SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefThursday, October 01, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Active Zero-Day Exploitation of Cisco and NetScaler | CRITICAL |
|
5 C2 IPs | 43 OTX IOCs | 35 ARTICLES |
|
■ ANALYST TLDR Threat actors are actively exploiting critical zero-day vulnerabilities in Cisco Catalyst SD-WAN Manager (CVE-2026-76504) and Citrix NetScaler (CVE-2026-88771/72) to gain administrative and root access. Concurrently, Russian state-sponsored group Star Blizzard is deploying the CosmicPulse backdoor via the new "RedFlick" technique, while Zimbra and MikroTik systems face severe unauthenticated remote execution threats. Additionally, over 543,000 valid credentials remain exposed in public GitHub repositories, highlighting persistent credential hygiene issues. |
|
■ CRITICAL STORIES Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager Attackers are actively exploiting a zero-day vulnerability (CVE-2026-76504) in Cisco Catalyst SD-WAN Manager to bypass authentication and escalate privileges to admin, threatening enterprise network control. |
Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks Threat actors are exploiting NetScaler vulnerabilities (CVE-2026-88771 and CVE-2026-88772) to obtain root access and deploy WHIPSHOT and SLAPSHOT malware against high-value targets. |
Russian state hackers use new RedFlick technique to push malware Star Blizzard (Russian state actor) is utilizing a novel malware installation tactic called "RedFlick" to distribute its signature CosmicPulse backdoor via large-scale phishing campaigns. |
DIVD says Zammad zero-days enabled AI-driven network breach A chain of two zero-day vulnerabilities in the open-source Zammad ticketing system enabled threat actors to execute an AI-driven breach of the DIVD network. |
|
■ CVEs IDENTIFIED CVE-2026-76504 Cisco Catalyst SD-WAN Manager — Authentication bypass leading to admin privilege escalation |
CVE-2026-88771 Citrix NetScaler ADC / Gateway — Root access exploitation and deployment of WHIPSHOT/SLAPSHOT malware |
CVE-2026-88772 Citrix NetScaler ADC / Gateway — Root access exploitation and deployment of WHIPSHOT/SLAPSHOT malware |
CVE-2026-73570 Zimbra Collaboration Suite (ZCS) — Unauthenticated command injection on internet-facing mail servers |
|
■ THREAT ACTORS Star Blizzard | Nation-State |
Deploying CosmicPulse backdoor via the "RedFlick" infection chain in phishing campaigns |
Tren de Aragua | Cybercriminal Gang |
Laundering money stolen from ATM malware schemes via Venezuelan nationals and front companies |
ShinyHunters | Cybercriminal Gang |
Defiantly claiming they did not intend to publish stolen FBI data following a leader's arrest |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Exploitation of vulnerabilities in Cisco SD-WAN, Citrix NetScaler, Zimbra, and Zammad |
| T1566 | | Phishing | Used by Star Blizzard (RedFlick), dual-RMM campaigns (MSP360), and CSuite credential harvesting |
| T1505.003 | | Server Software Component: Web Shell | Deployed on compromised Zimbra mail servers |
| T1219 | | Remote Access Software | Abuse of MSP360 and ScreenConnect for unauthorized persistence |
| T1552.001 | | Unsecured Credentials: Private Keys | Over 543,000 valid credentials exposed in public GitHub repositories |
| T1204.002 | | User Execution: Malicious File | ClickFix lures disguised as product offerings via Custom GPTs |
|
■ PATCH PRIORITY Cisco — Catalyst SD-WAN Manager (CVE-2026-76504) — Active zero-day exploitation allowing remote admin privilege escalation — THN |
Citrix — NetScaler ADC & Gateway (CVE-2026-88771, CVE-2026-88772) — Active zero-day exploitation for root access and malware deployment — SW |
Zimbra — Collaboration Suite (CVE-2026-73570) — Unauthenticated command injection leading to web shell deployment — THN |
MikroTik — RouterOS ([CVE-TBD]) — Pre-auth remote code execution and denial of service — BC |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Patch Cisco Catalyst SD-WAN Manager immediately to address the active zero-day authentication bypass vulnerability (CVE-2026-76504). |
| 2 | [P1] Apply security updates for Citrix NetScaler ADC and Gateway to mitigate active exploitation of CVE-2026-88771 and CVE-2026-88772. |
| 3 | [P1] Update Zimbra Collaboration Suite (ZCS) to patch CVE-2026-73570 to prevent unauthenticated command injection and web shell deployment. |
| 4 | [P1] Apply critical patches for MikroTik RouterOS to prevent pre-auth remote code execution (RCE). |
| 5 | [P2] Audit public GitHub repositories for exposed credentials and revoke the 543,000+ valid credentials identified in leaks. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |