# Daily Intelligence Briefing — Wednesday, October 21, 2026

> On 2026-10-21, Threadlinqs published 31 new threat reports and updated 7, 7 rated critical and 22 high, spanning 273 MITRE ATT&CK techniques and 17 named threat actors. Coverage that day added 342 new detection rules and 1096 extracted indicators.

- **Edition:** 2026-10-21 (Wednesday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-10-21
- **Last updated:** 2026-10-27
- **New threats:** 31 (7 updated)
- **Critical / high:** 7 critical, 22 high, 8 medium, 1 low
- **ATT&CK techniques:** 273
- **Threat actors:** 17
- **Indicators (count only):** 1096
- **New detection rules (count only):** 342

## Summary & highlights

Tibbar (Bad Rabbit) ransomware alerts triggered by inbound SMTP (TCP/25) SYN connection attempts from 185.149.120.3 on internet-exposed servers. Python .pth Startup Files Abused for Persistence (UPSTYLE backdoor in GlobalProtect CVE-2024-3400 exploitation). New Rust-Based Infostealer Distributed via Cracked Software Evades Analysis and Sandboxes (AhnLab ASEC).

- [TL-2026-4017](https://intel.threadlinqs.com/threat/TL-2026-4017) — Lynx Ransomware Intrusion via Valid RDP Credentials - Backup Deletion and Exfiltration via temp.sh
- [TL-2026-4022](https://intel.threadlinqs.com/threat/TL-2026-4022) — NSO Group Pegasus Spyware Zero-Click Attack on University of Belgrade Rector Vladan Đokić Ahead of Serbian Snap Elections
- [TL-2026-4023](https://intel.threadlinqs.com/threat/TL-2026-4023) — k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign Targeting FortiGate, FortiWeb and GlobalProtect (CVE-2025-64446, CVE-2026-0257)
- [TL-2026-4025](https://intel.threadlinqs.com/threat/TL-2026-4025) — GoldFactory Android/iOS banking trojan campaign impersonating tax officers across Indonesia, Thailand and Vietnam
- [TL-2026-4028](https://intel.threadlinqs.com/threat/TL-2026-4028) — WhiteArmor: New Data-Theft Extortion Group Claiming JWT Authentication Bypass Exploitation and Developing Ransomware

## Theme of the day

Exploited Fortinet edge devices and Apache ActiveMQ are top targets, fueling LockBit and SafePay ransomware operations, while APT28 hijacks routers for credential theft and lateral movement.

