| New Threats Detection Added | • ContEXE Stealer • CountLoader |
| Newly Detected Threats | 10 |
| New IDPS Rules Created | 61 |
Weekly Detected Threats
The following threats were added to Crystal Eye this week:
Threat name: | ContEXE Stealer | |||||||||||||||||||||
ContEXE Stealer is an information-stealing malware design to collect sensitive information such as browser-stored credentials, cookies, authentication tokens, system information, and other valuable artifacts. This ContEXE Stealer primarily targets Windows environments and masquerades as legitimate executables (.exe) often being distributed through phishing emails, malvertising, SEO poisoning and trojanised downloads and exfiltrate the stolen data to a Command-and-Control (C2) server. | ||||||||||||||||||||||
Threat Protected: | 14 | |||||||||||||||||||||
Rule Set Type: |
| |||||||||||||||||||||
Class Type: | Domain-c2 | |||||||||||||||||||||
Kill Chain: |
| |||||||||||||||||||||
Known Exploited Vulnerabilities (Week 2 - October 2026)
For more information, please visit the Red Piranha Forum:
https://forum.redpiranha.net/t/known-exploited-vulnerabilities-catalog-2nd-week-of-october-2026/702.
Vulnerability | CVSS | Description | Affected Version | Fixed Version |
7.5 | Denial of Service - ICS BIND contains a denial-of-service vulnerability that can allow an unauthenticated remote attacker to cause a denial of service via TKEY queries. | < 9.9.7-P2 < 9.10.2-P3 | 9.9.7-P2 9.10.2-P3 | |
8.1 | Unauthenticated RCE - Apache Struts contains a command injection vulnerability that can allow an unauthenticated remote attacker to execute code on the system, exploitation of this vulnerability requires Dynamic Method Invocation to be enabled. | 2.3.19 - 2.3.20.2 2.3.21 - 2.3.24.1 2.3.25 - 2.3.28 | 2.3.20.2 2.3.24.2 2.3.28.1 | |
7.2 | Information Disclosure - Strapi contains a vulnerability that can allow an authenticated remote attacker to discover sensitive user details via the query filter which can be used in further attacks. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution on the system. | 3.2.1 - 4.7.1 | 4.8.0 | |
9.8 | Unauthenticated RCE - OPENOFFICE Docs Server contains a path traversal vulnerability that can allow an unauthenticated remote attacker to execute code on the system via uploading an image when using a JWT. | <= 5.6.2 | 5.6.3 | |
10.0 | ProFTPD contains a vulnerability that can allow an unauthenticated remote attacker to read and write arbitrary files on the system via site cpfr/cpto FTP commands. | Check vendor advisory for affected products and versions. | ||
ICS Advisories (Week 2 - October 2026)
Vulnerability | CVSS | Description | Affected Version | Fixed Version |
Hitachi Energy | RTU500 CVE-2026-8065 (CVSS: 9.1) CVE-2026-8066 (CVSS: 9.1) CVE-2026-8067 (CVSS: 6.5) CVE-2010-2965 (CVSS: 9.8) CVE-2014-9195 (CVSS: 8.1) CVE-2023-46143 (CVSS: 7.5) | Contains vulnerabilities that can allow an unauthenticated remote attacker to gain access to the system. Additionally, contains vulnerabilities that can allow an unauthenticated attacker upload arbitrary firmware and files, and to execute arbitrary commands via protocol-compliant traffic. CISA ICS Advisory: icsa-26-279-06 | <= 11.x | 12.7.8 or 13.9.1 |
Contains vulnerabilities that can allow an authenticated attacker to cause a denial of service condition on the system. CISA ICS Advisory: icsa-26-279-05 | Check vendor advisory for affected products and versions. | |||
Contains a vulnerability within the ActiveMQ component used in the product that can allow an attacker to execute code on the system. CISA ICS Advisory: icsa-26-279-04 | 2.0.0 – 2.2.0 | SOI EP2 | ||
Contains vulnerabilities that can allow an unauthenticated remote attacker to upload configuration files to the system. CISA ICS Advisory: icsa-26-279-03 | <= 9.9.0 | 9.9.1 | ||
Savannah | Contains a buffer overflow vulnerability that can allow an unauthenticated remote attacker to execute code on the system. CISA ICS Advisory: icsa-26-279-02 | Check vendor advisory for affected versions. | ||
Johnson Controls | Contains vulnerabilities that can allow an unauthenticated remote attacker to gain access to the system through the use of hard-coded credentials and through brute forcing credentials. CISA ICS Advisory: icsa-26-279-01 | <= 2.0b52 | N/A (End-of-Life) | |
Red Lion Controls | CVE-2026-39460 (CVSS: 9.3) CVE-2026-28745 (CVSS: 9.3) CVE-2026-33367 (CVSS: 9.3) CVE-2026-29797 (CVSS: 8.4) CVE-2026-39453 (CVSS: 8.5) CVE-2026-33272 (CVSS: 6.8) | Contains vulnerabilities that can allow an unauthenticated remote attacker to access the system with default credentials. Additionally, credentials stored within the configuration utilise weak encryption and contains vulnerabilities that can allow an attacker to perform administrative actions through SNMP and TFTP without authentication. | <= Firmware_3.11.0 <= Bootloader_2.0.6.1 | 3.11.1 |
Grid Protection Alliance | openPDC and openHistorian CVE-2026-100730 (CVSS: 9.8) CVE-2026-105281 (CVSS: 7.5) CVE-2026-85479 (CVSS: 5.3) CVE-2026-101022 (CVSS: 4.3) CVE-2026-105278 (CVSS: 9.8) CVE-2026-104629 (CVSS: 8.8) | Contains a deserialisation vulnerability that can allow an unauthenticated remote attacker execute code on the system, allow an attacker to access the system via default credentials, and interact with the system through STTP and Modbus without authentication. | openPDC: < 2.9.482 openHistorian: < 2.8.585 | 2.9.482 2.8.585 |
Satel | Netco Design CVE-2026-105269 (CVSS: 6.8) CVE-2026-104628 (CVSS: 6.5) CVE-2026-105275 (CVSS: 4.3) CVE-2026-101024 (CVSS: 8.8) | Contains vulnerabilities that can allow an authenticated remote attacker to access system files through path traversal vulnerabilities which may lead to code execution on the system. Additionally, a stored cross-site scripting vulnerability exists which can result in the execution of JavaScript when viewed. | < v2.1.7 | v2.1.7 |
Updated Malware Signature (Week 2 - October 2026)
Threat | Description |
Remus Stealer | Remus Stealer is information-stealing malware that emerged in early 2026 and is considered and evolution of the Lumma Stealer malware family. Remus stealer targets Chromium and Firefox-based browsers to harvests browser credentials, cookies, cryptocurrency wallet information, authentication tokens, and other valuable data. This Remus Stealer commonly distributed through ClickFix social engineering campaigns, malicious advertisements and compromised websites. |
| Ransomware Report | |
The Red Piranha Team conducts continuous surveillance across the dark web and other threat intelligence channels to identify global organisations impacted by ransomware attacks. In the past week, this monitoring revealed multiple ransomware incidents spanning a diverse range of threat groups, underscoring the persistent and widespread nature of today's cyber threat landscape. Presented below is a detailed breakdown of ransomware group activity, victim geographies, and targeted industries observed during this period. Ransomware Hits Last WeekWorldwide ransomware victim distribution by threat group shows that The Gentlemen was the most active group, with 38 victims, accounting for 18.72% of total reported ransomware activity. Qilin and NightSpire jointly recorded the second-highest number of victims, with 22 cases each, representing 10.84% individually. Together, these three groups accounted for a substantial proportion of reported ransomware victims during the period. SafePay recorded 10 victims, representing 4.93% of the total. Umbra and Inc Ransom each reported 9 victims, contributing 4.43% individually. Byod recorded 7 victims (3.45%), while LeakedData reported 6 victims (2.96%). Everest and Akira each recorded 5 victims, accounting for 2.46% individually. Other groups with moderate activity included Panzer, Interlock, and Lamashtu, each reporting 4 victims, representing 1.97% individually. Rhysida, Emperador, Storm, Krybit, Lockbit5, Vypr, Black X, and Arcus Media each recorded 3 victims, contributing 1.48% individually. Several ransomware groups recorded 2 victims each, accounting for 0.99% individually. These included Wallstreet, Play, Doommageddon, Aurora, Payoutsking, Termite, Anubis, Eclipse, and DragonForce. The remaining groups recorded 1 victim each, representing 0.49% individually. These included Spirals, Direwolf, Booba Team, Insomnia, Global Secret Group, 3am, Endzone, Shiba, N0n, Vexy, Run Some Wares, Payload, Cry0, Bravox, Deadlock, and Brain Cipher. |
Worldwide Ransomware Victims
Worldwide ransomware victim distribution shows that the United States was the most affected country, with 88 victims, accounting for 43.35% of total ransomware activity. This indicates that more than two-fifths of all reported ransomware victims were located in the United States.
Canada recorded the second-highest number of victims, with 11 cases, representing 5.42% of the total. Spain followed with 8 victims, accounting for 3.94%. Brazil, France, and Germany each 7 victims, contributing 3.45% individually. India and the United Kingdom each recorded 5 victims, repreenting 2.46% of overall ransomware activity.
Other countries with notable ransomware impact included the United Arab Emirates, Australia, and Egypt, each reporting 4 victims, accounting for 1.97% individually. Turkey, Malaysia, Italy, and Taiwan each recorded 3 victims, representing 1.48% of the total ransomware activity.
Several countries reported 2 victims each, accounting for 0.99% individually. These included Saudi Arabia, Chile, Japan, Colombia, Denmark, Mexico, Switzerland, Ireland, Finland, Thailand, and Israel.
The remaining countries recorded 1 victim each, representing 0.49% individually. These included Lebanon, Iran, Trinidad and Tobago, Peru, Haiti, Belgium, Austria, Sweden, Slovakia, the Netherlands, the Czech Republic, Oman, Bulgaria, Cyprus, Qatar, Uruguay, Greece, Algeria, and Vietnam.
Worldwide Ransomware Victims
Worldwide ransomware victim distribution shows that the United States was the most affected country, with 88 victims, accounting for 43.35% of total ransomware activity. This indicates that more than two-fifths of all reported ransomware victims were located in the United States.
Canada recorded the second-highest number of victims, with 11 cases, representing 5.42% of the total. Spain followed with 8 victims, accounting for 3.94%. Brazil, France, and Germany each 7 victims, contributing 3.45% individually. India and the United Kingdom each recorded 5 victims, repreenting 2.46% of overall ransomware activity.
Other countries with notable ransomware impact included the United Arab Emirates, Australia, and Egypt, each reporting 4 victims, accounting for 1.97% individually. Turkey, Malaysia, Italy, and Taiwan each recorded 3 victims, representing 1.48% of the total ransomware activity.
Several countries reported 2 victims each, accounting for 0.99% individually. These included Saudi Arabia, Chile, Japan, Colombia, Denmark, Mexico, Switzerland, Ireland, Finland, Thailand, and Israel.
The remaining countries recorded 1 victim each, representing 0.49% individually. These included Lebanon, Iran, Trinidad and Tobago, Peru, Haiti, Belgium, Austria, Sweden, Slovakia, the Netherlands, the Czech Republic, Oman, Bulgaria, Cyprus, Qatar, Uruguay, Greece, Algeria, and Vietnam.
Worldwide Ransomware Victims
Worldwide ransomware victim distribution shows that the United States was the most affected country, with 88 victims, accounting for 43.35% of total ransomware activity. This indicates that more than two-fifths of all reported ransomware victims were located in the United States.
Canada recorded the second-highest number of victims, with 11 cases, representing 5.42% of the total. Spain followed with 8 victims, accounting for 3.94%. Brazil, France, and Germany each 7 victims, contributing 3.45% individually. India and the United Kingdom each recorded 5 victims, repreenting 2.46% of overall ransomware activity.
Other countries with notable ransomware impact included the United Arab Emirates, Australia, and Egypt, each reporting 4 victims, accounting for 1.97% individually. Turkey, Malaysia, Italy, and Taiwan each recorded 3 victims, representing 1.48% of the total ransomware activity.
Several countries reported 2 victims each, accounting for 0.99% individually. These included Saudi Arabia, Chile, Japan, Colombia, Denmark, Mexico, Switzerland, Ireland, Finland, Thailand, and Israel.
The remaining countries recorded 1 victim each, representing 0.49% individually. These included Lebanon, Iran, Trinidad and Tobago, Peru, Haiti, Belgium, Austria, Sweden, Slovakia, the Netherlands, the Czech Republic, Oman, Bulgaria, Cyprus, Qatar, Uruguay, Greece, Algeria, and Vietnam.