Summary & highlights
Response-Themed Email Thread Hijacking Delivers GoTo RAT, ConnectWise RAT and Credential Phishing. Operation Serengeti III: Interpol-coordinated takedown of 10,909 malicious networks across Africa. Double-Claimed Ransomware Victims: Same Victim Listed Under Two Groups on Leak Sites (2026 Trend).
Highlights
- TL-2026-4115 — Rapid7 Q3 2026 Threat Update: Attackers Exploiting Vulnerabilities Within 3 Days of Disclosure
- TL-2026-4121 — INC Ransomware: Evolution into a Top-Tier RaaS Operation (Rust Windows/ESXi payloads, edge-device exploitation CVE-2023-3519/CVE-2023-48788/CVE-2024-57727/CVE-2025-5777, modified Veeam credential dumper)
- TL-2026-4123 — Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco IOS XR routers, TACACS+ servers and Linux management hosts with BridgeAgent and TacTap
- TL-2026-4127 — UAC-0099 and Sandworm joint intrusion and data-wiping attack on Ukrainian grain logistics company (MATCHBOIL, MATCHWOK, MythicRatatoskr over Yggdrasil)
- TL-2026-4134 — Hirudo Android Banking RAT Replaces Legitimate Banking Apps via Fake In-App Updates
Theme of the day
Ransomware dominated, with SafePay, INC, and Akira surges, plus novel persistence and network-edge intrusions. Credential-harvesting and phishing tags underscored financially motivated campaigns across Linux and supply-chain targets.
- no-known-exploitation
- phishing
- social-engineering
- credential-theft
- linux
Threats published
43 threat lines in the 2026-10-22 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.
- Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep Microphone Audio Active After Call Hang-UpCRITICAL
- APT41 BlackX UEFI bootkit (BlackLotus-derived) targets Central Asian diplomatic organizations via CVE-2022-21894 (Baton Drop)CRITICAL
- Splunk Enterprise / Splunk SOAR and SolarWinds Security Updates (CVE-2026-76299, CVE-2026-76302, CVE-2026-76531, CVE-2026-76407, CVE-2026-28328)CRITICAL
- CVE-2026-91403: Critical Oracle Java SE and GraalVM JSSE Flaw Enables Unauthenticated Remote Attacks (CVSS 9.1)CRITICAL
- Arista VeloCloud Orchestrator SQL Injection Zero-Day (CVE-2026-114625) Exploited in AttacksCRITICAL
- ThreatsDay Roundup: AI API Key Leaks (OpenCode Console), PingCAP Source Code Theft, Zeabur Breach, NVIDIA AIStore CVE-2026-65162, Signal CVE-2026-113380, Laravel CVE-2026-114509CRITICAL
- Two CVSS 9.0 Linux KSMBD RCE Flaws (ZDI-CAN-33774, ZDI-CAN-33549) Disclosed on Public Mailing Lists Before Kernel FixesCRITICAL
- Splunk Enterprise Patroni REST API Missing Authentication Leads to Unauthenticated OS Command Execution (CVE-2026-76268)CRITICAL
- Critical Cisco Expressway Flaw (CVE-2026-76466) Lets Unauthenticated Attackers Execute Commands as RootCRITICAL
- Unpatched Linux Kernel Flaws (KSMBD Pre-Auth RCE ZDI-CAN-33774 / ZDI-CAN-33549, skb_zerocopy LPE and others) Accidentally Disclosed on Public Mailing ListsCRITICAL
- Multiple Vulnerabilities Fixed in Cisco Snort 3 (NCSC-2026-0450; CVE-2026-20043, CVE-2026-76524 and 11 others)CRITICAL
- Atlassian October 2026 Security Bulletin: 176 Flaw Entries in Jira and Confluence (incl. CVE-2026-65637, CVE-2026-58062, CVE-2026-75595) and Actively Exploited CVE-2026-21589CRITICAL
- Rust Supply Chain Attack on arrayref: Malicious Crate Versions with DPRK-Linked Backdoor (update)CRITICAL
- Storm-0940 Uses ARTEX Agentic AI Framework in ConnectWise/SkyKick OAuth Supply-Chain Compromise of Microsoft 365 Tenants (update)CRITICAL
- Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0): Unauthenticated RCE via Onigmo Regex Integer Overflow Across GitLab 7.0-19.5 (update)CRITICAL
- Rapid7 Q3 2026 Threat Update: Attackers Exploiting Vulnerabilities Within 3 Days of DisclosureHIGH
- INC Ransomware: Evolution into a Top-Tier RaaS Operation (Rust Windows/ESXi payloads, edge-device exploitation CVE-2023-3519/CVE-2023-48788/CVE-2024-57727/CVE-2025-5777, modified Veeam credential dumper)HIGH
- Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco IOS XR routers, TACACS+ servers and Linux management hosts with BridgeAgent and TacTapHIGH
- UAC-0099 and Sandworm joint intrusion and data-wiping attack on Ukrainian grain logistics company (MATCHBOIL, MATCHWOK, MythicRatatoskr over Yggdrasil)HIGH
- Hirudo Android Banking RAT Replaces Legitimate Banking Apps via Fake In-App UpdatesHIGH
- Hirudo Android Banking RAT Replaces Legitimate Banking Apps With Patched Copies to Bypass Security ChecksHIGH
- M365 Token Spray and Replay Campaign Compromises Business Email Accounts (AiTM-harvested tokens replayed from 1337 Services GmbH infrastructure)HIGH
- FortiBleed: Global Credential Attacks on Fortinet FortiGate SSL VPN Gateways and Leaked Credential Database (NCSC Alert)HIGH
- SEO Poisoning Campaign Delivers New Armorsteal Infostealer via Fake Chocolatey and Microsoft Activation Scripts SitesHIGH
- JSCeal (WEEVILPROXY / MeadowLocust) infostealer: malvertising-delivered Node.js malware with obfuscated V8 bytecodeHIGH
- Proxyjacking campaign hijacks 143+ edge devices in 34 countries (D-Link, Ubiquiti, SAP) to resell bandwidth via Pawns.app, plus active exploitation of PAN-OS CVE-2026-0322HIGH
- Navigate360 / P3 Global Intel breach by Internet Yiff Machine exposes anonymous Crime Stoppers tips; Toronto Crime Stoppers suspends operationsHIGH
- Russian Hybrid Campaign Shifts Towards Ukraine's Military Enablers (Starlink Ground Station Sabotage in Poland, Bulgaria and Lithuania)HIGH
- Iranian 'Prince of Persia' (Infy) APT Hosts Tornado/Foudre/Tonnerre C2 on US Shared Hosting Behind CloudflareHIGH
- BREEZE COMET (formerly UNC5669) - Financially Motivated Actor Targeting Brazilian Payment Systems and Banking SoftwareHIGH
- Mirage Kitten (UNC1549) deploys new NodeRabbit and PollCat RATs against aviation and FinTech via fake-recruiter coding challengesHIGH
- CVE-2026-111943: Go Blocks Compromised eMudhra CA Keys After Certificate Authority Incident (update)HIGH
- Node.js October 2026 Security Releases Fix 10 Vulnerabilities Including Brotli Decoder RCE and TLS Hostname Verification Bypasses (CVE-2026-111497, CVE-2026-105483, CVE-2026-106069, CVE-2026-105482) (update)HIGH
- Response-Themed Email Thread Hijacking Delivers GoTo RAT, ConnectWise RAT and Credential PhishingMEDIUM
- Operation Serengeti III: Interpol-coordinated takedown of 10,909 malicious networks across AfricaMEDIUM
- Double-Claimed Ransomware Victims: Same Victim Listed Under Two Groups on Leak Sites (2026 Trend)MEDIUM
- Phishing campaigns abuse 25+ legitimate platforms (Staples, Dell, WeTransfer) to deliver emails passing DKIM/DMARCMEDIUM
- Simulating legitimate Active Directory services (SMB/LDAP) on the network: GPO exploitation research (Synacktiv)MEDIUM
- Operation Serengeti III: INTERPOL-coordinated Africa-wide cybercrime crackdown (1,462 arrests, $105M recovered)MEDIUM
- CVE-2026-16477: Deserialization of Untrusted Data (CWE-502) in MTW CleanShot X (macOS) leading to code execution via malicious .cleanshot fileMEDIUM
- Password Spraying Campaign Targets AWS Root User Accounts Across 150+ OrganizationsMEDIUM
- CERT-FR: Web application data breaches in 2025 - low-complexity attacks without technical vulnerability exploitation (CERTFR-2026-CTI-008)MEDIUM
- Booking.com Impersonation Phishing and Partner-Account Fraud Campaigns (Vidar, ClickFix/Storm-1865, TONResolver) Prompt EU Digital Services Act InvestigationMEDIUM
Techniques observed
225 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.
- T1001
- T1003.001
- T1003.003
- T1005
- T1014
- T1018
- T1021.001
- T1021.002
- T1021.004
- T1021.005
- T1027
- T1027.013
- T1036
- T1036.005
- T1039
- T1040
- T1041
- T1046
- T1047
- T1048.003
- T1053
- T1053.003
- T1053.005
- T1056
- T1056.001
- T1056.004
- T1057
- T1059
- T1059.001
- T1059.003
- T1059.004
- T1059.005
- T1059.007
- T1068
- T1069.003
- T1070.003
- T1070.004
- T1070.006
- T1071
- T1071.001
- T1071.004
- T1074.001
- T1078
- T1078.001
- T1078.002
- T1078.004
- T1082
- T1083
- T1087.002
- T1087.004
- T1090
- T1090.001
- T1090.002
- T1090.003
- T1098.001
- T1098.003
- T1098.004
- T1098.005
- T1102.002
- T1105
- T1110
- T1110.001
- T1110.002
- T1110.003
- T1110.004
- T1111
- T1112
- T1113
- T1114.001
- T1114.002
- T1119
- T1123
- T1125
- T1132.001
- T1133
- T1136
- T1136.001
- T1136.003
- T1140
- T1176.002
- T1185
- T1187
- T1190
- T1195
- T1195.001
- T1195.002
- T1199
- T1203
- T1204
- T1204.001
- T1204.002
- T1204.004
- T1205
- T1210
- T1211
- T1212
- T1213
- T1213.003
- T1218.005
- T1218.011
- T1219
- T1219.002
- T1407
- T1417.001
- T1417.002
- T1418
- T1426
- T1429
- T1437
- T1437.001
- T1453
- T1484.001
- T1485
- T1489
- T1490
- T1491.001
- T1491.002
- T1496
- T1497
- T1497.001
- T1499
- T1499.004
- T1505.003
- T1512
- T1513
- T1517
- T1518
- T1518.001
- T1528
- T1529
- T1534
- T1539
- T1542.003
- T1543.001
- T1543.002
- T1543.003
- T1544
- T1547.001
- T1547.009
- T1548
- T1550.001
- T1550.004
- T1552
- T1552.001
- T1552.004
- T1553
- T1553.002
- T1553.004
- T1555
- T1555.003
- T1555.006
- T1556
- T1556.006
- T1557
- T1560.001
- T1564.003
- T1564.008
- T1565
- T1565.001
- T1565.002
- T1566
- T1566.001
- T1566.002
- T1566.003
- T1566.004
- T1567
- T1567.002
- T1567.003
- T1568
- T1568.002
- T1569.002
- T1570
- T1571
- T1572
- T1573
- T1573.001
- T1573.002
- T1574.001
- T1575
- T1580
- T1583
- T1583.001
- T1583.003
- T1583.006
- T1583.008
- T1585
- T1585.001
- T1585.003
- T1586.002
- T1587.003
- T1588.002
- T1588.005
- T1588.006
- T1588.007
- T1589.001
- T1589.002
- T1591
- T1593
- T1594
- T1595
- T1595.002
- T1599
- T1601.001
- T1602.002
- T1606
- T1608
- T1611
- T1625
- T1629
- T1629.003
- T1632.001
- T1636.004
- T1646
- T1649
- T1650
- T1655.001
- T1656
- T1657
- T1660
- T1667
- T1678
- T1684.001
- T1685
- T1685.005
- T1685.006
Threat actors
12 named threat actors across the reports.
- Storm-1865
- INC Ransom
- Mustang Panda - G0129
- UAC-0099
- Internet Yiff Machine
- Russian state intelligence services
- Infy
- BREEZE COMET
- Mirage Kitten
- APT41
- APT38
- Storm-0940
Nation-state attribution
- China
- Russia
- Iran
- North Korea (DPRK)
Threat categories
- PHISHING
- THREAT_INTEL
- RANSOMWARE
- VULNERABILITY
- CLOUD
- DATA_BREACH
- APT
- MALWARE
- SUPPLY_CHAIN
Severity breakdown
- critical15
- high18
- medium10
- low0
Indicator & detection coverage
Counts only: the indicator values and detection rule text behind them are tiered.
916 indicators of compromise · Red and above. Compare plans
- network 273
- file 262
- entity 103
- behavioral 76
- package 75
- infrastructure 57
- malware 38
- tool 31
- technique 1
387 new detection rules (100% of the day’s threats covered) · Blue and above. Compare plans