# Daily Intelligence Briefing — Thursday, October 15, 2026

> On 2026-10-15, Threadlinqs published 45 new threat reports and updated 9, 15 rated critical and 27 high, spanning 291 MITRE ATT&CK techniques and 9 named threat actors. Coverage that day added 486 new detection rules and 1031 extracted indicators.

- **Edition:** 2026-10-15 (Thursday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-10-15
- **Last updated:** 2026-10-21
- **New threats:** 45 (9 updated)
- **Critical / high:** 15 critical, 27 high, 10 medium, 1 low
- **ATT&CK techniques:** 291
- **Threat actors:** 9
- **Indicators (count only):** 1031
- **New detection rules (count only):** 486

## Summary & highlights

Insider Threat Report: Dark Web Recruitment & Access Trends (Flashpoint). AI Used in 84% of Ransomware Attacks as Identity Infrastructure (Active Directory, Entra ID, Okta) Comes Under Fire - Semperis 2026 Ransomware Risk Report. CikaBika Bot: Rust-based RAT with Nim loader using Discord for C2 and Ngrok for exfiltration.

- [TL-2026-3586](https://intel.threadlinqs.com/threat/TL-2026-3586) — CVE-2026-25196: Copeland XWEB Pro OS Command Injection via Wi-Fi SSID/Password Fields (Authenticated RCE)
- [TL-2026-3587](https://intel.threadlinqs.com/threat/TL-2026-3587) — CVE-2026-25721 - Copeland XWEB Pro OS Command Injection (Authenticated RCE) via API V1 Restore Action
- [TL-2026-3594](https://intel.threadlinqs.com/threat/TL-2026-3594) — Manic: Android Malware Blending Banking Trojan and Spyware Capabilities (Ukraine-focused)
- [TL-2026-3596](https://intel.threadlinqs.com/threat/TL-2026-3596) — SonicWall NSM On-Prem Flaws (CVE-2026-96540, CVE-2026-100232) Allow Privilege Escalation, Communication Interception and OS Command Execution
- [TL-2026-3597](https://intel.threadlinqs.com/threat/TL-2026-3597) — QuartzLine 'zenith' backdoor disguised as EV-signed PDF viewer

## Theme of the day

Severe exploited-CVE activity dominated, spanning ICS/OT systems per Claroty and CISA advisories, alongside iOS exploit kits,

windows, credential-theft, remote-code-execution, no-known-exploitation, privilege-escalation

## Threats published

- [TL-2026-3584](https://intel.threadlinqs.com/threat/TL-2026-3584) — CRITICAL — Multiple Active Directory Federation Services (AD FS) Authentication Bypass and Spoofing Vulnerabilities (CVE-2026-69982, CVE-2026-96252, CVE-2026-108131)
- [TL-2026-3602](https://intel.threadlinqs.com/threat/TL-2026-3602) — CRITICAL — Langflow Authenticated RCE via MCP Server stdio Transport (CVE-2026-105740) Under Active Exploitation
- [TL-2026-3610](https://intel.threadlinqs.com/threat/TL-2026-3610) — CRITICAL — CISA KEV: Exploited Flaws in Palo Alto PAN-OS (CVE-2026-0322), Cisco Secure Email Gateway (CVE-2026-76519) and Ahsay AhsayCBS (CVE-2026-105133, CVE-2026-105134)
- [TL-2026-3616](https://intel.threadlinqs.com/threat/TL-2026-3616) — CRITICAL — Drupal Core Field UI Critical Flaw (CVE-2026-108097, SA-CORE-2026-014) With Unauthenticated RCE Path via Contributed Modules
- [TL-2026-3638](https://intel.threadlinqs.com/threat/TL-2026-3638) — CRITICAL — Next.js Out-of-Band Patch for Two Critical RCE Flaws (use cache GHSA-673q-mjm6-r5xr, SVG processing CVE-2026-96889 / GHSA-2464-fhr4-w9xw)
- [TL-2026-3639](https://intel.threadlinqs.com/threat/TL-2026-3639) — CRITICAL — ChatGPT GitHub Connector Indirect Prompt Injection Allows Private Repository Secret Exfiltration via Unapproved GitHub Actions Workflow Commits
- [TL-2026-3657](https://intel.threadlinqs.com/threat/TL-2026-3657) — CRITICAL — PAN-OS GlobalProtect/Prisma Access Authentication Bypass CVE-2026-0257 Exploited by Qilin and Settra Ransomware (ThreatsDay Bulletin: SiteGuard WAF CVE-2026-106931, Adobe AEM RCE Chain, Noir Wallet Drainer)
- [TL-2026-3666](https://intel.threadlinqs.com/threat/TL-2026-3666) — CRITICAL — PwnEscape (CVE-2026-99999): Linux Kernel IPv4 Checksum-Offload Flaw Lets Guest VMs Read Host Memory
- [TL-2026-3668](https://intel.threadlinqs.com/threat/TL-2026-3668) — CRITICAL — ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote Support (CVE-2026-102764) with SAWFLY Webshell and BARECLAW Tunneler
- [TL-2026-0611](https://intel.threadlinqs.com/threat/TL-2026-0611) — CRITICAL — EKZ Infostealer Campaign — FortiClient EMS CVE-2026-35616 Abused via on_connect Script Injection (Arctic Wolf, May 2026) (update)
- [TL-2026-3157](https://intel.threadlinqs.com/threat/TL-2026-3157) — CRITICAL — GhostAction: Credential-Stealing GitHub Actions Workflows Planted in Compromised Maintainer Repositories (update)
- [TL-2026-3419](https://intel.threadlinqs.com/threat/TL-2026-3419) — CRITICAL — Docker Hub personal access token reassignment flaw (CVE-2026-105445, "GhostPAT") enables user impersonation and image tampering (update)
- [TL-2026-3483](https://intel.threadlinqs.com/threat/TL-2026-3483) — CRITICAL — Multiple Google Chrome Flaws Could Enable Memory Corruption and Code Execution Attacks (37 vulnerabilities patched, 7 critical; fixed in Chrome 155.0.8059.79) (update)
- [TL-2026-3529](https://intel.threadlinqs.com/threat/TL-2026-3529) — CRITICAL — Cisco Secure Email Gateway AMP Relative Path Traversal Zero-Day (CVE-2026-76519) Exploited for Root Command Execution (update)
- [TL-2026-3542](https://intel.threadlinqs.com/threat/TL-2026-3542) — CRITICAL — Hackers Backdoor Nextcloud Servers via Command Injection in Collabora Online Built-in CODE Server (CVE-2026-110447) (update)
- [TL-2026-3586](https://intel.threadlinqs.com/threat/TL-2026-3586) — HIGH — CVE-2026-25196: Copeland XWEB Pro OS Command Injection via Wi-Fi SSID/Password Fields (Authenticated RCE)
- [TL-2026-3587](https://intel.threadlinqs.com/threat/TL-2026-3587) — HIGH — CVE-2026-25721 - Copeland XWEB Pro OS Command Injection (Authenticated RCE) via API V1 Restore Action
- [TL-2026-3594](https://intel.threadlinqs.com/threat/TL-2026-3594) — HIGH — Manic: Android Malware Blending Banking Trojan and Spyware Capabilities (Ukraine-focused)
- [TL-2026-3596](https://intel.threadlinqs.com/threat/TL-2026-3596) — HIGH — SonicWall NSM On-Prem Flaws (CVE-2026-96540, CVE-2026-100232) Allow Privilege Escalation, Communication Interception and OS Command Execution
- [TL-2026-3597](https://intel.threadlinqs.com/threat/TL-2026-3597) — HIGH — QuartzLine 'zenith' backdoor disguised as EV-signed PDF viewer
- [TL-2026-3605](https://intel.threadlinqs.com/threat/TL-2026-3605) — HIGH — Apple Mercenary-Spyware Threat Notification Wave Reaches Users in 110 Countries (Citizen Lab: 'Pretty Unprecedented')
- [TL-2026-3606](https://intel.threadlinqs.com/threat/TL-2026-3606) — HIGH — Aoki (Aokigahara) Infostealer Targets AI Coding Assistant Credentials
- [TL-2026-3624](https://intel.threadlinqs.com/threat/TL-2026-3624) — HIGH — The Seven Deadly Sins RaaS Group - Multi-Victim Data Leak Campaign (Oct 2026)
- [TL-2026-3626](https://intel.threadlinqs.com/threat/TL-2026-3626) — HIGH — Japan Cyber Emergency: Nationwide Ransomware and Data Theft Incidents, Qilin Operation Using Possibly AI-Generated Python Scripts
- [TL-2026-3628](https://intel.threadlinqs.com/threat/TL-2026-3628) — HIGH — AdFection: Discover-Tech Abuses Real-Time Bidding Ad Networks to Deliver Candiru Spyware
- [TL-2026-3646](https://intel.threadlinqs.com/threat/TL-2026-3646) — HIGH — Fake AUR helper packages (yyay, paru lookalikes) deliver malware via trojanized install scripts with root privileges
- [TL-2026-3649](https://intel.threadlinqs.com/threat/TL-2026-3649) — HIGH — skynox7: Proxyjacking Edge Devices Into Residential Proxies (D-Link ShareCenter CVE-2024-3272/3273, UniFi Video CVE-2021-44228, SAP NetWeaver CVE-2025-31324)
- [TL-2026-3651](https://intel.threadlinqs.com/threat/TL-2026-3651) — HIGH — Talos Q3 2026 Vulnerability Pulse: Ivanti Connect Secure Zero-Day CVE-2026-104935, SonicWall SMA1000 SSRF CVE-2026-102255, and UAT-6275 (Silent Lynx) Espionage
- [TL-2026-3667](https://intel.threadlinqs.com/threat/TL-2026-3667) — HIGH — Refrigeration controller attack in France: internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers forced into defrost cycles at hundreds of grocery stores (CVE-2025-41450)
- [TL-2026-3672](https://intel.threadlinqs.com/threat/TL-2026-3672) — HIGH — Ransomware Extortion Escalates to Threats Against Employees and Their Families (Semperis 2026 Ransomware Risk Report)
- [TL-2026-3673](https://intel.threadlinqs.com/threat/TL-2026-3673) — HIGH — CL-UNK-1211: AI-Powered Espionage Campaign Targets Government Linux Infrastructure (SysGoRAT, CVE-2025-55182, CVE-2021-4034)
- [TL-2026-3674](https://intel.threadlinqs.com/threat/TL-2026-3674) — HIGH — CVE-2026-88794: XXE in Sparx Systems Enterprise Architect 17.1 XSLT Debugger
- [TL-2026-3676](https://intel.threadlinqs.com/threat/TL-2026-3676) — HIGH — GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI PINs via Fake Traffic Challan / mParivahan SMS Lures in India
- [TL-2026-3682](https://intel.threadlinqs.com/threat/TL-2026-3682) — HIGH — Ransomware Gangs Escalate to Personal Threats Against Employees and Families; Identity Infrastructure (AD/Entra ID/Okta) Targeted
- [TL-2026-3685](https://intel.threadlinqs.com/threat/TL-2026-3685) — HIGH — Nexus Leak: 153M-160M+ North American ID Records from IDScan.net Resold Across Dark Web Forums
- [TL-2026-3686](https://intel.threadlinqs.com/threat/TL-2026-3686) — HIGH — Citrix XenServer 8.4/9 Vulnerabilities Enabling Host Compromise (CVE-2026-79610, CVE-2026-102700, CVE-2026-102701, CVE-2026-79611)
- [TL-2026-3692](https://intel.threadlinqs.com/threat/TL-2026-3692) — HIGH — Suo5 HTTP Tunneling Webshell Used for Tunneling and Pivoting in IIS and Jenkins Intrusions
- [TL-2026-3699](https://intel.threadlinqs.com/threat/TL-2026-3699) — HIGH — September 2026 APT Group Threat Report (AhnLab ASEC): DPRK, China, Russia, Iran/Pakistan-linked activity incl. supply-chain and legitimate-service C2 abuse
- [TL-2026-3700](https://intel.threadlinqs.com/threat/TL-2026-3700) — HIGH — Slican Telephone Exchanges: Hardcoded Encryption Key (CVE-2026-35088) and WebCTI SQL Injection / Plaintext Password Storage (CVE-2026-63314, CVE-2026-63315)
- [TL-2026-3491](https://intel.threadlinqs.com/threat/TL-2026-3491) — HIGH — Windows Server DFS Zero-Day Denial of Service via Malformed DFS_REFERRAL_V3 (CVE-2026-70111) (update)
- [TL-2026-3512](https://intel.threadlinqs.com/threat/TL-2026-3512) — HIGH — Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets CIS government organizations with Chvost, Laplas and PickleShell (CVE-2025-8088, CVE-2025-25257) (update)
- [TL-2026-3534](https://intel.threadlinqs.com/threat/TL-2026-3534) — HIGH — Multiple NGINX Vulnerabilities (CVE-2026-97205, CVE-2026-93479, CVE-2026-15176) Allow Remote Crash and Code Execution (update)
- [TL-2026-3595](https://intel.threadlinqs.com/threat/TL-2026-3595) — MEDIUM — Insider Threat Report: Dark Web Recruitment & Access Trends (Flashpoint)
- [TL-2026-3598](https://intel.threadlinqs.com/threat/TL-2026-3598) — MEDIUM — AI Used in 84% of Ransomware Attacks as Identity Infrastructure (Active Directory, Entra ID, Okta) Comes Under Fire - Semperis 2026 Ransomware Risk Report
- [TL-2026-3613](https://intel.threadlinqs.com/threat/TL-2026-3613) — MEDIUM — CikaBika Bot: Rust-based RAT with Nim loader using Discord for C2 and Ngrok for exfiltration
- [TL-2026-3615](https://intel.threadlinqs.com/threat/TL-2026-3615) — MEDIUM — Digital Forensics Corporation sextortion 'recovery' scam: FTC alleges $60M taken from victims
- [TL-2026-3618](https://intel.threadlinqs.com/threat/TL-2026-3618) — MEDIUM — QuoIntelligence Weekly Snapshot W34 2026: AmnesiaStealer (macOS), ErrTraffic MaaS, Malicious RubyGems Packages (StubMaker), Ransom Busters
- [TL-2026-3623](https://intel.threadlinqs.com/threat/TL-2026-3623) — MEDIUM — Fake CAPTCHA Phishing and ClickFix Attacks Trick Users into Running Malware (Barracuda)
- [TL-2026-3643](https://intel.threadlinqs.com/threat/TL-2026-3643) — MEDIUM — AI Agents Create an Unseen Credential Surface Exposing API Keys and Cloud Secrets
- [TL-2026-3659](https://intel.threadlinqs.com/threat/TL-2026-3659) — MEDIUM — Hyperlocal fake news website networks targeting AI chatbots to influence election-related responses
- [TL-2026-3678](https://intel.threadlinqs.com/threat/TL-2026-3678) — MEDIUM — Vexy Ransomware claims Enchanted Fine Jewellery (India, Retail & E-Commerce) - 34.88 GB exfiltrated
- [TL-2026-3698](https://intel.threadlinqs.com/threat/TL-2026-3698) — MEDIUM — Threats to Vehicle Over-the-Air (OTA) Update Infrastructure, Telematics and Aftermarket Devices (Kaspersky ICS CERT Report)
- [TL-2026-3608](https://intel.threadlinqs.com/threat/TL-2026-3608) — LOW — Agent.BTZ USB-borne worm infection of US Central Command and DoD networks (2008, Operation Buckshot Yankee) - retrospective on Air Force removable-media mission-planning practices
- [TL-2026-3664](https://intel.threadlinqs.com/threat/TL-2026-3664) — INFO — AWS EKS Forensics: Data Sources and Investigation Tooling (Synacktiv)

## Techniques observed

AML.T0020, [AML.T0051](https://intel.threadlinqs.com/technique/AML.T0051), [AML.T0051.001](https://intel.threadlinqs.com/technique/AML.T0051.001), T0807, T0813, [T0819](https://intel.threadlinqs.com/technique/T0819), T0826, T0828, [T0831](https://intel.threadlinqs.com/technique/T0831), T0836, T0855, [T0859](https://intel.threadlinqs.com/technique/T0859), T0879, T0883, [T1003.003](https://intel.threadlinqs.com/technique/T1003.003), [T1003.006](https://intel.threadlinqs.com/technique/T1003.006), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1012](https://intel.threadlinqs.com/technique/T1012), [T1016](https://intel.threadlinqs.com/technique/T1016), T1016.001, [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1021.004](https://intel.threadlinqs.com/technique/T1021.004), [T1025](https://intel.threadlinqs.com/technique/T1025), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.002](https://intel.threadlinqs.com/technique/T1027.002), [T1027.010](https://intel.threadlinqs.com/technique/T1027.010), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), T1029, [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.004](https://intel.threadlinqs.com/technique/T1036.004), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1036.007](https://intel.threadlinqs.com/technique/T1036.007), [T1037](https://intel.threadlinqs.com/technique/T1037), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1048](https://intel.threadlinqs.com/technique/T1048), [T1048.003](https://intel.threadlinqs.com/technique/T1048.003), T1052.001, [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1056](https://intel.threadlinqs.com/technique/T1056), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.002](https://intel.threadlinqs.com/technique/T1056.002), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069.002](https://intel.threadlinqs.com/technique/T1069.002), [T1070](https://intel.threadlinqs.com/technique/T1070), T1070.002, [T1070.003](https://intel.threadlinqs.com/technique/T1070.003), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1071.004](https://intel.threadlinqs.com/technique/T1071.004), [T1072](https://intel.threadlinqs.com/technique/T1072), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1078.002](https://intel.threadlinqs.com/technique/T1078.002), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1087.004](https://intel.threadlinqs.com/technique/T1087.004), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.001](https://intel.threadlinqs.com/technique/T1090.001), [T1090.003](https://intel.threadlinqs.com/technique/T1090.003), [T1091](https://intel.threadlinqs.com/technique/T1091), T1092, [T1095](https://intel.threadlinqs.com/technique/T1095), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1098.004](https://intel.threadlinqs.com/technique/T1098.004), T1098.006, [T1102](https://intel.threadlinqs.com/technique/T1102), [T1102.001](https://intel.threadlinqs.com/technique/T1102.001), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110.001](https://intel.threadlinqs.com/technique/T1110.001), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114.001](https://intel.threadlinqs.com/technique/T1114.001), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1123](https://intel.threadlinqs.com/technique/T1123), [T1125](https://intel.threadlinqs.com/technique/T1125), [T1132](https://intel.threadlinqs.com/technique/T1132), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1132.002](https://intel.threadlinqs.com/technique/T1132.002), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134](https://intel.threadlinqs.com/technique/T1134), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1136.003](https://intel.threadlinqs.com/technique/T1136.003), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1187](https://intel.threadlinqs.com/technique/T1187), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), [T1217](https://intel.threadlinqs.com/technique/T1217), [T1218](https://intel.threadlinqs.com/technique/T1218), T1218.002, [T1218.005](https://intel.threadlinqs.com/technique/T1218.005), [T1218.010](https://intel.threadlinqs.com/technique/T1218.010), [T1218.011](https://intel.threadlinqs.com/technique/T1218.011), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1222.002](https://intel.threadlinqs.com/technique/T1222.002), [T1404](https://intel.threadlinqs.com/technique/T1404), [T1406.002](https://intel.threadlinqs.com/technique/T1406.002), [T1407](https://intel.threadlinqs.com/technique/T1407), [T1417.001](https://intel.threadlinqs.com/technique/T1417.001), [T1417.002](https://intel.threadlinqs.com/technique/T1417.002), [T1418](https://intel.threadlinqs.com/technique/T1418), [T1426](https://intel.threadlinqs.com/technique/T1426), [T1429](https://intel.threadlinqs.com/technique/T1429), [T1430](https://intel.threadlinqs.com/technique/T1430), [T1437.001](https://intel.threadlinqs.com/technique/T1437.001), T1451, [T1453](https://intel.threadlinqs.com/technique/T1453), [T1480](https://intel.threadlinqs.com/technique/T1480), [T1481](https://intel.threadlinqs.com/technique/T1481), [T1484.001](https://intel.threadlinqs.com/technique/T1484.001), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1491.001](https://intel.threadlinqs.com/technique/T1491.001), [T1496.001](https://intel.threadlinqs.com/technique/T1496.001), T1496.002, [T1497](https://intel.threadlinqs.com/technique/T1497), [T1499](https://intel.threadlinqs.com/technique/T1499), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505](https://intel.threadlinqs.com/technique/T1505), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1512](https://intel.threadlinqs.com/technique/T1512), [T1513](https://intel.threadlinqs.com/technique/T1513), [T1516](https://intel.threadlinqs.com/technique/T1516), [T1517](https://intel.threadlinqs.com/technique/T1517), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1525](https://intel.threadlinqs.com/technique/T1525), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1529](https://intel.threadlinqs.com/technique/T1529), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1531](https://intel.threadlinqs.com/technique/T1531), [T1533](https://intel.threadlinqs.com/technique/T1533), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1542](https://intel.threadlinqs.com/technique/T1542), [T1543.002](https://intel.threadlinqs.com/technique/T1543.002), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), [T1543.004](https://intel.threadlinqs.com/technique/T1543.004), [T1544](https://intel.threadlinqs.com/technique/T1544), [T1546](https://intel.threadlinqs.com/technique/T1546), [T1546.004](https://intel.threadlinqs.com/technique/T1546.004), [T1546.015](https://intel.threadlinqs.com/technique/T1546.015), [T1547](https://intel.threadlinqs.com/technique/T1547), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1548](https://intel.threadlinqs.com/technique/T1548), [T1548.001](https://intel.threadlinqs.com/technique/T1548.001), [T1548.002](https://intel.threadlinqs.com/technique/T1548.002), [T1548.003](https://intel.threadlinqs.com/technique/T1548.003), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.002](https://intel.threadlinqs.com/technique/T1552.002), [T1552.003](https://intel.threadlinqs.com/technique/T1552.003), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1552.005](https://intel.threadlinqs.com/technique/T1552.005), [T1552.007](https://intel.threadlinqs.com/technique/T1552.007), [T1553.001](https://intel.threadlinqs.com/technique/T1553.001), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.001](https://intel.threadlinqs.com/technique/T1555.001), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1555.005](https://intel.threadlinqs.com/technique/T1555.005), [T1555.006](https://intel.threadlinqs.com/technique/T1555.006), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1557.001](https://intel.threadlinqs.com/technique/T1557.001), [T1559](https://intel.threadlinqs.com/technique/T1559), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), [T1564](https://intel.threadlinqs.com/technique/T1564), [T1564.003](https://intel.threadlinqs.com/technique/T1564.003), [T1564.004](https://intel.threadlinqs.com/technique/T1564.004), T1564.012, [T1565](https://intel.threadlinqs.com/technique/T1565), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1568](https://intel.threadlinqs.com/technique/T1568), [T1569.002](https://intel.threadlinqs.com/technique/T1569.002), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), [T1574.006](https://intel.threadlinqs.com/technique/T1574.006), T1574.007, [T1575](https://intel.threadlinqs.com/technique/T1575), [T1580](https://intel.threadlinqs.com/technique/T1580), [T1582](https://intel.threadlinqs.com/technique/T1582), [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1583.008](https://intel.threadlinqs.com/technique/T1583.008), [T1584](https://intel.threadlinqs.com/technique/T1584), [T1584.008](https://intel.threadlinqs.com/technique/T1584.008), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1586.002](https://intel.threadlinqs.com/technique/T1586.002), [T1587](https://intel.threadlinqs.com/technique/T1587), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588](https://intel.threadlinqs.com/technique/T1588), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.003](https://intel.threadlinqs.com/technique/T1588.003), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1589](https://intel.threadlinqs.com/technique/T1589), [T1589.001](https://intel.threadlinqs.com/technique/T1589.001), [T1590](https://intel.threadlinqs.com/technique/T1590), [T1590.005](https://intel.threadlinqs.com/technique/T1590.005), [T1592](https://intel.threadlinqs.com/technique/T1592), [T1592.002](https://intel.threadlinqs.com/technique/T1592.002), [T1593](https://intel.threadlinqs.com/technique/T1593), [T1593.001](https://intel.threadlinqs.com/technique/T1593.001), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1598](https://intel.threadlinqs.com/technique/T1598), [T1598.003](https://intel.threadlinqs.com/technique/T1598.003), [T1606](https://intel.threadlinqs.com/technique/T1606), [T1606.002](https://intel.threadlinqs.com/technique/T1606.002), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1608.004](https://intel.threadlinqs.com/technique/T1608.004), [T1610](https://intel.threadlinqs.com/technique/T1610), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1613](https://intel.threadlinqs.com/technique/T1613), [T1616](https://intel.threadlinqs.com/technique/T1616), T1618, [T1620](https://intel.threadlinqs.com/technique/T1620), [T1621](https://intel.threadlinqs.com/technique/T1621), [T1624.001](https://intel.threadlinqs.com/technique/T1624.001), T1629.003, T1633, [T1636](https://intel.threadlinqs.com/technique/T1636), [T1636.002](https://intel.threadlinqs.com/technique/T1636.002), [T1636.003](https://intel.threadlinqs.com/technique/T1636.003), [T1636.004](https://intel.threadlinqs.com/technique/T1636.004), [T1646](https://intel.threadlinqs.com/technique/T1646), [T1650](https://intel.threadlinqs.com/technique/T1650), [T1655.001](https://intel.threadlinqs.com/technique/T1655.001), [T1657](https://intel.threadlinqs.com/technique/T1657), [T1658](https://intel.threadlinqs.com/technique/T1658), [T1660](https://intel.threadlinqs.com/technique/T1660), [T1664](https://intel.threadlinqs.com/technique/T1664), T1677, [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.005](https://intel.threadlinqs.com/technique/T1685.005), [T1685.006](https://intel.threadlinqs.com/technique/T1685.006), [T1686](https://intel.threadlinqs.com/technique/T1686)

