SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefTuesday, October 06, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Citrix NetScaler Zero-Day CVE-2026-88779 Under Active Exploitation | CRITICAL |
|
5 C2 IPs | 57 OTX IOCs | 31 ARTICLES |
|
■ ANALYST TLDR Active exploitation of critical zero-day and newly disclosed vulnerabilities dominates today's threat landscape, highlighted by targeted attacks on Citrix NetScaler (CVE-2026-88779) and Rejetto HFS (CVE-2026-61500). Additionally, Microsoft has issued urgent out-of-band patches for a high-severity Exchange Server privilege escalation vulnerability (CVE-2026-96940). Meanwhile, significant law enforcement actions are noted with the arrest of a key ShinyHunters extortion group member and the developer of the Ploutus ATM malware. |
|
■ CRITICAL STORIES Citrix NetScaler Zero-Day CVE-2026-88779 Exploited in Targeted Attacks A newly observed high-severity zero-day vulnerability in Citrix NetScaler ADC and Gateway is being actively exploited to knock SAML deployments offline, bypassing recent security patches and disrupting enterprise access. |
Critical Rejetto HFS Flaw CVE-2026-61500 Actively Scanned and Exploited Attackers are actively exploiting a critical session forgery and remote code execution vulnerability in Rejetto HTTP File Server (HFS) that allows complete administrative takeover. |
Microsoft Releases Out-of-Band Patch for Exchange Server Flaw CVE-2026-96940 Microsoft has addressed a high-severity vulnerability (CVSS 8.8) in Exchange Server that allows authenticated attackers to escalate privileges and access other users' mailboxes. |
Alleged ShinyHunters Leader Arrested in Jordan A key member of the prolific ShinyHunters extortion group, known as "Rey," has been detained in Jordan and is reportedly cooperating with the FBI to target other members of the group. |
|
■ CVEs IDENTIFIED CVE-2026-88779 Citrix NetScaler ADC and Gateway — Denial of Service / SAML Deployment Disruption |
CVE-2026-61500 Rejetto HTTP File Server (HFS) — Session Forgery, Account Takeover, and Remote Code Execution (RCE) |
CVE-2026-96940 Microsoft Exchange Server — Privilege Escalation and Unauthorized Mailbox Access |
[CVE-TBD] Dell System Update (DSU) CLI — Local Privilege Escalation to Root |
|
■ THREAT ACTORS ShinyHunters | Cybercrime / Extortion Group |
Leader "Rey" arrested in Jordan, currently cooperating with the FBI. |
Ploutus Developer | Cybercrime |
Alleged developer of Ploutus ATM jackpotting malware appeared in US court after arrest. |
Cling Botnet Operators | Cybercrime / Botnet |
Deploying Cling botnet malware utilizing STUN-based C2 via Realtek Jungle SDK exploits. |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Used to exploit Rejetto HFS (CVE-2026-61500) and Citrix NetScaler (CVE-2026-88779). |
| T1071.001 | | Application Layer Protocol: Web Protocols | STUN protocol abused by ClingSTUN backdoor for C2 communication. |
| T1068 | | Exploitation for Privilege Escalation | Exploiting Dell System Update and Microsoft Exchange (CVE-2026-96940) for elevated access. |
| T1539 | | Steal Web Session Cookie | Session forgery exploited in Rejetto HFS to gain admin access. |
| T1567 | | Exfiltration Over Web Service | Extortion groups stealing and threatening to leak sensitive data. |
| T1486 | | Data Encrypted for Impact | Ransomware attack affecting UIC College of Medicine. |
|
■ PATCH PRIORITY Citrix — NetScaler ADC and Gateway — Actively exploited zero-day (CVE-2026-88779) knocking SAML deployments offline — REC/SW |
Rejetto — HTTP File Server (HFS) — Actively exploited session forgery and RCE vulnerability (CVE-2026-61500) — BC/SW |
Microsoft — Exchange Server — High-severity privilege escalation (CVE-2026-96940) allowing unauthorized mailbox access — THN |
Dell — System Update (DSU) CLI — Critical flaw allowing local attackers to gain root privileges — BC |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Apply out-of-band security updates immediately to Citrix NetScaler ADC and Gateway to mitigate the actively exploited zero-day CVE-2026-88779. |
| 2 | [P1] Patch Rejetto HTTP File Server (HFS) installations immediately to remediate CVE-2026-61500 and prevent session forgery and RCE. |
| 3 | [P1] Deploy the out-of-band security update for Microsoft Exchange Server to resolve the high-severity privilege escalation vulnerability CVE-2026-96940. |
| 4 | [P2] Update Dell System Update (DSU) CLI deployments to the latest version to prevent local privilege escalation to root. |
| 5 | [P2] Audit macOS Full Disk Access (FDA) permissions and prepare for Apple's upcoming tighter controls regarding AI agent data access. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |