# Daily Intelligence Briefing — Thursday, October 22, 2026

> On 2026-10-22, Threadlinqs published 38 new threat reports and updated 5, 15 rated critical and 18 high, spanning 225 MITRE ATT&CK techniques and 12 named threat actors. Coverage that day added 387 new detection rules and 916 extracted indicators.

- **Edition:** 2026-10-22 (Thursday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-10-22
- **Last updated:** 2026-10-28
- **New threats:** 38 (5 updated)
- **Critical / high:** 15 critical, 18 high, 10 medium, 0 low
- **ATT&CK techniques:** 225
- **Threat actors:** 12
- **Indicators (count only):** 916
- **New detection rules (count only):** 387

## Summary & highlights

Response-Themed Email Thread Hijacking Delivers GoTo RAT, ConnectWise RAT and Credential Phishing. Operation Serengeti III: Interpol-coordinated takedown of 10,909 malicious networks across Africa. Double-Claimed Ransomware Victims: Same Victim Listed Under Two Groups on Leak Sites (2026 Trend).

- [TL-2026-4115](https://intel.threadlinqs.com/threat/TL-2026-4115) — Rapid7 Q3 2026 Threat Update: Attackers Exploiting Vulnerabilities Within 3 Days of Disclosure
- [TL-2026-4121](https://intel.threadlinqs.com/threat/TL-2026-4121) — INC Ransomware: Evolution into a Top-Tier RaaS Operation (Rust Windows/ESXi payloads, edge-device exploitation CVE-2023-3519/CVE-2023-48788/CVE-2024-57727/CVE-2025-5777, modified Veeam credential dumper)
- [TL-2026-4123](https://intel.threadlinqs.com/threat/TL-2026-4123) — Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco IOS XR routers, TACACS+ servers and Linux management hosts with BridgeAgent and TacTap
- [TL-2026-4127](https://intel.threadlinqs.com/threat/TL-2026-4127) — UAC-0099 and Sandworm joint intrusion and data-wiping attack on Ukrainian grain logistics company (MATCHBOIL, MATCHWOK, MythicRatatoskr over Yggdrasil)
- [TL-2026-4134](https://intel.threadlinqs.com/threat/TL-2026-4134) — Hirudo Android Banking RAT Replaces Legitimate Banking Apps via Fake In-App Updates

## Theme of the day

Ransomware dominated, with SafePay, INC, and Akira surges, plus novel persistence and network-edge intrusions. Credential-harvesting and phishing tags underscored financially motivated campaigns across Linux and supply-chain targets.

no-known-exploitation, phishing, social-engineering, credential-theft, linux

## Threats published

- [TL-2026-4117](https://intel.threadlinqs.com/threat/TL-2026-4117) — CRITICAL — Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep Microphone Audio Active After Call Hang-Up
- [TL-2026-4118](https://intel.threadlinqs.com/threat/TL-2026-4118) — CRITICAL — APT41 BlackX UEFI bootkit (BlackLotus-derived) targets Central Asian diplomatic organizations via CVE-2022-21894 (Baton Drop)
- [TL-2026-4136](https://intel.threadlinqs.com/threat/TL-2026-4136) — CRITICAL — Splunk Enterprise / Splunk SOAR and SolarWinds Security Updates (CVE-2026-76299, CVE-2026-76302, CVE-2026-76531, CVE-2026-76407, CVE-2026-28328)
- [TL-2026-4138](https://intel.threadlinqs.com/threat/TL-2026-4138) — CRITICAL — CVE-2026-91403: Critical Oracle Java SE and GraalVM JSSE Flaw Enables Unauthenticated Remote Attacks (CVSS 9.1)
- [TL-2026-4166](https://intel.threadlinqs.com/threat/TL-2026-4166) — CRITICAL — Arista VeloCloud Orchestrator SQL Injection Zero-Day (CVE-2026-114625) Exploited in Attacks
- [TL-2026-4172](https://intel.threadlinqs.com/threat/TL-2026-4172) — CRITICAL — ThreatsDay Roundup: AI API Key Leaks (OpenCode Console), PingCAP Source Code Theft, Zeabur Breach, NVIDIA AIStore CVE-2026-65162, Signal CVE-2026-113380, Laravel CVE-2026-114509
- [TL-2026-4179](https://intel.threadlinqs.com/threat/TL-2026-4179) — CRITICAL — Two CVSS 9.0 Linux KSMBD RCE Flaws (ZDI-CAN-33774, ZDI-CAN-33549) Disclosed on Public Mailing Lists Before Kernel Fixes
- [TL-2026-4182](https://intel.threadlinqs.com/threat/TL-2026-4182) — CRITICAL — Splunk Enterprise Patroni REST API Missing Authentication Leads to Unauthenticated OS Command Execution (CVE-2026-76268)
- [TL-2026-4205](https://intel.threadlinqs.com/threat/TL-2026-4205) — CRITICAL — Critical Cisco Expressway Flaw (CVE-2026-76466) Lets Unauthenticated Attackers Execute Commands as Root
- [TL-2026-4206](https://intel.threadlinqs.com/threat/TL-2026-4206) — CRITICAL — Unpatched Linux Kernel Flaws (KSMBD Pre-Auth RCE ZDI-CAN-33774 / ZDI-CAN-33549, skb_zerocopy LPE and others) Accidentally Disclosed on Public Mailing Lists
- [TL-2026-4210](https://intel.threadlinqs.com/threat/TL-2026-4210) — CRITICAL — Multiple Vulnerabilities Fixed in Cisco Snort 3 (NCSC-2026-0450; CVE-2026-20043, CVE-2026-76524 and 11 others)
- [TL-2026-4216](https://intel.threadlinqs.com/threat/TL-2026-4216) — CRITICAL — Atlassian October 2026 Security Bulletin: 176 Flaw Entries in Jira and Confluence (incl. CVE-2026-65637, CVE-2026-58062, CVE-2026-75595) and Actively Exploited CVE-2026-21589
- [TL-2026-2086](https://intel.threadlinqs.com/threat/TL-2026-2086) — CRITICAL — Rust Supply Chain Attack on arrayref: Malicious Crate Versions with DPRK-Linked Backdoor (update)
- [TL-2026-4060](https://intel.threadlinqs.com/threat/TL-2026-4060) — CRITICAL — Storm-0940 Uses ARTEX Agentic AI Framework in ConnectWise/SkyKick OAuth Supply-Chain Compromise of Microsoft 365 Tenants (update)
- [TL-2026-4063](https://intel.threadlinqs.com/threat/TL-2026-4063) — CRITICAL — Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0): Unauthenticated RCE via Onigmo Regex Integer Overflow Across GitLab 7.0-19.5 (update)
- [TL-2026-4115](https://intel.threadlinqs.com/threat/TL-2026-4115) — HIGH — Rapid7 Q3 2026 Threat Update: Attackers Exploiting Vulnerabilities Within 3 Days of Disclosure
- [TL-2026-4121](https://intel.threadlinqs.com/threat/TL-2026-4121) — HIGH — INC Ransomware: Evolution into a Top-Tier RaaS Operation (Rust Windows/ESXi payloads, edge-device exploitation CVE-2023-3519/CVE-2023-48788/CVE-2024-57727/CVE-2025-5777, modified Veeam credential dumper)
- [TL-2026-4123](https://intel.threadlinqs.com/threat/TL-2026-4123) — HIGH — Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco IOS XR routers, TACACS+ servers and Linux management hosts with BridgeAgent and TacTap
- [TL-2026-4127](https://intel.threadlinqs.com/threat/TL-2026-4127) — HIGH — UAC-0099 and Sandworm joint intrusion and data-wiping attack on Ukrainian grain logistics company (MATCHBOIL, MATCHWOK, MythicRatatoskr over Yggdrasil)
- [TL-2026-4134](https://intel.threadlinqs.com/threat/TL-2026-4134) — HIGH — Hirudo Android Banking RAT Replaces Legitimate Banking Apps via Fake In-App Updates
- [TL-2026-4140](https://intel.threadlinqs.com/threat/TL-2026-4140) — HIGH — Hirudo Android Banking RAT Replaces Legitimate Banking Apps With Patched Copies to Bypass Security Checks
- [TL-2026-4143](https://intel.threadlinqs.com/threat/TL-2026-4143) — HIGH — M365 Token Spray and Replay Campaign Compromises Business Email Accounts (AiTM-harvested tokens replayed from 1337 Services GmbH infrastructure)
- [TL-2026-4150](https://intel.threadlinqs.com/threat/TL-2026-4150) — HIGH — FortiBleed: Global Credential Attacks on Fortinet FortiGate SSL VPN Gateways and Leaked Credential Database (NCSC Alert)
- [TL-2026-4162](https://intel.threadlinqs.com/threat/TL-2026-4162) — HIGH — SEO Poisoning Campaign Delivers New Armorsteal Infostealer via Fake Chocolatey and Microsoft Activation Scripts Sites
- [TL-2026-4165](https://intel.threadlinqs.com/threat/TL-2026-4165) — HIGH — JSCeal (WEEVILPROXY / MeadowLocust) infostealer: malvertising-delivered Node.js malware with obfuscated V8 bytecode
- [TL-2026-4174](https://intel.threadlinqs.com/threat/TL-2026-4174) — HIGH — Proxyjacking campaign hijacks 143+ edge devices in 34 countries (D-Link, Ubiquiti, SAP) to resell bandwidth via Pawns.app, plus active exploitation of PAN-OS CVE-2026-0322
- [TL-2026-4183](https://intel.threadlinqs.com/threat/TL-2026-4183) — HIGH — Navigate360 / P3 Global Intel breach by Internet Yiff Machine exposes anonymous Crime Stoppers tips; Toronto Crime Stoppers suspends operations
- [TL-2026-4195](https://intel.threadlinqs.com/threat/TL-2026-4195) — HIGH — Russian Hybrid Campaign Shifts Towards Ukraine's Military Enablers (Starlink Ground Station Sabotage in Poland, Bulgaria and Lithuania)
- [TL-2026-4199](https://intel.threadlinqs.com/threat/TL-2026-4199) — HIGH — Iranian 'Prince of Persia' (Infy) APT Hosts Tornado/Foudre/Tonnerre C2 on US Shared Hosting Behind Cloudflare
- [TL-2026-4200](https://intel.threadlinqs.com/threat/TL-2026-4200) — HIGH — BREEZE COMET (formerly UNC5669) - Financially Motivated Actor Targeting Brazilian Payment Systems and Banking Software
- [TL-2026-4201](https://intel.threadlinqs.com/threat/TL-2026-4201) — HIGH — Mirage Kitten (UNC1549) deploys new NodeRabbit and PollCat RATs against aviation and FinTech via fake-recruiter coding challenges
- [TL-2026-4034](https://intel.threadlinqs.com/threat/TL-2026-4034) — HIGH — CVE-2026-111943: Go Blocks Compromised eMudhra CA Keys After Certificate Authority Incident (update)
- [TL-2026-4075](https://intel.threadlinqs.com/threat/TL-2026-4075) — HIGH — Node.js October 2026 Security Releases Fix 10 Vulnerabilities Including Brotli Decoder RCE and TLS Hostname Verification Bypasses (CVE-2026-111497, CVE-2026-105483, CVE-2026-106069, CVE-2026-105482) (update)
- [TL-2026-4107](https://intel.threadlinqs.com/threat/TL-2026-4107) — MEDIUM — Response-Themed Email Thread Hijacking Delivers GoTo RAT, ConnectWise RAT and Credential Phishing
- [TL-2026-4125](https://intel.threadlinqs.com/threat/TL-2026-4125) — MEDIUM — Operation Serengeti III: Interpol-coordinated takedown of 10,909 malicious networks across Africa
- [TL-2026-4130](https://intel.threadlinqs.com/threat/TL-2026-4130) — MEDIUM — Double-Claimed Ransomware Victims: Same Victim Listed Under Two Groups on Leak Sites (2026 Trend)
- [TL-2026-4137](https://intel.threadlinqs.com/threat/TL-2026-4137) — MEDIUM — Phishing campaigns abuse 25+ legitimate platforms (Staples, Dell, WeTransfer) to deliver emails passing DKIM/DMARC
- [TL-2026-4142](https://intel.threadlinqs.com/threat/TL-2026-4142) — MEDIUM — Simulating legitimate Active Directory services (SMB/LDAP) on the network: GPO exploitation research (Synacktiv)
- [TL-2026-4148](https://intel.threadlinqs.com/threat/TL-2026-4148) — MEDIUM — Operation Serengeti III: INTERPOL-coordinated Africa-wide cybercrime crackdown (1,462 arrests, $105M recovered)
- [TL-2026-4153](https://intel.threadlinqs.com/threat/TL-2026-4153) — MEDIUM — CVE-2026-16477: Deserialization of Untrusted Data (CWE-502) in MTW CleanShot X (macOS) leading to code execution via malicious .cleanshot file
- [TL-2026-4181](https://intel.threadlinqs.com/threat/TL-2026-4181) — MEDIUM — Password Spraying Campaign Targets AWS Root User Accounts Across 150+ Organizations
- [TL-2026-4191](https://intel.threadlinqs.com/threat/TL-2026-4191) — MEDIUM — CERT-FR: Web application data breaches in 2025 - low-complexity attacks without technical vulnerability exploitation (CERTFR-2026-CTI-008)
- [TL-2026-4197](https://intel.threadlinqs.com/threat/TL-2026-4197) — MEDIUM — Booking.com Impersonation Phishing and Partner-Account Fraud Campaigns (Vidar, ClickFix/Storm-1865, TONResolver) Prompt EU Digital Services Act Investigation