credential-theft, ransomware, linux, windows, credential-harvesting

## Threats published

- [TL-2026-4020](https://intel.threadlinqs.com/threat/TL-2026-4020) — CRITICAL — INC Ransomware Operators Use Claude AI and Phantom Framework; Exposed Data Shows 8,257 Messages and 46 Victim-Specific Encryptor Builds (CVE-2026-35616, CVE-2024-57727, CVE-2026-41940)
- [TL-2026-4042](https://intel.threadlinqs.com/threat/TL-2026-4042) — CRITICAL — LiteLLM Supply-Chain Compromise: Malicious v1.107.0 on PyPI and Container Registries Deploys 'privcollect' Credential Stealer and GitHub Dead-Drop Remote Code Loader
- [TL-2026-4060](https://intel.threadlinqs.com/threat/TL-2026-4060) — CRITICAL — Storm-0940 Uses ARTEX Agentic AI Framework in ConnectWise/SkyKick OAuth Supply-Chain Compromise of Microsoft 365 Tenants
- [TL-2026-4063](https://intel.threadlinqs.com/threat/TL-2026-4063) — CRITICAL — Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0): Unauthenticated RCE via Onigmo Regex Integer Overflow Across GitLab 7.0-19.5
- [TL-2026-4102](https://intel.threadlinqs.com/threat/TL-2026-4102) — CRITICAL — Google Chrome 156 Security Update Fixes 353 Flaws Including 6 Critical Memory-Corruption Vulnerabilities (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280, CVE-2026-113303, CVE-2026-113271)
- [TL-2026-3858](https://intel.threadlinqs.com/threat/TL-2026-3858) — CRITICAL — Plex Media Server Vulnerability Chain (Plex2Shell) Exploited in the Wild to Deploy XMRig Cryptominer - CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 (update)
- [TL-2026-3995](https://intel.threadlinqs.com/threat/TL-2026-3995) — CRITICAL — Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites Following TeamUpdraft Breach (update)
- [TL-2026-4017](https://intel.threadlinqs.com/threat/TL-2026-4017) — HIGH — Lynx Ransomware Intrusion via Valid RDP Credentials - Backup Deletion and Exfiltration via temp.sh
- [TL-2026-4022](https://intel.threadlinqs.com/threat/TL-2026-4022) — HIGH — NSO Group Pegasus Spyware Zero-Click Attack on University of Belgrade Rector Vladan Đokić Ahead of Serbian Snap Elections
- [TL-2026-4023](https://intel.threadlinqs.com/threat/TL-2026-4023) — HIGH — k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign Targeting FortiGate, FortiWeb and GlobalProtect (CVE-2025-64446, CVE-2026-0257)
- [TL-2026-4025](https://intel.threadlinqs.com/threat/TL-2026-4025) — HIGH — GoldFactory Android/iOS banking trojan campaign impersonating tax officers across Indonesia, Thailand and Vietnam
- [TL-2026-4028](https://intel.threadlinqs.com/threat/TL-2026-4028) — HIGH — WhiteArmor: New Data-Theft Extortion Group Claiming JWT Authentication Bypass Exploitation and Developing Ransomware
- [TL-2026-4029](https://intel.threadlinqs.com/threat/TL-2026-4029) — HIGH — Bitdefender Threat Debrief June 2026: Ransomware Landscape (Qilin, The Gentlemen, DragonForce, KryBit) and Actively Exploited SolarWinds Serv-U Flaw CVE-2026-28318
- [TL-2026-4030](https://intel.threadlinqs.com/threat/TL-2026-4030) — HIGH — Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attacks
- [TL-2026-4034](https://intel.threadlinqs.com/threat/TL-2026-4034) — HIGH — CVE-2026-111943: Go Blocks Compromised eMudhra CA Keys After Certificate Authority Incident
- [TL-2026-4036](https://intel.threadlinqs.com/threat/TL-2026-4036) — HIGH — BRONZE SANDCASTLE Intrusions: Active Directory Database (ntds.dit) Theft via DLL Sideloading and Modified Meterpreter
- [TL-2026-4041](https://intel.threadlinqs.com/threat/TL-2026-4041) — HIGH — NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
- [TL-2026-4043](https://intel.threadlinqs.com/threat/TL-2026-4043) — HIGH — Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate
- [TL-2026-4051](https://intel.threadlinqs.com/threat/TL-2026-4051) — HIGH — Akira Ransomware Attack Collapses 158-Year-Old UK Logistics Firm KNP (Knights of Old) After Guessed Employee Password
- [TL-2026-4058](https://intel.threadlinqs.com/threat/TL-2026-4058) — HIGH — AI-Assisted Attackers Chain Web App Flaws (SQLi to xp_cmdshell, File-Upload Web Shells) for Rapid Intrusions Using Cairn, CyberStrikeAI and CupcakeC2
- [TL-2026-4065](https://intel.threadlinqs.com/threat/TL-2026-4065) — HIGH — Onamae Desktop Cloud (GMO Internet, Japan) infrastructure compromised; malware installed on up to 26,739 customer servers
- [TL-2026-4075](https://intel.threadlinqs.com/threat/TL-2026-4075) — HIGH — Node.js October 2026 Security Releases Fix 10 Vulnerabilities Including Brotli Decoder RCE and TLS Hostname Verification Bypasses (CVE-2026-111497, CVE-2026-105483, CVE-2026-106069, CVE-2026-105482)
- [TL-2026-4088](https://intel.threadlinqs.com/threat/TL-2026-4088) — HIGH — Athena StealthRoute PhaaS Platform Uses AI Studio to Craft Phishing Lures and Decoy Content
- [TL-2026-4101](https://intel.threadlinqs.com/threat/TL-2026-4101) — HIGH — 333 Tor Exit Nodes Hijacked to Intercept SSH Logins and Steal Credentials (Ebury 1.8.3)
- [TL-2026-0091](https://intel.threadlinqs.com/threat/TL-2026-0091) — HIGH — BYOVD EDR Killer Tooling — Ransomware Groups Weaponizing Signed Kernel Drivers to Blind Endpoint Detection (update)
- [TL-2026-0828](https://intel.threadlinqs.com/threat/TL-2026-0828) — HIGH — BlueKit Phishing-as-a-Service (PhaaS) Platform Enabling Large-Scale Credential Harvesting, AiTM MFA Bypass, and Account Takeover (update)
- [TL-2026-3832](https://intel.threadlinqs.com/threat/TL-2026-3832) — HIGH — Gentlemen Ransomware (Storm-2697): Double-Extortion RaaS with Fortinet Exploitation, BYOVD EDR Killers and GPO-Based Mass Deployment (update)
- [TL-2026-3947](https://intel.threadlinqs.com/threat/TL-2026-3947) — HIGH — OVHcloud CLI GitHub Releases Hijacked to Distribute Secret-Stealing Malware (v0.11.0-v0.15.0) (update)
- [TL-2026-3949](https://intel.threadlinqs.com/threat/TL-2026-3949) — HIGH — APT28 (Fancy Bear) Espionage Campaign Against European Defense Contractors Using Hookedge Backdoor (update)
- [TL-2026-4008](https://intel.threadlinqs.com/threat/TL-2026-4008) — MEDIUM — Tibbar (Bad Rabbit) ransomware alerts triggered by inbound SMTP (TCP/25) SYN connection attempts from 185.149.120.3 on internet-exposed servers
- [TL-2026-4011](https://intel.threadlinqs.com/threat/TL-2026-4011) — MEDIUM — Python .pth Startup Files Abused for Persistence (UPSTYLE backdoor in GlobalProtect CVE-2024-3400 exploitation)
- [TL-2026-4026](https://intel.threadlinqs.com/threat/TL-2026-4026) — MEDIUM — New Rust-Based Infostealer Distributed via Cracked Software Evades Analysis and Sandboxes (AhnLab ASEC)
- [TL-2026-4027](https://intel.threadlinqs.com/threat/TL-2026-4027) — MEDIUM — Retirement Pension-Themed Phishing Campaign Using HTML Attachments and Web3Forms Credential Exfiltration
- [TL-2026-4047](https://intel.threadlinqs.com/threat/TL-2026-4047) — MEDIUM — AI-Generated Phishing and Deepfake Impersonation Campaigns: Fluent, Personalized Lures at Scale
- [TL-2026-4072](https://intel.threadlinqs.com/threat/TL-2026-4072) — MEDIUM — Fake AI Tool Campaigns Targeting Enterprises (ChatGPT, Claude, Copilot, Gemini, GitHub Copilot CLI lures)
- [TL-2026-4090](https://intel.threadlinqs.com/threat/TL-2026-4090) — MEDIUM — Credential Layer Exposure: Secrets Sprawl and Shai-Hulud npm Supply Chain Credential Harvesting (GitGuardian)
- [TL-2026-4098](https://intel.threadlinqs.com/threat/TL-2026-4098) — MEDIUM — BUGSTER: Low-Skill Financially Motivated Actor Uses AI Agents (Hermes Agent/DeepSeek V4, Cursor IDE) to Plan and Execute Multiple Cybercrime Operations
- [TL-2026-4012](https://intel.threadlinqs.com/threat/TL-2026-4012) — LOW — Kaspersky ICS CERT: Threat landscape for industrial automation systems, Q2 2026

