# Daily Intelligence Briefing — Wednesday, October 14, 2026

> On 2026-10-14, Threadlinqs published 61 new threat reports and updated 5, 16 rated critical and 34 high, spanning 234 MITRE ATT&CK techniques and 11 named threat actors. Coverage that day added 594 new detection rules and 1360 extracted indicators.

- **Edition:** 2026-10-14 (Wednesday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-10-14
- **Last updated:** 2026-10-20
- **New threats:** 61 (5 updated)
- **Critical / high:** 16 critical, 34 high, 14 medium, 2 low
- **ATT&CK techniques:** 234
- **Threat actors:** 11
- **Indicators (count only):** 1360
- **New detection rules (count only):** 594

## Summary & highlights

Phonescams (TOAD): Email-Spoofed Brand Impersonation Driving Victims to Scam Phone Numbers. Ransomware Actors Escalate to Personal Intimidation and Physical Threats Against Victim Staff (Semperis 2026 Ransomware Risk Report). Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026: Credential Phishing, BEC Surge and Teams-Based Phishing Growth.

- [TL-2026-3464](https://intel.threadlinqs.com/threat/TL-2026-3464) — North Korean IT Worker Laptop Farms in Texas Disrupted by DOJ (Operation Lonestar Roundup) — $3M Revenue from 70+ U.S. Companies
- [TL-2026-3470](https://intel.threadlinqs.com/threat/TL-2026-3470) — Coruna and DarkSword iOS Exploit Kits Compromise iPhones via Single Malicious Website (UNC6353, UNC6691, UNC6748, PARS Defense)
- [TL-2026-3475](https://intel.threadlinqs.com/threat/TL-2026-3475) — XWorm Leaked Builder Spawns Surveillance-Capable RAT Variants (V6.4, V6.5 'XWorm Reborn', V7.2, V7.4)
- [TL-2026-3476](https://intel.threadlinqs.com/threat/TL-2026-3476) — Windows BitLocker Vulnerabilities: Security Feature Bypass and Privilege Elevation (CVE-2026-85920, CVE-2026-88070, CVE-2026-83500)
- [TL-2026-3477](https://intel.threadlinqs.com/threat/TL-2026-3477) — SilkParasite: China-Nexus APT Campaign Targeting Central Asian Governments with Seven RAT Families

## Theme of the day

Activity centered on actively-exploited, botnet, cisa-kev.

no-known-exploitation, remote-code-execution, ics, ot, unauthenticated

## Threats published

- [TL-2026-3483](https://intel.threadlinqs.com/threat/TL-2026-3483) — CRITICAL — Multiple Google Chrome Flaws Could Enable Memory Corruption and Code Execution Attacks (37 vulnerabilities patched, 7 critical; fixed in Chrome 155.0.8059.79)
- [TL-2026-3502](https://intel.threadlinqs.com/threat/TL-2026-3502) — CRITICAL — Critical OTP Authentication Bypass in Insurer Login Found by AI Pentesting Agent (OTP Delivery Redirection)
- [TL-2026-3510](https://intel.threadlinqs.com/threat/TL-2026-3510) — CRITICAL — CVE-2026-108065: Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce
- [TL-2026-3518](https://intel.threadlinqs.com/threat/TL-2026-3518) — CRITICAL — ICS Patch Tuesday (Oct 2026): Rockwell 1732E ArmorBlock unauthenticated admin takeover (CVE-2026-12655), ABB dynovaPRO / Siemens Industrial Edge Management credential reset bypass (CVE-2026-18963)
- [TL-2026-3529](https://intel.threadlinqs.com/threat/TL-2026-3529) — CRITICAL — Cisco Secure Email Gateway AMP Relative Path Traversal Zero-Day (CVE-2026-76519) Exploited for Root Command Execution
- [TL-2026-3542](https://intel.threadlinqs.com/threat/TL-2026-3542) — CRITICAL — Hackers Backdoor Nextcloud Servers via Command Injection in Collabora Online Built-in CODE Server (CVE-2026-110447)
- [TL-2026-3558](https://intel.threadlinqs.com/threat/TL-2026-3558) — CRITICAL — PEERSTITCH: Stealthy Memory-Resident FortiGate Implant Deployed via FortiManager CVE-2024-47575 by CL-STA-0954 (UNC5820)
- [TL-2026-3573](https://intel.threadlinqs.com/threat/TL-2026-3573) — CRITICAL — CVE-2026-21658 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (Insufficient Input Validation)
- [TL-2026-3574](https://intel.threadlinqs.com/threat/TL-2026-3574) — CRITICAL — CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (Insufficient Input Validation)
- [TL-2026-3575](https://intel.threadlinqs.com/threat/TL-2026-3575) — CRITICAL — CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection Vulnerability
- [TL-2026-3576](https://intel.threadlinqs.com/threat/TL-2026-3576) — CRITICAL — CVE-2026-21654 - Johnson Controls Frick Controls Quantum HD Pre-Authentication OS Command Injection (ICSA-26-057-01)
- [TL-2026-3109](https://intel.threadlinqs.com/threat/TL-2026-3109) — CRITICAL — Threat Actors Exploit Critical AhsayCBS Flaws (CVE-2026-105133, CVE-2026-105134) to Drop Webshells and XMRig Cryptominer (update)
- [TL-2026-3412](https://intel.threadlinqs.com/threat/TL-2026-3412) — CRITICAL — SAP October 2026 Patch Day: Critical Flaws in Cloud SDK for Python, NetWeaver Visual Composer and S/4HANA (CVE-2026-89111, CVE-2026-89110, CVE-2026-89107) (update)
- [TL-2026-3413](https://intel.threadlinqs.com/threat/TL-2026-3413) — CRITICAL — CVE-2026-97229: Critical GitLab Unauthenticated RCE via CI/CD Regex Compiler Integer Overflow (update)
- [TL-2026-3433](https://intel.threadlinqs.com/threat/TL-2026-3433) — CRITICAL — Critical FortiSandbox GUI Authentication Bypass (CVE-2026-107656) (update)
- [TL-2026-3443](https://intel.threadlinqs.com/threat/TL-2026-3443) — CRITICAL — October 2026 Microsoft Patch Tuesday: Exploited Windows Shell MotW Bypass (CVE-2026-96951), 1,417 Vulnerabilities Patched (update)
