# Daily Intelligence Briefing — Saturday, October 17, 2026

> On 2026-10-17, Threadlinqs published 31 new threat reports and updated 2, 6 rated critical and 22 high, spanning 201 MITRE ATT&CK techniques and 15 named threat actors. Coverage that day added 297 new detection rules and 661 extracted indicators.

- **Edition:** 2026-10-17 (Saturday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-10-17
- **Last updated:** 2026-10-23
- **New threats:** 31 (2 updated)
- **Critical / high:** 6 critical, 22 high, 5 medium, 0 low
- **ATT&CK techniques:** 201
- **Threat actors:** 15
- **Indicators (count only):** 661
- **New detection rules (count only):** 297

## Summary & highlights

SideCopy Targets Indian Organizations with ReverseRAT via Spear-Phishing LNK/HTA Chain. Criminal Adoption of Unrestricted AI Services: MessiahGPT, Kriminal.ai, WormGPT-linked Actors and AI-Driven KYC Bypass (Flashpoint, Aug 2026 data). EvilNominatus Ransomware - BAT-based ransomware with low AV detection (ClearSky).

- [TL-2026-3799](https://intel.threadlinqs.com/threat/TL-2026-3799) — MALFEX npm Campaign: 'imgdecode' Native Addon Hides DLL Shellcode Loader and Infostealer/RAT Chain
- [TL-2026-3804](https://intel.threadlinqs.com/threat/TL-2026-3804) — OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and ip_moptions Out-of-Bounds Write Chain Enables Local Privilege Escalation to Root (Public PoC)
- [TL-2026-3805](https://intel.threadlinqs.com/threat/TL-2026-3805) — GhostAction: Credential-Stealing Malware Hidden in Fake Font Files Across 94 GitHub Repositories
- [TL-2026-3810](https://intel.threadlinqs.com/threat/TL-2026-3810) — YuanKong Android RAT: Accessibility-Driven Remote Control, Overlay Credential Theft and Wireless Debugging Self-Pairing, With Operator Identities Embedded in Every Build
- [TL-2026-3812](https://intel.threadlinqs.com/threat/TL-2026-3812) — Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim - 12 GB Exfiltrated

## Theme of the day

Activity centered on windows, dll-sideloading, financial-motivation.