## Threat actors

[Dmitry Belkin](https://intel.threadlinqs.com/actor/Dmitry%20Belkin), [Vexy Ransomware](https://intel.threadlinqs.com/actor/Vexy%20Ransomware), [The Seven Deadly Sins](https://intel.threadlinqs.com/actor/The%20Seven%20Deadly%20Sins), [Qilin](https://intel.threadlinqs.com/actor/Qilin), [Caramel Tsunami](https://intel.threadlinqs.com/actor/Caramel%20Tsunami), skynox7, [UAT-6275](https://intel.threadlinqs.com/actor/UAT-6275), [CL-UNK-1211](https://intel.threadlinqs.com/actor/CL-UNK-1211), [ARMORY CASTLE](https://intel.threadlinqs.com/actor/ARMORY%20CASTLE)

Nation-state attribution: Russia, Israel, Kazakhstan, North Korea, China, Russia, Iran, Pakistan, China

Threat categories: THREAT_INTEL, RANSOMWARE, MALWARE, PHISHING, VULNERABILITY, CLOUD, SUPPLY_CHAIN, IOT, ICS_SCADA, APT, DATA_BREACH

## Severity breakdown

- critical: 15
- high: 27
- medium: 10
- low: 1

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 1031 (network 289, file 261, entity 116, behavioral 94, infrastructure 89, malware 74, package 54, tool 53, url 1)
- New detection rules: 486 (100% of the day’s threats covered)

## More editions

- Previous: [2026-10-14](https://intel.threadlinqs.com/debrief/2026-10-14)
- Next: [2026-10-16](https://intel.threadlinqs.com/debrief/2026-10-16)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-10-15