August 30, 2026 · Applied Cybernetics Group
Morning Brief — August 30, 2026
Morning Brief — 2026-08-30
10 emerging critical cves, 17 ransomware activity, 493 ioc volume, 1 recent osint events, 16 active malware families, 3 multi-source iocs, 2 intel feeds, 12 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Material Breach Disclosures
No new Item 1.05 8-K filings in this window.
Federal Patching Priority
No new KEV additions in this window.
Exploit Probability Movers
No CVEs with ≥0.20 EPSS movement in this window.
Emerging Critical CVEs
CVE-2026-82456· CRITICAL (10.0) · 2026-08-29 — argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the…CVE-2026-15980· CRITICAL (9.8) · 2026-08-30 — The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation…CVE-2026-15369· CRITICAL (9.8) · 2026-08-29 — The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_sel…CVE-2026-82460· CRITICAL (9.8) · 2026-08-29 — Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to…CVE-2026-82452· CRITICAL (9.8) · 2026-08-29 — rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, l…CVE-2026-82448· CRITICAL (9.8) · 2026-08-29 — Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present…CVE-2026-14494· CRITICAL (9.8) · 2026-08-29 — The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfi…CVE-2026-82454· CRITICAL (9.1) · 2026-08-29 — The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the ‘alg’ field from the attacker-supplied J…CVE-2026-82450· HIGH (8.8) · 2026-08-29 — BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book…CVE-2026-82447· HIGH (8.8) · 2026-08-29 — Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject m…
Supply Chain
No high/critical GHSA advisories in this window.
Ransomware Activity
17 new victim postings across 9 groups.
| Group | Victims | Sample |
|---|---|---|
qilin | 8 | Bandit Industries, LAPoco Architects, Neumaticos Corral S.A., The Frame Group, L… |
Black X | 2 | FE CREDIT, i-one |
Orova | 1 | ITC Properties Group Limited |
emperador | 1 | Uniguacu |
incransom | 1 | wittmann |
m3rx | 1 | lindner-group.com |
majinahanashi | 1 | TERRA*** & MON**** |
shinyhunters | 1 | Neogen Corporation |
threeam | 1 | wmdn.net |
IOC Volume
493 new IOCs in this window. By source:
| Source | Count |
|---|---|
urlhaus | 490 |
misp | 3 |
Recent OSINT Events
[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems
- Date: 2021-01-27 · Threat: undefined · Org: CERT-FR_1510
- Signal: 3 actionable IOCs (of 17 attributes) · https://www.circl.lu/doc/misp/feed-osint/60118dab-1ab8-40b2-b02b-b6f80aba047c.json
Active Malware Families
16 malware families active this week (0 corroborated across ≥2 sources), exercising 17 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.
| Family | Type | Corrob. | IOCs | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| Mirai | botnet | — | 1,164 | T1110, T1498, T1499, T1584.005 |
| ConnectWise ScreenConnect (abuse) | rmm-abuse | — | 38 | T1219 |
| ClickFix | delivery → | — | 25 | T1059.001, T1204 |
| AgentTesla | stealer | — | 17 | T1056.001, T1071, T1114, T1555 |
| CoinMiner | miner | — | 13 | T1496 |
| Formbook | stealer | — | 8 | T1005, T1056.001, T1071, T1555 |
| XWorm | rat | — | 7 | T1056.001, T1071 |
| PureLogsStealer | stealer | — | 6 | T1005, T1071, T1555 |
| DDoSAgent | ddos | — | 4 | T1498, T1499 |
| Stealc | stealer | — | 4 | T1005, T1071, T1555 |
| ClearFake | delivery → | — | 2 | T1059.001, T1189, T1204 |
| GuLoader | loader → | — | 2 | T1027, T1071, T1105 |
| SilverFox | rat | — | 2 | T1059, T1071, T1219 |
| AsyncRAT | rat | — | 1 | T1056.001, T1059.001, T1071, T1219 |
| Lumma | stealer | — | 1 | T1005, T1071, T1555 |
| MassLogger | stealer | — | 1 | T1056.001, T1071, T1555 |
Families marked ”→” are delivery/social-engineering clusters (ClickFix, ClearFake, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Multi-Source IOCs
3 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.
| IOC | Type | Sources | Last seen |
|---|---|---|---|
cryptovectorhub1.lol | domain | misp + urlhaus | 2026-08-30 |
hypercorevector4.lol | domain | misp + urlhaus | 2026-08-30 |
iploglab.store | domain | misp + urlhaus | 2026-08-30 |
MISP × KEV Correlation
No MISP events in this window referenced a CVE.
Cross-Reference
No recent SEC filings to cross-reference.
Intel Feeds
2 IOC feeds updated this run (2,868 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.
| Feed | Source | Type | Count | Downloads |
|---|---|---|---|---|
| URLhaus — Malware Distribution URLs | urlhaus | url | 2,710 | CSV · MISP · STIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 158 | CSV · MISP · STIX |
Hand-Authored Sigma
10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation — SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage — Detection | draft | https://thrunt.meundefined |
Detection Gaps
18 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | MISP | KEV |
|---|---|---|---|---|
T1011 | Exfiltration Over Other Network Medium | — | 0 | 4 |
T1497 | Virtualization/Sandbox Evasion | — | 0 | 4 |
T1573.001 | Symmetric Cryptography | — | 1 | 3 |
T1562 | — | — | 0 | 3 |
T1001 | Data Obfuscation | — | 0 | 2 |
T1499.002 | Service Exhaustion Flood | — | 0 | 2 |
T1530 | Data from Cloud Storage | — | 0 | 2 |
T1562.001 | — | — | 0 | 2 |
T1003.008 | /etc/passwd and /etc/shadow | — | 0 | 1 |
T1070.001 | — | — | 0 | 1 |
…and 8 more below the cut — full list on the rollup.
Pipeline Health
All feeds healthy.
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.