windows, credential-theft, kryptos-logic, banking-trojan, financial-motivation

## Threats published

- [TL-2026-3798](https://intel.threadlinqs.com/threat/TL-2026-3798) — CRITICAL — Compromised ConnectWise Cloud Backup (SkyKick) OAuth App Credential Used to Sign In to 173 Microsoft 365 Tenants
- [TL-2026-3801](https://intel.threadlinqs.com/threat/TL-2026-3801) — CRITICAL — Google Chrome 155 Security Update Fixes 10 Vulnerabilities Including Critical Prerender Use-After-Free (CVE-2026-110922)
- [TL-2026-3828](https://intel.threadlinqs.com/threat/TL-2026-3828) — CRITICAL — RDP Gateway pre-auth RCE via UDP fragment reassembly flaws (CVE-2020-0609, CVE-2020-0610)
- [TL-2026-3836](https://intel.threadlinqs.com/threat/TL-2026-3836) — CRITICAL — BlueKeep (CVE-2019-0708) RDP exploitation observed in the wild delivering cryptocurrency miner
- [TL-2026-3668](https://intel.threadlinqs.com/threat/TL-2026-3668) — CRITICAL — ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote Support (CVE-2026-102764) with SAWFLY Webshell and BARECLAW Tunneler (update)
- [TL-2026-3740](https://intel.threadlinqs.com/threat/TL-2026-3740) — CRITICAL — AI-Agent-Driven Exploitation of PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) Leads to Windows Credential Theft and Domain Admin Compromise (update)
- [TL-2026-3799](https://intel.threadlinqs.com/threat/TL-2026-3799) — HIGH — MALFEX npm Campaign: 'imgdecode' Native Addon Hides DLL Shellcode Loader and Infostealer/RAT Chain
- [TL-2026-3804](https://intel.threadlinqs.com/threat/TL-2026-3804) — HIGH — OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and ip_moptions Out-of-Bounds Write Chain Enables Local Privilege Escalation to Root (Public PoC)
- [TL-2026-3805](https://intel.threadlinqs.com/threat/TL-2026-3805) — HIGH — GhostAction: Credential-Stealing Malware Hidden in Fake Font Files Across 94 GitHub Repositories
- [TL-2026-3810](https://intel.threadlinqs.com/threat/TL-2026-3810) — HIGH — YuanKong Android RAT: Accessibility-Driven Remote Control, Overlay Credential Theft and Wireless Debugging Self-Pairing, With Operator Identities Embedded in Every Build
- [TL-2026-3812](https://intel.threadlinqs.com/threat/TL-2026-3812) — HIGH — Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim - 12 GB Exfiltrated
- [TL-2026-3819](https://intel.threadlinqs.com/threat/TL-2026-3819) — HIGH — Homeland Justice (Iran-linked) "No-Justice" wiper (NACL.exe) targeting Albanian organizations
- [TL-2026-3821](https://intel.threadlinqs.com/threat/TL-2026-3821) — HIGH — Progress MOVEit Transfer: 12 vulnerabilities incl. authentication bypass and privilege escalation (CVE-2026-89067, CVE-2026-87093, CVE-2026-89068 and 9 more)
- [TL-2026-3822](https://intel.threadlinqs.com/threat/TL-2026-3822) — HIGH — YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords
- [TL-2026-3824](https://intel.threadlinqs.com/threat/TL-2026-3824) — HIGH — Insider Threat: Ransomware Negotiator Angelo Martino Worked for BlackCat/ALPHV Against Victims
- [TL-2026-3826](https://intel.threadlinqs.com/threat/TL-2026-3826) — HIGH — TrickBot injectDLL Web Injection Module: Certificate Transparency Bypass, Localhost Proxy and Multistage JavaScript Injection
- [TL-2026-3827](https://intel.threadlinqs.com/threat/TL-2026-3827) — HIGH — TrickBot masrv Module: Masscan-based Network Scanner with Anchor/Bazar Infrastructure Overlap
- [TL-2026-3829](https://intel.threadlinqs.com/threat/TL-2026-3829) — HIGH — Emotet Scales Use of Stolen Email Content for Context-Aware Phishing
- [TL-2026-3830](https://intel.threadlinqs.com/threat/TL-2026-3830) — HIGH — Emotet Botnet Global Victimology and Malspam-Delivered Qakbot Payloads
- [TL-2026-3831](https://intel.threadlinqs.com/threat/TL-2026-3831) — HIGH — Petya/NotPetya Outbreak (June 2017): EternalBlue/EternalRomance (MS17-010, CVE-2017-0144/0145) Lateral Movement and M.E.Doc Update Compromise
- [TL-2026-3832](https://intel.threadlinqs.com/threat/TL-2026-3832) — HIGH — Gentlemen Ransomware (Storm-2697): Double-Extortion RaaS with Fortinet Exploitation, BYOVD EDR Killers and GPO-Based Mass Deployment
- [TL-2026-3833](https://intel.threadlinqs.com/threat/TL-2026-3833) — HIGH — Vexy Ransomware claims polisee Inc (AI policy intelligence platform) as victim
- [TL-2026-3834](https://intel.threadlinqs.com/threat/TL-2026-3834) — HIGH — Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North Korean (Lazarus) Attribution Questioned
- [TL-2026-3835](https://intel.threadlinqs.com/threat/TL-2026-3835) — HIGH — Emotet Awakens With New Campaign of Mass Email Exfiltration
- [TL-2026-3837](https://intel.threadlinqs.com/threat/TL-2026-3837) — HIGH — AnchorDNS backdoor and AnchorAdjuster tool used by TrickBot actors (Kryptos Logic)
- [TL-2026-3838](https://intel.threadlinqs.com/threat/TL-2026-3838) — HIGH — TrickBot adds Zeus-style webinject configs (winj) to injectDll32/injectDll64 webinject module
- [TL-2026-3839](https://intel.threadlinqs.com/threat/TL-2026-3839) — HIGH — EasterBunny: advanced modular espionage implant attributed to APT29 (SVR)
- [TL-2026-3843](https://intel.threadlinqs.com/threat/TL-2026-3843) — HIGH — APT-C-60 Update: SpyGlace Campaign via VHDX Spear-Phishing Targeting Recruitment Staff in Japan/East Asia
- [TL-2026-3806](https://intel.threadlinqs.com/threat/TL-2026-3806) — MEDIUM — SideCopy Targets Indian Organizations with ReverseRAT via Spear-Phishing LNK/HTA Chain
- [TL-2026-3813](https://intel.threadlinqs.com/threat/TL-2026-3813) — MEDIUM — Criminal Adoption of Unrestricted AI Services: MessiahGPT, Kriminal.ai, WormGPT-linked Actors and AI-Driven KYC Bypass (Flashpoint, Aug 2026 data)
- [TL-2026-3817](https://intel.threadlinqs.com/threat/TL-2026-3817) — MEDIUM — EvilNominatus Ransomware - BAT-based ransomware with low AV detection (ClearSky)
- [TL-2026-3820](https://intel.threadlinqs.com/threat/TL-2026-3820) — MEDIUM — Houthi/Yemen-linked Influence Campaign Using Fake News Sites and Forged Facebook Personas Targeting Israel and Gulf States
- [TL-2026-3844](https://intel.threadlinqs.com/threat/TL-2026-3844) — MEDIUM — Hotejka Help TDS Abuses 20,000+ Cloudflare Pages Domains to Push Fake Microsoft Security Alerts (Tech Support Scam)

## Techniques observed

[T1003](https://intel.threadlinqs.com/technique/T1003), [T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1003.002](https://intel.threadlinqs.com/technique/T1003.002), [T1003.003](https://intel.threadlinqs.com/technique/T1003.003), [T1003.004](https://intel.threadlinqs.com/technique/T1003.004), [T1003.006](https://intel.threadlinqs.com/technique/T1003.006), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1012](https://intel.threadlinqs.com/technique/T1012), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1021.006](https://intel.threadlinqs.com/technique/T1021.006), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.007](https://intel.threadlinqs.com/technique/T1027.007), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1036.007](https://intel.threadlinqs.com/technique/T1036.007), [T1036.008](https://intel.threadlinqs.com/technique/T1036.008), T1036.010, [T1037](https://intel.threadlinqs.com/technique/T1037), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1048](https://intel.threadlinqs.com/technique/T1048), [T1048.003](https://intel.threadlinqs.com/technique/T1048.003), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), [T1055.001](https://intel.threadlinqs.com/technique/T1055.001), [T1056](https://intel.threadlinqs.com/technique/T1056), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.004](https://intel.threadlinqs.com/technique/T1056.004), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069.001](https://intel.threadlinqs.com/technique/T1069.001), T1070.002, [T1070.003](https://intel.threadlinqs.com/technique/T1070.003), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1071.004](https://intel.threadlinqs.com/technique/T1071.004), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.002](https://intel.threadlinqs.com/technique/T1078.002), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1087.004](https://intel.threadlinqs.com/technique/T1087.004), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.001](https://intel.threadlinqs.com/technique/T1090.001), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1098.001](https://intel.threadlinqs.com/technique/T1098.001), [T1098.003](https://intel.threadlinqs.com/technique/T1098.003), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110.001](https://intel.threadlinqs.com/technique/T1110.001), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114.001](https://intel.threadlinqs.com/technique/T1114.001), [T1129](https://intel.threadlinqs.com/technique/T1129), [T1132](https://intel.threadlinqs.com/technique/T1132), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1132.002](https://intel.threadlinqs.com/technique/T1132.002), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1135](https://intel.threadlinqs.com/technique/T1135), [T1136.002](https://intel.threadlinqs.com/technique/T1136.002), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), [T1218](https://intel.threadlinqs.com/technique/T1218), [T1218.005](https://intel.threadlinqs.com/technique/T1218.005), [T1219](https://intel.threadlinqs.com/technique/T1219), T1222.001, [T1406](https://intel.threadlinqs.com/technique/T1406), [T1414](https://intel.threadlinqs.com/technique/T1414), [T1417](https://intel.threadlinqs.com/technique/T1417), [T1417.001](https://intel.threadlinqs.com/technique/T1417.001), [T1417.002](https://intel.threadlinqs.com/technique/T1417.002), [T1418](https://intel.threadlinqs.com/technique/T1418), [T1420](https://intel.threadlinqs.com/technique/T1420), [T1430](https://intel.threadlinqs.com/technique/T1430), [T1437.001](https://intel.threadlinqs.com/technique/T1437.001), [T1453](https://intel.threadlinqs.com/technique/T1453), [T1480](https://intel.threadlinqs.com/technique/T1480), [T1480.001](https://intel.threadlinqs.com/technique/T1480.001), [T1484.001](https://intel.threadlinqs.com/technique/T1484.001), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1491.001](https://intel.threadlinqs.com/technique/T1491.001), [T1496.001](https://intel.threadlinqs.com/technique/T1496.001), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1513](https://intel.threadlinqs.com/technique/T1513), [T1516](https://intel.threadlinqs.com/technique/T1516), [T1517](https://intel.threadlinqs.com/technique/T1517), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1529](https://intel.threadlinqs.com/technique/T1529), [T1533](https://intel.threadlinqs.com/technique/T1533), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1541](https://intel.threadlinqs.com/technique/T1541), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), [T1546.015](https://intel.threadlinqs.com/technique/T1546.015), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1548.001](https://intel.threadlinqs.com/technique/T1548.001), [T1548.003](https://intel.threadlinqs.com/technique/T1548.003), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.002](https://intel.threadlinqs.com/technique/T1550.002), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), T1553.004, [T1553.005](https://intel.threadlinqs.com/technique/T1553.005), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), [T1561](https://intel.threadlinqs.com/technique/T1561), [T1561.001](https://intel.threadlinqs.com/technique/T1561.001), T1561.002, T1562.001, T1562.004, [T1564.003](https://intel.threadlinqs.com/technique/T1564.003), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1566.004](https://intel.threadlinqs.com/technique/T1566.004), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1568.002](https://intel.threadlinqs.com/technique/T1568.002), [T1569.002](https://intel.threadlinqs.com/technique/T1569.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1584.008](https://intel.threadlinqs.com/technique/T1584.008), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1586.002](https://intel.threadlinqs.com/technique/T1586.002), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588](https://intel.threadlinqs.com/technique/T1588), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1589.001](https://intel.threadlinqs.com/technique/T1589.001), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.001](https://intel.threadlinqs.com/technique/T1595.001), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1596.005](https://intel.threadlinqs.com/technique/T1596.005), [T1598](https://intel.threadlinqs.com/technique/T1598), [T1620](https://intel.threadlinqs.com/technique/T1620), T1623.001, [T1626](https://intel.threadlinqs.com/technique/T1626), T1626.001, [T1628.001](https://intel.threadlinqs.com/technique/T1628.001), T1629.001, [T1646](https://intel.threadlinqs.com/technique/T1646), [T1649](https://intel.threadlinqs.com/technique/T1649), [T1657](https://intel.threadlinqs.com/technique/T1657), [T1659](https://intel.threadlinqs.com/technique/T1659), T1671, [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.005](https://intel.threadlinqs.com/technique/T1685.005)

## Threat actors

[SideCopy](https://intel.threadlinqs.com/actor/SideCopy), dabial leaks, [Hotejka](https://intel.threadlinqs.com/actor/Hotejka), [MALFEX](https://intel.threadlinqs.com/actor/MALFEX), [Vexy Ransomware](https://intel.threadlinqs.com/actor/Vexy%20Ransomware), [Homeland Justice](https://intel.threadlinqs.com/actor/Homeland%20Justice), [BlackCat](https://intel.threadlinqs.com/actor/BlackCat), [TrickBot operators](https://intel.threadlinqs.com/actor/TrickBot%20operators), [APT44](https://intel.threadlinqs.com/actor/APT44), [The Gentlemen](https://intel.threadlinqs.com/actor/The%20Gentlemen), [GRIM SPIDER](https://intel.threadlinqs.com/actor/GRIM%20SPIDER), [TrickBot group](https://intel.threadlinqs.com/actor/TrickBot%20group), [APT29](https://intel.threadlinqs.com/actor/APT29), [APT-C-60](https://intel.threadlinqs.com/actor/APT-C-60), [ARMORY CASTLE](https://intel.threadlinqs.com/actor/ARMORY%20CASTLE)

Nation-state attribution: Pakistan, Yemen, Iran, Russia, South Korea, China

Threat categories: MALWARE, THREAT_INTEL, RANSOMWARE, PHISHING, SUPPLY_CHAIN, VULNERABILITY, APT

## Severity breakdown

- critical: 6
- high: 22
- medium: 5
- low: 0

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 661 (file 225, network 189, malware 52, entity 51, tool 46, behavioral 44, infrastructure 42, package 12)
- New detection rules: 297 (100% of the day’s threats covered)

## More editions

- Previous: [2026-10-16](https://intel.threadlinqs.com/debrief/2026-10-16)
- Next: [2026-10-19](https://intel.threadlinqs.com/debrief/2026-10-19)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-10-17