Threadlinqs IntelligenceStart free

Daily debrief · Wednesday2026-10-21

Daily Intelligence Briefing — Wednesday, October 21, 2026

7 critical22 high8 medium1 low

On 2026-10-21, Threadlinqs published 31 new threat reports and updated 7, 7 rated critical and 22 high, spanning 273 MITRE ATT&CK techniques and 17 named threat actors. Coverage that day added 342 new detection rules and 1096 extracted indicators.

New threats
317 updated
Critical / high
297 critical · 22 high
ATT&CK techniques
273Observed in the day’s reports
Threat actors
17Named in the reports
Indicators
1096Count only · values are Red+
Detection rules
342New that day · rule text is Blue+

Edition date: · Last updated:

Summary & highlights

Tibbar (Bad Rabbit) ransomware alerts triggered by inbound SMTP (TCP/25) SYN connection attempts from 185.149.120.3 on internet-exposed servers. Python .pth Startup Files Abused for Persistence (UPSTYLE backdoor in GlobalProtect CVE-2024-3400 exploitation). New Rust-Based Infostealer Distributed via Cracked Software Evades Analysis and Sandboxes (AhnLab ASEC).

Highlights

  • TL-2026-4017 — Lynx Ransomware Intrusion via Valid RDP Credentials - Backup Deletion and Exfiltration via temp.sh
  • TL-2026-4022 — NSO Group Pegasus Spyware Zero-Click Attack on University of Belgrade Rector Vladan Đokić Ahead of Serbian Snap Elections
  • TL-2026-4023 — k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign Targeting FortiGate, FortiWeb and GlobalProtect (CVE-2025-64446, CVE-2026-0257)
  • TL-2026-4025 — GoldFactory Android/iOS banking trojan campaign impersonating tax officers across Indonesia, Thailand and Vietnam
  • TL-2026-4028 — WhiteArmor: New Data-Theft Extortion Group Claiming JWT Authentication Bypass Exploitation and Developing Ransomware

Theme of the day

Exploited Fortinet edge devices and Apache ActiveMQ are top targets, fueling LockBit and SafePay ransomware operations, while APT28 hijacks routers for credential theft and lateral movement.

  • credential-theft
  • ransomware
  • linux
  • windows
  • credential-harvesting

Threats published

38 threat lines in the 2026-10-21 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.

Techniques observed

273 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.

Threat actors

17 named threat actors across the reports.

Nation-state attribution

  • CN
  • China
  • North Korea, Russia
  • Russia

Threat categories

  • RANSOMWARE
  • THREAT_INTEL
  • MALWARE
  • PHISHING
  • SUPPLY_CHAIN
  • VULNERABILITY
  • APT

Severity breakdown

  • critical7
  • high22
  • medium8
  • low1

Indicator & detection coverage

Counts only: the indicator values and detection rule text behind them are tiered.

1096 indicators of compromise · Red and above. Compare plans
  • file 409
  • network 288
  • behavioral 112
  • tool 71
  • malware 58
  • infrastructure 56
  • entity 55
  • package 27
  • technique 19
  • cve 1
342 new detection rules (100% of the day’s threats covered) · Blue and above. Compare plans