October 11, 2026 · Applied Cybernetics Group
Morning Brief — October 11, 2026
⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.
ctid-attck— 432.9h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac
Morning Brief — 2026-10-11
10 emerging critical cves, 35 ransomware activity, 703 ioc volume, 16 active malware families, 3 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Material Breach Disclosures
No new Item 1.05 8-K filings in this window.
Federal Patching Priority
No new KEV additions in this window.
Exploit Probability Movers
No CVEs with ≥0.20 EPSS movement in this window.
Emerging Critical CVEs
CVE-2026-42696· CRITICAL (10.0) · 2026-10-10 — Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 versions.CVE-2026-108540· CRITICAL (9.9) · 2026-10-11 — A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack…CVE-2026-62129· CRITICAL (9.9) · 2026-10-10 — Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.CVE-2026-62024· CRITICAL (9.9) · 2026-10-10 — Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.CVE-2026-108707· CRITICAL (9.8) · 2026-10-11 — Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR a…CVE-2026-81797· CRITICAL (9.8) · 2026-10-10 — Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.CVE-2026-78535· CRITICAL (9.8) · 2026-10-10 — Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.CVE-2026-78533· CRITICAL (9.8) · 2026-10-10 — Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.CVE-2026-78531· CRITICAL (9.8) · 2026-10-10 — Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.CVE-2026-78529· CRITICAL (9.8) · 2026-10-10 — Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
Supply Chain
No high/critical GHSA advisories in this window.
Ransomware Activity
35 new victim postings across 10 groups.
| Group | Victims | Sample |
|---|---|---|
Majinahanashi | 19 | PIO PIO, BONJOUR GROUP, KT RESTAURANT, SON-VIDEO, GRUPO STARFOODS, CDA, WONDR DI… |
qilin | 5 | Confipetrol, ACI Proyectos SAS, Secretaría de Modernización e Innovación del Mun… |
N0n | 2 | Company #5, Company #4 |
dragonforce | 2 | TQC S.A., TEXMA International Co., Ltd |
rhysida | 2 | Charles E. Tabor AAL LLC, Gress Clark Young & Schoepper |
Redact | 1 | DexCom |
UmBra | 1 | Helwan University (HITU) |
exitium | 1 | KOIKE Sanso Kogoyo Co. Ltd. |
incransom | 1 | hsc.mb.ca |
thegentlemen | 1 | Royal Thai Air Force |
IOC Volume
703 new IOCs in this window. By source:
| Source | Count |
|---|---|
urlhaus | 703 |
Recent OSINT Events
No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).
Active Malware Families
16 malware families active this week (1 corroborated across ≥2 sources), exercising 20 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.
| Family | Type | Corrob. | IOCs | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| ConnectWise ScreenConnect (abuse) | rmm-abuse | ✓ | 22 | T1219 |
| Mirai | botnet | — | 1,699 | T1110, T1498, T1499, T1584.005 |
| ClickFix | delivery → | — | 31 | T1059.001, T1204 |
| SmartLoader | loader → | — | 24 | T1027, T1059.001, T1105 |
| AsyncRAT | rat | — | 19 | T1056.001, T1059.001, T1071, T1219 |
| CoinMiner | miner | — | 15 | T1496 |
| DDoSAgent | ddos | — | 14 | T1498, T1499 |
| AgentTesla | stealer | — | 12 | T1056.001, T1071, T1114, T1555 |
| Formbook | stealer | — | 7 | T1005, T1056.001, T1071, T1555 |
| GuLoader | loader → | — | 7 | T1027, T1071, T1105 |
| Remcos | rat | — | 6 | T1056.001, T1071, T1113 |
| SilverFox | rat | — | 4 | T1059, T1071, T1219 |
| XWorm | rat | — | 4 | T1056.001, T1071 |
| AMOS (Atomic macOS Stealer) | stealer | — | 2 | T1005, T1056.002, T1071, T1555.001 |
| ClearFake | delivery → | — | 2 | T1059.001, T1189, T1204 |
| NetSupport Manager (abuse) | rmm-abuse | — | 2 | T1219 |
Families marked ”→” are delivery/social-engineering clusters (ClickFix, SmartLoader, GuLoader, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Multi-Source IOCs
3 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.
| IOC | Type | Sources | Last seen |
|---|---|---|---|
193.161.193.99 | ip-src | misp + urlhaus | 2026-10-11 |
exo-api.tf | domain | misp + urlhaus | 2026-10-11 |
swervimgbackj.top | domain | misp + urlhaus | 2026-10-11 |
MISP × KEV Correlation
No MISP events in this window referenced a CVE.
Cross-Reference
No recent SEC filings to cross-reference.
Intel Feeds
2 IOC feeds updated this run (5,124 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.
| Feed | Source | Type | Count | Downloads |
|---|---|---|---|---|
| URLhaus — Malware Distribution URLs | urlhaus | url | 5,000 | CSV · MISP · STIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 124 | CSV · MISP · STIX |
Hand-Authored Sigma
16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation — SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1098.005 Okta Verify Enrollment from a Hypervisor Guest | experimental | https://thrunt.me/sigma/t1098-005-hypervisor-mfa-device-enrollment.yml |
| T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel | experimental | https://thrunt.me/sigma/t1557-aitm-cross-asn-session-mfa.yml |
| T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2 | experimental | https://thrunt.me/sigma/t1557-claims-kit-single-letter-c2-xenc.yml |
| T1557 Okta Verify SVG Asset Served by a Non-Okta Host | experimental | https://thrunt.me/sigma/t1557-non-okta-host-oktaverify-svg.yml |
| T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate | experimental | https://thrunt.me/sigma/t1557-recaptcha-skinned-turnstile-gate.yml |
| T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain | experimental | https://thrunt.me/sigma/t1583-001-claims-registration-conjunction.yml |
| T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage — Detection | draft | https://thrunt.meundefined |
Detection Gaps
18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | MISP | KEV |
|---|---|---|---|---|
T1011 | Exfiltration Over Other Network Medium | — | 0 | 4 |
T1497 | Virtualization/Sandbox Evasion | — | 0 | 4 |
T1573.001 | Symmetric Cryptography | — | 1 | 3 |
T1562 | — | — | 0 | 3 |
T1001 | Data Obfuscation | — | 0 | 2 |
T1499.002 | Service Exhaustion Flood | — | 0 | 2 |
T1530 | Data from Cloud Storage | — | 0 | 2 |
T1562.001 | — | — | 0 | 2 |
T1003.008 | /etc/passwd and /etc/shadow | — | 0 | 1 |
T1070.001 | — | — | 0 | 1 |
…and 8 more below the cut — full list on the rollup.
Pipeline Health
| Feed | Last success | Status |
|---|---|---|
ctid-attck | 2026-09-23 09:41:01 UTC | failing |
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.