Last Updated: Nov 11, 6:01 AM CT
Intelligence Dashboard
Live threat intelligence landscape. Monitoring active threat actors, vulnerability severity breakdowns, and aggregated intelligence sources in real-time.
Threat Risk Index
Live Network
Daily Risk Score
64.06/ 100
Risk Level
HIGH
Historical Trend (30 Days)
Live· Source: Daily risk engine (CISA KEV, NVD, OTX, abuse.ch, Shodan, HIBP)· As of Nov 11, 6:01 AM CT· Feed status
Items Scanned
855
Named Actors Active
10
Severity Breakdown
Actor Mentions
Threat Actors Named in the Feed
Live· Source: MITRE ATT&CK groups matched in the threat intel items· Matched by name in the 855 most recent items, plus the news wire· Feed status
| Actor | MITRE ID | Aliases | Mentions | Example |
|---|---|---|---|---|
| Play | G1040 | Play | 5 | OTX: From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META |
| Sea Turtle | G1041 | Sea Turtle, Teal Kurma, Marbled Dust, Cosmic Wolf, SILICON | 5 | OTX: Inside ICMacOS: From an Infostealer to a Persistent RAT |
| Turla | G0010 | Turla, IRON HUNTER, Group 88, Waterbug, WhiteBear, Snake, Krypton, Venomous Bear, Secret Blizzard, BELUGASTURGEON | 3 | AI Makes Reverse Engineering Mainstream Software & Malware Far Easier |
| APT29 | G0016 | APT29, IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard | 3 | OTX: Poisoned Source: APT29 Watering Holes Targets Mobile Devices |
| Lazarus Group | G0032 | Lazarus Group, Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet | 2 | OTX: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure |
| Kimsuky | G0094 | Kimsuky, Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Earth Kumiho, PatheticSlug | 2 | OTX: Kimsuky attacks targeting Ukrainian experts in diplomacy, security, and international policy |
| Star Blizzard | G1033 | Star Blizzard, SEABORGIUM, Callisto Group, TA446, COLDRIVER | 1 | OTX: Adversary Unmasked APT Profile - Star Blizzard |
| APT-C-36 | G0099 | APT-C-36, Blind Eagle, TAG-144, AguilaCiega, APT-Q-98 | 1 | Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America |
| Fox Kitten | G0117 | Fox Kitten, UNC757, Parisite, Pioneer Kitten, RUBIDIUM, Lemon Sandstorm | 1 | Rubidium atoms let physicists retrodict quantum spin beyond uncertainty |
| Earth Lusca | G1006 | Earth Lusca, TAG-22, Charcoal Typhoon, CHROMIUM, ControlX | 1 | CISA KEV: CVE-2026-125350 - Google Chromium Use-After-Free Vulnerability |
Recent Threat Intelligence Feed
20 Items of 20 · Newest firstMEDIUMVT-ip-182.117.126.17-20261111Today
VirusTotal: 182.117.126.17 flagged by 1 engines (+0 suspicious)
VirusTotal ip report for IOC 182.117.126.17 (from ThreatFox/URLhaus): malicious=1, suspicious=0, engines=92, reputation=0, owner=CHINA UNICOM China169 Backbone parent=URLhaus-4063736 vt_url=https://www.virustotal.com/api/v3/ip_addresses/182.117.126.17
MEDIUMVT-domain-8diou96v.celar.store-20261111Today
VirusTotal: 8diou96v.celar.store flagged by 1 engines (+0 suspicious)
VirusTotal domain report for IOC 8diou96v.celar.store (from ThreatFox/URLhaus): malicious=1, suspicious=0, engines=92, reputation=-11 parent=ThreatFox-2024600 vt_url=https://www.virustotal.com/api/v3/domains/8diou96v.celar.store
MEDIUMVT-ip-42.233.104.42-20261111Today
VirusTotal: 42.233.104.42 flagged by 2 engines (+0 suspicious)
VirusTotal ip report for IOC 42.233.104.42 (from ThreatFox/URLhaus): malicious=2, suspicious=0, engines=92, reputation=0, owner=CHINA UNICOM China169 Backbone parent=URLhaus-4063737 vt_url=https://www.virustotal.com/api/v3/ip_addresses/42.233.104.42
GreyNoise: 182.115.65.76 classified malicious (unknown)
GreyNoise v3 IP lookup for IOC 182.115.65.76 (from ThreatFox/URLhaus): classification=malicious, internet_scanner_seen=True, business_service=False, last_seen=2026-11-11
GreyNoise: 125.44.254.173 classified malicious (unknown)
GreyNoise v3 IP lookup for IOC 125.44.254.173 (from ThreatFox/URLhaus): classification=malicious, internet_scanner_seen=True, business_service=False, last_seen=2026-11-11
GreyNoise: 196.190.224.62 classified malicious (unknown)
GreyNoise v3 IP lookup for IOC 196.190.224.62 (from ThreatFox/URLhaus): classification=malicious, internet_scanner_seen=True, business_service=False, last_seen=2026-11-11
