Threadlinqs IntelligenceStart free

Daily debrief · Tuesday2026-10-13

Daily Intelligence Briefing — Tuesday, October 13, 2026

12 critical16 high7 medium

On 2026-10-13, Threadlinqs published 34 new threat reports and updated 1, 12 rated critical and 16 high, spanning 179 MITRE ATT&CK techniques and 7 named threat actors. Coverage that day added 315 new detection rules and 727 extracted indicators.

New threats
341 updated
Critical / high
2812 critical · 16 high
ATT&CK techniques
179Observed in the day’s reports
Threat actors
7Named in the reports
Indicators
727Count only · values are Red+
Detection rules
315New that day · rule text is Blue+

Edition date: · Last updated:

Summary & highlights

Amazon Fire TV Cube 3 Exploit Enables Root Access and Bootloader Unlock (CVE-2026-43499 Ghostlock). CVE-2026-63316: SQL Injection in Payload CMS via in/not_in query parameters. Anthropic Research: Small AI Models Could Autonomously Self-Replicate Across Poorly Secured IoT Devices.

Highlights

  • TL-2026-3379 — Kimsuky 'Operation GitPower': Fake Zoom Installers and Malicious LNK Files Deliver Malware via GitHub/GitLab Staging
  • TL-2026-3385 — ICMacOS (Icarus macOS): ClickFix-delivered macOS infostealer evolving into persistent WebSocket RAT (GlowComa / MADHASH)
  • TL-2026-3386 — GhostProfile macOS Malware Clones Chrome Profiles to Browse With Victims' Live Logins
  • TL-2026-3389 — Apex Arena (REF8801) fake Web3 accelerator spreads CloudSyncD macOS backdoor and multi-stage Windows stealer via malicious npm packages @apexacc/cli and @apexacc/audit
  • TL-2026-3391 — MariaDB Server and Connector/C Flaws Enable Code Execution, Data Access and Credential Exposure (CVE-2026-107815, CVE-2026-107821, CVE-2026-102523, CVE-2026-107819)

Theme of the day

Anubis ransomware struck Fairlife via CitrixBleed, while Apache Struts RCE was actively exploited per CISA KEV. Both severe, exploited attacks dominated the day's threat landscape.

  • privilege-escalation
  • no-known-exploitation
  • windows
  • no-public-poc
  • remote-code-execution

Threats published

35 threat lines in the 2026-10-13 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.

Techniques observed

179 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.

Threat actors

7 named threat actors across the reports.

Nation-state attribution

  • North Korea

Threat categories

  • VULNERABILITY
  • THREAT_INTEL
  • MALWARE
  • APT
  • RANSOMWARE
  • PHISHING

Severity breakdown

  • critical12
  • high16
  • medium7
  • low0

Indicator & detection coverage

Counts only: the indicator values and detection rule text behind them are tiered.

727 indicators of compromise · Red and above. Compare plans
  • file 168
  • network 148
  • behavioral 105
  • infrastructure 96
  • entity 68
  • tool 56
  • package 50
  • malware 35
  • technique 1
315 new detection rules (100% of the day’s threats covered) · Blue and above. Compare plans