# Daily Intelligence Briefing — Monday, October 5, 2026

> On 2026-10-05, Threadlinqs published 15 new threat reports and updated 2, 2 rated critical and 10 high, spanning 120 MITRE ATT&CK techniques and 6 named threat actors. Coverage that day added 153 new detection rules and 381 extracted indicators.

- **Edition:** 2026-10-05 (Monday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-10-05
- **Last updated:** 2026-10-11
- **New threats:** 15 (2 updated)
- **Critical / high:** 2 critical, 10 high, 5 medium, 0 low
- **ATT&CK techniques:** 120
- **Threat actors:** 6
- **Indicators (count only):** 381
- **New detection rules (count only):** 153

## Summary & highlights

Google's PageBreak AI Agent Finds 500+ Verified XSS Flaws and Builds Working Exploit Chains. Phishing Campaign Abuses Legitimate ScreenConnect Client for Remote Access via Fake Payment Notification. ShinyHunters: alleged leader 'Rey' (Saif al-Din Khader) detained in Jordan and reportedly cooperating with the FBI; Dutch suspect Pepijn van der Stap ('Umbreon') arrested.

- [TL-2026-2923](https://intel.threadlinqs.com/threat/TL-2026-2923) — Citrix NetScaler ADC/Gateway Zero-Day CVE-2026-88779 ("PitScaler 2") Exploited Against Appliances Patched Days Earlier (CISA KEV)
- [TL-2026-2928](https://intel.threadlinqs.com/threat/TL-2026-2928) — Azazel: Gentlemen Ransomware Affiliate Compromises 24+ Organizations via Stolen CI/CD Secrets, Abuses MCP as C2 and Runs LEAKNED Leak Site
- [TL-2026-2930](https://intel.threadlinqs.com/threat/TL-2026-2930) — IQUALIF French Residential Data Leak, IUT Paris Seine Breach, 19M SMTP Credential Dump and Apache Struts CVE-2017-5638 Access Sale
- [TL-2026-2934](https://intel.threadlinqs.com/threat/TL-2026-2934) — ClingSTUN Linux Backdoor Turns Unpatched IoT Devices Into Proxy Nodes via Public STUN Infrastructure
- [TL-2026-2939](https://intel.threadlinqs.com/threat/TL-2026-2939) — Alleged Ploutus ATM Malware Developer Anibal Canelon Aguirre ('Prometheus'/'The Engineer') Appears in US Court; Tren de Aragua ATM Jackpotting Campaign

## Theme of the day

Credential-harvesting TIKTOUK toolkit dominated severe alerts, alongside a ransomware intrusion; most activity was unattributed, with one TA419-linked threat.

sso, buffer-overflow, cisa-kev, unauthenticated, remote-code-execution

## Threats published

- [TL-2026-2935](https://intel.threadlinqs.com/threat/TL-2026-2935) — CRITICAL — Dell System Update (DSU) path traversal CVE-2026-86360 (CVSS 9.6) allows unauthenticated root code execution, plus four high-severity flaws fixed in DSU 2.3.0.0
- [TL-2026-2938](https://intel.threadlinqs.com/threat/TL-2026-2938) — CRITICAL — Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers via ImageMagick/libheif (GHSA-x8r2-mggj-j6wr)
- [TL-2026-2923](https://intel.threadlinqs.com/threat/TL-2026-2923) — HIGH — Citrix NetScaler ADC/Gateway Zero-Day CVE-2026-88779 ("PitScaler 2") Exploited Against Appliances Patched Days Earlier (CISA KEV)
- [TL-2026-2928](https://intel.threadlinqs.com/threat/TL-2026-2928) — HIGH — Azazel: Gentlemen Ransomware Affiliate Compromises 24+ Organizations via Stolen CI/CD Secrets, Abuses MCP as C2 and Runs LEAKNED Leak Site
- [TL-2026-2930](https://intel.threadlinqs.com/threat/TL-2026-2930) — HIGH — IQUALIF French Residential Data Leak, IUT Paris Seine Breach, 19M SMTP Credential Dump and Apache Struts CVE-2017-5638 Access Sale
- [TL-2026-2934](https://intel.threadlinqs.com/threat/TL-2026-2934) — HIGH — ClingSTUN Linux Backdoor Turns Unpatched IoT Devices Into Proxy Nodes via Public STUN Infrastructure
- [TL-2026-2939](https://intel.threadlinqs.com/threat/TL-2026-2939) — HIGH — Alleged Ploutus ATM Malware Developer Anibal Canelon Aguirre ('Prometheus'/'The Engineer') Appears in US Court; Tren de Aragua ATM Jackpotting Campaign
- [TL-2026-2940](https://intel.threadlinqs.com/threat/TL-2026-2940) — HIGH — Booba ransomware (reported Frag rebrand) hits University of Illinois Chicago College of Medicine
- [TL-2026-2944](https://intel.threadlinqs.com/threat/TL-2026-2944) — HIGH — Citrix NetScaler ADC/Gateway SAML memory-overflow DoS CVE-2026-88779 actively exploited; added to CISA KEV alongside still-exploited CVE-2026-88771/88772
- [TL-2026-2950](https://intel.threadlinqs.com/threat/TL-2026-2950) — HIGH — Belarusian Cyber Partisans maintain two-year undetected access to Russian healthcare network using Vasilek Telegram backdoor
- [TL-2026-2896](https://intel.threadlinqs.com/threat/TL-2026-2896) — HIGH — CISA adds Citrix NetScaler SAML memory overflow DoS (CVE-2026-88779) to KEV Catalog (update)
- [TL-2026-2929](https://intel.threadlinqs.com/threat/TL-2026-2929) — HIGH — CARBONATO: Botnet Built Around an AI Agent (Hermes Agent) Spreading via Exposed Docker APIs (update)
- [TL-2026-2926](https://intel.threadlinqs.com/threat/TL-2026-2926) — MEDIUM — Google's PageBreak AI Agent Finds 500+ Verified XSS Flaws and Builds Working Exploit Chains
- [TL-2026-2931](https://intel.threadlinqs.com/threat/TL-2026-2931) — MEDIUM — Phishing Campaign Abuses Legitimate ScreenConnect Client for Remote Access via Fake Payment Notification
- [TL-2026-2945](https://intel.threadlinqs.com/threat/TL-2026-2945) — MEDIUM — ShinyHunters: alleged leader 'Rey' (Saif al-Din Khader) detained in Jordan and reportedly cooperating with the FBI; Dutch suspect Pepijn van der Stap ('Umbreon') arrested
- [TL-2026-2952](https://intel.threadlinqs.com/threat/TL-2026-2952) — MEDIUM — Nikkei discloses Microsoft 365 and Google Workspace employee account compromises; ~9,000 phishing emails sent
- [TL-2026-2955](https://intel.threadlinqs.com/threat/TL-2026-2955) — MEDIUM — "Ancient" Linux IoT botnet with custom ANCT C2 protocol (Telnet-spreading, DNS-over-TLS C2 resolution)

