SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefThursday, October 15, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
| THREAT OF THE DAY Zero-day exploitation of network devices. | CRITICAL |
| 5 C2 IPs | 51 OTX IOCs | 40 ARTICLES |
| ■ ANALYST TLDR Today's intelligence highlights widespread active exploitation of critical vulnerabilities in network security devices from Palo Alto Networks, Fortinet, Cisco, and Ivanti, emphasizing the urgent need for patching. Concurrently, global law enforcement and private sector partners have disrupted major cybercrime operations, including North Korean IT worker schemes and large-scale phishing infrastructures. |
| ■ CRITICAL STORIES Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks A high-severity RCE zero-day (CVE-2026-0322) in PAN-OS is actively exploited, requiring immediate patching for critical network security devices. |
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant Attackers are exploiting CVE-2024-47575 in FortiGate firewalls to deploy sophisticated memory-resident ARM64 malware, PEERSTITCH, impacting over 500 devices. |
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability Cisco has patched a critical zero-day in Secure Email Gateway (SEG) that allows remote unauthenticated attackers to achieve root-level command execution, actively exploited in the wild. |
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day CISA urges immediate patching for an Ivanti Connect Secure (ICS) zero-day, actively exploited since October 1st, with honeypots logging numerous exploit attempts. |
| ■ CVEs IDENTIFIED CVE-2026-0322 Palo Alto Networks PAN-OS — RCE, exploited in attacks |
CVE-2024-47575 Fortinet FortiGate — Implant deployment (PEERSTITCH), exploited in attacks |
[CVE-TBD] Cisco Secure Email Gateway (SEG) — Remote unauthenticated command execution with root privileges, exploited as zero-day |
[CVE-TBD] Nextcloud Collabora Online - Built-in CODE Server — Web shell deployment, actively exploited |
|
■ THREAT ACTORS Famous Chollima | Nation-state (DPRK) |
Operating IT worker schemes, subject of US law enforcement disruption |
OLVX market administrator | Cybercrime |
Administrator of a cybercrime market, arrested |
Phishing kit operators (CoGUI, YAM Store, Iron Man, Storm-2990) | Cybercrime |
Operating large-scale phishing infrastructure, subject of Microsoft-led disruption |
|
|
| ■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Exploiting RCE zero-days in PAN-OS, FortiGate, Cisco SEG, Ivanti ICS, Nextcloud app |
| T1505.003 | | Server Software Component: Web Shell | Deploying web shells on Nextcloud servers |
| T1566.002 | | Phishing: Spearphishing Link | Over 1 billion scam messages, fake Calendly pages stealing credentials |
| T1078 | | Valid Accounts | Stealing Facebook/Google logins, using fraudulent accounts for DPRK IT worker schemes |
| T1496 | | Resource Hijacking | Cryptocurrency mining (Panchan's Mining Island) |
| T1547.001 | | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | PEERSTITCH implant persistence (inferred) |
|
■ PATCH PRIORITY Palo Alto Networks PAN-OS — RCE zero-day actively exploited — [BC] |
Fortinet FortiGate — CVE-2024-47575 exploited for implant deployment — [U42] |
Cisco Secure Email Gateway (SEG) — Zero-day RCE with root privileges actively exploited — [THN], [BC] |
Ivanti Connect Secure (ICS) — Zero-day actively exploited since Oct 1st — [BC], [THN] |
|
|
| ■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Patch immediately: Apply security updates for Palo Alto Networks PAN-OS to address CVE-2026-0322, as it is actively exploited for RCE. |
| 2 | [P1] Patch immediately: Update Fortinet FortiGate appliances to mitigate CVE-2024-47575, which is being exploited to deploy the PEERSTITCH implant. |
| 3 | [P1] Patch immediately: Apply available patches for Cisco Secure Email Gateway (SEG) to remediate the critical zero-day allowing remote unauthenticated root command execution. |
| 4 | [P1] Patch immediately: Follow CISA's guidance to update Ivanti Connect Secure (ICS) appliances to fix the actively exploited zero-day vulnerability. |
| 5 | [P1] Patch immediately: Deploy Microsoft's October Patch Tuesday updates, prioritizing the actively exploited Windows flaw and other zero-days. |
|
| | C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
| FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
| IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |
|