SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefFriday, October 30, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Cisco SD-WAN Flaw Exploited to Deploy KeyDrift | CRITICAL |
|
5 C2 IPs | 31 OTX IOCs | 36 ARTICLES |
|
■ ANALYST TLDR Advanced threat actors are actively exploiting critical network infrastructure and enterprise platforms, highlighted by APT group UAT-11473 abusing a Cisco Catalyst SD-WAN authentication bypass (CVE-2026-20127) to deploy KeyDrift malware. Concurrently, a CVSS 9.8 Linux kernel TCP vulnerability (CVE-2026-98432) and widespread supply chain threats—including 13.4M malicious Chrome extension installs and fake AI desktop apps—pose severe risks to enterprise networks and credentials. Organizations must prioritize patching network edge appliances, applying kernel updates, and auditing exposed repository secrets. |
|
■ CRITICAL STORIES Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware APT group UAT-11473 is actively exploiting CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controllers, to breach networks and deploy custom malware. |
Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions CVE-2026-98432 exposes major Linux distributions to high-severity remote exploitation stemming from a flaw in the kernel's TCP stack implementation. |
Chrome extensions with 13.4 million installs caught hijacking searches A widespread supply-chain campaign involving 319 Chrome extensions hijacked search traffic across millions of endpoints for malicious ad-revenue redirection. |
Limited reports of PHP bug exploitation emerge Suspected Chinese APT actors are exploiting PHP2Shell vulnerabilities targeting U.S. government-affiliated entities for initial access. |
|
■ CVEs IDENTIFIED CVE-2026-20127 Cisco Catalyst SD-WAN Controllers — Authentication bypass allowing persistent deployment of KeyDrift malware |
CVE-2026-98432 Linux Kernel (Ubuntu, RHEL, others) — Flaw in TCP stack code permitting high-impact remote exploitation |
[CVE-TBD] PHP Engine — PHP2Shell flaw exploited in targeted attacks against server infrastructure |
[CVE-TBD] Telegram for Android — Chained flaw permitting code execution upon answering incoming voice calls |
|
■ THREAT ACTORS Exploited Cisco Catalyst SD-WAN vulnerability (CVE-2026-20127) to deploy custom KeyDrift malware |
Targeting U.S. government-affiliated servers using PHP2Shell exploits |
North Korean Threat Actors | Nation-State |
Integrating AI models into attack pipelines to accelerate operational efficiency |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Exploitation of Cisco SD-WAN (CVE-2026-20127) and PHP2Shell bugs |
| T1204.002 | | User Execution: Malicious File | Yoba campaign delivering trojanized AI applications carrying miners |
| T1176 | | Browser Extensions | Malicious Chrome search-hijacking and Firefox wallet-stealing browser add-ons |
| T1552.001 | | Unsecured Credentials: Code Repositories | Exposure of 26,400 working AI and cloud keys on Gitee |
| T1496 | | Resource Hijacking | GPU server takeover via malicious Hugging Face models and endpoint mining |
| T1059.007 | | JavaScript | Malicious JS injection into third-party crypto prediction platform (Polymarket) |
|
■ PATCH PRIORITY Cisco Catalyst SD-WAN Controllers — CVE-2026-20127 authentication bypass actively exploited to deploy KeyDrift malware — [BC] |
Linux Kernel (Ubuntu, RHEL) — CVE-2026-98432 CVSS 9.8 flaw in TCP processing code allowing potential remote takeover — [THN] |
Veeam / Adobe / Juniper Networks — Critical flaws allowing arbitrary code execution, privilege escalation, and auth bypass — [SW] |
Apple iOS / iPadOS — Backported update for CoreGraphics zero-day flaw exploited in targeted attacks — [MWB] |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Patch Cisco Catalyst SD-WAN Controllers immediately to mitigate active exploitation of CVE-2026-20127 by UAT-11473. |
| 2 | [P1] Apply urgent kernel security updates for CVE-2026-98432 across all Ubuntu, Red Hat Enterprise Linux, and Linux server hosts. |
| 3 | [P1] Update Adobe, Veeam, and Juniper Networks systems to current release versions to fix critical RCE and privilege escalation bugs. |
| 4 | [P2] Rotate all organizational API keys and audit developer repositories for exposed credentials following the Gitee breach disclosures. |
| 5 | [P2] Deploy updates for Telegram on Android endpoints and legacy Apple iOS devices (iPhone XS/XR, iPad 7th gen) to mitigate voice call and CoreGraphics exploits. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |