● Threat Intelligence Report

Generated 2026-10-17 14:25 UTC  ·  3/3 sources live  ·  ← back to cyberassist
↻ Refresh⇩ Download PDF
1748
KEV catalog total
9
Added last 7 days
361
Ransomware-linked
35
Fresh IOCs / pulses

Latest CISA Known Exploited Vulnerabilities live

CVEVendor / ProductVulnerabilityAddedDue
CVE-2026-102764BeyondTrust
Remote Support		BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability2026-10-162026-10-19
CVE-2025-61624Fortinet
Multiple Products		Fortinet Multiple Products Path Traversal Vulnerability2026-10-162026-10-19
CVE-2026-21589Atlassian
Multiple Products		Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability2026-10-152026-10-18
CVE-2026-105134Ahsay
AhsayCBS		Ahsay AhsayCBS Command Injection Vulnerability2026-10-142026-10-17
CVE-2026-76519Cisco
Secure Email Gateway		Cisco Secure Email Gateway Relative Path Traversal Vulnerability2026-10-142026-10-17
CVE-2026-105133Ahsay
AhsayCBS		Ahsay AhsayCBS Improper Authentication Vulnerability2026-10-142026-10-17
CVE-2026-0322Palo Alto Networks
PAN-OS		Palo Alto Networks PAN-OS Code Injection Vulnerability2026-10-142026-10-17
CVE-2026-104935Ivanti
Connect Secure		Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability2026-10-132026-10-16
CVE-2026-96951Microsoft
Windows		Microsoft Windows Command Injection Vulnerability2026-10-132026-10-16
CVE-2015-5477ISC
BIND		 ISC BIND Data Processing Errors Vulnerability2026-10-082026-10-11
CVE-2016-3081Apache
Struts		Apache Struts Command Injection Vulnerability2026-10-082026-10-11
CVE-2023-22894Strapi
Strapi		Strapi Cleartext Storage of Sensitive Information Vulnerability2026-10-082026-10-11
CVE-2021-3199ONLYOFFICE
Docs		ONLYOFFICE Docs Server Path Traversal Vulnerability2026-10-082026-10-11
CVE-2015-3306ProFTPD
ProFTPD		ProFTPD Improper Access Control Vulnerability2026-10-082026-10-11
CVE-2026-88779Citrix
NetScaler		Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability2026-10-042026-10-07
CVE-2026-102490Zammad GmbH
Zammad		Zammad GmbH Zammad Improper Privilege Management Vulnerability2026-10-022026-10-05
CVE-2026-102489Zammad GmbH
Zammad		Zammad GmbH Zammad Session Fixation Vulnerability2026-10-022026-10-05
CVE-2026-104286Fortinet
FortiMail		Fortinet FortiMail Path Traversal Vulnerability2026-10-012026-10-04
CVE-2026-76504Cisco
Catalyst SD-WAN Manager		Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability2026-09-302026-10-03
CVE-2026-86950Apple
Multiple Products		Apple Multiple Products Out-of-Bounds Write Vulnerability2026-09-292026-10-13
CVE-2026-88772Citrix
NetScaler		Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability2026-09-272026-09-30
CVE-2026-88771Citrix
NetScaler		Citrix NetScaler Improper Input Validation Vulnerability2026-09-272026-09-30
CVE-2026-67279MikroTik
RouterOS		Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability2026-09-252026-09-28
CVE-2026-65660Microsoft
SharePoint		Microsoft SharePoint Code Injection Vulnerability2026-09-252026-09-28
CVE-2026-87902WordPress
Core		WordPress Core Remote File Inclusion Vulnerability2026-09-252026-09-28

Recent Malware IOCs — ThreatFox live

IndicatorTypeMalwareThreatConf.First seen
https://g3.8mytogel.org/j/urlVidarbotnet_cc100%2026-10-17 13:55:48 UTC
f2d4898329126e280c1c0845ef4fc19ad9e822622b0c38afe4ec5c74f1228591sha256_hashMiraipayload95%2026-10-17 13:53:48 UTC
https://g3.8mytogel.org/us/urlVidarbotnet_cc100%2026-10-17 13:50:48 UTC
awg5bzdo.escritoriovirtualasesor.comdomainClearFakepayload_delivery100%2026-10-17 13:50:47 UTC
beterbewegenmetyael.blogdomainClearFakepayload_delivery100%2026-10-17 13:49:31 UTC
45.130.147.87:1111ip:portCobalt Strikebotnet_cc75%2026-10-17 13:45:55 UTC
https://g3.8mytogel.org/sd/urlVidarbotnet_cc100%2026-10-17 13:45:48 UTC
https://g3.8mytogel.org/gh/urlVidarbotnet_cc100%2026-10-17 13:40:48 UTC
66560b1d6fbeaeda88cd9b8cb60c6a5f5a0566671cab18ce4e9ea76ea01c6919sha256_hashAMOSpayload100%2026-10-17 13:36:17 UTC
https://g3.8mytogel.org/ly/urlVidarbotnet_cc100%2026-10-17 13:35:48 UTC
8012bebbae6ce207e8eb80ec1fbedc2e3671febb8076c4d169ea7697c38ce48asha256_hashAMOSpayload100%2026-10-17 13:33:41 UTC
174346a59ee8838aa96f197cc32f387301f6184dcb8c1a68f9e516983e53387dsha256_hashAMOSpayload100%2026-10-17 13:31:18 UTC
https://g3.8mytogel.org/b2/urlVidarbotnet_cc100%2026-10-17 13:30:48 UTC
c944cca192412a63599b52564a6a7b71cd70360786ed81d1fb6e750a9c3b8eedsha256_hashAMOSpayload100%2026-10-17 13:29:22 UTC
https://g3.8mytogel.org/hm/urlVidarbotnet_cc100%2026-10-17 13:25:48 UTC
24906c1f9e68e5cfd165a59b92e00ea913a6742ac7133828fdffcb6fbf653407sha256_hashAMOSpayload100%2026-10-17 13:25:41 UTC
https://g3.8mytogel.org/hcp/urlVidarbotnet_cc100%2026-10-17 13:20:48 UTC
https://g3.8mytogel.org/i2/urlVidarbotnet_cc100%2026-10-17 13:15:48 UTC
https://g3.8mytogel.org/m3/urlVidarbotnet_cc100%2026-10-17 13:10:48 UTC
54.215.31.113:5621ip:portRemusbotnet_cc100%2026-10-17 13:10:12 UTC
https://g3.8mytogel.org/rx/urlVidarbotnet_cc100%2026-10-17 13:05:48 UTC
95.214.181.145:80ip:portVShellbotnet_cc100%2026-10-17 13:05:06 UTC
15.207.73.20:7443ip:portUnknown malwarebotnet_cc100%2026-10-17 13:05:05 UTC
156.238.224.156:5533ip:portVShellbotnet_cc100%2026-10-17 13:05:05 UTC
47.113.227.139:8084ip:portVShellbotnet_cc100%2026-10-17 13:05:05 UTC

Community Threat Pulses — AlienVault OTX live

PulseAuthorTagsIOCsCreated
VectraRAT: An Undocumented Full-Stack MaaS Built From ScratchAlienVaultamadey, maas platform, vidar, vectrarat, nyxel, netsupport rat, clickfix, uac bypass362026-09-16
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central AsiaAlienVaultbloodalchemy, nomadrat, silkparasite, spicerat, nodeedgerat, government impersonation602026-09-16
Noodle RAT: A Recipe for Cross Platform EspionageAlienVaultrekoobe, angryrebel, noodle rat, tiny shell, microload, multidrop, gh0st rat542026-09-16
How Money Laundering, Scams, and Espionage Hide in a Web Full of Casino GarbageAlienVaultpeckbirdy, money laundering, illegal gambling, bulletproof hosting, scambling, casino domains242026-09-16
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessionsAlienVaultKREMLIN, browser extension, Ethereum dead-drop, PULSAR, REMCOS, session hijacking3602026-09-16
The banana stand: brokering and managing infections across Asia using MQTTAlienVaultsupply chain, mqtt, iocontrol, korplug, plugx, sideloading, wailingcrab, tendyron onkey472026-09-16
Fake MP4 File Carries Malicious PayloadAlienVaultfake mp4, encrypted payload, powershell, cloudflare, iso-bmff, remote administration tool, netsupport, uuid box632026-08-29
skynox7: Proxyjacking Edge Devices Into Residential ProxiesAlienVaultbandwidth monetization, proxyjacking, dvr exploitation, cve-2024-3272, cve-2021-44228, cve-2024-3273, edge devices, iproyal112026-10-15
Inside a PaperCut Attacker's AI Toolkit: Agent Instructions, Exploit Code, a Second RCE, and Victims Across 45+ CountriesAlienVaultpentagi framework, ai-orchestrated exploitation, cve-2026-81578, xml-rpc abuse, reverse socks5, credential harvesting, chisel persistence, active directory compromise252026-10-15
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and TerrorizeAlienVaultcredential theft, hvnc, telegram c2, psychological harassment, bladabindi, remote access trojan, kgb rat, windows402026-10-15