Summary & highlights
SideCopy Targets Indian Organizations with ReverseRAT via Spear-Phishing LNK/HTA Chain. Criminal Adoption of Unrestricted AI Services: MessiahGPT, Kriminal.ai, WormGPT-linked Actors and AI-Driven KYC Bypass (Flashpoint, Aug 2026 data). EvilNominatus Ransomware - BAT-based ransomware with low AV detection (ClearSky).
Highlights
- TL-2026-3799 — MALFEX npm Campaign: 'imgdecode' Native Addon Hides DLL Shellcode Loader and Infostealer/RAT Chain
- TL-2026-3804 — OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and ip_moptions Out-of-Bounds Write Chain Enables Local Privilege Escalation to Root (Public PoC)
- TL-2026-3805 — GhostAction: Credential-Stealing Malware Hidden in Fake Font Files Across 94 GitHub Repositories
- TL-2026-3810 — YuanKong Android RAT: Accessibility-Driven Remote Control, Overlay Credential Theft and Wireless Debugging Self-Pairing, With Operator Identities Embedded in Every Build
- TL-2026-3812 — Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim - 12 GB Exfiltrated
Theme of the day
Activity centered on windows, dll-sideloading, financial-motivation.
- windows
- credential-theft
- kryptos-logic
- banking-trojan
- financial-motivation
Threats published
33 threat lines in the 2026-10-17 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.
- Compromised ConnectWise Cloud Backup (SkyKick) OAuth App Credential Used to Sign In to 173 Microsoft 365 TenantsCRITICAL
- Google Chrome 155 Security Update Fixes 10 Vulnerabilities Including Critical Prerender Use-After-Free (CVE-2026-110922)CRITICAL
- RDP Gateway pre-auth RCE via UDP fragment reassembly flaws (CVE-2020-0609, CVE-2020-0610)CRITICAL
- BlueKeep (CVE-2019-0708) RDP exploitation observed in the wild delivering cryptocurrency minerCRITICAL
- ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote Support (CVE-2026-102764) with SAWFLY Webshell and BARECLAW Tunneler (update)CRITICAL
- AI-Agent-Driven Exploitation of PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) Leads to Windows Credential Theft and Domain Admin Compromise (update)CRITICAL
- MALFEX npm Campaign: 'imgdecode' Native Addon Hides DLL Shellcode Loader and Infostealer/RAT ChainHIGH
- OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and ip_moptions Out-of-Bounds Write Chain Enables Local Privilege Escalation to Root (Public PoC)HIGH
- GhostAction: Credential-Stealing Malware Hidden in Fake Font Files Across 94 GitHub RepositoriesHIGH
- YuanKong Android RAT: Accessibility-Driven Remote Control, Overlay Credential Theft and Wireless Debugging Self-Pairing, With Operator Identities Embedded in Every BuildHIGH
- Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim - 12 GB ExfiltratedHIGH
- Homeland Justice (Iran-linked) "No-Justice" wiper (NACL.exe) targeting Albanian organizationsHIGH
- Progress MOVEit Transfer: 12 vulnerabilities incl. authentication bypass and privilege escalation (CVE-2026-89067, CVE-2026-87093, CVE-2026-89068 and 9 more)HIGH
- YuanKong Android RAT Hijacks Phones to Steal Banking PINs and PasswordsHIGH
- Insider Threat: Ransomware Negotiator Angelo Martino Worked for BlackCat/ALPHV Against VictimsHIGH
- TrickBot injectDLL Web Injection Module: Certificate Transparency Bypass, Localhost Proxy and Multistage JavaScript InjectionHIGH
- TrickBot masrv Module: Masscan-based Network Scanner with Anchor/Bazar Infrastructure OverlapHIGH
- Emotet Scales Use of Stolen Email Content for Context-Aware PhishingHIGH
- Emotet Botnet Global Victimology and Malspam-Delivered Qakbot PayloadsHIGH
- Petya/NotPetya Outbreak (June 2017): EternalBlue/EternalRomance (MS17-010, CVE-2017-0144/0145) Lateral Movement and M.E.Doc Update CompromiseHIGH
- Gentlemen Ransomware (Storm-2697): Double-Extortion RaaS with Fortinet Exploitation, BYOVD EDR Killers and GPO-Based Mass DeploymentHIGH
- Vexy Ransomware claims polisee Inc (AI policy intelligence platform) as victimHIGH
- Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North Korean (Lazarus) Attribution QuestionedHIGH
- Emotet Awakens With New Campaign of Mass Email ExfiltrationHIGH
- AnchorDNS backdoor and AnchorAdjuster tool used by TrickBot actors (Kryptos Logic)HIGH
- TrickBot adds Zeus-style webinject configs (winj) to injectDll32/injectDll64 webinject moduleHIGH
- EasterBunny: advanced modular espionage implant attributed to APT29 (SVR)HIGH
- APT-C-60 Update: SpyGlace Campaign via VHDX Spear-Phishing Targeting Recruitment Staff in Japan/East AsiaHIGH
- SideCopy Targets Indian Organizations with ReverseRAT via Spear-Phishing LNK/HTA ChainMEDIUM
- Criminal Adoption of Unrestricted AI Services: MessiahGPT, Kriminal.ai, WormGPT-linked Actors and AI-Driven KYC Bypass (Flashpoint, Aug 2026 data)MEDIUM
- EvilNominatus Ransomware - BAT-based ransomware with low AV detection (ClearSky)MEDIUM
- Houthi/Yemen-linked Influence Campaign Using Fake News Sites and Forged Facebook Personas Targeting Israel and Gulf StatesMEDIUM
- Hotejka Help TDS Abuses 20,000+ Cloudflare Pages Domains to Push Fake Microsoft Security Alerts (Tech Support Scam)MEDIUM
Techniques observed
201 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.
