markcardiff.tech:/daily-intel/2026-10-28.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-28 08:00:32 UTC
P1: 2
P2: 3
Items: 79

Daily Cyber Threat Intel Brief — 2026-10-28

Generated: 2026-10-28 08:00:32 UTC

Executive summary

  • Collected 79 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=2, P2=3, P3=63, P4=11.
  • Highest-priority item: CVE-2026-70007 .NET Framework Remote Code Execution Vulnerability (P1, source: Microsoft Security Response Center RSS).
  • 11 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 CVE-2026-70007 .NET Framework Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P1 CVE-2026-62765 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  • P2 RansomLook: Charter Township of Commerce claimed by booba team — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: booba team. Claimed victim/listing: Charter Township of Commerce. Description excerpt: Government Administration Website: www.commercetwp.com Stolen data: 155 GB.

  • P2 RansomLook: Hawaii Law Enforcement Fedral Credit Union claimed by qilin — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Hawaii Law Enforcement Fedral Credit Union. Description excerpt: Finance

  • P2 RansomLook: FPT Software claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: FPT Software. Description excerpt: fptsoftware.com FPT Software is the largest IT services company in Southeast Asia, founded in 1999 in Hanoi with 1.34 billion…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-70007: CVE-2026-70007 .NET Framework Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P1 CVE-2026-62765: CVE-2026-62765 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-70277: CVE-2026-70277 Windows Fast FAT File System Driver Information Disclosure Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-70161: CVE-2026-70161 .NET Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-96225: CVE-2026-96225 .NET Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69473: CVE-2026-69473 Windows Kernel Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69284: CVE-2026-69284 Windows DCOM Server Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-20942: CVE-2026-20942 Microsoft Edge (Chromium-based) Spoofing Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-88078: CVE-2026-88078 Microsoft Edge (Chromium-based) Spoofing Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-96196: CVE-2026-96196 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Charter Township of Commerce claimed by booba team — Public RansomLook extortion-site listing claim. Group: booba team. Claimed victim/listing: Charter Township of Commerce. Description excerpt: Government Administration Website: www.commercetwp.com Stolen data: 155 GB.
  • P2 RansomLook: Hawaii Law Enforcement Fedral Credit Union claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Hawaii Law Enforcement Fedral Credit Union. Description excerpt: Finance
  • P2 RansomLook: FPT Software claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: FPT Software. Description excerpt: fptsoftware.com FPT Software is the largest IT services company in Southeast Asia, founded…
  • P3 RansomLook: Kucoin claimed by whitearmor — Public RansomLook extortion-site listing claim. Group: whitearmor. Claimed victim/listing: Kucoin. Description excerpt: Dear Kucoin, We are NOT a hacktivist group. We focus mainly on data extortion & ransomware, so…
  • P3 Japan's GMO urges customers to shut down PCs amid ransomware threat — The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company's Onamae Desktop Cloud threatened to launch a ransomware attack…
  • P3 UNM Health ransomware attack disrupts patient care, surgeries — The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]
  • P3 RansomLook: Company #112 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #112. Description excerpt: telecommunications services · Malaysia
  • P3 RansomLook: SK Capital Partners claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: SK Capital Partners. Description excerpt: skcapitalpartners.com Revenue $63 Million SK Capital Partners is a New York-based…
  • P3 RansomLook: Cherry Bekaert claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Cherry Bekaert. Description excerpt: cbh.com Revenue $446.7 Million CBH Group Australia's largest grain cooperative, founded…
  • P3 RansomLook: Angeles Contractor claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Angeles Contractor. Description excerpt: angelescontractor.com Angeles Contractor Inc is a general contractor founded in 1998…
  • P3 RansomLook: Svedala Kommun claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Svedala Kommun. Description excerpt: svedala.se Svedala kommun is a municipality in Skåne County, Sweden, part of Greater…
  • P3 RansomLook: First Dental claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: First Dental. Description excerpt: myfirstdental.com First Dental Care is a dental practice network in Massachusetts founded…

    • Malware / infrastructure / abuse feed highlights

  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P4 Camera Management Software Compromise Leads to Malware Deployment — Attackers compromised camera management software to deploy malware, establish persistence, and beacon to C2. Huntress breaks down the attack chain and IOCs.

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-70007`CVE-2026-70007 .NET Framework Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-62765`CVE-2026-62765 Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-70277`CVE-2026-70277 Windows Fast FAT File System Driver Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-70161`CVE-2026-70161 .NET Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-96225`CVE-2026-96225 .NET Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69473`CVE-2026-69473 Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69284`CVE-2026-69284 Windows DCOM Server Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-20942`CVE-2026-20942 Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-88078`CVE-2026-88078 Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-96196`CVE-2026-96196 Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=51
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=1 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=20 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=6 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: error: HTTP 410 for https://urlhaus.abuse.ch/downloads/csv_recent/: b'<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">\n<html><head>\n<title>410 Gone</title>\n</head><body>\n<h1>Gone</h1>\n<p>The requested resource is no longer avail'
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation