Last Updated: Nov 12, 6:01 AM CT
Intelligence Dashboard
Live threat intelligence landscape. Monitoring active threat actors, vulnerability severity breakdowns, and aggregated intelligence sources in real-time.
Threat Risk Index
Live Network
Daily Risk Score
63.54/ 100
Risk Level
HIGH
Historical Trend (30 Days)
Live· Source: Daily risk engine (CISA KEV, NVD, OTX, abuse.ch, Shodan, HIBP)· As of Nov 12, 6:01 AM CT· Feed status
Items Scanned
875
Named Actors Active
10
Severity Breakdown
Actor Mentions
Threat Actors Named in the Feed
Live· Source: MITRE ATT&CK groups matched in the threat intel items· Matched by name in the 875 most recent items, plus the news wire· Feed status
| Actor | MITRE ID | Aliases | Mentions | Example |
|---|---|---|---|---|
| Play | G1040 | Play | 6 | OTX: From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META |
| Turla | G0010 | Turla, IRON HUNTER, Group 88, Waterbug, WhiteBear, Snake, Krypton, Venomous Bear, Secret Blizzard, BELUGASTURGEON | 3 | AI Makes Reverse Engineering Mainstream Software & Malware Far Easier |
| Sea Turtle | G1041 | Sea Turtle, Teal Kurma, Marbled Dust, Cosmic Wolf, SILICON | 3 | OTX: Inside ICMacOS: From an Infostealer to a Persistent RAT |
| Lazarus Group | G0032 | Lazarus Group, Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet | 2 | OTX: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure |
| Kimsuky | G0094 | Kimsuky, Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Earth Kumiho, PatheticSlug | 2 | OTX: From Endpoint to Funhouse: Changes in Ransomware Families and Kimsuky-Related Distribution Cases |
| APT29 | G0016 | APT29, IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard | 2 | OTX: Poisoned Source: APT29 Watering Holes Targets Mobile Devices |
| Star Blizzard | G1033 | Star Blizzard, SEABORGIUM, Callisto Group, TA446, COLDRIVER | 1 | OTX: Adversary Unmasked APT Profile - Star Blizzard |
| APT-C-36 | G0099 | APT-C-36, Blind Eagle, TAG-144, AguilaCiega, APT-Q-98 | 1 | Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America |
| Fox Kitten | G0117 | Fox Kitten, UNC757, Parisite, Pioneer Kitten, RUBIDIUM, Lemon Sandstorm | 1 | Rubidium atoms let physicists retrodict quantum spin beyond uncertainty |
| Earth Lusca | G1006 | Earth Lusca, TAG-22, Charcoal Typhoon, CHROMIUM, ControlX | 1 | CISA KEV: CVE-2026-125350 - Google Chromium Use-After-Free Vulnerability |
Recent Threat Intelligence Feed
20 Items of 20 · Newest firstGreyNoise: 220.198.112.168 classified malicious (unknown)
GreyNoise v3 IP lookup for IOC 220.198.112.168 (from ThreatFox/URLhaus): classification=malicious, internet_scanner_seen=True, business_service=False, last_seen=2026-11-12
GreyNoise: 45.2.198.109 classified malicious (unknown)
GreyNoise v3 IP lookup for IOC 45.2.198.109 (from ThreatFox/URLhaus): classification=malicious, internet_scanner_seen=True, business_service=False, last_seen=2026-11-12
GreyNoise: 182.126.124.170 classified malicious (unknown)
GreyNoise v3 IP lookup for IOC 182.126.124.170 (from ThreatFox/URLhaus): classification=malicious, internet_scanner_seen=True, business_service=False, last_seen=2026-11-12
GreyNoise: 219.157.62.223 classified malicious (unknown)
GreyNoise v3 IP lookup for IOC 219.157.62.223 (from ThreatFox/URLhaus): classification=malicious, internet_scanner_seen=True, business_service=False, last_seen=2026-11-12
URLhaus Active Malware URL: http://180.190.203.41:43013/bin.sh
Active malware hosting URL (malware_download): http://180.190.203.41:43013/bin.sh. Host: 180.190.203.41. Tags: 32-bit, arm, elf, Mozi. Reporter: geenensp source_id=4064472 source_url=https://urlhaus.abuse.ch/url/4064472/
URLhaus Active Malware URL: http://115.55.226.105:51891/bin.sh
Active malware hosting URL (malware_download): http://115.55.226.105:51891/bin.sh. Host: 115.55.226.105. Tags: . Reporter: adliwahid source_id=4064475 source_url=https://urlhaus.abuse.ch/url/4064475/
URLhaus Active Malware URL: http://42.224.171.193:50373/bin.sh
Active malware hosting URL (malware_download): http://42.224.171.193:50373/bin.sh. Host: 42.224.171.193. Tags: . Reporter: adliwahid source_id=4064474 source_url=https://urlhaus.abuse.ch/url/4064474/
URLhaus Active Malware URL: http://115.48.39.2:38761/bin.sh
Active malware hosting URL (malware_download): http://115.48.39.2:38761/bin.sh. Host: 115.48.39.2. Tags: . Reporter: adliwahid source_id=4064476 source_url=https://urlhaus.abuse.ch/url/4064476/
URLhaus Active Malware URL: http://115.59.11.61:38478/bin.sh
Active malware hosting URL (malware_download): http://115.59.11.61:38478/bin.sh. Host: 115.59.11.61. Tags: . Reporter: adliwahid source_id=4064477 source_url=https://urlhaus.abuse.ch/url/4064477/
URLhaus Active Malware URL: http://182.122.218.192:34899/i
Active malware hosting URL (malware_download): http://182.122.218.192:34899/i. Host: 182.122.218.192. Tags: cowrie, elf, honeypot, mips, Mozi. Reporter: ksi_digital source_id=4064478 source_url=https://urlhaus.abuse.ch/url/4064478/
ThreatFox: payload_delivery - hotscriptz.com
Unknown malware indicator (payload_delivery): hotscriptz.com. Confidence: 90%. Type: domain. Tags: ClickFix, compromised source_id=2025705
ThreatFox: payload_delivery - djmisspink.co.uk
ClearFake indicator (payload_delivery): djmisspink.co.uk. Confidence: 90%. Type: domain. Tags: compromised, etherhide source_id=2025706
CISA KEV: CVE-2026-125350 - Google Chromium Use-After-Free Vulnerability
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
CISA KEV: CVE-2026-116606 - Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
CISA KEV: CVE-2026-111560 - Barracuda Networks Multiple Products OS Command Injection Vulnerability
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
CISA KEV: CVE-2026-20320 - Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
CISA KEV: CVE-2026-111793 - Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
CISA KEV: CVE-2026-124194 - Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
CISA KEV: CVE-2026-123218 - IBM Aspera Faspex Incorrect Authorization Vulnerability
IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.
CISA KEV: CVE-2026-116779 - SignalWire FreeSwitch Code Injection Vulnerability
SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.
CISA Advisories
20 ItemsSiemens Desigo, Gridscale
CISA Advisories
Siemens RUGGEDCOM APE1808
CISA Advisories
Siemens RUGGEDCOM APE1808
CISA Advisories
Siemens Building Automation and Energy Products
CISA Advisories
Siemens Industrial Edge Management
CISA Advisories
CISA Adds Six Known Exploited Vulnerabilities to Catalog
CISA Advisories
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Advisories
Post-Quantum Questions to Ask Your Vendors
CISA Advisories
US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems
CISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Advisories
Subnet Solutions PowerSYSTEM Center
CISA Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Advisories
Hitachi Energy TRO600 series products
CISA Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Advisories
Hitachi Energy CoreTec Product
CISA Advisories
Siemens Mendix SAML Module
CISA Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Advisories
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
CISA Advisories
News Wire
12 ItemsNew Windows SignDrop zero-day gives hackers SYSTEM privileges
BleepingComputer
Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
BleepingComputer
Your Endpoint Management Platform Could Be Your Biggest Security Risk
BleepingComputer
Apify rotates API tokens, prompts 2FA resets after breach
BleepingComputer
Microsoft: Recent Windows updates cause SQL Server performance issues
BleepingComputer
Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)
SANS Internet Storm Center
Microsoft confirms Windows security updates installation issues
BleepingComputer
Hackers plant GSocket on Linux servers for persistent access
BleepingComputer
ISC Stormcast For Thursday, November 12th, 2026 https://isc.sans.edu/podcastdetail/10176, (Thu, Nov 12th)
SANS Internet Storm Center
Baker Tilly notifies clients of data breach at third-party provider
BleepingComputer
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
BleepingComputer
eMudhra revokes 8 more CA certificates after private key mishap
BleepingComputer