- T1003
- T1003.001
- T1003.002
- T1003.003
- T1003.004
- T1003.006
- T1005
- T1012
- T1018
- T1021
- T1021.001
- T1021.002
- T1021.006
- T1027
- T1027.007
- T1027.013
- T1036
- T1036.005
- T1036.007
- T1036.008
- T1036.010
- T1037
- T1041
- T1046
- T1047
- T1048
- T1048.003
- T1053.003
- T1053.005
- T1055
- T1055.001
- T1056
- T1056.001
- T1056.004
- T1057
- T1059
- T1059.001
- T1059.003
- T1059.004
- T1059.005
- T1059.006
- T1059.007
- T1068
- T1069.001
- T1070.002
- T1070.003
- T1070.004
- T1070.006
- T1071.001
- T1071.004
- T1074.001
- T1078
- T1078.002
- T1078.004
- T1082
- T1083
- T1087.002
- T1087.004
- T1090
- T1090.001
- T1098
- T1098.001
- T1098.003
- T1102.002
- T1105
- T1106
- T1110.001
- T1110.003
- T1111
- T1112
- T1113
- T1114.001
- T1129
- T1132
- T1132.001
- T1132.002
- T1133
- T1135
- T1136.002
- T1140
- T1185
- T1189
- T1190
- T1195
- T1195.001
- T1195.002
- T1199
- T1203
- T1204
- T1204.001
- T1204.002
- T1211
- T1212
- T1213
- T1213.003
- T1218
- T1218.005
- T1219
- T1222.001
- T1406
- T1414
- T1417
- T1417.001
- T1417.002
- T1418
- T1420
- T1430
- T1437.001
- T1453
- T1480
- T1480.001
- T1484.001
- T1486
- T1489
- T1490
- T1491.001
- T1496.001
- T1497.001
- T1499.004
- T1505.003
- T1513
- T1516
- T1517
- T1518
- T1526
- T1528
- T1529
- T1533
- T1539
- T1541
- T1543.003
- T1546.015
- T1547.001
- T1548.001
- T1548.003
- T1550.001
- T1550.002
- T1550.004
- T1552
- T1552.001
- T1552.004
- T1553.002
- T1553.004
- T1553.005
- T1555
- T1555.003
- T1557
- T1560.001
- T1561
- T1561.001
- T1561.002
- T1562.001
- T1562.004
- T1564.003
- T1566
- T1566.001
- T1566.002
- T1566.003
- T1566.004
- T1567
- T1567.002
- T1568.002
- T1569.002
- T1570
- T1571
- T1572
- T1573
- T1573.001
- T1573.002
- T1583.001
- T1583.003
- T1583.006
- T1584.008
- T1585
- T1585.001
- T1586.002
- T1587.001
- T1587.004
- T1588
- T1588.002
- T1588.007
- T1589.001
- T1595
- T1595.001
- T1595.002
- T1596.005
- T1598
- T1620
- T1623.001
- T1626
- T1626.001
- T1628.001
- T1629.001
- T1646
- T1649
- T1657
- T1659
- T1671
- T1684.001
- T1685
- T1685.005
Threat actors
15 named threat actors across the reports.
- SideCopy
- dabial leaks
- Hotejka
- MALFEX
- Vexy Ransomware
- Homeland Justice
- BlackCat
- TrickBot operators
- APT44
- The Gentlemen
- GRIM SPIDER
- TrickBot group
- APT29
- APT-C-60
- ARMORY CASTLE
Nation-state attribution
- Pakistan
- Yemen
- Iran
- Russia
- South Korea
- China
Threat categories
- MALWARE
- THREAT_INTEL
- RANSOMWARE
- PHISHING
- SUPPLY_CHAIN
- VULNERABILITY
- APT
Severity breakdown
- critical6
- high22
- medium5
- low0
Indicator & detection coverage
Counts only: the indicator values and detection rule text behind them are tiered.
661 indicators of compromise · Red and above. Compare plans
- file 225
- network 189
- malware 52
- entity 51
- tool 46
- behavioral 44
- infrastructure 42
- package 12
297 new detection rules (100% of the day’s threats covered) · Blue and above. Compare plans