markcardiff.tech:/daily-intel/2026-10-30.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-30 08:00:26 UTC
P1: 0
P2: 4
Items: 51

Daily Cyber Threat Intel Brief — 2026-10-30

Generated: 2026-10-30 08:00:26 UTC

Executive summary

  • Collected 51 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=0, P2=4, P3=33, P4=14.
  • Highest-priority item: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) (P2, source: Unit 42 Threat Research).
  • 5 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P2 Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) — Unit 42 Threat Research; score 67; technologies: none explicitly matched.

    • - CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared…

  • P2 IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases — Cisco Talos Blog; score 62; technologies: none explicitly matched.

    • - Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries.

  • P2 RansomLook: MAA Group Consulting Engineers claimed by emperador — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: MAA Group Consulting Engineers. Description excerpt: MAA Group Consulting Engineers is a leading regional engineering and consulting service provider founded in 1975,…

  • P2 Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th) — SANS Internet Storm Center; score 50; technologies: none explicitly matched.

    • - Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and take some more when you reached…

    Newly exploited vulnerabilities / CVE watch

  • P2 CVE-2026-109618, CVE-2026-109619: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) — technologies: not watchlist-specific.
  • P3 CVE-2026-20127: Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases — Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries.
  • P2 RansomLook: MAA Group Consulting Engineers claimed by emperador — Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: MAA Group Consulting Engineers. Description excerpt: MAA Group Consulting Engineers is a leading regional engineering and…
  • P3 RansomLook: INTI International University & Colleges claimed by rhysida — Public RansomLook extortion-site listing claim. Group: rhysida. Claimed victim/listing: INTI International University & Colleges. Description excerpt: INTI International University & Colleges INTI International…
  • P3 RansomLook: Susman Godfrey LLP claimed by leakeddata — Public RansomLook extortion-site listing claim. Group: leakeddata. Claimed victim/listing: Susman Godfrey LLP. Description excerpt: Susman Godfrey L.L.P. is a premier litigation firm recognized for its exceptional…
  • P3 RansomLook: TDS Telecommunications LLC. claimed by global secret group — Public RansomLook extortion-site listing claim. Group: global secret group. Claimed victim/listing: TDS Telecommunications LLC.. Description excerpt: Country: Madison, Wisconsin, US | Website: tdstelecom.com | Revenue:…
  • P3 RansomLook: rolly.io claimed by whitearmor — Public RansomLook extortion-site listing claim. Group: whitearmor. Claimed victim/listing: rolly.io. Description excerpt: Rolly.io is an on-chain crypto casino on Arbitrum featuring a public bankroll, transparent bonus…
  • P3 RansomLook: Southwest Orthopedic & Reconstructive Specialists claimed by interlock — Public RansomLook extortion-site listing claim. Group: interlock. Claimed victim/listing: Southwest Orthopedic & Reconstructive Specialists. Description excerpt: https://www.southwestortho.com/ Southwest Orthopedic &…
  • P3 RansomLook: Antwerp House Dentistry claimed by shiba — Public RansomLook extortion-site listing claim. Group: shiba. Claimed victim/listing: Antwerp House Dentistry. Description excerpt: Healthcare Services - United Kingdom Local dentist clinic based in Cambridge, London
  • P3 RansomLook: Y**s claimed by payoutsking — Public RansomLook extortion-site listing claim. Group: payoutsking. Claimed victim/listing: Y**s.
  • P3 RansomLook: The Anglican International School claimed by global secret group — Public RansomLook extortion-site listing claim. Group: global secret group. Claimed victim/listing: The Anglican International School. Description excerpt: Country: Grenada.Spain | Website: aisj.co.il | Revenue: $11.1…
  • P3 RansomLook: USClaims claimed by direwolf — Public RansomLook extortion-site listing claim. Group: direwolf. Claimed victim/listing: USClaims.
  • P3 RansomLook: LA PROFUMERIA SRL claimed by emperador — Public RansomLook extortion-site listing claim. Group: emperador. Claimed victim/listing: LA PROFUMERIA SRL. Description excerpt: Italian company working with perfumes and cosmetics. Archived personal and corporate data…

    • Malware / infrastructure / abuse feed highlights

  • P2 Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th) — Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation from a clean…
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 Hugging Face malware campaign returns to hijack GPUs for crypto mining — A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on…

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-109618`Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated OUnit 42 Threat Research
    cve`CVE-2026-109619`Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated OUnit 42 Threat Research
    cve`CVE-2026-20127`Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malwareBleepingComputer Ransomware News
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    hash`c5fc6f5c6ce071766c550bc58b3b4f4dcc2b9d1a35ef5672aa6f4e888bb12f92`RansomLook: www.viehhauser-kfz.at claimed by krybitRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=54
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=1 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=14 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=1 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: error: HTTP 410 for https://urlhaus.abuse.ch/downloads/csv_recent/: b'<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">\n<html><head>\n<title>410 Gone</title>\n</head><body>\n<h1>Gone</h1>\n<p>The requested resource is no longer avail'
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation