SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefSaturday, October 10, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL LOW |
|
THREAT OF THE DAY Max Severity Exploits Target SonicWall SMA1000 and Citrix | LOW |
|
5 C2 IPs | 13 OTX IOCs | 32 ARTICLES |
|
■ ANALYST TLDR Active zero-day and unpatched flaw exploitation highlights today's threat environment, led by critical vulnerabilities in SonicWall SMA1000 (CVE-2026-102255), Citrix NetScaler (CVE-2026-107406), and AhsayCBS (CVE-2026-105133, CVE-2026-105134). Concurrently, state-sponsored actors like China-linked Flax Typhoon continue targeting critical infrastructure, while major law enforcement operations successfully disrupted ShinyHunters and Qilin ransomware operatives. Supply chain risks persist through malicious GitHub Actions workflows and pre-installed Android firmware malware (Midnight Mimosa). |
|
■ CRITICAL STORIES Max severity SonicWall SMA1000 flaw now exploited in attacks Threat actors are actively exploiting a maximum-severity vulnerability (CVE-2026-102255) in SonicWall SMA1000 appliances patched just days ago, posing immediate compromise risks to enterprise perimeters. |
Citrix Urges Immediate Patching of Critical NetScaler Vulnerability Citrix released urgent updates for CVE-2026-107406 in NetScaler ADC and Gateway, which allows remote code execution (RCE) and denial-of-service, directly threatening critical remote access infrastructure. |
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge Active exploitation of two flaws (CVE-2026-105133, CVE-2026-105134) in AhsayCBS backup software allows unauthenticated attackers to bypass security, inject commands, deploy webshells, and run disguised XMRig miners. |
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories Compromised open-source maintainer accounts were leveraged to inject malicious credential-stealing workflows into over 340 repositories, creating severe CI/CD supply chain exposure. |
|
■ CVEs IDENTIFIED None identified |
■ THREAT ACTORS None identified |
|
|
■ ATT&CK TTPs None identified today |
■ PATCH PRIORITY None identified |
|
|
■ RECOMMENDED ACTIONS TODAY Review articles manually |
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |