SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefSaturday, October 03, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Warlock Ransomware Targets Critical Infrastructure Via SharePoint | CRITICAL |
|
5 C2 IPs | 52 OTX IOCs | 25 ARTICLES |
|
■ ANALYST TLDR Today's threat landscape is dominated by active exploitation of critical infrastructure, highlighted by the China-nexus "Warlock" ransomware group targeting water and telecom sectors via Microsoft SharePoint vulnerabilities. Additionally, threat actors are aggressively exploiting zero-day vulnerabilities in Fortinet FortiMail (CVE-2026-104286) and critical flaws in GitLab's AI Gateway and Dell Container Storage Modules. Organizations must prioritize patching these high-severity vulnerabilities immediately to prevent unauthenticated remote code execution and initial access. |
|
■ CRITICAL STORIES Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action Attackers are actively exploiting CVE-2026-104286, a path traversal zero-day in Fortinet FortiMail, allowing unauthenticated arbitrary file writes. This has been added to CISA's KEV catalog, indicating active in-the-wild exploitation. |
Warlock ransomware breach SharePoint in water, telecom operator attacks The China-linked "Warlock" ransomware group is actively exploiting Microsoft SharePoint vulnerabilities to target critical infrastructure sectors, including water utilities and telecommunications providers, across multiple regions. |
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers A critical vulnerability in GitLab's AI Gateway allows authenticated users with Duo Agent Platform access to execute arbitrary commands on self-hosted servers, posing a severe threat to development pipelines and integrated AI environments. |
macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor Threat actors are distributing a fake Zoom installer containing a universal Mach-O binary that drops the CloudSyncD backdoor, demonstrating continued sophistication in targeting macOS environments for persistent access. |
|
■ CVEs IDENTIFIED CVE-2026-104286 Fortinet FortiMail — Path traversal leading to unauthenticated arbitrary file write |
CVE-2026-63688 Dell Container Storage Modules (CSM) — Unauthenticated admin access and root execution on Kubernetes nodes |
[CVE-TBD] GitLab AI Gateway — Command execution on self-hosted servers |
[CVE-TBD] Microsoft SharePoint — Vulnerability exploited for initial access by Warlock ransomware |
|
■ THREAT ACTORS Warlock | Ransomware / State-sponsored (China-nexus) |
Exploiting SharePoint vulnerabilities to target water, telecom, and critical infrastructure. |
Antino | Threat Campaign / Backdoor (China-nexus) |
Using Outlook and OneDrive for C2 in espionage targeting Asian government and policy organizations. |
Tren de Aragua (TdA) | Organized Crime Group (Venezuelan) |
Sanctioned by US Treasury for ATM jackpotting attacks. |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Warlock exploiting SharePoint; Fortinet FortiMail zero-day exploitation. |
| T1204.002 | | User Execution: Malicious File | Fake Zoom installer executing CloudSyncD backdoor on macOS. |
| T1071.001 | | Application Layer Protocol: Web Protocols | Antino backdoor using Outlook and OneDrive for C2 communications. |
| T1566.002 | | Phishing: Spearphishing Link | AI policy experts targeted with phishing campaigns. |
| T1110 | | Brute Force / ATM Jackpotting | Tren de Aragua gang executing ATM jackpotting attacks. |
| T1190 | | SQL Injection | AI agents targeting US and Canadian government sites with SQL injection. |
|
■ PATCH PRIORITY Fortinet FortiMail — Active zero-day exploitation (CVE-2026-104286) allowing arbitrary file writes — SecurityWeek / CISA KEV |
GitLab AI Gateway — Critical 9.9 CVSS vulnerability allowing arbitrary command execution on self-hosted servers — The Hacker News |
Dell Container Storage Modules (CSM) — Critical CVE-2026-63688 allowing unauthenticated admin/root access on Kubernetes — The Hacker News |
Microsoft SharePoint — Actively exploited by Warlock ransomware group for initial access — BleepingComputer |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Apply urgent patches for Fortinet FortiMail to mitigate the actively exploited zero-day CVE-2026-104286. |
| 2 | [P1] Patch GitLab AI Gateway immediately to resolve the critical 9.9 command execution vulnerability on self-hosted instances. |
| 3 | [P1] Deploy security updates for Dell Container Storage Modules (CSM) to address CVE-2026-63688 and prevent unauthenticated root access on Kubernetes nodes. |
| 4 | [P2] Audit Microsoft SharePoint environments for unpatched vulnerabilities and review access logs for indicators of compromise associated with the Warlock ransomware group. |
| 5 | [P2] Implement application whitelisting and user awareness training to detect and block fake macOS Zoom installers delivering the CloudSyncD backdoor. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |