markcardiff.tech:/daily-intel/2026-10-31.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-31 08:00:30 UTC
P1: 0
P2: 5
Items: 57

Daily Cyber Threat Intel Brief — 2026-10-31

Generated: 2026-10-31 08:00:30 UTC

Executive summary

  • Collected 57 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=0, P2=5, P3=47, P4=5.
  • Highest-priority item: Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) (P2, source: Rapid7 Blog).
  • 5 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P2 Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) — Rapid7 Blog; score 65; technologies: none explicitly matched.

    • - Overview An origin-validation flaw in BeyondTrust Remote Support lets an unauthenticated attacker write files on the appliance and execute code as the site's operating-system user. The entry point is the public customer connection used to start a support…

  • P2 RansomLook: Illinois Work Injury Resource Center (IWIRC) claimed by genesis — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: genesis. Claimed victim/listing: Illinois Work Injury Resource Center (IWIRC). Description excerpt: A comprehensive occupational health and rehabilitation service provider located in Peoria, IL.

  • P2 RansomLook: Richland Resources Corporation claimed by qilin — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Richland Resources Corporation. Description excerpt: Electricity, Oil & Gas

  • P2 RansomLook: Rapid Manufacturing claimed by aurora — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: aurora. Claimed victim/listing: Rapid Manufacturing. Description excerpt: Rapid Manufacturing — a 50-year-old electronics contract manufacturer in Anaheim, California with operations in Ensenada, Mexico.…

  • P2 RansomLook: lyserp.com claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: lyserp.com. Description excerpt: ERP systems and automation: Inventory management, finance and accounting, logistics, production management and supply chain.

    Newly exploited vulnerabilities / CVE watch

  • P2 CVE-2026-102764: Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) — technologies: not watchlist-specific.
  • P3 CVE-2026-118147: CVE-2026-118147 Visual Studio Spoofing Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69446: CVE-2026-69446 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: Illinois Work Injury Resource Center (IWIRC) claimed by genesis — Public RansomLook extortion-site listing claim. Group: genesis. Claimed victim/listing: Illinois Work Injury Resource Center (IWIRC). Description excerpt: A comprehensive occupational health and rehabilitation service…
  • P2 RansomLook: Richland Resources Corporation claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Richland Resources Corporation. Description excerpt: Electricity, Oil & Gas
  • P2 RansomLook: Rapid Manufacturing claimed by aurora — Public RansomLook extortion-site listing claim. Group: aurora. Claimed victim/listing: Rapid Manufacturing. Description excerpt: Rapid Manufacturing — a 50-year-old electronics contract manufacturer in Anaheim,…
  • P2 RansomLook: lyserp.com claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: lyserp.com. Description excerpt: ERP systems and automation: Inventory management, finance and accounting, logistics,…
  • P3 RansomLook: sp*g.com claimed by everstake — Public RansomLook extortion-site listing claim. Group: everstake. Claimed victim/listing: sp*g.com. Description excerpt: Category: Manufacturing | Size: 1.79 Tb | Release: 2026-11-06T14:45:00+00:00 | Status: Scheduled
  • P3 RansomLook: ArentFox Schiff claimed by leakeddata — Public RansomLook extortion-site listing claim. Group: leakeddata. Claimed victim/listing: ArentFox Schiff. Description excerpt: ArentFox Schiff LLP is a prominent national law firm and lobbying firm formed on March 1,…
  • P3 RansomLook: Hensel Elektrik claimed by deadlock — Public RansomLook extortion-site listing claim. Group: deadlock. Claimed victim/listing: Hensel Elektrik. Description excerpt: Hensel Elektrik is the Turkish subsidiary of the German company Gustav Hensel GmbH & Co. KG,…
  • P3 RansomLook: P... claimed by leakeddata — Public RansomLook extortion-site listing claim. Group: leakeddata. Claimed victim/listing: P.... Description excerpt: To be announced...
  • P3 RansomLook: Acclaim Companies / JCJ Investment claimed by genesis — Public RansomLook extortion-site listing claim. Group: genesis. Claimed victim/listing: Acclaim Companies / JCJ Investment. Description excerpt: A privately-held, real estate development and property management company.
  • P3 RansomLook: Gilliam & Associates, P.C claimed by genesis — Public RansomLook extortion-site listing claim. Group: genesis. Claimed victim/listing: Gilliam & Associates, P.C. Description excerpt: A full service CPA firm.
  • P3 RansomLook: Facts N Figures claimed by genesis — Public RansomLook extortion-site listing claim. Group: genesis. Claimed victim/listing: Facts N Figures. Description excerpt: A consumer insights research company.
  • P3 RansomLook: Psychometrics Canada claimed by genesis — Public RansomLook extortion-site listing claim. Group: genesis. Claimed victim/listing: Psychometrics Canada. Description excerpt: A company that works in the science of objective assessments for over 35 years.

    • Malware / infrastructure / abuse feed highlights

  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 Malicious Claude Code extension on Cursor planted SSH backdoors — A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to…

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-102764`Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-202Rapid7 Blog
    cve`CVE-2026-118147`CVE-2026-118147 Visual Studio Spoofing VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69446`CVE-2026-69446 Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    hash`b529ff8c638d9ee14d8ea33734bc95ef5379a410`RansomLook: Phillips Nizer claimed by ransomhouseRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=56
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=80 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=0 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: error: HTTP 410 for https://urlhaus.abuse.ch/downloads/csv_recent/: b'<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">\n<html><head>\n<title>410 Gone</title>\n</head><body>\n<h1>Gone</h1>\n<p>The requested resource is no longer avail'
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation