============================================================================== CYBER THREAT INTELLIGENCE - INDICATORS OF COMPROMISE (IOC) LIST ============================================================================== Generated: 2026-11-14 12:15 UTC Report ID: IOC-20261114-121547 Total Indicators: 28 Classification: OPEN - Law Enforcement / DFIR use Sources: CISA KEV Catalog, OpenPhish SUMMARY ------------------------------------------------------------------------------ CISA KEV (Known Exploited Vulnerability): 10 Phishing URL: 9 Domain: 9 Severity: CRITICAL=28 ============================================================================== [CISA KEV (KNOWN EXPLOITED VULNERABILITY)] - 10 indicator(s) ============================================================================== #1 CVE-2026-114713 Severity: CRITICAL Description: UnrealIRCd UnrealIRCd contains an improper neutralization of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority. Product: UnrealIRCd (UnrealIRCd) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-114713 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-13 Tags: kev,cisa,active-exploitation #2 CVE-2026-123039 Severity: CRITICAL Description: Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server contain an incorrect permissions assignment for critical resources vulnerability when the Gaia OS DynamicCLI daemon ru Product: Multiple Products (Check Point) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123039 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-13 Tags: kev,cisa,active-exploitation #3 CVE-2026-124194 Severity: CRITICAL Description: Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network. Product: Office (Microsoft) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-124194 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-10 Tags: kev,cisa,active-exploitation #4 CVE-2026-111793 Severity: CRITICAL Description: Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. Product: Webtop Media Transcoder (Openwave Messaging Limited) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111793 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-10 Tags: kev,cisa,active-exploitation #5 CVE-2026-20320 Severity: CRITICAL Description: Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. Product: BroadWorks (Cisco) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20320 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-10 Tags: kev,cisa,active-exploitation #6 CVE-2026-111560 Severity: CRITICAL Description: Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vu Product: Multiple Products (Barracuda Networks) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111560 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-10 Tags: kev,cisa,active-exploitation #7 CVE-2026-116606 Severity: CRITICAL Description: Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backu Product: Barracuda Email Security Gateway (ESG) (Barracuda Networks) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-116606 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-10 Tags: kev,cisa,active-exploitation #8 CVE-2026-125350 Severity: CRITICAL Description: Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that u Product: Chromium (Google) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-125350 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-10 Tags: kev,cisa,active-exploitation #9 CVE-2026-102895 Severity: CRITICAL Description: GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code Product: GPUStack (GPUStack) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102895 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-09 Tags: kev,cisa,active-exploitation #10 CVE-2026-123158 Severity: CRITICAL Description: OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass. Product: OpenSSH (OpenBSD) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123158 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-09 Tags: kev,cisa,active-exploitation ============================================================================== [PHISHING URL] - 9 indicator(s) ============================================================================== #11 https://now-13-11-26.shop/rxxgABqn Severity: CRITICAL Description: Active phishing URL: https://now-13-11-26.shop/rxxgABqn Source: OpenPhish URL: https://now-13-11-26.shop/rxxgABqn Date: Tags: phishing,openphish #12 https://kiocoixlogen.gitbook.io/ Severity: CRITICAL Description: Active phishing URL: https://kiocoixlogen.gitbook.io/ Source: OpenPhish URL: https://kiocoixlogen.gitbook.io/ Date: Tags: phishing,openphish #13 http://explore-trustextension.apper.so/ Severity: CRITICAL Description: Active phishing URL: http://explore-trustextension.apper.so/ Source: OpenPhish URL: http://explore-trustextension.apper.so/ Date: Tags: phishing,openphish #14 https://ql4488.craftum.io/page2 Severity: CRITICAL Description: Active phishing URL: https://ql4488.craftum.io/page2 Source: OpenPhish URL: https://ql4488.craftum.io/page2 Date: Tags: phishing,openphish #15 https://gemini-lugin.gitbook.io/ Severity: CRITICAL Description: Active phishing URL: https://gemini-lugin.gitbook.io/ Source: OpenPhish URL: https://gemini-lugin.gitbook.io/ Date: Tags: phishing,openphish #16 https://codedetrichelattaquedeszombieroblox.blogspot.com/ Severity: CRITICAL Description: Active phishing URL: https://codedetrichelattaquedeszombieroblox.blogspot.com/ Source: OpenPhish URL: https://codedetrichelattaquedeszombieroblox.blogspot.com/ Date: Tags: phishing,openphish #17 https://kukoinzlogen.gitbook.io/ Severity: CRITICAL Description: Active phishing URL: https://kukoinzlogen.gitbook.io/ Source: OpenPhish URL: https://kukoinzlogen.gitbook.io/ Date: Tags: phishing,openphish #18 https://supercauchoabanto.com/96627c/RE025486658/CR/card.php Severity: CRITICAL Description: Active phishing URL: https://supercauchoabanto.com/96627c/RE025486658/CR/card.php Source: OpenPhish URL: https://supercauchoabanto.com/96627c/RE025486658/CR/card.php Date: Tags: phishing,openphish #19 https://mydpd.slpfr.help/track-ch Severity: CRITICAL Description: Active phishing URL: https://mydpd.slpfr.help/track-ch Source: OpenPhish URL: https://mydpd.slpfr.help/track-ch Date: Tags: phishing,openphish ============================================================================== [DOMAIN] - 9 indicator(s) ============================================================================== #20 now-13-11-26.shop Severity: CRITICAL Description: Phishing domain: now-13-11-26.shop Source: OpenPhish URL: https://now-13-11-26.shop/rxxgABqn Date: Tags: phishing,openphish,domain #21 kiocoixlogen.gitbook Severity: CRITICAL Description: Phishing domain: kiocoixlogen.gitbook Source: OpenPhish URL: https://kiocoixlogen.gitbook.io/ Date: Tags: phishing,openphish,domain #22 explore-trustextension.apper Severity: CRITICAL Description: Phishing domain: explore-trustextension.apper Source: OpenPhish URL: http://explore-trustextension.apper.so/ Date: Tags: phishing,openphish,domain #23 ql4488.craftum Severity: CRITICAL Description: Phishing domain: ql4488.craftum Source: OpenPhish URL: https://ql4488.craftum.io/page2 Date: Tags: phishing,openphish,domain #24 gemini-lugin.gitbook Severity: CRITICAL Description: Phishing domain: gemini-lugin.gitbook Source: OpenPhish URL: https://gemini-lugin.gitbook.io/ Date: Tags: phishing,openphish,domain #25 codedetrichelattaquedeszombieroblox.blogspot Severity: CRITICAL Description: Phishing domain: codedetrichelattaquedeszombieroblox.blogspot Source: OpenPhish URL: https://codedetrichelattaquedeszombieroblox.blogspot.com/ Date: Tags: phishing,openphish,domain #26 kukoinzlogen.gitbook Severity: CRITICAL Description: Phishing domain: kukoinzlogen.gitbook Source: OpenPhish URL: https://kukoinzlogen.gitbook.io/ Date: Tags: phishing,openphish,domain #27 supercauchoabanto.com Severity: CRITICAL Description: Phishing domain: supercauchoabanto.com Source: OpenPhish URL: https://supercauchoabanto.com/96627c/RE025486658/CR/card.php Date: Tags: phishing,openphish,domain #28 mydpd.slpfr Severity: CRITICAL Description: Phishing domain: mydpd.slpfr Source: OpenPhish URL: https://mydpd.slpfr.help/track-ch Date: Tags: phishing,openphish,domain ============================================================================== RECOMMENDED ACTIONS ============================================================================== 1. Search SIEM/network logs for all listed indicators 2. Block listed domains at DNS/proxy immediately 3. Scan endpoints for listed SHA256 hashes 4. Check email gateways for listed sender addresses/links 5. Block listed IP addresses at the firewall 6. Share IOCs with partner agencies and ISACs 7. Update detection rules (Sigma/YARA/Suricata/Splunk) 8. Monitor for indicator rotation (new domains, IP changes) ============================================================================== END OF IOC LIST - IOC-20261114-121547 ==============================================================================