⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.

ctid-attck — 264.1h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac

Morning Brief — 2026-10-04

1 exploit probability movers, 10 emerging critical cves, 5 ransomware activity, 1273 ioc volume, 15 active malware families, 2 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

CVE	Today	Prev	Δ	In KEV
`CVE-2023-42118`	0.216	0.475	▼ 0.259

Emerging Critical CVEs

CVE-2026-105135 · CRITICAL (10.0) · 2026-10-04 — A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inpu…
CVE-2026-105134 · CRITICAL (10.0) · 2026-10-04 — A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument r…
CVE-2026-105105 · CRITICAL (9.8) · 2026-10-03 — CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to…
CVE-2026-103355 · CRITICAL (9.3) · 2026-10-04 — Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor…
CVE-2026-105123 · HIGH (8.8) · 2026-10-04 — W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Att…
CVE-2026-96451 · HIGH (8.8) · 2026-10-03 — Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
CVE-2026-105115 · HIGH (8.6) · 2026-10-03 — OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SO…
CVE-2026-103065 · HIGH (8.2) · 2026-10-03 — Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.
CVE-2026-105133 · HIGH (7.3) · 2026-10-04 — A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument rando…
CVE-2026-105126 · HIGH (7.2) · 2026-10-04 — LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their r…

Supply Chain

No high/critical GHSA advisories in this window.

Ransomware Activity

5 new victim postings across 4 groups.

Group	Victims	Sample
`Wallstreet`	2	St. Francis Healthcare Systems of Hawaii, World Cup 2034
`netrunner`	1	Precon Marine Inc
`qilin`	1	Genesis Credit Management
`rhysida`	1	Skaff Group

IOC Volume

1273 new IOCs in this window. By source:

Source	Count
`urlhaus`	1273

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

15 malware families active this week (1 corroborated across ≥2 sources), exercising 17 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Family	Type	Corrob.	IOCs	Techniques (✗ = coverage gap)
ClickFix	delivery →	✓	34	`T1059.001`, `T1204`
Mirai	botnet	—	2,893	`T1110`, `T1498`, `T1499`, `T1584.005`
ConnectWise ScreenConnect (abuse)	rmm-abuse	—	59	`T1219`
CoinMiner	miner	—	21	`T1496`
AsyncRAT	rat	—	9	`T1056.001`, `T1059.001`, `T1071`, `T1219`
SilverFox	rat	—	6	`T1059`, `T1071`, `T1219`
PhantomStealer	stealer	—	5	`T1005`, `T1555`
AgentTesla	stealer	—	4	`T1056.001`, `T1071`, `T1114`, `T1555`
ClearFake	delivery →	—	4	`T1059.001`, `T1189`, `T1204`
Formbook	stealer	—	3	`T1005`, `T1056.001`, `T1071`, `T1555`
ACRStealer	stealer	—	2	`T1005`, `T1071`, `T1555`
PureLogsStealer	stealer	—	2	`T1005`, `T1071`, `T1555`
XWorm	rat	—	2	`T1056.001`, `T1071`
Phorpiex	botnet	—	1	`T1071`, `T1486`, `T1566`
Stealc	stealer	—	1	`T1005`, `T1071`, `T1555`

Families marked ”→” are delivery/social-engineering clusters (ClickFix, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

IOC	Type	Sources	Last seen
`sandiegomobiletire.com`	domain	`misp` + `urlhaus`	2026-10-04
`xenonclient.com`	domain	`misp` + `urlhaus`	2026-10-04

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No recent SEC filings to cross-reference.

Intel Feeds

2 IOC feeds updated this run (4,903 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Feed	Source	Type	Count	Downloads
URLhaus — Malware Distribution URLs	`urlhaus`	`url`	4,798	CSV · MISP · STIX
URLhaus — Malware Distribution Domains	`urlhaus`	`domain`	105	CSV · MISP · STIX

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Rule	Status	YAML
T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification	experimental	https://thrunt.me/sigma/t1037-linux-init-script-modification.yml
T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host	experimental	https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml
T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process	experimental	https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml
T1098.004 Account Manipulation — SSH Authorized Keys File Modification	experimental	https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml
T1098.005 Okta Verify Enrollment from a Hypervisor Guest	experimental	https://thrunt.me/sigma/t1098-005-hypervisor-mfa-device-enrollment.yml
T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet	experimental	https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml
T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container	experimental	https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml
T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution	experimental	https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml
T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution	experimental	https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml
T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel	experimental	https://thrunt.me/sigma/t1557-aitm-cross-asn-session-mfa.yml
T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2	experimental	https://thrunt.me/sigma/t1557-claims-kit-single-letter-c2-xenc.yml
T1557 Okta Verify SVG Asset Served by a Non-Okta Host	experimental	https://thrunt.me/sigma/t1557-non-okta-host-oktaverify-svg.yml
T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate	experimental	https://thrunt.me/sigma/t1557-recaptcha-skinned-turnstile-gate.yml
T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign	experimental	https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml
T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path	experimental	https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml
T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain	experimental	https://thrunt.me/sigma/t1583-001-claims-registration-conjunction.yml
T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access	draft	https://thrunt.meundefined
T1530 Data from Cloud Storage — Detection	draft	https://thrunt.meundefined

Detection Gaps

18 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

Technique	Name	Active families	MISP	KEV
`T1011`	Exfiltration Over Other Network Medium	—	0	4
`T1497`	Virtualization/Sandbox Evasion	—	0	4
`T1573.001`	Symmetric Cryptography	—	1	3
`T1562`	—	—	0	3
`T1001`	Data Obfuscation	—	0	2
`T1499.002`	Service Exhaustion Flood	—	0	2
`T1530`	Data from Cloud Storage	—	0	2
`T1562.001`	—	—	0	2
`T1003.008`	/etc/passwd and /etc/shadow	—	0	1
`T1070.001`	—	—	0	1

…and 8 more below the cut — full list on the rollup.

Pipeline Health

Feed	Last success	Status
`ctid-attck`	2026-09-23 09:41:01 UTC	failing

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.