# Daily Intelligence Briefing — Tuesday, October 20, 2026

> On 2026-10-20, Threadlinqs published 39 new threat reports and updated 4, 12 rated critical and 19 high, spanning 235 MITRE ATT&CK techniques and 13 named threat actors. Coverage that day added 387 new detection rules and 1265 extracted indicators.

- **Edition:** 2026-10-20 (Tuesday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-10-20
- **Last updated:** 2026-10-26
- **New threats:** 39 (4 updated)
- **Critical / high:** 12 critical, 19 high, 11 medium, 1 low
- **ATT&CK techniques:** 235
- **Threat actors:** 13
- **Indicators (count only):** 1265
- **New detection rules (count only):** 387

## Summary & highlights

JPHP-based Windows loader (suspected d3f@ck loader) with Telegram dead-drop C2 and Defender exclusion. SBI Data Breach Claim – Threat Actor 'Siriusim' Alleges Access to 375,000-Row Customer Database on BreachForums. Fake Google Meet Login Pages (meet-google.cyou, qooglo.com) Harvesting Google Credentials and 2FA Codes.

- [TL-2026-3924](https://intel.threadlinqs.com/threat/TL-2026-3924) — Q2 2026 Vulnerability and Exploit Landscape: Exploited AI-platform flaws (OpenClaw CVE-2026-25253, Dify CVE-2026-41948, Open WebUI CVE-2026-45386), Exchange CVE-2026-45501, and Linux kernel page-cache LPE exploit wave (Copy Fail, Dirty Frag)
- [TL-2026-3930](https://intel.threadlinqs.com/threat/TL-2026-3930) — EtherRAT and TukTuk C2 lead to The Gentleman ransomware (malicious MSI posing as Sysinternals RAMMap)
- [TL-2026-3936](https://intel.threadlinqs.com/threat/TL-2026-3936) — Siemens Software Center DLL Sideloading Vulnerability (CVE-2026-110936) Exploited in ClickFix Malware Attacks
- [TL-2026-3938](https://intel.threadlinqs.com/threat/TL-2026-3938) — OpenClaw AI Agent Skills Weaponized on ClawHub (ClawHavoc) to Deliver Atomic Stealer, Trojans and Backdoors
- [TL-2026-3939](https://intel.threadlinqs.com/threat/TL-2026-3939) — Infostealer Campaign Using Spoofed Software Installers and DLL Sideloading (CoreMessaging.dll)

## Theme of the day

Activity centered on backdoor, cisa-kev, privilege-escalation.

windows, credential-theft, phishing, ransomware, social-engineering

## Threats published

- [TL-2026-3952](https://intel.threadlinqs.com/threat/TL-2026-3952) — CRITICAL — Apache ActiveMQ Exploit (CVE-2023-46604) Leads to LockBit Ransomware
- [TL-2026-3953](https://intel.threadlinqs.com/threat/TL-2026-3953) — CRITICAL — INC and The Gentlemen Ransomware: Exposed AI-Executed, Human-Approved Attack Infrastructure (Phantom framework)
- [TL-2026-3971](https://intel.threadlinqs.com/threat/TL-2026-3971) — CRITICAL — Fake Kernel Threads Hiding Backdoors on Linux Servers and Appliances (StyleSmuggler, Tengu, Cyclops Blink; CVE-2026-75650, CVE-2026-20079)
- [TL-2026-3976](https://intel.threadlinqs.com/threat/TL-2026-3976) — CRITICAL — Fortinet FortiSIEM CVE-2026-106173 gRPC phQueryMaster Path Traversal Enables Unauthenticated RCE (Public PoC)
- [TL-2026-3978](https://intel.threadlinqs.com/threat/TL-2026-3978) — CRITICAL — #StopRansomware: SafePay Ransomware (CISA AA26-293A) — Exploitation of Cisco ASA/FTD, Veeam B&R and SonicWall SonicOS
- [TL-2026-3980](https://intel.threadlinqs.com/threat/TL-2026-3980) — CRITICAL — Unauthenticated RCE in Veeam Service Provider Console via agent impersonation and arbitrary file write (CVE-2026-58073, CVE-2026-58072)
- [TL-2026-3988](https://intel.threadlinqs.com/threat/TL-2026-3988) — CRITICAL — CVE-2026-101767: Oracle E-Business Suite TCF Unauthenticated SQL Injection and Remote Code Execution
- [TL-2026-3989](https://intel.threadlinqs.com/threat/TL-2026-3989) — CRITICAL — PHP pre-announces two critical RCE flaws in PHP core (CVE-2026-109618, CVE-2026-109619); emergency patches due 2026-10-21 after embargo leak
- [TL-2026-3993](https://intel.threadlinqs.com/threat/TL-2026-3993) — CRITICAL — OpenCode MCP OAuth Remote Code Execution (Windows/WSL) - Silently Patched in 1.18.33, No CVE
- [TL-2026-3995](https://intel.threadlinqs.com/threat/TL-2026-3995) — CRITICAL — Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites Following TeamUpdraft Breach
- [TL-2026-0631](https://intel.threadlinqs.com/threat/TL-2026-0631) — CRITICAL — Palo Alto Networks PAN-OS / Prisma Access GlobalProtect Authentication Bypass (CVE-2026-0257) — Active Exploitation, CISA KEV (update)
- [TL-2026-3902](https://intel.threadlinqs.com/threat/TL-2026-3902) — CRITICAL — Rank Math PRO WordPress Plugin Supply Chain Compromise (v3.0.123, CVE-2026-111862) (update)
- [TL-2026-3924](https://intel.threadlinqs.com/threat/TL-2026-3924) — HIGH — Q2 2026 Vulnerability and Exploit Landscape: Exploited AI-platform flaws (OpenClaw CVE-2026-25253, Dify CVE-2026-41948, Open WebUI CVE-2026-45386), Exchange CVE-2026-45501, and Linux kernel page-cache LPE exploit wave (Copy Fail, Dirty Frag)
- [TL-2026-3930](https://intel.threadlinqs.com/threat/TL-2026-3930) — HIGH — EtherRAT and TukTuk C2 lead to The Gentleman ransomware (malicious MSI posing as Sysinternals RAMMap)
- [TL-2026-3936](https://intel.threadlinqs.com/threat/TL-2026-3936) — HIGH — Siemens Software Center DLL Sideloading Vulnerability (CVE-2026-110936) Exploited in ClickFix Malware Attacks
- [TL-2026-3938](https://intel.threadlinqs.com/threat/TL-2026-3938) — HIGH — OpenClaw AI Agent Skills Weaponized on ClawHub (ClawHavoc) to Deliver Atomic Stealer, Trojans and Backdoors
- [TL-2026-3939](https://intel.threadlinqs.com/threat/TL-2026-3939) — HIGH — Infostealer Campaign Using Spoofed Software Installers and DLL Sideloading (CoreMessaging.dll)
- [TL-2026-3942](https://intel.threadlinqs.com/threat/TL-2026-3942) — HIGH — OpenCode Console breach exposes linked AI-provider API keys amid large-scale distillation attack
- [TL-2026-3947](https://intel.threadlinqs.com/threat/TL-2026-3947) — HIGH — OVHcloud CLI GitHub Releases Hijacked to Distribute Secret-Stealing Malware (v0.11.0-v0.15.0)
- [TL-2026-3949](https://intel.threadlinqs.com/threat/TL-2026-3949) — HIGH — APT28 (Fancy Bear) Espionage Campaign Against European Defense Contractors Using Hookedge Backdoor
- [TL-2026-3951](https://intel.threadlinqs.com/threat/TL-2026-3951) — HIGH — Payouts King Ransomware and AI-Assisted Data-Theft Extortion via Teams Vishing and Quick Assist
- [TL-2026-3956](https://intel.threadlinqs.com/threat/TL-2026-3956) — HIGH — Japan October 2026 Data Breach Surge: Web/API Compromises, Supplier Breaches, IDC Frontier Ransomware and AI-Assisted Probing (ARTEX)
- [TL-2026-3959](https://intel.threadlinqs.com/threat/TL-2026-3959) — HIGH — Open-Source AI Pentest Platform Cairn Abused to Breach 100+ Organizations (E-commerce/Payment Targets)
- [TL-2026-3981](https://intel.threadlinqs.com/threat/TL-2026-3981) — HIGH — Device Code Authentication Phishing Abusing Microsoft Sign-In via Fake Mimecast Device Enrollment
- [TL-2026-3986](https://intel.threadlinqs.com/threat/TL-2026-3986) — HIGH — Abliterated and Resold AI Models Fueling Cybercrime Underground; ARTEX-Assisted Intrusions at South Korean Banks (Flare Quantitative Analysis)
- [TL-2026-3987](https://intel.threadlinqs.com/threat/TL-2026-3987) — HIGH — From Phishing to LLMjacking: Threat Actors Hijacking GCP Billing Accounts for Gemini API Usage
- [TL-2026-3996](https://intel.threadlinqs.com/threat/TL-2026-3996) — HIGH — Browser Trust Abuse: Fake Update Lures, Browser-in-the-Browser, ClickFix and Device Code Phishing
- [TL-2026-4000](https://intel.threadlinqs.com/threat/TL-2026-4000) — HIGH — Operation FlashHole: Lazarus watering-hole and spear-phishing campaign abusing INISAFE CrossWeb EX against South Korean organizations
- [TL-2026-4002](https://intel.threadlinqs.com/threat/TL-2026-4002) — HIGH — Red Hat RHSA-2026:86331 glycin-loaders use-after-free (CVE-2026-96889 / RUSTSEC-2026-0305, librsvg)
- [TL-2026-3435](https://intel.threadlinqs.com/threat/TL-2026-3435) — HIGH — Microsoft October 2026 Patch Tuesday: 1,118 Vulnerabilities Fixed, Grouped into 15 Risk Cohorts (update)
- [TL-2026-3805](https://intel.threadlinqs.com/threat/TL-2026-3805) — HIGH — GhostAction: Credential-Stealing Malware Hidden in Fake Font Files Across 94 GitHub Repositories (update)
- [TL-2026-3925](https://intel.threadlinqs.com/threat/TL-2026-3925) — MEDIUM — JPHP-based Windows loader (suspected d3f@ck loader) with Telegram dead-drop C2 and Defender exclusion
- [TL-2026-3927](https://intel.threadlinqs.com/threat/TL-2026-3927) — MEDIUM — SBI Data Breach Claim – Threat Actor 'Siriusim' Alleges Access to 375,000-Row Customer Database on BreachForums
- [TL-2026-3941](https://intel.threadlinqs.com/threat/TL-2026-3941) — MEDIUM — Fake Google Meet Login Pages (meet-google.cyou, qooglo.com) Harvesting Google Credentials and 2FA Codes
- [TL-2026-3955](https://intel.threadlinqs.com/threat/TL-2026-3955) — MEDIUM — Unnamed PHP backdoor leveraging php-win.exe and cutt.ly shortened-URL C2 (scheduled task 'ClockLauncher')
- [TL-2026-3961](https://intel.threadlinqs.com/threat/TL-2026-3961) — MEDIUM — Generative AI Used by Ransomware Operators to Build Custom Malware, Craft Phishing and Accelerate Data Theft (Zscaler ThreatLabz)
- [TL-2026-3963](https://intel.threadlinqs.com/threat/TL-2026-3963) — MEDIUM — Evolution of Hacktivism in Hybrid Warfare: NoName057(16), Killnet and Handala Hack Tactics and Real-World Impact
- [TL-2026-3964](https://intel.threadlinqs.com/threat/TL-2026-3964) — MEDIUM — Classiscam-linked actors abuse open banking account-linking to validate stolen credentials
- [TL-2026-3973](https://intel.threadlinqs.com/threat/TL-2026-3973) — MEDIUM — Doppelgänger NG: Russian influence campaign targeting Israel (fake Walla clone, X amplification, ClearSky low-confidence APT28 link)
- [TL-2026-3992](https://intel.threadlinqs.com/threat/TL-2026-3992) — MEDIUM — Ransomware attack on Data Cymru via weak 'Test2'/'Password1' test account at Ogi Networks leads to theft of children's data
- [TL-2026-3994](https://intel.threadlinqs.com/threat/TL-2026-3994) — MEDIUM — Booz Allen Lab Test: Frontier AI Models Achieve All Eight OT Attack Objectives, Including Moving a Robotic Arm
- [TL-2026-4004](https://intel.threadlinqs.com/threat/TL-2026-4004) — MEDIUM — Developer credential exposure on dev machines: StepSecurity Dev Machine Guard credential-source inventory (context: TeamPCP stealer, Bitwarden CLI npm hijack, Shai-Hulud)
- [TL-2026-3972](https://intel.threadlinqs.com/threat/TL-2026-3972) — LOW — curl Moves Low/Medium-Severity Vulnerability Handling to Public GitHub Amid AI-Driven Report Flood

## Techniques observed

T0846, [T1003](https://intel.threadlinqs.com/technique/T1003), [T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1003.003](https://intel.threadlinqs.com/technique/T1003.003), [T1003.006](https://intel.threadlinqs.com/technique/T1003.006), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1012](https://intel.threadlinqs.com/technique/T1012), [T1016](https://intel.threadlinqs.com/technique/T1016), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1020](https://intel.threadlinqs.com/technique/T1020), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1021.004](https://intel.threadlinqs.com/technique/T1021.004), [T1021.006](https://intel.threadlinqs.com/technique/T1021.006), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.001](https://intel.threadlinqs.com/technique/T1027.001), [T1027.002](https://intel.threadlinqs.com/technique/T1027.002), [T1027.003](https://intel.threadlinqs.com/technique/T1027.003), [T1027.007](https://intel.threadlinqs.com/technique/T1027.007), [T1027.010](https://intel.threadlinqs.com/technique/T1027.010), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.004](https://intel.threadlinqs.com/technique/T1036.004), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1036.008](https://intel.threadlinqs.com/technique/T1036.008), [T1037.004](https://intel.threadlinqs.com/technique/T1037.004), [T1039](https://intel.threadlinqs.com/technique/T1039), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1048](https://intel.threadlinqs.com/technique/T1048), [T1048.003](https://intel.threadlinqs.com/technique/T1048.003), [T1053](https://intel.threadlinqs.com/technique/T1053), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.002](https://intel.threadlinqs.com/technique/T1056.002), [T1056.003](https://intel.threadlinqs.com/technique/T1056.003), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069](https://intel.threadlinqs.com/technique/T1069), [T1069.002](https://intel.threadlinqs.com/technique/T1069.002), [T1070](https://intel.threadlinqs.com/technique/T1070), T1070.001, [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1071.004](https://intel.threadlinqs.com/technique/T1071.004), [T1074](https://intel.threadlinqs.com/technique/T1074), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1078.002](https://intel.threadlinqs.com/technique/T1078.002), [T1078.003](https://intel.threadlinqs.com/technique/T1078.003), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1087.001](https://intel.threadlinqs.com/technique/T1087.001), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1087.004](https://intel.threadlinqs.com/technique/T1087.004), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.003](https://intel.threadlinqs.com/technique/T1090.003), [T1095](https://intel.threadlinqs.com/technique/T1095), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1098.001](https://intel.threadlinqs.com/technique/T1098.001), [T1098.003](https://intel.threadlinqs.com/technique/T1098.003), [T1098.004](https://intel.threadlinqs.com/technique/T1098.004), [T1098.005](https://intel.threadlinqs.com/technique/T1098.005), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1102.001](https://intel.threadlinqs.com/technique/T1102.001), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1123](https://intel.threadlinqs.com/technique/T1123), [T1125](https://intel.threadlinqs.com/technique/T1125), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134.001](https://intel.threadlinqs.com/technique/T1134.001), T1134.004, [T1135](https://intel.threadlinqs.com/technique/T1135), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1136.002](https://intel.threadlinqs.com/technique/T1136.002), [T1136.003](https://intel.threadlinqs.com/technique/T1136.003), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1176](https://intel.threadlinqs.com/technique/T1176), [T1187](https://intel.threadlinqs.com/technique/T1187), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), [T1218](https://intel.threadlinqs.com/technique/T1218), [T1218.005](https://intel.threadlinqs.com/technique/T1218.005), [T1218.007](https://intel.threadlinqs.com/technique/T1218.007), [T1218.010](https://intel.threadlinqs.com/technique/T1218.010), [T1219](https://intel.threadlinqs.com/technique/T1219), T1222.001, [T1480](https://intel.threadlinqs.com/technique/T1480), [T1482](https://intel.threadlinqs.com/technique/T1482), [T1484.001](https://intel.threadlinqs.com/technique/T1484.001), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1491.001](https://intel.threadlinqs.com/technique/T1491.001), [T1491.002](https://intel.threadlinqs.com/technique/T1491.002), T1496.004, [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1498](https://intel.threadlinqs.com/technique/T1498), [T1498.001](https://intel.threadlinqs.com/technique/T1498.001), [T1499](https://intel.threadlinqs.com/technique/T1499), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505](https://intel.threadlinqs.com/technique/T1505), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1529](https://intel.threadlinqs.com/technique/T1529), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1531](https://intel.threadlinqs.com/technique/T1531), [T1537](https://intel.threadlinqs.com/technique/T1537), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1543.001](https://intel.threadlinqs.com/technique/T1543.001), [T1543.002](https://intel.threadlinqs.com/technique/T1543.002), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), [T1546.004](https://intel.threadlinqs.com/technique/T1546.004), [T1547](https://intel.threadlinqs.com/technique/T1547), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1548.002](https://intel.threadlinqs.com/technique/T1548.002), [T1548.003](https://intel.threadlinqs.com/technique/T1548.003), [T1550](https://intel.threadlinqs.com/technique/T1550), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.002](https://intel.threadlinqs.com/technique/T1550.002), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.002](https://intel.threadlinqs.com/technique/T1552.002), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1552.005](https://intel.threadlinqs.com/technique/T1552.005), [T1553.005](https://intel.threadlinqs.com/technique/T1553.005), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.001](https://intel.threadlinqs.com/technique/T1555.001), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1557.001](https://intel.threadlinqs.com/technique/T1557.001), [T1558.003](https://intel.threadlinqs.com/technique/T1558.003), [T1560](https://intel.threadlinqs.com/technique/T1560), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), [T1561](https://intel.threadlinqs.com/technique/T1561), T1562.001, [T1564](https://intel.threadlinqs.com/technique/T1564), [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), [T1564.003](https://intel.threadlinqs.com/technique/T1564.003), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1566.004](https://intel.threadlinqs.com/technique/T1566.004), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.001](https://intel.threadlinqs.com/technique/T1567.001), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1567.004](https://intel.threadlinqs.com/technique/T1567.004), [T1569.002](https://intel.threadlinqs.com/technique/T1569.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), T1574.002, [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1583.008](https://intel.threadlinqs.com/technique/T1583.008), [T1584.004](https://intel.threadlinqs.com/technique/T1584.004), [T1584.005](https://intel.threadlinqs.com/technique/T1584.005), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1585.002](https://intel.threadlinqs.com/technique/T1585.002), [T1586](https://intel.threadlinqs.com/technique/T1586), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1589](https://intel.threadlinqs.com/technique/T1589), [T1589.001](https://intel.threadlinqs.com/technique/T1589.001), [T1592.002](https://intel.threadlinqs.com/technique/T1592.002), [T1593](https://intel.threadlinqs.com/technique/T1593), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.001](https://intel.threadlinqs.com/technique/T1595.001), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1598](https://intel.threadlinqs.com/technique/T1598), [T1598.003](https://intel.threadlinqs.com/technique/T1598.003), [T1606](https://intel.threadlinqs.com/technique/T1606), [T1606.001](https://intel.threadlinqs.com/technique/T1606.001), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1614.001](https://intel.threadlinqs.com/technique/T1614.001), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1649](https://intel.threadlinqs.com/technique/T1649), T1656, [T1657](https://intel.threadlinqs.com/technique/T1657), [T1665](https://intel.threadlinqs.com/technique/T1665), [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.005](https://intel.threadlinqs.com/technique/T1685.005)

## Threat actors

[Siriusim](https://intel.threadlinqs.com/actor/Siriusim), [NoName057(16)](https://intel.threadlinqs.com/actor/NoName057(16)), Classiscam-linked fraudsters, [Doppelgänger network](https://intel.threadlinqs.com/actor/Doppelg%C3%A4nger%20network), [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP), [The Gentlemen](https://intel.threadlinqs.com/actor/The%20Gentlemen), [GlassWorm](https://intel.threadlinqs.com/actor/GlassWorm), [APT28](https://intel.threadlinqs.com/actor/APT28), [Payouts King](https://intel.threadlinqs.com/actor/Payouts%20King), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group), [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom), [Safepay](https://intel.threadlinqs.com/actor/Safepay), Qilin / Agenda RaaS affiliates / Settra / Inc (Tarnished Scorpius)

Nation-state attribution: Russia / Iran, Russia, North Korea

Threat categories: MALWARE, DATA_BREACH, PHISHING, RANSOMWARE, THREAT_INTEL, ICS_SCADA, SUPPLY_CHAIN, VULNERABILITY, APT, CLOUD

## Severity breakdown

- critical: 12
- high: 19
- medium: 11
- low: 1

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 1265 (network 427, file 358, behavioral 178, entity 85, tool 69, infrastructure 64, malware 49, package 34, technique 1)
- New detection rules: 387 (100% of the day’s threats covered)

## More editions

- Previous: [2026-10-19](https://intel.threadlinqs.com/debrief/2026-10-19)
- Next: [2026-10-21](https://intel.threadlinqs.com/debrief/2026-10-21)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-10-20