## Techniques observed

[T1001](https://intel.threadlinqs.com/technique/T1001), [T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1003.003](https://intel.threadlinqs.com/technique/T1003.003), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1014](https://intel.threadlinqs.com/technique/T1014), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1021.004](https://intel.threadlinqs.com/technique/T1021.004), [T1021.005](https://intel.threadlinqs.com/technique/T1021.005), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1039](https://intel.threadlinqs.com/technique/T1039), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1048.003](https://intel.threadlinqs.com/technique/T1048.003), [T1053](https://intel.threadlinqs.com/technique/T1053), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1056](https://intel.threadlinqs.com/technique/T1056), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.004](https://intel.threadlinqs.com/technique/T1056.004), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069.003](https://intel.threadlinqs.com/technique/T1069.003), [T1070.003](https://intel.threadlinqs.com/technique/T1070.003), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1071.004](https://intel.threadlinqs.com/technique/T1071.004), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1078.002](https://intel.threadlinqs.com/technique/T1078.002), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1087.004](https://intel.threadlinqs.com/technique/T1087.004), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.001](https://intel.threadlinqs.com/technique/T1090.001), [T1090.002](https://intel.threadlinqs.com/technique/T1090.002), [T1090.003](https://intel.threadlinqs.com/technique/T1090.003), [T1098.001](https://intel.threadlinqs.com/technique/T1098.001), [T1098.003](https://intel.threadlinqs.com/technique/T1098.003), [T1098.004](https://intel.threadlinqs.com/technique/T1098.004), [T1098.005](https://intel.threadlinqs.com/technique/T1098.005), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.001](https://intel.threadlinqs.com/technique/T1110.001), [T1110.002](https://intel.threadlinqs.com/technique/T1110.002), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1110.004](https://intel.threadlinqs.com/technique/T1110.004), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114.001](https://intel.threadlinqs.com/technique/T1114.001), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1123](https://intel.threadlinqs.com/technique/T1123), [T1125](https://intel.threadlinqs.com/technique/T1125), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1136.003](https://intel.threadlinqs.com/technique/T1136.003), [T1140](https://intel.threadlinqs.com/technique/T1140), T1176.002, [T1185](https://intel.threadlinqs.com/technique/T1185), [T1187](https://intel.threadlinqs.com/technique/T1187), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1205](https://intel.threadlinqs.com/technique/T1205), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), [T1218.005](https://intel.threadlinqs.com/technique/T1218.005), [T1218.011](https://intel.threadlinqs.com/technique/T1218.011), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1219.002](https://intel.threadlinqs.com/technique/T1219.002), [T1407](https://intel.threadlinqs.com/technique/T1407), [T1417.001](https://intel.threadlinqs.com/technique/T1417.001), [T1417.002](https://intel.threadlinqs.com/technique/T1417.002), [T1418](https://intel.threadlinqs.com/technique/T1418), [T1426](https://intel.threadlinqs.com/technique/T1426), [T1429](https://intel.threadlinqs.com/technique/T1429), [T1437](https://intel.threadlinqs.com/technique/T1437), [T1437.001](https://intel.threadlinqs.com/technique/T1437.001), [T1453](https://intel.threadlinqs.com/technique/T1453), [T1484.001](https://intel.threadlinqs.com/technique/T1484.001), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1491.001](https://intel.threadlinqs.com/technique/T1491.001), [T1491.002](https://intel.threadlinqs.com/technique/T1491.002), [T1496](https://intel.threadlinqs.com/technique/T1496), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1499](https://intel.threadlinqs.com/technique/T1499), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1512](https://intel.threadlinqs.com/technique/T1512), [T1513](https://intel.threadlinqs.com/technique/T1513), [T1517](https://intel.threadlinqs.com/technique/T1517), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1529](https://intel.threadlinqs.com/technique/T1529), [T1534](https://intel.threadlinqs.com/technique/T1534), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1542.003](https://intel.threadlinqs.com/technique/T1542.003), [T1543.001](https://intel.threadlinqs.com/technique/T1543.001), [T1543.002](https://intel.threadlinqs.com/technique/T1543.002), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), [T1544](https://intel.threadlinqs.com/technique/T1544), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1547.009](https://intel.threadlinqs.com/technique/T1547.009), [T1548](https://intel.threadlinqs.com/technique/T1548), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1553](https://intel.threadlinqs.com/technique/T1553), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), T1553.004, [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1555.006](https://intel.threadlinqs.com/technique/T1555.006), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1556.006](https://intel.threadlinqs.com/technique/T1556.006), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), [T1564.003](https://intel.threadlinqs.com/technique/T1564.003), [T1564.008](https://intel.threadlinqs.com/technique/T1564.008), [T1565](https://intel.threadlinqs.com/technique/T1565), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1565.002](https://intel.threadlinqs.com/technique/T1565.002), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1566.004](https://intel.threadlinqs.com/technique/T1566.004), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), T1567.003, [T1568](https://intel.threadlinqs.com/technique/T1568), [T1568.002](https://intel.threadlinqs.com/technique/T1568.002), [T1569.002](https://intel.threadlinqs.com/technique/T1569.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), [T1575](https://intel.threadlinqs.com/technique/T1575), [T1580](https://intel.threadlinqs.com/technique/T1580), [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1583.008](https://intel.threadlinqs.com/technique/T1583.008), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1585.003](https://intel.threadlinqs.com/technique/T1585.003), [T1586.002](https://intel.threadlinqs.com/technique/T1586.002), [T1587.003](https://intel.threadlinqs.com/technique/T1587.003), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1589.001](https://intel.threadlinqs.com/technique/T1589.001), [T1589.002](https://intel.threadlinqs.com/technique/T1589.002), [T1591](https://intel.threadlinqs.com/technique/T1591), [T1593](https://intel.threadlinqs.com/technique/T1593), [T1594](https://intel.threadlinqs.com/technique/T1594), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1599](https://intel.threadlinqs.com/technique/T1599), [T1601.001](https://intel.threadlinqs.com/technique/T1601.001), [T1602.002](https://intel.threadlinqs.com/technique/T1602.002), [T1606](https://intel.threadlinqs.com/technique/T1606), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1611](https://intel.threadlinqs.com/technique/T1611), T1625, [T1629](https://intel.threadlinqs.com/technique/T1629), T1629.003, T1632.001, [T1636.004](https://intel.threadlinqs.com/technique/T1636.004), [T1646](https://intel.threadlinqs.com/technique/T1646), [T1649](https://intel.threadlinqs.com/technique/T1649), [T1650](https://intel.threadlinqs.com/technique/T1650), [T1655.001](https://intel.threadlinqs.com/technique/T1655.001), T1656, [T1657](https://intel.threadlinqs.com/technique/T1657), [T1660](https://intel.threadlinqs.com/technique/T1660), T1667, T1678, [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.005](https://intel.threadlinqs.com/technique/T1685.005), [T1685.006](https://intel.threadlinqs.com/technique/T1685.006)

## Threat actors

[Storm-1865](https://intel.threadlinqs.com/actor/Storm-1865), [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom), [Mustang Panda - G0129](https://intel.threadlinqs.com/actor/Mustang%20Panda%20-%20G0129), [UAC-0099](https://intel.threadlinqs.com/actor/UAC-0099), [Internet Yiff Machine](https://intel.threadlinqs.com/actor/Internet%20Yiff%20Machine), [Russian state intelligence services](https://intel.threadlinqs.com/actor/Russian%20state%20intelligence%20services), [Infy](https://intel.threadlinqs.com/actor/Infy), [BREEZE COMET](https://intel.threadlinqs.com/actor/BREEZE%20COMET), [Mirage Kitten](https://intel.threadlinqs.com/actor/Mirage%20Kitten), [APT41](https://intel.threadlinqs.com/actor/APT41), [APT38](https://intel.threadlinqs.com/actor/APT38), [Storm-0940](https://intel.threadlinqs.com/actor/Storm-0940)

Nation-state attribution: China, Russia, Iran, North Korea (DPRK)

Threat categories: PHISHING, THREAT_INTEL, RANSOMWARE, VULNERABILITY, CLOUD, DATA_BREACH, APT, MALWARE, SUPPLY_CHAIN

## Severity breakdown

- critical: 15
- high: 18
- medium: 10
- low: 0

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 916 (network 273, file 262, entity 103, behavioral 76, package 75, infrastructure 57, malware 38, tool 31, technique 1)
- New detection rules: 387 (100% of the day’s threats covered)

## More editions

- Previous: [2026-10-21](https://intel.threadlinqs.com/debrief/2026-10-21)
- Next: [2026-10-23](https://intel.threadlinqs.com/debrief/2026-10-23)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-10-22