## Techniques observed

AML.T0010.001, [AML.T0051](https://intel.threadlinqs.com/technique/AML.T0051), [AML.T0054](https://intel.threadlinqs.com/technique/AML.T0054), AML.T0055, [T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1003.002](https://intel.threadlinqs.com/technique/T1003.002), [T1003.003](https://intel.threadlinqs.com/technique/T1003.003), [T1003.004](https://intel.threadlinqs.com/technique/T1003.004), [T1003.006](https://intel.threadlinqs.com/technique/T1003.006), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1012](https://intel.threadlinqs.com/technique/T1012), [T1014](https://intel.threadlinqs.com/technique/T1014), [T1016](https://intel.threadlinqs.com/technique/T1016), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1020](https://intel.threadlinqs.com/technique/T1020), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1021.004](https://intel.threadlinqs.com/technique/T1021.004), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.002](https://intel.threadlinqs.com/technique/T1027.002), [T1027.004](https://intel.threadlinqs.com/technique/T1027.004), [T1027.006](https://intel.threadlinqs.com/technique/T1027.006), [T1027.010](https://intel.threadlinqs.com/technique/T1027.010), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.003](https://intel.threadlinqs.com/technique/T1036.003), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1036.007](https://intel.threadlinqs.com/technique/T1036.007), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1048](https://intel.threadlinqs.com/technique/T1048), [T1048.003](https://intel.threadlinqs.com/technique/T1048.003), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055.001](https://intel.threadlinqs.com/technique/T1055.001), [T1056](https://intel.threadlinqs.com/technique/T1056), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.002](https://intel.threadlinqs.com/technique/T1056.002), [T1056.003](https://intel.threadlinqs.com/technique/T1056.003), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1059.010](https://intel.threadlinqs.com/technique/T1059.010), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069](https://intel.threadlinqs.com/technique/T1069), [T1069.003](https://intel.threadlinqs.com/technique/T1069.003), [T1070](https://intel.threadlinqs.com/technique/T1070), [T1070.003](https://intel.threadlinqs.com/technique/T1070.003), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.002](https://intel.threadlinqs.com/technique/T1078.002), [T1078.003](https://intel.threadlinqs.com/technique/T1078.003), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1087.001](https://intel.threadlinqs.com/technique/T1087.001), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1087.004](https://intel.threadlinqs.com/technique/T1087.004), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.002](https://intel.threadlinqs.com/technique/T1090.002), [T1090.003](https://intel.threadlinqs.com/technique/T1090.003), [T1091](https://intel.threadlinqs.com/technique/T1091), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1098.001](https://intel.threadlinqs.com/technique/T1098.001), T1098.002, [T1098.003](https://intel.threadlinqs.com/technique/T1098.003), [T1098.005](https://intel.threadlinqs.com/technique/T1098.005), T1098.007, [T1102](https://intel.threadlinqs.com/technique/T1102), [T1102.001](https://intel.threadlinqs.com/technique/T1102.001), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.001](https://intel.threadlinqs.com/technique/T1110.001), [T1110.002](https://intel.threadlinqs.com/technique/T1110.002), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1129](https://intel.threadlinqs.com/technique/T1129), [T1132](https://intel.threadlinqs.com/technique/T1132), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134.001](https://intel.threadlinqs.com/technique/T1134.001), [T1135](https://intel.threadlinqs.com/technique/T1135), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1136.002](https://intel.threadlinqs.com/technique/T1136.002), [T1136.003](https://intel.threadlinqs.com/technique/T1136.003), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1176](https://intel.threadlinqs.com/technique/T1176), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1187](https://intel.threadlinqs.com/technique/T1187), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), T1204.005, [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), T1213.006, [T1217](https://intel.threadlinqs.com/technique/T1217), [T1218.005](https://intel.threadlinqs.com/technique/T1218.005), [T1219](https://intel.threadlinqs.com/technique/T1219), T1221, T1222.001, [T1406.002](https://intel.threadlinqs.com/technique/T1406.002), [T1417.001](https://intel.threadlinqs.com/technique/T1417.001), [T1417.002](https://intel.threadlinqs.com/technique/T1417.002), [T1426](https://intel.threadlinqs.com/technique/T1426), [T1429](https://intel.threadlinqs.com/technique/T1429), [T1437.001](https://intel.threadlinqs.com/technique/T1437.001), [T1480](https://intel.threadlinqs.com/technique/T1480), T1480.002, [T1481](https://intel.threadlinqs.com/technique/T1481), [T1484.001](https://intel.threadlinqs.com/technique/T1484.001), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1491.001](https://intel.threadlinqs.com/technique/T1491.001), [T1496](https://intel.threadlinqs.com/technique/T1496), [T1496.001](https://intel.threadlinqs.com/technique/T1496.001), T1496.002, T1496.004, [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505](https://intel.threadlinqs.com/technique/T1505), T1505.001, [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1512](https://intel.threadlinqs.com/technique/T1512), [T1513](https://intel.threadlinqs.com/technique/T1513), [T1516](https://intel.threadlinqs.com/technique/T1516), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1534](https://intel.threadlinqs.com/technique/T1534), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1542.003](https://intel.threadlinqs.com/technique/T1542.003), [T1543.001](https://intel.threadlinqs.com/technique/T1543.001), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), T1546.018, [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1547.006](https://intel.threadlinqs.com/technique/T1547.006), [T1550](https://intel.threadlinqs.com/technique/T1550), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.002](https://intel.threadlinqs.com/technique/T1550.002), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.002](https://intel.threadlinqs.com/technique/T1552.002), [T1552.003](https://intel.threadlinqs.com/technique/T1552.003), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1552.005](https://intel.threadlinqs.com/technique/T1552.005), [T1552.007](https://intel.threadlinqs.com/technique/T1552.007), [T1553](https://intel.threadlinqs.com/technique/T1553), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), [T1554](https://intel.threadlinqs.com/technique/T1554), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1555.005](https://intel.threadlinqs.com/technique/T1555.005), [T1555.006](https://intel.threadlinqs.com/technique/T1555.006), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1558.003](https://intel.threadlinqs.com/technique/T1558.003), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), T1560.002, T1560.003, [T1561.001](https://intel.threadlinqs.com/technique/T1561.001), T1561.002, T1562, T1562.004, [T1564](https://intel.threadlinqs.com/technique/T1564), [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), [T1564.003](https://intel.threadlinqs.com/technique/T1564.003), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1566.004](https://intel.threadlinqs.com/technique/T1566.004), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1567.004](https://intel.threadlinqs.com/technique/T1567.004), [T1569.002](https://intel.threadlinqs.com/technique/T1569.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574](https://intel.threadlinqs.com/technique/T1574), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), T1574.002, [T1574.006](https://intel.threadlinqs.com/technique/T1574.006), [T1575](https://intel.threadlinqs.com/technique/T1575), [T1580](https://intel.threadlinqs.com/technique/T1580), [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1583.008](https://intel.threadlinqs.com/technique/T1583.008), [T1584](https://intel.threadlinqs.com/technique/T1584), [T1584.004](https://intel.threadlinqs.com/technique/T1584.004), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1586](https://intel.threadlinqs.com/technique/T1586), [T1586.002](https://intel.threadlinqs.com/technique/T1586.002), [T1587](https://intel.threadlinqs.com/technique/T1587), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.003](https://intel.threadlinqs.com/technique/T1587.003), [T1588](https://intel.threadlinqs.com/technique/T1588), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1589.002](https://intel.threadlinqs.com/technique/T1589.002), [T1589.003](https://intel.threadlinqs.com/technique/T1589.003), [T1590](https://intel.threadlinqs.com/technique/T1590), [T1591](https://intel.threadlinqs.com/technique/T1591), [T1591.004](https://intel.threadlinqs.com/technique/T1591.004), [T1593.001](https://intel.threadlinqs.com/technique/T1593.001), [T1594](https://intel.threadlinqs.com/technique/T1594), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1596.005](https://intel.threadlinqs.com/technique/T1596.005), [T1598.003](https://intel.threadlinqs.com/technique/T1598.003), T1604, [T1606](https://intel.threadlinqs.com/technique/T1606), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1608.005](https://intel.threadlinqs.com/technique/T1608.005), [T1608.006](https://intel.threadlinqs.com/technique/T1608.006), [T1614.001](https://intel.threadlinqs.com/technique/T1614.001), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1633.001](https://intel.threadlinqs.com/technique/T1633.001), [T1636](https://intel.threadlinqs.com/technique/T1636), [T1636.004](https://intel.threadlinqs.com/technique/T1636.004), [T1646](https://intel.threadlinqs.com/technique/T1646), [T1649](https://intel.threadlinqs.com/technique/T1649), [T1650](https://intel.threadlinqs.com/technique/T1650), [T1655.001](https://intel.threadlinqs.com/technique/T1655.001), T1656, [T1657](https://intel.threadlinqs.com/technique/T1657), [T1660](https://intel.threadlinqs.com/technique/T1660), [T1664](https://intel.threadlinqs.com/technique/T1664), [T1665](https://intel.threadlinqs.com/technique/T1665), [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.005](https://intel.threadlinqs.com/technique/T1685.005), [T1685.006](https://intel.threadlinqs.com/technique/T1685.006), [T1686](https://intel.threadlinqs.com/technique/T1686), [T1688](https://intel.threadlinqs.com/technique/T1688)

## Threat actors

[UTA0218](https://intel.threadlinqs.com/actor/UTA0218), [BUGSTER](https://intel.threadlinqs.com/actor/BUGSTER), [Lynx ransomware operators](https://intel.threadlinqs.com/actor/Lynx%20ransomware%20operators), k0t, [GoldFactory](https://intel.threadlinqs.com/actor/GoldFactory), [WhiteArmor](https://intel.threadlinqs.com/actor/WhiteArmor), [Qilin](https://intel.threadlinqs.com/actor/Qilin), [BRONZE SANDCASTLE](https://intel.threadlinqs.com/actor/BRONZE%20SANDCASTLE), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group), [The Gentlemen](https://intel.threadlinqs.com/actor/The%20Gentlemen), [Akira](https://intel.threadlinqs.com/actor/Akira), [INC Ransomware affiliates](https://intel.threadlinqs.com/actor/INC%20Ransomware%20affiliates), [Storm-0940](https://intel.threadlinqs.com/actor/Storm-0940), [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider), [BlueKit operators](https://intel.threadlinqs.com/actor/BlueKit%20operators), [GlassWorm](https://intel.threadlinqs.com/actor/GlassWorm), [APT28](https://intel.threadlinqs.com/actor/APT28)

Nation-state attribution: CN, China, North Korea, Russia, Russia

Threat categories: RANSOMWARE, THREAT_INTEL, MALWARE, PHISHING, SUPPLY_CHAIN, VULNERABILITY, APT

## Severity breakdown

- critical: 7
- high: 22
- medium: 8
- low: 1

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 1096 (file 409, network 288, behavioral 112, tool 71, malware 58, infrastructure 56, entity 55, package 27, technique 19, cve 1)
- New detection rules: 342 (100% of the day’s threats covered)

## More editions

- Previous: [2026-10-20](https://intel.threadlinqs.com/debrief/2026-10-20)
- Next: [2026-10-22](https://intel.threadlinqs.com/debrief/2026-10-22)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-10-21