SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefTuesday, October 20, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Ransomware Groups Actively Exploit PAN-OS CVE-2026-0257 | CRITICAL |
|
5 C2 IPs | 62 OTX IOCs | 37 ARTICLES |
|
■ ANALYST TLDR Active exploitation of Palo Alto Networks PAN-OS (CVE-2026-0257) by ransomware groups Spikey Scorpius and Tarnished Scorpius poses an immediate critical risk to enterprise perimeter defenses. Concurrently, supply chain attacks targeting Rank Math PRO, AOMEI update servers, ConnectWise Cloud Backup, and GitHub repositories demonstrate widespread tampering with trusted software delivery channels. Rapid weaponization of newly disclosed vulnerabilities, such as the Plex2Shell exploit chain and unpatched Broadcom Wi-Fi flaws, highlights urgent patching requirements across perimeter, cloud, and local software infrastructure. |
|
■ CRITICAL STORIES Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 Ransomware actors including Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) are actively exploiting PAN-OS vulnerability CVE-2026-0257 to compromise networks and deploy ransomware. |
WordPress SEO plugin Rank Math compromised to backdoor websites A supply-chain compromise inserted hidden backdoors into Rank Math PRO version 3.0.123 distributed between October 15 and October 16, exposing thousands of WordPress sites to remote persistent access. |
F5 releases out-of-band patches for critical NGINX vulnerabilities F5 issued emergency security patches for critical NGINX web server flaws that allow unauthenticated threat actors to execute remote code on vulnerable targets. |
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor Attackers weaponized a chain of vulnerabilities in Plex Media Server within hours of a public PoC release to deploy cryptocurrency miners and reverse proxy backdoors. |
|
■ CVEs IDENTIFIED CVE-2026-0257 Palo Alto Networks PAN-OS — Active ransomware exploitation enabling initial access and network breach |
[CVE-TBD] F5 NGINX — Out-of-band remote code execution vulnerabilities in web server |
[CVE-TBD] Drupal Core (Entity List & Field UI) — Fast exploitation risk leading to remote code execution |
[CVE-TBD] Broadcom Wi-Fi Setup Software — Unauthenticated root code execution on routers via Wi-Fi radio range |
|
■ THREAT ACTORS Spikey Scorpius (Qilin) | Ransomware Group |
Actively exploiting PAN-OS CVE-2026-0257 for enterprise network intrusions |
Tarnished Scorpius (Inc) | Ransomware Group |
Actively exploiting PAN-OS CVE-2026-0257 for initial compromise and extortion |
ShinyHunters | Extortion Group |
Investigated by US federal authorities regarding major data theft and extortion operations |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Active exploitation of PAN-OS CVE-2026-0257, Plex2Shell, Fortinet, and Drupal vulnerabilities |
| T1195.002 | | Supply Chain Compromise: Compromise Software Dependencies / Delivery | Tampering with Rank Math PRO installers, AOMEI update servers, and GitHub workflows |
| T1574.002 | | Hijack Execution Flow: DLL Side-Loading | Pairing signed Siemens Software Center binaries with malicious DLLs |
| T1566.002 | | Phishing: Spearphishing Link | Social engineering via ClickFix lures and fake Web3 accelerator promotional offers |
| T1078 | | Valid Accounts | Abuse of compromised credentials to access ETS SFTP servers containing student records |
| T1496 | | Resource Hijacking | Unauthorized deployment of cryptocurrency miners on compromised Plex servers |
|
■ PATCH PRIORITY Palo Alto Networks PAN-OS — Active exploitation by ransomware operators targeting CVE-2026-0257 — [U42] |
F5 NGINX — Emergency out-of-band security updates released for multiple critical RCE flaws — [BC] |
Drupal Core — Critical RCE vulnerabilities in core modules with fast exploitation potential — [SW] |
Broadcom Wi-Fi Setup Software — Allows unauthenticated root code execution within radio range — [THN] |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Immediately apply security patches for Palo Alto Networks PAN-OS (CVE-2026-0257) to mitigate active ransomware attacks by Spikey Scorpius and Tarnished Scorpius. |
| 2 | [P1] Deploy out-of-band security updates issued by F5 for NGINX web servers to prevent critical remote code execution. |
| 3 | [P1] Inspect WordPress environments running Rank Math PRO; remove version 3.0.123, purge installed backdoors, and reinstall clean packages from verified sources. |
| 4 | [P2] Patch Plex Media Server instances to the latest version to block active exploitation of the Plex2Shell vulnerability chain. |
| 5 | [P2] Revoke and rotate all third-party AI service API keys (OpenAI, Anthropic, Google) configured in OpenCode Console following the disclosed legacy breach. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |