Cyber Threat Brief — October 18 2026
⚠️ This report is AI-generated. Always validate findings.
1. AdFection — Discover-Tech ads delivered Candiru spyware with no click
TL;DR: Citizen Lab and Confiant showed that Israeli ad-tech firm Discover-Tech bought normal ad placements through Google, Yandex, and other exchanges and used them to deliver Candiru spyware to selected targets, including at least 45 Al Jazeera devices, with no click needed. Block the Discover-Tech and Candiru domains below and search DNS and proxy logs back to 2024.
What’s New:
- Ads carrying Discover-Tech’s script ran on 120,768 websites and 75,373 apps in 161 countries between March and June 2026, including on government, critical-infrastructure, and university networks.
- Each rendered ad reported the device’s IP and advertising ID to a Discover-Tech server, which returned extra code only for chosen targets. For most organizations, a hit means profiling or tracking rather than infection.
- Citizen Lab recovered a Windows Candiru DLL from an Al Jazeera device and links it with high confidence to the 2021 Candiru toolset. The browser exploit used for delivery was not recovered.
- Google, IAB Europe, Beeswax, Vungle, and Eskimi have cut Discover-Tech off, so expect the domains to go quiet. Historical log hits still matter.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Domain mtrtb[.]com and its subdomains (noas., ppv2., pqv2., infinoas., dtech., tracker.) | IOC (Discover-Tech ad-serving and targeting servers) | T1189 | DNS logs / web proxy logs | Block mtrtb.com and all subdomains, and search DNS and proxy logs back to 2024. Requests to /getAd with idfa= or aaid= parameters are the targeting check-in. |
Domain adtimizer[.]co (dtech. and tekma. subdomains) | IOC (Discover-Tech ad infrastructure) | T1189 | DNS logs / web proxy logs | Block adtimizer.co and search for its dtech. and tekma. subdomains since 2024. Adtimizer told Citizen Lab these subdomains were used only inside Discover-Tech’s infrastructure. |
CloudFront host d23625plpxg1yn.cloudfront[.]net with /iframe?impid= | IOC (Candiru delivery layer) | T1189 | Web proxy logs (full URL) | Search proxy logs for /iframe?impid= on this host and on the seven sibling CloudFront hosts Confiant lists (see Hunt hint). A hit means the device was passed from the ad to Candiru’s delivery server. |
Domain keyadapter[.]com | IOC (Candiru validator server) | T1071.001 | DNS logs / web proxy logs | Block keyadapter.com and search for it since 2022. Citizen Lab fingerprinted keyadapter.com as a Candiru validator server that screens devices before infection. |
Domain sharethere[.]net | IOC (Candiru validator server) | T1071.001 | DNS logs / web proxy logs | Block sharethere.net and search for it since 2022. Citizen Lab fingerprinted sharethere.net as a Candiru validator server that screens devices before infection. |
Domain fearevolve[.]com | IOC (Candiru C2, hard-coded in the recovered DLL) | T1071.001 | DNS logs / firewall / EDR network events | Block fearevolve.com, which is hard-coded in the recovered sample. Treat any host that resolved fearevolve.com as possibly infected and send it for forensics. |
Domain jobmarcher[.]com | IOC (Candiru C2, hard-coded in the recovered DLL) | T1071.001 | DNS logs / firewall / EDR network events | Block jobmarcher.com, which is hard-coded in the recovered sample. Treat any host that resolved jobmarcher.com as possibly infected and send it for forensics. |
Domain insightenterprisells[.]com | IOC (Candiru C2, fingerprint match) | T1071.001 | DNS logs / firewall | Block insightenterprisells.com, which matches Citizen Lab’s Candiru C2 fingerprint, and search DNS for it. |
Domain plasticbells[.]com | IOC (Candiru C2, fingerprint match) | T1071.001 | DNS logs / firewall | Block plasticbells.com, which matches Citizen Lab’s Candiru C2 fingerprint, and search DNS for it. |
SHA-256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 | File hash (Candiru Windows DLL) | T1546.015 | EDR file inventory / threat-intel blocklist | Add the hash to EDR blocklists and sweep file inventory for it. The DLL persists by hijacking a COM registration, so also review recent InprocServer32 changes on any host that matches. |
Domain pagead.trustlayersdk[.]com | IOC (SDK command-and-control) | T1071.001 | DNS logs / web proxy logs | Block pagead.trustlayersdk.com and search proxy logs for it. Confiant saw an obfuscated JavaScript SDK in Discover-Tech ads reporting here after stealing first-party cookies from the host page. |
Domain tracookiepixel[.]xyz | IOC (Discover-Tech cookie and ID syncing) | T1189 | DNS logs / web proxy logs | Block tracookiepixel.xyz. Hits on tracookiepixel.xyz show that a user’s browser was profiled by Discover-Tech, not that it was infected. |
Domain cookie-sync[.]xyz | IOC (Discover-Tech cookie and ID syncing) | T1189 | DNS logs / web proxy logs | Block cookie-sync.xyz. Hits on cookie-sync.xyz show that a user’s browser was profiled by Discover-Tech, not that it was infected. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule covers Discover-Tech or Candiru domains; Windows New InProcServer32 Added is a hunting search, not an alert. |
| Elastic | None — verified | Component Object Model Hijacking fires only if the hijack lands under HKEY_USERS, and neither report names the key. |
| Sigma | None — verified | The 2021 Sourgum/Candiru rules key on the old DLL and CLSID set; Citizen Lab says the new sample uses different DLLs. |
Detection index: ESCU d6afc62 (2026-10-16) · elastic detection-rules a61fa31 (2026-10-16) · SigmaHQ b7920ed (2026-10-18).
Hunt hint: Load the full domain lists from both reports into a DNS and proxy lookup. The Discover-Tech set is mtrtb.com, adtimizer.co, controlium.net, powerium.net, discover-tech.io, myipinfo.io, myweb3id.io, volasim.com, tekma-dmp.ai, tracookiepixel.xyz, cookie-sync.xyz, and ads-monitor.xyz. The Candiru set is keyadapter.com, sharethere.net, fearevolve.com, jobmarcher.com, insightenterprisells.com, plasticbells.com, sincereaccertain.com, outdooutcome.com, and suggestutterly.com. The CloudFront delivery hosts are d23625plpxg1yn, d39619tdxn6mhj, d2f4zpg1mgzwov, d1fzw0miu1r9rc, d19oo8r6k9oumb, d147nolwbekx2b, dcv2rnj2ograe, d1x4e580sn23dn, and d2epnp0vokbtl7 (?qq=), all under cloudfront.net. The pattern to escalate is a host that hits a Discover-Tech domain, then a CloudFront delivery host, then a Candiru validator or C2 domain. Hits on Discover-Tech domains alone are common and show tracking, not infection. Enterprise ad blocking on managed browsers removes most of this exposure.
Sources: Citizen Lab: Exposing AdFection · Confiant: ADINT, weaponized ad tech · BleepingComputer · SecurityWeek
2. Infinity Core — six Linux kernel privilege-escalation fixes to patch (CVE-2026-98260 and five more)
TL;DR: Six Linux kernel local privilege-escalation bugs, disclosed together as “Infinity Core”, now have public proof-of-concept code. Upgrade Linux hosts to the fixed stable builds below, starting with shared, multi-tenant, CI, and container hosts.
What’s New:
- The details went public on oss-security on Oct 16 after the linux-distros embargo ended, and the researcher’s writeup followed the same day.
- Affected ranges start at kernel 5.7 for CVE-2026-98260 and at 6.15 or later for the other five.
- On each branch, one build fixes every bug that applies: 7.2.9 fixes all six, 6.18.54 fixes the four that reach 6.18, and 6.12.112 and 6.6.158 fix CVE-2026-98260, the only one that reaches those trees. The rows below give each CVE’s own minimum fixed build. The CNA records list no complete fix on 7.0 or 7.1, so move those hosts to 7.2.9.
- Debian bookworm (6.1.176-1) is still listed as vulnerable to CVE-2026-98260, and we could not retrieve Ubuntu’s status.
