Threadlinqs IntelligenceStart free

Daily debrief · Thursday2026-10-08

Daily Intelligence Briefing — Thursday, October 8, 2026

6 critical16 high4 medium

On 2026-10-08, Threadlinqs published 19 new threat reports and updated 7, 6 rated critical and 16 high, spanning 225 MITRE ATT&CK techniques and 12 named threat actors. Coverage that day added 234 new detection rules and 727 extracted indicators.

New threats
197 updated
Critical / high
226 critical · 16 high
ATT&CK techniques
225Observed in the day’s reports
Threat actors
12Named in the reports
Indicators
727Count only · values are Red+
Detection rules
234New that day · rule text is Blue+

Edition date: · Last updated:

Summary & highlights

Mozilla Firefox File Handling Mitigation Bypass Vulnerability (CVE-2026-106016). Fake brand-sponsorship and "channel verification" phishing campaign targets YouTube creators (Hollyland, Nike, Spotify impersonation). OpenAI disrupts Russian 'Dark Clark' fake-think-tank and Iranian fake-journalist AI-enabled influence operations.

Highlights

  • TL-2026-3038 — The Gentlemen RaaS: BYOVD AV/EDR Killing (ThrottleBlood.sys / CVE-2025-7771), FortiGate Initial Access and GPO/NETLOGON Ransomware Deployment
  • TL-2026-3039 — Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia
  • TL-2026-3040 — Solo Threat Actor Uses ARTEX Agentic AI Pentest Tool to Breach South Korean Financial Organizations and Steal Data
  • TL-2026-3041 — Malicious Bookmark (Bookmarklet) Phishing Campaign Hijacks Logged-In FOMO Web Platform Accounts
  • TL-2026-3049 — NEBULA: Seven Fake AI SDK Packages on npm Install a Windows RAT (Modified KNTRAT) That Needs No DLL

Theme of the day

Two severe threats dominated: OT attacks targeting US critical infrastructure and PoeLLM malware infecting exposed AI servers, with Hafnium bounty news also active.

  • windows
  • phishing
  • social-engineering
  • spearphishing
  • cisa-kev

Threats published

26 threat lines in the 2026-10-08 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.

Techniques observed

225 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.

Threat actors

12 named threat actors across the reports.

Nation-state attribution

  • Russia / Iran
  • China
  • Russia
  • Iran
  • Venezuela
  • North Korea (DPRK)

Threat categories

  • VULNERABILITY
  • PHISHING
  • THREAT_INTEL
  • MALWARE
  • RANSOMWARE
  • DATA_BREACH
  • SUPPLY_CHAIN
  • APT

Severity breakdown

  • critical6
  • high16
  • medium4
  • low0

Indicator & detection coverage

Counts only: the indicator values and detection rule text behind them are tiered.

727 indicators of compromise · Red and above. Compare plans
  • network 224
  • file 211
  • entity 80
  • behavioral 66
  • infrastructure 41
  • tool 37
  • malware 36
  • package 28
  • technique 4
234 new detection rules (100% of the day’s threats covered) · Blue and above. Compare plans