## Techniques observed

T1001.003, [T1005](https://intel.threadlinqs.com/technique/T1005), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1021.004](https://intel.threadlinqs.com/technique/T1021.004), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.004](https://intel.threadlinqs.com/technique/T1036.004), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1037.004](https://intel.threadlinqs.com/technique/T1037.004), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1049](https://intel.threadlinqs.com/technique/T1049), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), T1053.006, [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1071.004](https://intel.threadlinqs.com/technique/T1071.004), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), T1074.002, [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1091](https://intel.threadlinqs.com/technique/T1091), [T1095](https://intel.threadlinqs.com/technique/T1095), [T1098.004](https://intel.threadlinqs.com/technique/T1098.004), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110.002](https://intel.threadlinqs.com/technique/T1110.002), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1115](https://intel.threadlinqs.com/technique/T1115), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1176](https://intel.threadlinqs.com/technique/T1176), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1200](https://intel.threadlinqs.com/technique/T1200), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), [T1219](https://intel.threadlinqs.com/technique/T1219), T1219.002, [T1222.002](https://intel.threadlinqs.com/technique/T1222.002), [T1480.001](https://intel.threadlinqs.com/technique/T1480.001), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1491.001](https://intel.threadlinqs.com/technique/T1491.001), [T1491.002](https://intel.threadlinqs.com/technique/T1491.002), T1496.001, [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1499](https://intel.threadlinqs.com/technique/T1499), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1529](https://intel.threadlinqs.com/technique/T1529), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1534](https://intel.threadlinqs.com/technique/T1534), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), [T1546.004](https://intel.threadlinqs.com/technique/T1546.004), T1547.004, [T1548](https://intel.threadlinqs.com/technique/T1548), [T1548.002](https://intel.threadlinqs.com/technique/T1548.002), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1557](https://intel.threadlinqs.com/technique/T1557), T1562, T1562.001, [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.004](https://intel.threadlinqs.com/technique/T1566.004), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1568](https://intel.threadlinqs.com/technique/T1568), [T1568.002](https://intel.threadlinqs.com/technique/T1568.002), [T1569.002](https://intel.threadlinqs.com/technique/T1569.002), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1584.008](https://intel.threadlinqs.com/technique/T1584.008), [T1586.002](https://intel.threadlinqs.com/technique/T1586.002), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1589.001](https://intel.threadlinqs.com/technique/T1589.001), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1610](https://intel.threadlinqs.com/technique/T1610), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1613](https://intel.threadlinqs.com/technique/T1613), [T1622](https://intel.threadlinqs.com/technique/T1622), [T1650](https://intel.threadlinqs.com/technique/T1650), T1656, [T1657](https://intel.threadlinqs.com/technique/T1657), T1659, T1674, [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685.006](https://intel.threadlinqs.com/technique/T1685.006)

## Threat actors

[ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters), [Azazel](https://intel.threadlinqs.com/actor/Azazel), [Tren de Aragua](https://intel.threadlinqs.com/actor/Tren%20de%20Aragua), [Booba](https://intel.threadlinqs.com/actor/Booba), [Cyber Partisans](https://intel.threadlinqs.com/actor/Cyber%20Partisans), [CARBONATO operators](https://intel.threadlinqs.com/actor/CARBONATO%20operators)

Nation-state attribution: Venezuela, Belarus

Threat categories: VULNERABILITY, PHISHING, THREAT_INTEL, DATA_BREACH, MALWARE, ZERO_DAY, RANSOMWARE, APT

## Severity breakdown

- critical: 2
- high: 10
- medium: 5
- low: 0

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 381 (file 119, network 99, entity 56, behavioral 42, tool 21, malware 17, infrastructure 14, package 13)
- New detection rules: 153 (100% of the day’s threats covered)

## More editions

- Previous: [2026-10-04](https://intel.threadlinqs.com/debrief/2026-10-04)
- Next: [2026-10-06](https://intel.threadlinqs.com/debrief/2026-10-06)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-10-05