily Threat Briefing — 2026-10-18

33 findings4 articles5 sections

Updated 04:53 UTCSubscribe
Critical findings
0
High findings
0
New since 06:02 UTC
0
CISA KEV additions
0
First seen in this period
4 Articles22 CVEs1,744 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 32
Browse all 33 findings

Executive summary · as of 06:02 UTC

The situation

Two items lead this window. The first is an active supply-chain intrusion: ConnectWise shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after attackers accessed application identities and used them to compromise Microsoft 365 tenants. The second is a Drupal advisory patching two critical remote code execution flaws affecting every supported version of the CMS, with Drupal warning that exploits may emerge soon. Organisations using ConnectWise Cloud Backup should review Entra ID application consent, service principal activity and M365 audit logs now. Drupal operators should patch as an emergency change. No new CISA KEV additions were ingested.

Live updates

5 updates since 06:02 UTC

  1. N0n leaks Finzly payment-infrastructure secrets and cloud keys; Helix lists American Campus with timed data release

  2. Two critical (CVSS 9.3) auth flaws disclosed in Google OSS Agent Mesh (SAM) MCP proxy, OIDC registration and libp2p ingress

  3. Critical CVSS 9.8 flaw disclosed in GeoWebServer.exe web server default connection ports (CVE-2026-108983)

    • Critical severityCritical vulnerability in GeoWebServer.exe web server (CVE-2026-108983) (opens the source in a new tab)

Updates are added during the day when material new intelligence arrives. They are not part of the executive summary; the next daily briefing recaps them.

Browse the full briefing

33 findings · 5 sections
Findings by severity
  • 4 critical
  • 18 high
  • 10 medium
  • 1 info
Threat Actors1 critical

Active Intrusions & Supply-Chain Compromise

An active supply-chain intrusion abused a SaaS backup provider's application identities to reach downstream Microsoft 365 tenants. No law-enforcement takedowns were recorded in this window.

  • Critical severity
    ConnectWise Cloud Backup supply-chain compromise leads to Microsoft 365 tenant breaches (opens the source in a new tab)

    ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup). Attackers accessed the service's application identities and used them to compromise Microsoft 365 tenants. Customers should take the following actions: - Audit Entra ID enterprise applications and service principals tied to the backup service. - Review consented Graph/Exchange permissions. - Hunt M365 unified audit logs for anomalous application sign-ins, mailbox access and data export. - Rotate application secrets and certificates, and revoke or re-consent once ConnectWise provides guidance.

    Source: RSS
Vulnerabilities2 critical · 7 high · 3 medium

Vulnerabilities & Patches

Drupal's critical RCE patches and the phpMyFAQ authentication-bypass cluster are the priority fixes. NVD published 22 high or critical CVEs and 17 WordPress-related entries were ingested. None were reported as exploited in the wild, and there were no new KEV additions.

Malware3 high · 5 medium

Malware & Indicators

abuse.ch recorded 1,719 new indicators (1,305 from ThreatFox and 414 from URLhaus) across 99 families; 1,189 were supplied for analysis. Infostealers (Vidar, AMOS and others) and ClickFix-style delivery (IClickFix, ClearFake) dominate, alongside persistent IoT botnet traffic.

  • High severity
    Vidar infostealer leads abuse.ch volume (321 indicators)

    Vidar had 321 new ThreatFox indicators: URLs, domains, ip:port pairs and MD5/SHA1/SHA256 hashes. Threat types were botnet C2 and payload. Sample indicators: - hxxps://vx[.]88bravo[.]com - hxxps://b[.]7sot[.]org - hxxps://vx[.]88bravo[.]com/ The volume indicates heavy active infostealer distribution. Block the C2 domains and hunt for browser credential-store access by unsigned processes.

    Source: abuse.ch
  • High severity
    IClickFix ClickFix delivery infrastructure (272 domains)

    IClickFix had 272 new payload-delivery domains on ThreatFox. These are typically compromised or lure sites serving fake verification prompts that trick users into pasting commands into Run or a terminal. Sample domains: - 100-ho[.]com - a-frame-marisa[.]com - adlibentertainment[.]com[.]au Monitor RunMRU entries and explorer-spawned PowerShell or mshta processes.

    Source: abuse.ch
  • High severity
    AMOS (Atomic macOS Stealer) activity (99 indicators)

    AMOS had 99 new indicators (SHA256 hashes, URLs and domains) covering payload and payload delivery. Sample hashes: - 9d44b9cb6d05e0644311ec64bbd50d414af03d114663f715e5a9cc4405c2fb98 - 9d47fcf063bba75a390e48f2127da2ad8e650902cbbf980693f882c0abeaa7c8 - d18a59ac6cfadd3ae1e9994ff649fae5cf43aca1cfc797ed5499dccbcb6d36f2

    Source: abuse.ch
  • Medium severity
    Mirai/Mozi IoT botnet propagation

    Mirai and Mozi activity continued across ThreatFox and URLhaus: - Mirai: 76 hashes and C2 ip:port indicators. - Mozi: 43 MIPS and 21 ARM ELF download URLs. - Shell-script and ELF droppers fetched via wget: 60 URLs on 31[.]56[.]209[.]86 and 15 on 31[.]56[.]52[.]6. Sample indicators: - hxxp://31[.]56[.]209[.]86/wget[.]sh - hxxp://31[.]56[.]52[.]6/main_arm7 - hxxp://123[.]12[.]227[.]78:59648/i

    Source: abuse.ch
  • Medium severity
    ClearFake fake-update injection domains (18)

    ClearFake had 18 new payload-delivery domains for its fake browser-update and ClickFix-style lure infrastructure. Sample domains: - r1oqxdev[.]abijacobs[.]co[.]uk - iae44bmf[.]cita-top[.]com - fhhiios[.]site

    Source: abuse.ch
  • Medium severity
    PHP web shell staging on Cloudflare Workers (40 domains)

    php.shin_webshell had 40 payload-delivery domains, hosted on Cloudflare workers[.]dev subdomains. Sample domains: - ttzve13336[.]workers[.]dev - zimiwoqa[.]workers[.]dev - sbhhe93865[.]workers[.]dev A separate 'Unknown RAT' cluster (20 indicators) also uses workers[.]dev paths, for example hxxps://telemetry-relay[.]kartohaantoha36-6a9[.]workers[.]dev/file/9d2f48c1e3a54b8dbf12.

    Source: abuse.ch
  • Medium severity
    Commodity infostealers: Raven, WARDEN and Salat

    Three smaller infostealer families received new indicators: - Raven Stealer: 28 hashes. - WARDENStealer: 24 hashes and domains, e.g. ricarle[.]homes, falaheeh[.]mom, warrette[.]quest. - SalatStealer: 15 hashes. This reinforces the window's credential-theft theme.

    Source: abuse.ch
  • Medium severity
    RAT and C2 infrastructure: CLOUDHAZE, Hermes, PureRAT, NetWire

    New RAT and C2 indicators were published: - CLOUDHAZE: 40 hashes, domains and URLs (payload/C2). - Hermes: 32 C2 ip:port indicators, concentrated on 107[.]149[.]8[.]243 across ports 8787, 8080 and 8093. - PureRAT: 20 C2 indicators, e.g. 172[.]93[.]110[.]43:443. - NetWire RC: 18 hashes.

    Source: abuse.ch
Data Breaches & Leaks1 critical · 8 high · 2 medium

Data Breaches & Leaks

Leak sites added 23 ransomware and extortion victims. N0n published credential-rich dumps (VPN credentials, plaintext passwords, password hashes), and Helix staged timed releases for five large US firms. Separately, a state education contractor breach affected millions of California students.

Policy1 info

Policy & Regulation

State regulators extended breach liability to a healthcare provider's IT vendor.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.