- [TL-2026-3464](https://intel.threadlinqs.com/threat/TL-2026-3464) — HIGH — North Korean IT Worker Laptop Farms in Texas Disrupted by DOJ (Operation Lonestar Roundup) — $3M Revenue from 70+ U.S. Companies
- [TL-2026-3470](https://intel.threadlinqs.com/threat/TL-2026-3470) — HIGH — Coruna and DarkSword iOS Exploit Kits Compromise iPhones via Single Malicious Website (UNC6353, UNC6691, UNC6748, PARS Defense)
- [TL-2026-3475](https://intel.threadlinqs.com/threat/TL-2026-3475) — HIGH — XWorm Leaked Builder Spawns Surveillance-Capable RAT Variants (V6.4, V6.5 'XWorm Reborn', V7.2, V7.4)
- [TL-2026-3476](https://intel.threadlinqs.com/threat/TL-2026-3476) — HIGH — Windows BitLocker Vulnerabilities: Security Feature Bypass and Privilege Elevation (CVE-2026-85920, CVE-2026-88070, CVE-2026-83500)
- [TL-2026-3477](https://intel.threadlinqs.com/threat/TL-2026-3477) — HIGH — SilkParasite: China-Nexus APT Campaign Targeting Central Asian Governments with Seven RAT Families
- [TL-2026-3485](https://intel.threadlinqs.com/threat/TL-2026-3485) — HIGH — Attackers Breach European Bank Through Third-Party Gateway and Target WSUS Server
- [TL-2026-3487](https://intel.threadlinqs.com/threat/TL-2026-3487) — HIGH — KGB RAT: NjRAT-based Windows Trojan sold as MaaS with FUD crypter
- [TL-2026-3489](https://intel.threadlinqs.com/threat/TL-2026-3489) — HIGH — Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045, Crashpad CVE-2026-78952) built with GPT-5.6 Sol by XBOW earns $250,000 Google bounty
- [TL-2026-3490](https://intel.threadlinqs.com/threat/TL-2026-3490) — HIGH — Fake WatchGuard VPN Site Steals Credentials Then Delivers Legitimate Signed Installer
- [TL-2026-3491](https://intel.threadlinqs.com/threat/TL-2026-3491) — HIGH — Windows Server DFS Zero-Day Denial of Service via Malformed DFS_REFERRAL_V3 (CVE-2026-70111)
- [TL-2026-3495](https://intel.threadlinqs.com/threat/TL-2026-3495) — HIGH — Fake AI Tool Campaigns (Claude, ChatGPT, Copilot and others) Deliver Infostealers and RATs to US Organizations
- [TL-2026-3499](https://intel.threadlinqs.com/threat/TL-2026-3499) — HIGH — Hirudo Android Banking Trojan Replaces Indonesian Banking Apps with Patched Copies and Relays Play Integrity Checks
- [TL-2026-3504](https://intel.threadlinqs.com/threat/TL-2026-3504) — HIGH — Grandoreiro Banking Trojan Targets Mexico via Duplicate Files Finder DLL Sideloading (mingwm10.dll)
- [TL-2026-3507](https://intel.threadlinqs.com/threat/TL-2026-3507) — HIGH — Wallstreet Ransomware Group Lists E-Z Pack Trucks (E-Z Pack Manufacturing) as Victim
- [TL-2026-3509](https://intel.threadlinqs.com/threat/TL-2026-3509) — HIGH — Microsoft Disrupts Three Chinese Phishing-as-a-Service Platforms: YAM Store, CoGUI, Iron Man (Storm-2990 / Storm-3119)
- [TL-2026-3512](https://intel.threadlinqs.com/threat/TL-2026-3512) — HIGH — Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets CIS government organizations with Chvost, Laplas and PickleShell (CVE-2025-8088, CVE-2025-25257)
- [TL-2026-3517](https://intel.threadlinqs.com/threat/TL-2026-3517) — HIGH — ROMULUS Malware Delivery Server Leverages ClickFix to Deliver Multiple Payloads (incl. LegionLoader)
- [TL-2026-3525](https://intel.threadlinqs.com/threat/TL-2026-3525) — HIGH — CVE-2026-74580: Linux vhost IOTLB Cache Flaw Enables Root Privilege Escalation and VM Escape (Public PoC)
- [TL-2026-3526](https://intel.threadlinqs.com/threat/TL-2026-3526) — HIGH — Business-Themed Phishing Lures Deliver Abused RMM Tools (MSP360, ScreenConnect)
- [TL-2026-3527](https://intel.threadlinqs.com/threat/TL-2026-3527) — HIGH — NSO Group Pegasus: Vendor Retained Exclusive Control of Infection Server Module and Technical Access to Data Harvested in Polish Government Operations
- [TL-2026-3532](https://intel.threadlinqs.com/threat/TL-2026-3532) — HIGH — LegionRelay: Russia-aligned UAC-0247 / GREYVIBE PowerShell RAT C2 Servers Targeting Ukraine
- [TL-2026-3534](https://intel.threadlinqs.com/threat/TL-2026-3534) — HIGH — Multiple NGINX Vulnerabilities (CVE-2026-97205, CVE-2026-93479, CVE-2026-15176) Allow Remote Crash and Code Execution
- [TL-2026-3539](https://intel.threadlinqs.com/threat/TL-2026-3539) — HIGH — SnakeKeylogger Infostealer Delivered via Phishing Emails Disguised as Purchase Orders (Malicious DOCX / Equation Editor)
- [TL-2026-3544](https://intel.threadlinqs.com/threat/TL-2026-3544) — HIGH — Balonx Sistema: Mexican Banking PhaaS with BankProtect Android RAT and CallFlow AI Vishing
- [TL-2026-3548](https://intel.threadlinqs.com/threat/TL-2026-3548) — HIGH — Google Search Poisoning Delivers Trojanized PuTTY MSI with Node.js Loader and EtherHiding C2 Targeting IT Administrators
- [TL-2026-3557](https://intel.threadlinqs.com/threat/TL-2026-3557) — HIGH — BRIDGEHEAD: npm typosquatting campaign crosses from WSL into Windows to deploy Rust crypto-wallet stealer
- [TL-2026-3561](https://intel.threadlinqs.com/threat/TL-2026-3561) — HIGH — CVE-2026-28253: Trane Tracer SC, Tracer SC+ and Tracer Concierge Memory Allocation with Excessive Size Value (Unauthenticated DoS)
- [TL-2026-3562](https://intel.threadlinqs.com/threat/TL-2026-3562) — HIGH — Palo Alto Networks PAN-OS Management Interface RCE (CVE-2026-0322) Exploited in Attacks
- [TL-2026-3565](https://intel.threadlinqs.com/threat/TL-2026-3565) — HIGH — CVE-2026-58113: Reflected XSS in Siemens Teamcenter Active Workspace Login Redirect (/auth/) Enabling Zero-Interaction Script Execution
- [TL-2026-3567](https://intel.threadlinqs.com/threat/TL-2026-3567) — HIGH — CVE-2026-28252 - Trane Tracer SC/SC+/Concierge Broken Cryptographic Algorithm Authentication Bypass
- [TL-2026-3572](https://intel.threadlinqs.com/threat/TL-2026-3572) — HIGH — CVE-2026-21659 - Johnson Controls Frick Controls Quantum HD Unauthenticated Arbitrary Code Execution via Local File Inclusion / Relative Path Traversal
- [TL-2026-3577](https://intel.threadlinqs.com/threat/TL-2026-3577) — HIGH — CVE-2026-3037: OS Command Injection in Copeland XWEB Pro (MBird SMS service) enabling authenticated RCE
- [TL-2026-3582](https://intel.threadlinqs.com/threat/TL-2026-3582) — HIGH — CVE-2026-25037: OS Command Injection in Copeland XWEB Pro (XWEB 300D/500D/500B PRO) Enabling Authenticated RCE
- [TL-2026-3583](https://intel.threadlinqs.com/threat/TL-2026-3583) — HIGH — CVE-2026-20764: OS Command Injection in Copeland XWEB Pro (hostname configuration) enables authenticated RCE
- [TL-2026-3465](https://intel.threadlinqs.com/threat/TL-2026-3465) — MEDIUM — Phonescams (TOAD): Email-Spoofed Brand Impersonation Driving Victims to Scam Phone Numbers
- [TL-2026-3467](https://intel.threadlinqs.com/threat/TL-2026-3467) — MEDIUM — Ransomware Actors Escalate to Personal Intimidation and Physical Threats Against Victim Staff (Semperis 2026 Ransomware Risk Report)
- [TL-2026-3474](https://intel.threadlinqs.com/threat/TL-2026-3474) — MEDIUM — Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026: Credential Phishing, BEC Surge and Teams-Based Phishing Growth
- [TL-2026-3484](https://intel.threadlinqs.com/threat/TL-2026-3484) — MEDIUM — AgentTesla Infostealer Distributed via Business Proposal Phishing Emails (Fake Café Management Software)
- [TL-2026-3486](https://intel.threadlinqs.com/threat/TL-2026-3486) — MEDIUM — Meta GitHub Repositories Breached via Stolen Employee Credentials; Source Code and Personal Data of ~1,500 People Stolen
- [TL-2026-3514](https://intel.threadlinqs.com/threat/TL-2026-3514) — MEDIUM — U.K. Sanctions Cryptomus (Heleket) Crypto Payment Platform for Russian Money Laundering
- [TL-2026-3520](https://intel.threadlinqs.com/threat/TL-2026-3520) — MEDIUM — Ransomware Gangs Escalate to Threats Against Employees' Families Amid AI-Powered Attacks and Identity Infrastructure Targeting (Semperis 2026 Ransomware Risk Report)
- [TL-2026-3552](https://intel.threadlinqs.com/threat/TL-2026-3552) — MEDIUM — CVE-2026-28256: Hard-coded Security-Relevant Constants in Trane Tracer SC, Tracer SC+ and Tracer Concierge
- [TL-2026-3553](https://intel.threadlinqs.com/threat/TL-2026-3553) — MEDIUM — CVE-2026-28255: Trane Tracer SC / Tracer SC+ / Tracer Concierge Use of Hard-coded Credentials
- [TL-2026-3555](https://intel.threadlinqs.com/threat/TL-2026-3555) — MEDIUM — CVE-2026-28254: Missing Authorization in Trane Tracer SC, Tracer SC+ and Tracer Concierge Building Management Controllers
- [TL-2026-3568](https://intel.threadlinqs.com/threat/TL-2026-3568) — MEDIUM — CVE-2025-13902 - Schneider Electric Modicon M241/M251/M262 (and M258/LMC058) Controllers Stored Cross-Site Scripting (CWE-79)
- [TL-2026-3570](https://intel.threadlinqs.com/threat/TL-2026-3570) — MEDIUM — CVE-2025-13901: Schneider Electric Modicon M241/M251/M262 Machine Expert Protocol Partial Denial of Service (CWE-404)
- [TL-2026-3571](https://intel.threadlinqs.com/threat/TL-2026-3571) — MEDIUM — CVE-2026-21660: Hardcoded Credentials in Johnson Controls Frick Controls Quantum HD Industrial Refrigeration Controller
- [TL-2026-3578](https://intel.threadlinqs.com/threat/TL-2026-3578) — MEDIUM — CVE-2026-20797: Copeland XWEB Pro Unauthenticated Stack-Based Buffer Overflow in API Route
- [TL-2026-3460](https://intel.threadlinqs.com/threat/TL-2026-3460) — LOW — Anthropic Frontier Red Team research: small open-weight AI models approaching ability to self-replicate across consumer IoT devices (Android TV boxes)
- [TL-2026-3579](https://intel.threadlinqs.com/threat/TL-2026-3579) — LOW — CVE-2026-22877: Copeland XWEB / XWEB Pro Unauthenticated Arbitrary File Read (Path Traversal)

## Techniques observed

T0807, [T0814](https://intel.threadlinqs.com/technique/T0814), [T0819](https://intel.threadlinqs.com/technique/T0819), [T0859](https://intel.threadlinqs.com/technique/T0859), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1014](https://intel.threadlinqs.com/technique/T1014), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1021.004](https://intel.threadlinqs.com/technique/T1021.004), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.001](https://intel.threadlinqs.com/technique/T1027.001), [T1027.002](https://intel.threadlinqs.com/technique/T1027.002), [T1027.003](https://intel.threadlinqs.com/technique/T1027.003), [T1027.010](https://intel.threadlinqs.com/technique/T1027.010), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.004](https://intel.threadlinqs.com/technique/T1036.004), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1048](https://intel.threadlinqs.com/technique/T1048), [T1048.003](https://intel.threadlinqs.com/technique/T1048.003), [T1049](https://intel.threadlinqs.com/technique/T1049), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), T1055.008, [T1055.012](https://intel.threadlinqs.com/technique/T1055.012), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.002](https://intel.threadlinqs.com/technique/T1056.002), [T1056.003](https://intel.threadlinqs.com/technique/T1056.003), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1070](https://intel.threadlinqs.com/technique/T1070), T1070.002, [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1071.004](https://intel.threadlinqs.com/technique/T1071.004), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1078.002](https://intel.threadlinqs.com/technique/T1078.002), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.003](https://intel.threadlinqs.com/technique/T1090.003), [T1090.004](https://intel.threadlinqs.com/technique/T1090.004), [T1095](https://intel.threadlinqs.com/technique/T1095), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1098.001](https://intel.threadlinqs.com/technique/T1098.001), [T1098.003](https://intel.threadlinqs.com/technique/T1098.003), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.001](https://intel.threadlinqs.com/technique/T1110.001), [T1110.002](https://intel.threadlinqs.com/technique/T1110.002), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1123](https://intel.threadlinqs.com/technique/T1123), [T1124](https://intel.threadlinqs.com/technique/T1124), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134](https://intel.threadlinqs.com/technique/T1134), [T1135](https://intel.threadlinqs.com/technique/T1135), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1187](https://intel.threadlinqs.com/technique/T1187), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), T1218.003, [T1218.005](https://intel.threadlinqs.com/technique/T1218.005), [T1218.007](https://intel.threadlinqs.com/technique/T1218.007), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1219.002](https://intel.threadlinqs.com/technique/T1219.002), T1219.003, [T1407](https://intel.threadlinqs.com/technique/T1407), [T1417.001](https://intel.threadlinqs.com/technique/T1417.001), [T1417.002](https://intel.threadlinqs.com/technique/T1417.002), [T1418](https://intel.threadlinqs.com/technique/T1418), [T1437.001](https://intel.threadlinqs.com/technique/T1437.001), [T1480](https://intel.threadlinqs.com/technique/T1480), T1484.002, [T1485](https://intel.threadlinqs.com/technique/T1485), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1496](https://intel.threadlinqs.com/technique/T1496), [T1496.001](https://intel.threadlinqs.com/technique/T1496.001), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), T1497.002, [T1497.003](https://intel.threadlinqs.com/technique/T1497.003), [T1499](https://intel.threadlinqs.com/technique/T1499), [T1499.002](https://intel.threadlinqs.com/technique/T1499.002), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1512](https://intel.threadlinqs.com/technique/T1512), [T1513](https://intel.threadlinqs.com/technique/T1513), [T1516](https://intel.threadlinqs.com/technique/T1516), [T1517](https://intel.threadlinqs.com/technique/T1517), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1529](https://intel.threadlinqs.com/technique/T1529), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), [T1544](https://intel.threadlinqs.com/technique/T1544), T1546.001, [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1548.002](https://intel.threadlinqs.com/technique/T1548.002), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), [T1553.005](https://intel.threadlinqs.com/technique/T1553.005), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.001](https://intel.threadlinqs.com/technique/T1555.001), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1555.004](https://intel.threadlinqs.com/technique/T1555.004), [T1555.005](https://intel.threadlinqs.com/technique/T1555.005), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1556.006](https://intel.threadlinqs.com/technique/T1556.006), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1560](https://intel.threadlinqs.com/technique/T1560), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), T1562.001, [T1564](https://intel.threadlinqs.com/technique/T1564), [T1564.003](https://intel.threadlinqs.com/technique/T1564.003), [T1564.004](https://intel.threadlinqs.com/technique/T1564.004), [T1565](https://intel.threadlinqs.com/technique/T1565), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1566.004](https://intel.threadlinqs.com/technique/T1566.004), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1568](https://intel.threadlinqs.com/technique/T1568), [T1568.002](https://intel.threadlinqs.com/technique/T1568.002), [T1569.002](https://intel.threadlinqs.com/technique/T1569.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1574](https://intel.threadlinqs.com/technique/T1574), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), T1574.002, T1574.008, [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.004](https://intel.threadlinqs.com/technique/T1583.004), [T1583.005](https://intel.threadlinqs.com/technique/T1583.005), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1583.008](https://intel.threadlinqs.com/technique/T1583.008), [T1584.001](https://intel.threadlinqs.com/technique/T1584.001), [T1584.005](https://intel.threadlinqs.com/technique/T1584.005), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1585.002](https://intel.threadlinqs.com/technique/T1585.002), [T1585.003](https://intel.threadlinqs.com/technique/T1585.003), [T1586.002](https://intel.threadlinqs.com/technique/T1586.002), [T1586.003](https://intel.threadlinqs.com/technique/T1586.003), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.003](https://intel.threadlinqs.com/technique/T1588.003), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1589](https://intel.threadlinqs.com/technique/T1589), [T1589.001](https://intel.threadlinqs.com/technique/T1589.001), T1590.004, [T1592](https://intel.threadlinqs.com/technique/T1592), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1598.003](https://intel.threadlinqs.com/technique/T1598.003), [T1598.004](https://intel.threadlinqs.com/technique/T1598.004), [T1602](https://intel.threadlinqs.com/technique/T1602), [T1602.002](https://intel.threadlinqs.com/technique/T1602.002), [T1606](https://intel.threadlinqs.com/technique/T1606), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1608.005](https://intel.threadlinqs.com/technique/T1608.005), [T1608.006](https://intel.threadlinqs.com/technique/T1608.006), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1614](https://intel.threadlinqs.com/technique/T1614), T1617, [T1620](https://intel.threadlinqs.com/technique/T1620), [T1621](https://intel.threadlinqs.com/technique/T1621), T1629.003, [T1633.001](https://intel.threadlinqs.com/technique/T1633.001), [T1636](https://intel.threadlinqs.com/technique/T1636), [T1636.004](https://intel.threadlinqs.com/technique/T1636.004), [T1646](https://intel.threadlinqs.com/technique/T1646), [T1655.001](https://intel.threadlinqs.com/technique/T1655.001), T1656, [T1657](https://intel.threadlinqs.com/technique/T1657), [T1660](https://intel.threadlinqs.com/technique/T1660), [T1664](https://intel.threadlinqs.com/technique/T1664), T1671, [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1686](https://intel.threadlinqs.com/technique/T1686)

## Threat actors

[Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider), [WageMole](https://intel.threadlinqs.com/actor/WageMole), [UNC6353](https://intel.threadlinqs.com/actor/UNC6353), [SilkParasite](https://intel.threadlinqs.com/actor/SilkParasite), [Wallstreet](https://intel.threadlinqs.com/actor/Wallstreet), [Storm-2990](https://intel.threadlinqs.com/actor/Storm-2990), [UAT-6275](https://intel.threadlinqs.com/actor/UAT-6275), Central Anti-Corruption Bureau operators, [UAC-0247](https://intel.threadlinqs.com/actor/UAC-0247), [Balonx](https://intel.threadlinqs.com/actor/Balonx), [CL-STA-0954](https://intel.threadlinqs.com/actor/CL-STA-0954)

Nation-state attribution: Russia, North Korea, China, Kazakhstan, Poland, Mexico

Threat categories: PHISHING, RANSOMWARE, MALWARE, DATA_BREACH, THREAT_INTEL, ICS_SCADA, VULNERABILITY, IOT, APT, SUPPLY_CHAIN

## Severity breakdown

- critical: 16
- high: 34
- medium: 14
- low: 2

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 1360 (network 418, file 284, entity 180, infrastructure 161, behavioral 115, malware 72, tool 67, package 60, technique 3)
- New detection rules: 594 (100% of the day’s threats covered)

## More editions

- Previous: [2026-10-13](https://intel.threadlinqs.com/debrief/2026-10-13)
- Next: [2026-10-15](https://intel.threadlinqs.com/debrief/2026-10-15)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-10-14