markcardiff.tech:/daily-intel/2026-10-25.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-25 08:00:23 UTC
P1: 0
P2: 1
Items: 34

Daily Cyber Threat Intel Brief — 2026-10-25

Generated: 2026-10-25 08:00:23 UTC

Executive summary

  • Collected 34 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=0, P2=1, P3=32, P4=1.
  • Highest-priority item: RansomLook: Mach Law APC (San Diego family law and divorce practice) claimed by n0n (P2, source: RansomLook Recent Listings).
  • 8 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P2 RansomLook: Mach Law APC (San Diego family law and divorce practice) claimed by n0n — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Mach Law APC (San Diego family law and divorce practice). Description excerpt: Legal Services - Family Law (US) · California, USA

    Newly exploited vulnerabilities / CVE watch

  • None observed.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Mach Law APC (San Diego family law and divorce practice) claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Mach Law APC (San Diego family law and divorce practice). Description excerpt: Legal Services - Family Law (US) · California, USA
  • P3 RansomLook: ETO claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: ETO. Description excerpt: Automotive Parts
  • P3 RansomLook: TOPLIVO AD claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: TOPLIVO AD. Description excerpt: fuel trading and construction materials · Bulgaria
  • P3 RansomLook: Technoleads Services Inc. claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Technoleads Services Inc.. Description excerpt: media production (audio description and accessibility media) · Montreal, Quebec, Canada
  • P3 RansomLook: Pure Grow Diamonds Inc. claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Pure Grow Diamonds Inc.. Description excerpt: diamond and lab grown diamond trading · New York, New York, United States
  • P3 RansomLook: Keidel Supply Company Incorporated claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Keidel Supply Company Incorporated. Description excerpt: plumbing and kitchen products distribution · Cincinnati, Ohio, United States
  • P3 RansomLook: Andrews Advisory Group LLC claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Andrews Advisory Group LLC. Description excerpt: Financial Advisory & Restructuring (US) · Chicago, Illinois, USA
  • P3 RansomLook: Hisense claimed by whitearmor — Public RansomLook extortion-site listing claim. Group: whitearmor. Claimed victim/listing: Hisense. Description excerpt: Hisense is a Chinese multinational electronics and appliance manufacturer, founded in 1969, known…
  • P3 RansomLook: Newcomer Cremations, Funerals & Receptions claimed by anubis — Public RansomLook extortion-site listing claim. Group: anubis. Claimed victim/listing: Newcomer Cremations, Funerals & Receptions. Description excerpt: Customers' personal documents and the company's internal documents.
  • P3 RansomLook: AB InBev claimed by emperador — Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: AB InBev. Description excerpt: AB InBev is the world's largest brewer, headquartered in Belgium, known for Budweiser, Corona, and…
  • P3 RansomLook: mediporta.ch claimed by cloak — Public RansomLook extortion-site listing claim. Group: cloak. Claimed victim/listing: mediporta.ch. Description excerpt: Country: Switzerland | Size: 87GB | Public | Views: 13
  • P3 RansomLook: Synergy Engeneering claimed by securotrop — Public RansomLook extortion-site listing claim. Group: securotrop. Claimed victim/listing: Synergy Engeneering.

    • Malware / infrastructure / abuse feed highlights

  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211

    • IOC highlights

    TypeValueContextSource
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    hash`ad10729196bfae1e58eb75aa8ae7536f`RansomLook: Vins Viallet claimed by lamashtuRansomLook Recent Listings
    hash`e38184cbe95213765772ae7675f2d9b1ef5ceedf9117e7c91a0f980136d7a3ab`RansomLook: www.choicegoodwill.com claimed by krybitRansomLook Recent Listings
    hash`b4af8a7dfe84a3294642a4b76442862e057075b2c45e312c75b9714cf262edea`RansomLook: mainplace.com.my claimed by krybitRansomLook Recent Listings
    hash`c04cb7e3f4662014fa8b77afc3ad0df07e9f885b7324139d20e2fdf6aeb78ae6`RansomLook: MODON Developments S.A.E claimed by krybitRansomLook Recent Listings
    hash`6cfb5eacd7b1a293331438fa76a5119a256a1cb287855df86a28141f8ae4f987`RansomLook: www.zhservices.com claimed by krybitRansomLook Recent Listings
    hash`11267670f1e1f99e723fe6d0b723fc5fc71d43c31d1b44d7e898781d35d9fac6`RansomLook: grupoeuro.com.mx claimed by krybitRansomLook Recent Listings
    hash`19fdf217cbcd5c8374612e3b8efe3b14c0bb5533c63a1078043e321072392f16`RansomLook: www.optika.ca claimed by krybitRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=53
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=34 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=19 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: error: HTTP 410 for https://urlhaus.abuse.ch/downloads/csv_recent/: b'<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">\n<html><head>\n<title>410 Gone</title>\n</head><body>\n<h1>Gone</h1>\n<p>The requested resource is no longer avail'
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation