Daily Cyber Threat Intel Brief — 2026-10-26
Generated: 2026-10-26 08:00:30 UTC
Executive summary
Collected 41 recent public-source CTI items for technology-only monitoring.
Priority distribution: P1=2, P2=3, P3=33, P4=3.
Highest-priority item: CVE-2026-70197 .NET and Visual Studio Remote Code Execution Vulnerability (P1, source: Microsoft Security Response Center RSS).
5 public IOC highlights selected for analyst awareness.
Priority technology watch items
P1 CVE-2026-70197 .NET and Visual Studio Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.
- Updated product information in the Software Update table. This is an informational change only.
P1 CVE-2026-102870 ASP.NET Core Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.
- Updated product information in the Software Update table. This is an informational change only.
P2 RansomLook: Inside Passage Electric Cooperative, Inc claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Inside Passage Electric Cooperative, Inc. Description excerpt: In 2004, Tlingit & Haida Regional Electric Authority was re-organized to an electric cooperative which…
P2 RansomLook: A-RMS claimed by emperador — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: A-RMS. Description excerpt: We encrypted your servers and stole some of your source code, along with some sensitive information. If you do not pay the ransom, we will…
P2 RansomLook: Mach Law APC (San Diego family law and divorce practice) claimed by n0n — RansomLook Recent Listings; score 53; technologies: none explicitly matched.
- Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Mach Law APC (San Diego family law and divorce practice). Description excerpt: Legal Services - Family Law (US) · California, USA
Newly exploited vulnerabilities / CVE watch
P1 CVE-2026-70197: CVE-2026-70197 .NET and Visual Studio Remote Code Execution Vulnerability — technologies: not watchlist-specific.
P1 CVE-2026-102870: CVE-2026-102870 ASP.NET Core Remote Code Execution Vulnerability — technologies: not watchlist-specific.
P3 CVE-2026-114148: CVE-2026-114148 ASP.NET Core Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
P3 CVE-2026-111497: CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder — technologies: not watchlist-specific.
Ransomware and extortion trend notes
P2 RansomLook: Inside Passage Electric Cooperative, Inc claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Inside Passage Electric Cooperative, Inc. Description excerpt: In 2004, Tlingit & Haida Regional Electric Authority was…
P2 RansomLook: A-RMS claimed by emperador — Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: A-RMS. Description excerpt: We encrypted your servers and stole some of your source code, along with some sensitive information.…
P2 RansomLook: Mach Law APC (San Diego family law and divorce practice) claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Mach Law APC (San Diego family law and divorce practice). Description excerpt: Legal Services - Family Law (US) · California, USA
P3 RansomLook: mahsing.com.my claimed by scarlettgroup — Public RansomLook extortion-site listing claim. Group: scarlettgroup. Claimed victim/listing: mahsing.com.my. Description excerpt: Mah Sing Group is a leading Malaysian property developer specializing in affordable…
P3 RansomLook: LoveSac claimed by whitearmor — Public RansomLook extortion-site listing claim. Group: whitearmor. Claimed victim/listing: LoveSac. Description excerpt: LoveSac (LOVE) is a premium furniture retailer operating more than 250 showrooms across the United…
P3 RansomLook: WhiteArmor.cc claimed by whitearmor — Public RansomLook extortion-site listing claim. Group: whitearmor. Claimed victim/listing: WhiteArmor.cc. Description excerpt: Hi, our VPS provider has decided to ban our account. Due to this, whitearmor.cc is down and…
P3 RansomLook: J.B Hunt claimed by whitearmor — Public RansomLook extortion-site listing claim. Group: whitearmor. Claimed victim/listing: J.B Hunt. Description excerpt: You are so stupid JB Hunt. Instead of getting in contact with us & starting the negotiation…
P3 RansomLook: Glückauf-Vermessung GmbH claimed by payload — Public RansomLook extortion-site listing claim. Group: payload. Claimed victim/listing: Glückauf-Vermessung GmbH. Description excerpt: Glückauf-Vermessung GmbH (glueckauf-vermessung.de) is a German engineering and…
P3 RansomLook: Miletic GmbH claimed by payload — Public RansomLook extortion-site listing claim. Group: payload. Claimed victim/listing: Miletic GmbH. Description excerpt: Miletic GmbH is a German specialized contractor headquartered in Bad Schönborn that has been…
P3 RansomLook: Edelstahl-Mechanik GmbH claimed by payload — Public RansomLook extortion-site listing claim. Group: payload. Claimed victim/listing: Edelstahl-Mechanik GmbH. Description excerpt: Edelstahl-Mechanik GmbH is a German manufacturing company based in Göppingen. The…
P3 RansomLook: Advantage Sintered Metals claimed by securotrop — Public RansomLook extortion-site listing claim. Group: securotrop. Claimed victim/listing: Advantage Sintered Metals.
P3 RansomLook: https://x.com/WhiteArmorxd claimed by whitearmor — Public RansomLook extortion-site listing claim. Group: whitearmor. Claimed victim/listing: https://x.com/WhiteArmorxd. Description excerpt: Hi, we now have an X account. https://x.com/WhiteArmorxd Also, fuck the AI slop…
Malware / infrastructure / abuse feed highlights
P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
IOC highlights
| Type | Value | Context | Source |
| cve | `CVE-2026-70197` | CVE-2026-70197 .NET and Visual Studio Remote Code Execution Vulnerability | Microsoft Security Response Center RSS |
| cve | `CVE-2026-102870` | CVE-2026-102870 ASP.NET Core Remote Code Execution Vulnerability | Microsoft Security Response Center RSS |
| cve | `CVE-2026-114148` | CVE-2026-114148 ASP.NET Core Elevation of Privilege Vulnerability | Microsoft Security Response Center RSS |
| cve | `CVE-2026-111497` | CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decode | Microsoft Security Response Center RSS |
| ipv4 | `50.16.16.211` | Feodo Tracker: 1 recommended botnet C2 IPs listed | Feodo Tracker Recommended Blocklist |
Defensive takeaways
Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.
Sources checked
BleepingComputer Ransomware News: ok new=0 fetched=15
CISA Known Exploited Vulnerabilities: ok new=0 fetched=51
Cisco Talos Blog: ok new=0 fetched=15
Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
Huntress Blog: ok new=0 fetched=25
Microsoft Security Response Center RSS: ok new=0 fetched=25
NVD Recent CVEs: ok new=40 fetched=80
ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
RansomLook Recent Listings: ok new=2 fetched=50
Rapid7 Blog: ok new=0 fetched=20
SANS Internet Storm Center: ok new=0 fetched=10
Sophos X-Ops: ok new=0 fetched=15
The DFIR Report: ok new=0 fetched=10
URLhaus Recent URLs: error: HTTP 410 for https://urlhaus.abuse.ch/downloads/csv_recent/: b'<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">\n<html><head>\n<title>410 Gone</title>\n</head><body>\n<h1>Gone</h1>\n<p>The requested resource is no longer avail'
Unit 42 Threat Research: ok new=0 fetched=15
Limitations
Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
Technology-only matching can miss relevant items that do not name a tracked product explicitly.
Ransomware victim claims are actor/source claims unless independently corroborated.
IOC highlights are publicly sourced and should be validated before enforcement in production controls.