Summary & highlights
Insider Threat Report: Dark Web Recruitment & Access Trends (Flashpoint). AI Used in 84% of Ransomware Attacks as Identity Infrastructure (Active Directory, Entra ID, Okta) Comes Under Fire - Semperis 2026 Ransomware Risk Report. CikaBika Bot: Rust-based RAT with Nim loader using Discord for C2 and Ngrok for exfiltration.
Highlights
- TL-2026-3586 — CVE-2026-25196: Copeland XWEB Pro OS Command Injection via Wi-Fi SSID/Password Fields (Authenticated RCE)
- TL-2026-3587 — CVE-2026-25721 - Copeland XWEB Pro OS Command Injection (Authenticated RCE) via API V1 Restore Action
- TL-2026-3594 — Manic: Android Malware Blending Banking Trojan and Spyware Capabilities (Ukraine-focused)
- TL-2026-3596 — SonicWall NSM On-Prem Flaws (CVE-2026-96540, CVE-2026-100232) Allow Privilege Escalation, Communication Interception and OS Command Execution
- TL-2026-3597 — QuartzLine 'zenith' backdoor disguised as EV-signed PDF viewer
Theme of the day
Severe exploited-CVE activity dominated, spanning ICS/OT systems per Claroty and CISA advisories, alongside iOS exploit kits,
- windows
- credential-theft
- remote-code-execution
- no-known-exploitation
- privilege-escalation
Threats published
54 threat lines in the 2026-10-15 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.
- Multiple Active Directory Federation Services (AD FS) Authentication Bypass and Spoofing Vulnerabilities (CVE-2026-69982, CVE-2026-96252, CVE-2026-108131)CRITICAL
- Langflow Authenticated RCE via MCP Server stdio Transport (CVE-2026-105740) Under Active ExploitationCRITICAL
- CISA KEV: Exploited Flaws in Palo Alto PAN-OS (CVE-2026-0322), Cisco Secure Email Gateway (CVE-2026-76519) and Ahsay AhsayCBS (CVE-2026-105133, CVE-2026-105134)CRITICAL
- Drupal Core Field UI Critical Flaw (CVE-2026-108097, SA-CORE-2026-014) With Unauthenticated RCE Path via Contributed ModulesCRITICAL
- Next.js Out-of-Band Patch for Two Critical RCE Flaws (use cache GHSA-673q-mjm6-r5xr, SVG processing CVE-2026-96889 / GHSA-2464-fhr4-w9xw)CRITICAL
- ChatGPT GitHub Connector Indirect Prompt Injection Allows Private Repository Secret Exfiltration via Unapproved GitHub Actions Workflow CommitsCRITICAL
- PAN-OS GlobalProtect/Prisma Access Authentication Bypass CVE-2026-0257 Exploited by Qilin and Settra Ransomware (ThreatsDay Bulletin: SiteGuard WAF CVE-2026-106931, Adobe AEM RCE Chain, Noir Wallet Drainer)CRITICAL
- PwnEscape (CVE-2026-99999): Linux Kernel IPv4 Checksum-Offload Flaw Lets Guest VMs Read Host MemoryCRITICAL
- ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote Support (CVE-2026-102764) with SAWFLY Webshell and BARECLAW TunnelerCRITICAL
- EKZ Infostealer Campaign — FortiClient EMS CVE-2026-35616 Abused via on_connect Script Injection (Arctic Wolf, May 2026) (update)CRITICAL
- GhostAction: Credential-Stealing GitHub Actions Workflows Planted in Compromised Maintainer Repositories (update)CRITICAL
- Docker Hub personal access token reassignment flaw (CVE-2026-105445, "GhostPAT") enables user impersonation and image tampering (update)CRITICAL
- Multiple Google Chrome Flaws Could Enable Memory Corruption and Code Execution Attacks (37 vulnerabilities patched, 7 critical; fixed in Chrome 155.0.8059.79) (update)CRITICAL
- Cisco Secure Email Gateway AMP Relative Path Traversal Zero-Day (CVE-2026-76519) Exploited for Root Command Execution (update)CRITICAL
- Hackers Backdoor Nextcloud Servers via Command Injection in Collabora Online Built-in CODE Server (CVE-2026-110447) (update)CRITICAL
- CVE-2026-25196: Copeland XWEB Pro OS Command Injection via Wi-Fi SSID/Password Fields (Authenticated RCE)HIGH
- CVE-2026-25721 - Copeland XWEB Pro OS Command Injection (Authenticated RCE) via API V1 Restore ActionHIGH
- Manic: Android Malware Blending Banking Trojan and Spyware Capabilities (Ukraine-focused)HIGH
- SonicWall NSM On-Prem Flaws (CVE-2026-96540, CVE-2026-100232) Allow Privilege Escalation, Communication Interception and OS Command ExecutionHIGH
- QuartzLine 'zenith' backdoor disguised as EV-signed PDF viewerHIGH
- Apple Mercenary-Spyware Threat Notification Wave Reaches Users in 110 Countries (Citizen Lab: 'Pretty Unprecedented')HIGH
- Aoki (Aokigahara) Infostealer Targets AI Coding Assistant CredentialsHIGH
- The Seven Deadly Sins RaaS Group - Multi-Victim Data Leak Campaign (Oct 2026)HIGH
- Japan Cyber Emergency: Nationwide Ransomware and Data Theft Incidents, Qilin Operation Using Possibly AI-Generated Python ScriptsHIGH
- AdFection: Discover-Tech Abuses Real-Time Bidding Ad Networks to Deliver Candiru SpywareHIGH
- Fake AUR helper packages (yyay, paru lookalikes) deliver malware via trojanized install scripts with root privilegesHIGH
- skynox7: Proxyjacking Edge Devices Into Residential Proxies (D-Link ShareCenter CVE-2024-3272/3273, UniFi Video CVE-2021-44228, SAP NetWeaver CVE-2025-31324)HIGH
- Talos Q3 2026 Vulnerability Pulse: Ivanti Connect Secure Zero-Day CVE-2026-104935, SonicWall SMA1000 SSRF CVE-2026-102255, and UAT-6275 (Silent Lynx) EspionageHIGH
- Refrigeration controller attack in France: internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers forced into defrost cycles at hundreds of grocery stores (CVE-2025-41450)HIGH
- Ransomware Extortion Escalates to Threats Against Employees and Their Families (Semperis 2026 Ransomware Risk Report)HIGH
- CL-UNK-1211: AI-Powered Espionage Campaign Targets Government Linux Infrastructure (SysGoRAT, CVE-2025-55182, CVE-2021-4034)HIGH
- CVE-2026-88794: XXE in Sparx Systems Enterprise Architect 17.1 XSLT DebuggerHIGH
- GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI PINs via Fake Traffic Challan / mParivahan SMS Lures in IndiaHIGH
- Ransomware Gangs Escalate to Personal Threats Against Employees and Families; Identity Infrastructure (AD/Entra ID/Okta) TargetedHIGH
- Nexus Leak: 153M-160M+ North American ID Records from IDScan.net Resold Across Dark Web ForumsHIGH
- Citrix XenServer 8.4/9 Vulnerabilities Enabling Host Compromise (CVE-2026-79610, CVE-2026-102700, CVE-2026-102701, CVE-2026-79611)HIGH
- Suo5 HTTP Tunneling Webshell Used for Tunneling and Pivoting in IIS and Jenkins IntrusionsHIGH
- September 2026 APT Group Threat Report (AhnLab ASEC): DPRK, China, Russia, Iran/Pakistan-linked activity incl. supply-chain and legitimate-service C2 abuseHIGH
- Slican Telephone Exchanges: Hardcoded Encryption Key (CVE-2026-35088) and WebCTI SQL Injection / Plaintext Password Storage (CVE-2026-63314, CVE-2026-63315)HIGH
- Windows Server DFS Zero-Day Denial of Service via Malformed DFS_REFERRAL_V3 (CVE-2026-70111) (update)HIGH
- Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets CIS government organizations with Chvost, Laplas and PickleShell (CVE-2025-8088, CVE-2025-25257) (update)HIGH
- Multiple NGINX Vulnerabilities (CVE-2026-97205, CVE-2026-93479, CVE-2026-15176) Allow Remote Crash and Code Execution (update)HIGH
- Insider Threat Report: Dark Web Recruitment & Access Trends (Flashpoint)MEDIUM
- AI Used in 84% of Ransomware Attacks as Identity Infrastructure (Active Directory, Entra ID, Okta) Comes Under Fire - Semperis 2026 Ransomware Risk ReportMEDIUM
- CikaBika Bot: Rust-based RAT with Nim loader using Discord for C2 and Ngrok for exfiltrationMEDIUM
- Digital Forensics Corporation sextortion 'recovery' scam: FTC alleges $60M taken from victimsMEDIUM
- QuoIntelligence Weekly Snapshot W34 2026: AmnesiaStealer (macOS), ErrTraffic MaaS, Malicious RubyGems Packages (StubMaker), Ransom BustersMEDIUM
- Fake CAPTCHA Phishing and ClickFix Attacks Trick Users into Running Malware (Barracuda)MEDIUM
- AI Agents Create an Unseen Credential Surface Exposing API Keys and Cloud SecretsMEDIUM
- Hyperlocal fake news website networks targeting AI chatbots to influence election-related responsesMEDIUM
- Vexy Ransomware claims Enchanted Fine Jewellery (India, Retail & E-Commerce) - 34.88 GB exfiltratedMEDIUM
- Threats to Vehicle Over-the-Air (OTA) Update Infrastructure, Telematics and Aftermarket Devices (Kaspersky ICS CERT Report)MEDIUM
- Agent.BTZ USB-borne worm infection of US Central Command and DoD networks (2008, Operation Buckshot Yankee) - retrospective on Air Force removable-media mission-planning practicesLOW
- AWS EKS Forensics: Data Sources and Investigation Tooling (Synacktiv)
Techniques observed
291 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.
- AML.T0020
- AML.T0051
- AML.T0051.001
- T0807
- T0813
- T0819
- T0826
- T0828
- T0831
- T0836
- T0855
- T0859
- T0879
- T0883
- T1003.003
- T1003.006
- T1005
- T1012
- T1016
- T1016.001
- T1021
- T1021.001
- T1021.002
- T1021.004
- T1025
- T1027
- T1027.002
- T1027.010
- T1027.013
- T1029
- T1033
- T1036
- T1036.004
- T1036.005
- T1036.007
- T1037
- T1040
- T1041
- T1046
- T1048
- T1048.003
- T1052.001
- T1053.003
- T1053.005
- T1056
- T1056.001
- T1056.002
- T1057
- T1059
- T1059.001
- T1059.003
- T1059.004
- T1059.005
- T1059.006
- T1059.007
- T1068
- T1069.002
- T1070
- T1070.002
- T1070.003
- T1070.004
- T1070.006
- T1071
- T1071.001
- T1071.004
- T1072
- T1074.001
- T1078
- T1078.001
- T1078.002
- T1078.004
- T1082
- T1083
- T1087.002
- T1087.004
- T1090
- T1090.001
- T1090.003
- T1091
- T1092
- T1095
- T1098
- T1098.004
- T1098.006
- T1102
- T1102.001
- T1102.002
- T1105
- T1106
- T1110.001
- T1110.003
- T1111
- T1112
- T1113
- T1114.001
- T1119
- T1123
- T1125
- T1132
- T1132.001
- T1132.002
- T1133
- T1134
- T1136.001
- T1136.003
- T1140
- T1185
- T1187
- T1189
- T1190
- T1195.001
- T1195.002
- T1199
- T1203
- T1204
- T1204.001
- T1204.002
- T1204.004
- T1210
- T1211
- T1212
- T1213
- T1213.003
- T1217
- T1218
- T1218.002
- T1218.005
- T1218.010
- T1218.011
- T1219
- T1222.002
- T1404
- T1406.002
- T1407
- T1417.001
- T1417.002
- T1418
- T1426
- T1429
- T1430
- T1437.001
- T1451
- T1453
- T1480
- T1481
- T1484.001
- T1485
- T1489
- T1490
- T1491.001
- T1496.001
- T1496.002
- T1497
- T1499
- T1499.004
- T1505
- T1505.003
- T1512
- T1513
- T1516
- T1517
- T1518
- T1518.001
- T1525
- T1528
- T1529
- T1530
- T1531
- T1533
- T1539
- T1542
- T1543.002
- T1543.003
- T1543.004
- T1544
- T1546
- T1546.004
- T1546.015
- T1547
- T1547.001
- T1548
- T1548.001
- T1548.002
- T1548.003
- T1550.001
- T1550.004
- T1552
- T1552.001
- T1552.002
- T1552.003
- T1552.004
- T1552.005
- T1552.007
- T1553.001
- T1553.002
- T1555
- T1555.001
- T1555.003
- T1555.005
- T1555.006
- T1556
- T1557
- T1557.001
- T1559
- T1560.001
- T1564
- T1564.003
- T1564.004
- T1564.012
- T1565
- T1565.001
- T1566
- T1566.001
- T1566.002
- T1566.003
- T1567
- T1567.002
- T1568
- T1569.002
- T1571
- T1572
- T1573
- T1573.001
- T1573.002
- T1574.001
- T1574.006
- T1574.007
- T1575
- T1580
- T1582
- T1583
- T1583.001
- T1583.006
- T1583.008
- T1584
- T1584.008
- T1585
- T1586.002
- T1587
- T1587.001
- T1587.004
- T1588
- T1588.002
- T1588.003
- T1588.005
- T1588.006
- T1588.007
- T1589
- T1589.001
- T1590
- T1590.005
- T1592
- T1592.002
- T1593
- T1593.001
- T1595
- T1595.002
- T1598
- T1598.003
- T1606
- T1606.002
- T1608
- T1608.001
- T1608.004
- T1610
- T1611
- T1613
- T1616
- T1618
- T1620
- T1621
- T1624.001
- T1629.003
- T1633
- T1636
- T1636.002
- T1636.003
- T1636.004
- T1646
- T1650
- T1655.001
- T1657
- T1658
- T1660
- T1664
- T1677
- T1684.001
- T1685
- T1685.005
- T1685.006
- T1686
Threat actors
9 named threat actors across the reports.
- Dmitry Belkin
- Vexy Ransomware
- The Seven Deadly Sins
- Qilin
- Caramel Tsunami
- skynox7
- UAT-6275
- CL-UNK-1211
- ARMORY CASTLE
Nation-state attribution
- Russia
- Israel
- Kazakhstan
- North Korea, China, Russia, Iran, Pakistan
- China
Threat categories
- THREAT_INTEL
- RANSOMWARE
- MALWARE
- PHISHING
- VULNERABILITY
- CLOUD
- SUPPLY_CHAIN
- IOT
- ICS_SCADA
- APT
- DATA_BREACH
Severity breakdown
- critical15
- high27
- medium10
- low1
Indicator & detection coverage
Counts only: the indicator values and detection rule text behind them are tiered.
1031 indicators of compromise · Red and above. Compare plans
- network 289
- file 261
- entity 116
- behavioral 94
- infrastructure 89
- malware 74
- package 54
- tool 53
- url 1
486 new detection rules (100% of the day’s threats covered) · Blue and above. Compare plans