SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefFriday, October 02, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Fortinet FortiMail Zero-Day Under Active Exploitation | CRITICAL |
|
5 C2 IPs | 86 OTX IOCs | 38 ARTICLES |
|
■ ANALYST TLDR Active zero-day exploitation of Fortinet FortiMail (CVE-2026-104286) and Zimbra (CVE-2026-73570) highlights an immediate threat to enterprise communication gateways. Meanwhile, international law enforcement has successfully disrupted the KillSec ransomware-as-a-service network, and emerging AI-centric threats are materializing through sophisticated model reasoning extraction campaigns. |
|
■ CRITICAL STORIES Fortinet warns of critical FortiMail flaw exploited in zero-day attacks Attackers are actively exploiting CVE-2026-104286 to execute unauthorized code or commands on vulnerable FortiMail devices, bypassing traditional security perimeters. |
Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure CVE-2026-73570 allows threat actors to execute remote code with zero user interaction via specially crafted emails, making it an extremely high-risk vector for enterprise email servers. |
OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates This represents a novel class of intellectual property theft where threat actors attempt to steal the underlying reasoning models of advanced AI systems via distillation campaigns. |
Police dismantle KillSec ransomware gang allegedly led by 16-year-old Operation KillSwitch successfully seized servers and 110TB of stolen data, demonstrating a major win for law enforcement against teenage-led cybercrime syndicates. |
|
■ CVEs IDENTIFIED CVE-2026-104286 Fortinet FortiMail — Unauthorized code or command execution |
CVE-2026-73570 Zimbra Collaboration Suite — Zero-interaction remote code execution via email |
CVE-2026-86950 Apple CoreGraphics — Arbitrary code execution via malicious PDF |
[CVE-TBD] Kiteworks Email Protection Gateway (EPG) — Max-severity code injection vulnerability |
|
■ THREAT ACTORS KillSec | Ransomware-as-a-Service (RaaS) |
Infrastructure seized and 16-year-old leader arrested in Spain |
Moonshot AI Associates | Cyber Espionage / AI Extraction |
Conducted a coordinated distillation campaign to extract protected reasoning from OpenAI models |
China-linked groups | State-sponsored APT |
Targeted AI firms and Asian governments with phishing campaigns impersonating Western experts |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Used to exploit FortiMail (CVE-2026-104286) and Zimbra (CVE-2026-73570) |
| T1566 | | Phishing | Chinese actors impersonating Western experts to target AI firms; fake crypto voting sites |
| T1543 | | Create or Modify System Process | WordPress backdoor rebuilding itself via database and shared memory |
| T1219 | | Remote Access Software | Abuse of legitimate ScreenConnect clients for persistence |
| T1588.007 | | Obtain Capabilities: Artificial Intelligence | Moonshot AI Associates extracting reasoning models from OpenAI |
|
■ PATCH PRIORITY Fortinet — FortiMail (CVE-2026-104286) zero-day command execution — [BC] |
Zimbra — Collaboration Suite (CVE-2026-73570) zero-interaction RCE — [SW] |
Kiteworks — Email Protection Gateway (EPG) max-severity code injection — [BC] |
Cisco — Catalyst SD-WAN Manager authentication bypass — [THN] |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Patch Fortinet FortiMail immediately to remediate CVE-2026-104286 and block active zero-day exploitation. |
| 2 | [P1] Apply security updates to Zimbra Collaboration Suite to address CVE-2026-73570 and prevent zero-interaction email-based RCE. |
| 3 | [P1] Remediate Cisco Catalyst SD-WAN Manager authentication bypass vulnerability following its addition to the CISA KEV list. |
| 4 | [P1] Update Kiteworks Email Protection Gateway (EPG) to the latest version to patch the max-severity code injection vulnerability. |
| 5 | [P2] Deploy updates for Apple CoreGraphics (CVE-2026-86950) to defend against malicious PDF exploits delivered via messaging apps like WhatsApp. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |