============================================================================== CYBER THREAT INTELLIGENCE - INDICATORS OF COMPROMISE (IOC) LIST ============================================================================== Generated: 2026-10-18 12:15 UTC Report ID: IOC-20261018-121523 Total Indicators: 28 Classification: OPEN - Law Enforcement / DFIR use Sources: CISA KEV Catalog, OpenPhish SUMMARY ------------------------------------------------------------------------------ CISA KEV (Known Exploited Vulnerability): 10 Phishing URL: 9 Domain: 9 Severity: CRITICAL=28 ============================================================================== [CISA KEV (KNOWN EXPLOITED VULNERABILITY)] - 10 indicator(s) ============================================================================== #1 CVE-2026-102764 Severity: CRITICAL Description: BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. Product: Remote Support (BeyondTrust) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102764 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-16 Tags: kev,cisa,active-exploitation #2 CVE-2025-61624 Severity: CRITICAL Description: FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Product: Multiple Products (Fortinet) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-61624 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-16 Tags: kev,cisa,active-exploitation #3 CVE-2026-21589 Severity: CRITICAL Description: Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to exte Product: Multiple Products (Atlassian) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21589 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-15 Tags: kev,cisa,active-exploitation #4 CVE-2026-105134 Severity: CRITICAL Description: Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoi Product: AhsayCBS (Ahsay) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105134 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-14 Tags: kev,cisa,active-exploitation #5 CVE-2026-76519 Severity: CRITICAL Description: Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Product: Secure Email Gateway (Cisco) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76519 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-14 Tags: kev,cisa,active-exploitation #6 CVE-2026-105133 Severity: CRITICAL Description: Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with Product: AhsayCBS (Ahsay) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105133 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-14 Tags: kev,cisa,active-exploitation #7 CVE-2026-0322 Severity: CRITICAL Description: Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Product: PAN-OS (Palo Alto Networks) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-0322 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-14 Tags: kev,cisa,active-exploitation #8 CVE-2026-104935 Severity: CRITICAL Description: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. Product: Connect Secure (Ivanti) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104935 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-13 Tags: kev,cisa,active-exploitation #9 CVE-2026-96951 Severity: CRITICAL Description: Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. Product: Windows (Microsoft) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96951 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-13 Tags: kev,cisa,active-exploitation #10 CVE-2015-5477 Severity: CRITICAL Description: ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. Product: BIND (ISC) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2015-5477 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-08 Tags: kev,cisa,active-exploitation ============================================================================== [PHISHING URL] - 9 indicator(s) ============================================================================== #11 http://www.roblox.ly/users/1036952856/profile Severity: CRITICAL Description: Active phishing URL: http://www.roblox.ly/users/1036952856/profile Source: OpenPhish URL: http://www.roblox.ly/users/1036952856/profile Date: Tags: phishing,openphish #12 http://digitley-dhl.azurewebsites.net/login Severity: CRITICAL Description: Active phishing URL: http://digitley-dhl.azurewebsites.net/login Source: OpenPhish URL: http://digitley-dhl.azurewebsites.net/login Date: Tags: phishing,openphish #13 https://www.roblox.com.ml/games/9872472334/HLWN-Evade?privateServerLinkCode=384328757637766641742433182819 Severity: CRITICAL Description: Active phishing URL: https://www.roblox.com.ml/games/9872472334/HLWN-Evade?privateServerLinkCode=384328757637766641742433182819 Source: OpenPhish URL: https://www.roblox.com.ml/games/9872472334/HLWN-Evade?privateServerLinkCode=384328757637766641742433182819 Date: Tags: phishing,openphish #14 https://tiktokvip.cyou/ Severity: CRITICAL Description: Active phishing URL: https://tiktokvip.cyou/ Source: OpenPhish URL: https://tiktokvip.cyou/ Date: Tags: phishing,openphish #15 http://rss2.sayler.at/go/z2b4u2/z274y274 Severity: CRITICAL Description: Active phishing URL: http://rss2.sayler.at/go/z2b4u2/z274y274 Source: OpenPhish URL: http://rss2.sayler.at/go/z2b4u2/z274y274 Date: Tags: phishing,openphish #16 http://worker-shy-leaf-da6e.njperk308.workers.dev/ Severity: CRITICAL Description: Active phishing URL: http://worker-shy-leaf-da6e.njperk308.workers.dev/ Source: OpenPhish URL: http://worker-shy-leaf-da6e.njperk308.workers.dev/ Date: Tags: phishing,openphish #17 http://qerqumi-kxt-belfavi-p8t1hk53.pages.dev/ Severity: CRITICAL Description: Active phishing URL: http://qerqumi-kxt-belfavi-p8t1hk53.pages.dev/ Source: OpenPhish URL: http://qerqumi-kxt-belfavi-p8t1hk53.pages.dev/ Date: Tags: phishing,openphish #18 https://www.roblox.com.am/users/296446714432/profile Severity: CRITICAL Description: Active phishing URL: https://www.roblox.com.am/users/296446714432/profile Source: OpenPhish URL: https://www.roblox.com.am/users/296446714432/profile Date: Tags: phishing,openphish #19 https://sp24ct-rumi-biz-kelak-zati.pages.dev/ Severity: CRITICAL Description: Active phishing URL: https://sp24ct-rumi-biz-kelak-zati.pages.dev/ Source: OpenPhish URL: https://sp24ct-rumi-biz-kelak-zati.pages.dev/ Date: Tags: phishing,openphish ============================================================================== [DOMAIN] - 9 indicator(s) ============================================================================== #20 www.roblox Severity: CRITICAL Description: Phishing domain: www.roblox Source: OpenPhish URL: http://www.roblox.ly/users/1036952856/profile Date: Tags: phishing,openphish,domain #21 digitley-dhl.azurewebsites Severity: CRITICAL Description: Phishing domain: digitley-dhl.azurewebsites Source: OpenPhish URL: http://digitley-dhl.azurewebsites.net/login Date: Tags: phishing,openphish,domain #22 tiktokvip.cyou Severity: CRITICAL Description: Phishing domain: tiktokvip.cyou Source: OpenPhish URL: https://tiktokvip.cyou/ Date: Tags: phishing,openphish,domain #23 rss2.sayler Severity: CRITICAL Description: Phishing domain: rss2.sayler Source: OpenPhish URL: http://rss2.sayler.at/go/z2b4u2/z274y274 Date: Tags: phishing,openphish,domain #24 njperk308.workers Severity: CRITICAL Description: Phishing domain: njperk308.workers Source: OpenPhish URL: http://worker-shy-leaf-da6e.njperk308.workers.dev/ Date: Tags: phishing,openphish,domain #25 qerqumi-kxt-belfavi-p8t1hk53.pages Severity: CRITICAL Description: Phishing domain: qerqumi-kxt-belfavi-p8t1hk53.pages Source: OpenPhish URL: http://qerqumi-kxt-belfavi-p8t1hk53.pages.dev/ Date: Tags: phishing,openphish,domain #26 sp24ct-rumi-biz-kelak-zati.pages Severity: CRITICAL Description: Phishing domain: sp24ct-rumi-biz-kelak-zati.pages Source: OpenPhish URL: https://sp24ct-rumi-biz-kelak-zati.pages.dev/ Date: Tags: phishing,openphish,domain #27 clktp0b58pz-kphzwlsi-4f9g1b-clk20c.pages Severity: CRITICAL Description: Phishing domain: clktp0b58pz-kphzwlsi-4f9g1b-clk20c.pages Source: OpenPhish URL: https://clktp0b58pz-kphzwlsi-4f9g1b-clk20c.pages.dev/ Date: Tags: phishing,openphish,domain #28 vormita-kxt-felquro-r2t7dw84.pages Severity: CRITICAL Description: Phishing domain: vormita-kxt-felquro-r2t7dw84.pages Source: OpenPhish URL: http://vormita-kxt-felquro-r2t7dw84.pages.dev/ Date: Tags: phishing,openphish,domain ============================================================================== RECOMMENDED ACTIONS ============================================================================== 1. Search SIEM/network logs for all listed indicators 2. Block listed domains at DNS/proxy immediately 3. Scan endpoints for listed SHA256 hashes 4. Check email gateways for listed sender addresses/links 5. Block listed IP addresses at the firewall 6. Share IOCs with partner agencies and ISACs 7. Update detection rules (Sigma/YARA/Suricata/Splunk) 8. Monitor for indicator rotation (new domains, IP changes) ============================================================================== END OF IOC LIST - IOC-20261018-121523 ==============================================================================