GreyNoise: 182.117.126.17 classified malicious (unknown)
GreyNoise v3 IP lookup for IOC 182.117.126.17 (from ThreatFox/URLhaus): classification=malicious, internet_scanner_seen=True, business_service=False, last_seen=2026-11-11
GreyNoise: 42.233.104.42 classified malicious (unknown)
GreyNoise v3 IP lookup for IOC 42.233.104.42 (from ThreatFox/URLhaus): classification=malicious, internet_scanner_seen=True, business_service=False, last_seen=2026-11-11
URLhaus Active Malware URL: http://182.235.148.10:53443/bin.sh
Active malware hosting URL (malware_download): http://182.235.148.10:53443/bin.sh. Host: 182.235.148.10. Tags: 32-bit, arm, elf, Mozi. Reporter: geenensp source_id=4063688 source_url=https://urlhaus.abuse.ch/url/4063688/
URLhaus Active Malware URL: http://125.45.9.68:39711/bin.sh
Active malware hosting URL (malware_download): http://125.45.9.68:39711/bin.sh. Host: 125.45.9.68. Tags: . Reporter: adliwahid source_id=4063689 source_url=https://urlhaus.abuse.ch/url/4063689/
URLhaus Active Malware URL: http://115.53.209.5:60021/i
Active malware hosting URL (malware_download): http://115.53.209.5:60021/i. Host: 115.53.209.5. Tags: . Reporter: adliwahid source_id=4063690 source_url=https://urlhaus.abuse.ch/url/4063690/
URLhaus Active Malware URL: http://220.198.112.168:51674/i
Active malware hosting URL (malware_download): http://220.198.112.168:51674/i. Host: 220.198.112.168. Tags: 32-bit, elf, mips, Mozi. Reporter: geenensp source_id=4063691 source_url=https://urlhaus.abuse.ch/url/4063691/
CISA KEV: CVE-2026-125350 - Google Chromium Use-After-Free Vulnerability
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
CISA KEV: CVE-2026-116606 - Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
CISA KEV: CVE-2026-111560 - Barracuda Networks Multiple Products OS Command Injection Vulnerability
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
CISA KEV: CVE-2026-20320 - Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
CISA KEV: CVE-2026-111793 - Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
CISA KEV: CVE-2026-124194 - Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
CISA KEV: CVE-2026-123218 - IBM Aspera Faspex Incorrect Authorization Vulnerability
IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.
CISA KEV: CVE-2026-116779 - SignalWire FreeSwitch Code Injection Vulnerability
SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.
CISA Advisories
20 ItemsCISA Adds Six Known Exploited Vulnerabilities to Catalog
CISA Advisories
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Advisories
Post-Quantum Questions to Ask Your Vendors
CISA Advisories
US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems
CISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Advisories
Subnet Solutions PowerSYSTEM Center
CISA Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Advisories
Hitachi Energy TRO600 series products
CISA Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Advisories
Siemens Mendix SAML Module
CISA Advisories
Hitachi Energy CoreTec Product
CISA Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Advisories
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
CISA Advisories
EPICS Base
CISA Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Advisories
News Wire
12 ItemsBaker Tilly notifies clients of data breach at third-party provider
BleepingComputer
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
BleepingComputer
eMudhra revokes 8 more CA certificates after private key mishap
BleepingComputer
Notion says Fireworks breach exposed customer AI chat transcripts
BleepingComputer
Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)
SANS Internet Storm Center
Maersk confirms data breach as WhiteArmor ransomware demands $5 million
BleepingComputer
Hackers use AntiFox AI agents in AWS credential-theft attacks
BleepingComputer
eBPF Rootkits: Why Underground Actors Are Taking Notice
BleepingComputer
N-able releases security hotfixes for zero-day vulnerabilities
BleepingComputer
Microsoft fixes audio issues caused by September security updates
BleepingComputer
CISA flags Cisco BroadWorks flaw as actively exploited in attacks
BleepingComputer
Microsoft fixes Exchange sign-ins broken by Windows Server updates
BleepingComputer