October 5, 2026 · Applied Cybernetics Group
Morning Brief — October 5, 2026
⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.
ctid-attck— 288h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac
Morning Brief — 2026-10-05
1 federal patching priority, 10 emerging critical cves, 24 ransomware activity, 895 ioc volume, 16 active malware families, 3 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Material Breach Disclosures
No new Item 1.05 8-K filings in this window.
Federal Patching Priority
CVE-2026-88779 — Citrix NetScaler
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Added: 2026-10-04 · Federal due: 2026-10-07 · EPSS 18.2th pct (score 0.003) · CWE-119
- ransomware use: Unknown
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
Exploit Probability Movers
No CVEs with ≥0.20 EPSS movement in this window.
Emerging Critical CVEs
CVE-2026-105284· CRITICAL (10.0) · 2026-10-05 — A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to im…CVE-2026-105207· CRITICAL (9.8) · 2026-10-04 — ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller’s permission, including on identify-only Login V2…CVE-2026-105209· CRITICAL (9.6) · 2026-10-04 — ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not…CVE-2026-105215· CRITICAL (9.1) · 2026-10-04 — ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the ‘external account not found’ registration endpoint trusts client-supplied external identity fields witho…CVE-2026-105089· HIGH (8.7) · 2026-10-04 — WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouP…CVE-2026-105086· HIGH (8.7) · 2026-10-04 — WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips t…CVE-2026-104389· HIGH (8.5) · 2026-10-05 — Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5.CVE-2026-19184· HIGH (8.4) · 2026-10-05 — The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored tha…CVE-2026-105213· HIGH (8.2) · 2026-10-04 — ZITADEL 4.x before 4.17.1 does not check an organization’s inactive state during Login V2 authentication, verifying only the individual user’s status. Users of a deactivated organization who hold valid credentials, an ex…CVE-2026-105210· HIGH (8.2) · 2026-10-04 — ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any prim…
Supply Chain
No high/critical GHSA advisories in this window.
Ransomware Activity
24 new victim postings across 12 groups.
| Group | Victims | Sample |
|---|---|---|
qilin | 5 | Unident Group, Chadwick Switchboards, Emser, Cotesma, Mutsumi Group |
lamashtu | 4 | Fluge Audiovisuales, Bender Tribunenbau, TRANS LOGROÑO SOCIEDAD ANONIMA, Grupo I… |
BYOD | 3 | Trump Mobile Wireless (Telecom), Eteam, Royal Selangor |
krybit | 3 | euroditel.com, superpack.com.co, daralteb.com |
play | 2 | Bold Spring Nursery, Silicon Valley Glass |
Booba Project | 1 | MorseLife Health System, Inc. |
Storm | 1 | Nipigon District Memorial Hospital |
aurora | 1 | Thomas Y. Pickett & Co., Inc. |
direwolf | 1 | Softruck |
emperador | 1 | OMUR HIRDAVAT LTD |
payoutsking | 1 | M****C |
thegentlemen | 1 | Center State Engineering |
IOC Volume
895 new IOCs in this window. By source:
| Source | Count |
|---|---|
urlhaus | 895 |
Recent OSINT Events
No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).
Active Malware Families
16 malware families active this week (1 corroborated across ≥2 sources), exercising 19 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.
| Family | Type | Corrob. | IOCs | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| ClickFix | delivery → | ✓ | 38 | T1059.001, T1204 |
| Mirai | botnet | — | 2,905 | T1110, T1498, T1499, T1584.005 |
| ConnectWise ScreenConnect (abuse) | rmm-abuse | — | 52 | T1219 |
| CoinMiner | miner | — | 22 | T1496 |
| AsyncRAT | rat | — | 16 | T1056.001, T1059.001, T1071, T1219 |
| AgentTesla | stealer | — | 8 | T1056.001, T1071, T1114, T1555 |
| Formbook | stealer | — | 7 | T1005, T1056.001, T1071, T1555 |
| PhantomStealer | stealer | — | 5 | T1005, T1555 |
| ClearFake | delivery → | — | 4 | T1059.001, T1189, T1204 |
| SilverFox | rat | — | 4 | T1059, T1071, T1219 |
| ACRStealer | stealer | — | 2 | T1005, T1071, T1555 |
| GuLoader | loader → | — | 2 | T1027, T1071, T1105 |
| PureLogsStealer | stealer | — | 2 | T1005, T1071, T1555 |
| XWorm | rat | — | 2 | T1056.001, T1071 |
| Phorpiex | botnet | — | 1 | T1071, T1486, T1566 |
| Stealc | stealer | — | 1 | T1005, T1071, T1555 |
Families marked ”→” are delivery/social-engineering clusters (ClickFix, ClearFake, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Multi-Source IOCs
3 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.
| IOC | Type | Sources | Last seen |
|---|---|---|---|
exo-api.tf | domain | misp + urlhaus | 2026-10-05 |
sandiegomobiletire.com | domain | misp + urlhaus | 2026-10-05 |
xenonclient.com | domain | misp + urlhaus | 2026-10-05 |
MISP × KEV Correlation
No MISP events in this window referenced a CVE.
Cross-Reference
No recent SEC filings to cross-reference.
Intel Feeds
2 IOC feeds updated this run (4,973 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.
| Feed | Source | Type | Count | Downloads |
|---|---|---|---|---|
| URLhaus — Malware Distribution URLs | urlhaus | url | 4,847 | CSV · MISP · STIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 126 | CSV · MISP · STIX |
Hand-Authored Sigma
16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation — SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1098.005 Okta Verify Enrollment from a Hypervisor Guest | experimental | https://thrunt.me/sigma/t1098-005-hypervisor-mfa-device-enrollment.yml |
| T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel | experimental | https://thrunt.me/sigma/t1557-aitm-cross-asn-session-mfa.yml |
| T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2 | experimental | https://thrunt.me/sigma/t1557-claims-kit-single-letter-c2-xenc.yml |
| T1557 Okta Verify SVG Asset Served by a Non-Okta Host | experimental | https://thrunt.me/sigma/t1557-non-okta-host-oktaverify-svg.yml |
| T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate | experimental | https://thrunt.me/sigma/t1557-recaptcha-skinned-turnstile-gate.yml |
| T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain | experimental | https://thrunt.me/sigma/t1583-001-claims-registration-conjunction.yml |
| T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage — Detection | draft | https://thrunt.meundefined |
Detection Gaps
18 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | MISP | KEV |
|---|---|---|---|---|
T1011 | Exfiltration Over Other Network Medium | — | 0 | 4 |
T1497 | Virtualization/Sandbox Evasion | — | 0 | 4 |
T1573.001 | Symmetric Cryptography | — | 1 | 3 |
T1562 | — | — | 0 | 3 |
T1001 | Data Obfuscation | — | 0 | 2 |
T1499.002 | Service Exhaustion Flood | — | 0 | 2 |
T1530 | Data from Cloud Storage | — | 0 | 2 |
T1562.001 | — | — | 0 | 2 |
T1003.008 | /etc/passwd and /etc/shadow | — | 0 | 1 |
T1070.001 | — | — | 0 | 1 |
…and 8 more below the cut — full list on the rollup.
Pipeline Health
| Feed | Last success | Status |
|---|---|---|
ctid-attck | 2026-09-23 09:41:01 UTC | failing |
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.