============================================================================== CYBER THREAT INTELLIGENCE - INDICATORS OF COMPROMISE (IOC) LIST ============================================================================== Generated: 2026-09-09 12:15 UTC Report ID: IOC-20260909-121523 Total Indicators: 44 Classification: OPEN - Law Enforcement / DFIR use Sources: Article: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets, Article: Ivanti Patches Critical Flaws Across Enterprise Security Products, CISA KEV Catalog, OpenPhish SUMMARY ------------------------------------------------------------------------------ IP Address: 16 CISA KEV (Known Exploited Vulnerability): 10 Phishing URL: 9 Domain: 9 Severity: CRITICAL=28, HIGH=16 ============================================================================== [CISA KEV (KNOWN EXPLOITED VULNERABILITY)] - 10 indicator(s) ============================================================================== #1 CVE-2026-75650 Severity: CRITICAL Description: Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. Product: Commerce and Magento (Adobe) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-75650 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-08 Tags: kev,cisa,active-exploitation #2 CVE-2026-81963 Severity: CRITICAL Description: Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. Product: Windows (Microsoft) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-81963 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-08 Tags: kev,cisa,active-exploitation #3 CVE-2026-86218 Severity: CRITICAL Description: N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. Product: N-central (N-able) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86218 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-08 Tags: kev,cisa,active-exploitation #4 CVE-2026-85880 Severity: CRITICAL Description: Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. Product: Windows (Microsoft) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85880 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-08 Tags: kev,cisa,active-exploitation #5 CVE-2026-85046 Severity: CRITICAL Description: Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but Product: Chromium V8 (Google) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85046 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-04 Tags: kev,cisa,active-exploitation #6 CVE-2026-59822 Severity: CRITICAL Description: BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Product: LiteLLM (BerriAI) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59822 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-02 Tags: kev,cisa,active-exploitation #7 CVE-2026-48710 Severity: CRITICAL Description: Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the Product: Starlette (Kludex) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48710 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-02 Tags: kev,cisa,active-exploitation #8 CVE-2026-49869 Severity: CRITICAL Description: Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. Product: Kestra OSS (Kestra) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49869 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-02 Tags: kev,cisa,active-exploitation #9 CVE-2026-82329 Severity: CRITICAL Description: JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. Product: Artifactory (JFrog) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82329 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-02 Tags: kev,cisa,active-exploitation #10 CVE-2026-9586 Severity: CRITICAL Description: Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and rem Product: Switchvox (Sangoma) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9586 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-02 Tags: kev,cisa,active-exploitation ============================================================================== [IP ADDRESS] - 16 indicator(s) ============================================================================== #11 127.0.0.1 Severity: HIGH Description: C2/infrastructure in threat context: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wa Source: Article: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets URL: https://thehackernews.com/2026/09/alby-hub-critical-flaw-could-let.html Date: Tags: ip,infrastructure #12 127.0.0.1 Severity: HIGH Description: C2/infrastructure in threat context: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wa Source: Article: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets URL: https://thehackernews.com/2026/09/alby-hub-critical-flaw-could-let.html Date: Tags: ip,infrastructure #13 127.0.0.1 Severity: HIGH Description: C2/infrastructure in threat context: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wa Source: Article: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets URL: https://thehackernews.com/2026/09/alby-hub-critical-flaw-could-let.html Date: Tags: ip,infrastructure #14 127.0.0.1 Severity: HIGH Description: C2/infrastructure in threat context: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wa Source: Article: Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets URL: https://thehackernews.com/2026/09/alby-hub-critical-flaw-could-let.html Date: Tags: ip,infrastructure #15 12.10.0.0 Severity: HIGH Description: C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products Source: Article: Ivanti Patches Critical Flaws Across Enterprise Security Products URL: https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Date: Tags: ip,infrastructure #16 12.9.0.2 Severity: HIGH Description: C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products Source: Article: Ivanti Patches Critical Flaws Across Enterprise Security Products URL: https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Date: Tags: ip,infrastructure #17 12.8.0.4 Severity: HIGH Description: C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products Source: Article: Ivanti Patches Critical Flaws Across Enterprise Security Products URL: https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Date: Tags: ip,infrastructure #18 12.10.0.0 Severity: HIGH Description: C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products Source: Article: Ivanti Patches Critical Flaws Across Enterprise Security Products URL: https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Date: Tags: ip,infrastructure #19 12.9.0.2 Severity: HIGH Description: C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products Source: Article: Ivanti Patches Critical Flaws Across Enterprise Security Products URL: https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Date: Tags: ip,infrastructure #20 12.8.0.4 Severity: HIGH Description: C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products Source: Article: Ivanti Patches Critical Flaws Across Enterprise Security Products URL: https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Date: Tags: ip,infrastructure #21 12.10.0.0 Severity: HIGH Description: C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products Source: Article: Ivanti Patches Critical Flaws Across Enterprise Security Products URL: https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Date: Tags: ip,infrastructure #22 12.9.0.2 Severity: HIGH Description: C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products Source: Article: Ivanti Patches Critical Flaws Across Enterprise Security Products URL: https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Date: Tags: ip,infrastructure #23 12.8.0.4 Severity: HIGH Description: C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products Source: Article: Ivanti Patches Critical Flaws Across Enterprise Security Products URL: https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Date: Tags: ip,infrastructure #24 12.10.0.0 Severity: HIGH Description: C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products Source: Article: Ivanti Patches Critical Flaws Across Enterprise Security Products URL: https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Date: Tags: ip,infrastructure #25 12.9.0.2 Severity: HIGH Description: C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products Source: Article: Ivanti Patches Critical Flaws Across Enterprise Security Products URL: https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Date: Tags: ip,infrastructure #26 12.8.0.4 Severity: HIGH Description: C2/infrastructure in threat context: Ivanti Patches Critical Flaws Across Enterprise Security Products Source: Article: Ivanti Patches Critical Flaws Across Enterprise Security Products URL: https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Date: Tags: ip,infrastructure ============================================================================== [PHISHING URL] - 9 indicator(s) ============================================================================== #27 https://www.facebooklogin21.blogspot.com/ Severity: CRITICAL Description: Active phishing URL: https://www.facebooklogin21.blogspot.com/ Source: OpenPhish URL: https://www.facebooklogin21.blogspot.com/ Date: Tags: phishing,openphish #28 https://ledgrr-live-io-faq.pages.dev/ Severity: CRITICAL Description: Active phishing URL: https://ledgrr-live-io-faq.pages.dev/ Source: OpenPhish URL: https://ledgrr-live-io-faq.pages.dev/ Date: Tags: phishing,openphish #29 http://ledgrr--live.pages.dev/ Severity: CRITICAL Description: Active phishing URL: http://ledgrr--live.pages.dev/ Source: OpenPhish URL: http://ledgrr--live.pages.dev/ Date: Tags: phishing,openphish #30 http://ledgrr-livv-app.pages.dev/ Severity: CRITICAL Description: Active phishing URL: http://ledgrr-livv-app.pages.dev/ Source: OpenPhish URL: http://ledgrr-livv-app.pages.dev/ Date: Tags: phishing,openphish #31 https://ledgrr-iolive.pages.dev/ Severity: CRITICAL Description: Active phishing URL: https://ledgrr-iolive.pages.dev/ Source: OpenPhish URL: https://ledgrr-iolive.pages.dev/ Date: Tags: phishing,openphish #32 https://ledgrlive-app-guide.pages.dev/ Severity: CRITICAL Description: Active phishing URL: https://ledgrlive-app-guide.pages.dev/ Source: OpenPhish URL: https://ledgrlive-app-guide.pages.dev/ Date: Tags: phishing,openphish #33 http://ledgrr-live-run.pages.dev/ Severity: CRITICAL Description: Active phishing URL: http://ledgrr-live-run.pages.dev/ Source: OpenPhish URL: http://ledgrr-live-run.pages.dev/ Date: Tags: phishing,openphish #34 http://ledgr-livdesktp.pages.dev/ Severity: CRITICAL Description: Active phishing URL: http://ledgr-livdesktp.pages.dev/ Source: OpenPhish URL: http://ledgr-livdesktp.pages.dev/ Date: Tags: phishing,openphish #35 https://sso-uphold--en-cdn.webflow.io/ Severity: CRITICAL Description: Active phishing URL: https://sso-uphold--en-cdn.webflow.io/ Source: OpenPhish URL: https://sso-uphold--en-cdn.webflow.io/ Date: Tags: phishing,openphish ============================================================================== [DOMAIN] - 9 indicator(s) ============================================================================== #36 facebooklogin21.blogspot Severity: CRITICAL Description: Phishing domain: facebooklogin21.blogspot Source: OpenPhish URL: https://www.facebooklogin21.blogspot.com/ Date: Tags: phishing,openphish,domain #37 ledgrr-live-io-faq.pages Severity: CRITICAL Description: Phishing domain: ledgrr-live-io-faq.pages Source: OpenPhish URL: https://ledgrr-live-io-faq.pages.dev/ Date: Tags: phishing,openphish,domain #38 ledgrr--live.pages Severity: CRITICAL Description: Phishing domain: ledgrr--live.pages Source: OpenPhish URL: http://ledgrr--live.pages.dev/ Date: Tags: phishing,openphish,domain #39 ledgrr-livv-app.pages Severity: CRITICAL Description: Phishing domain: ledgrr-livv-app.pages Source: OpenPhish URL: http://ledgrr-livv-app.pages.dev/ Date: Tags: phishing,openphish,domain #40 ledgrr-iolive.pages Severity: CRITICAL Description: Phishing domain: ledgrr-iolive.pages Source: OpenPhish URL: https://ledgrr-iolive.pages.dev/ Date: Tags: phishing,openphish,domain #41 ledgrlive-app-guide.pages Severity: CRITICAL Description: Phishing domain: ledgrlive-app-guide.pages Source: OpenPhish URL: https://ledgrlive-app-guide.pages.dev/ Date: Tags: phishing,openphish,domain #42 ledgrr-live-run.pages Severity: CRITICAL Description: Phishing domain: ledgrr-live-run.pages Source: OpenPhish URL: http://ledgrr-live-run.pages.dev/ Date: Tags: phishing,openphish,domain #43 ledgr-livdesktp.pages Severity: CRITICAL Description: Phishing domain: ledgr-livdesktp.pages Source: OpenPhish URL: http://ledgr-livdesktp.pages.dev/ Date: Tags: phishing,openphish,domain #44 sso-uphold--en-cdn.webflow Severity: CRITICAL Description: Phishing domain: sso-uphold--en-cdn.webflow Source: OpenPhish URL: https://sso-uphold--en-cdn.webflow.io/ Date: Tags: phishing,openphish,domain ============================================================================== RECOMMENDED ACTIONS ============================================================================== 1. Search SIEM/network logs for all listed indicators 2. Block listed domains at DNS/proxy immediately 3. Scan endpoints for listed SHA256 hashes 4. Check email gateways for listed sender addresses/links 5. Block listed IP addresses at the firewall 6. Share IOCs with partner agencies and ISACs 7. Update detection rules (Sigma/YARA/Suricata/Splunk) 8. Monitor for indicator rotation (new domains, IP changes) ============================================================================== END OF IOC LIST - IOC-20260909-121523 ==============================================================================