- No exploitation has been reported.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-98260 (timer), kernel 5.7 and later | Vulnerable version | T1068 | osquery kernel_info / uname -r inventory | Upgrade to 6.6.158, 6.12.112, 6.18.54, or 7.2.8 or later to fix CVE-2026-98260. Debian bookworm 6.1.176-1 has no fix yet, so track it until one ships. |
| CVE-2026-98256 (signal), kernel 6.15 and later | Vulnerable version | T1068 | osquery kernel_info / uname -r inventory | Upgrade to 6.18.54 or 7.2.8 or later to fix CVE-2026-98256. |
| CVE-2026-89754 (memory management), kernel 7.0 and later, plus 6.18.21 through 6.18.49 | Vulnerable version | T1068 | osquery kernel_info / uname -r inventory | Upgrade to 6.18.50 or 7.2.4 or later to fix CVE-2026-89754. |
| CVE-2026-80775 (futex), kernel 6.17 and later | Vulnerable version | T1068 | osquery kernel_info / uname -r inventory | Upgrade to 6.18.47, 7.1.11, or 7.2.1 or later to fix CVE-2026-80775. |
CVE-2026-98385 (scheduler), kernel 7.2 built with CONFIG_SCHED_CACHE=y | Vulnerable version | T1068 | Kernel config inventory (/boot/config-*) | Upgrade 7.2 hosts built with CONFIG_SCHED_CACHE=y to 7.2.9 or later to fix CVE-2026-98385. |
| CVE-2026-97941 (SLUB allocator), kernel 7.2 | Vulnerable version | T1068 | osquery kernel_info / uname -r inventory | Upgrade to 7.2.7 or later to fix CVE-2026-97941. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Not checked | Patch-level section; coverage is tracked through inventory, not detections. |
| Elastic | Not checked | Patch-level section; coverage is tracked through inventory, not detections. |
| Sigma | Not checked | Patch-level section; coverage is tracked through inventory, not detections. |
Hunt hint: Pull kernel versions from your inventory (osquery SELECT version FROM kernel_info; or a uname -r sweep) and list every host below the fixed builds above. Patch multi-tenant hosts, CI runners, and container nodes first.
Sources: Infinity Core writeup (V4bel) · oss-security disclosure · CVE-2026-98260 (Linux kernel CNA) · Debian tracker: CVE-2026-98260
Status Updates
- ConnectWise Cloud Backup / Cloud Management (M365 app abuse): ConnectWise disabled seven app identities at 07:00 UTC on Oct 17, adding Cloud Management
2399d300-6fca-4e6a-a686-399fefe75b83, MS Graph0de14c77-b9b0-4137-9360-34878a929827, and Partner Center412dcf96-176d-4b3a-a1b0-4981ad66971e. Cloud Backup, SaaS Security, and Cloud Management are offline, and ConnectWise says to keep the apps disabled. Original brief. - ConnectWise scope (Huntress and Microsoft): Huntress now counts nearly 1,000 tenants with sign-ins from
144.172.64.128, over 300 of them successful, plus a second, manual-looking wave on Oct 15 (09:25–12:35 and 13:54–14:20 UTC) against 16 policy, national-security, trade, and critical-minerals tenants. Microsoft Threat Intelligence confirms the app compromise. Original brief. - CVE-2026-21589 (Atlassian Data Center file read): KEV due today, Oct 18, forensic triage required. Original brief.
- CVE-2026-102764 (BeyondTrust Remote Support): KEV due tomorrow, Oct 19, forensic triage required. Still no public PoC. Original brief.
- CVE-2025-61624 (FortiOS auto-script path traversal / PEERSTITCH): KEV due tomorrow, Oct 19, forensic triage required. Original brief.
- KEV deadlines passed Oct 17: CVE-2026-0322 (PAN-OS) and CVE-2026-76519 (Cisco SEG) (brief), and CVE-2026-105133 / CVE-2026-105134 (AhsayCBS) (brief). All are now overdue.
- Earlier KEV deadlines passed: CVE-2026-104935 (Ivanti) and CVE-2026-96951 (Windows Shell), due Oct 16 (brief); CVE-2026-86950 (Apple CoreGraphics) (brief); CVE-2026-0257 (GlobalProtect) (brief).
- Retired from watch: the Flax Typhoon set CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, and CVE-2023-22894 (last update 2026-10-11) (brief). Also retired in state: 66 older entries whose KEV deadlines passed by Sep 30 with no change since Oct 9 or earlier, including PaperCut CVE-2026-81578 and CVE-2026-82078 (brief) and NetScaler CVE-2026-88771 and CVE-2026-88772 (brief); the full list is in the audit.
- Deferred, Redis CVE-2026-25243: Exploit attempts rest on one origin, DefusedCyber’s decoys. The bug is fixed in 8.6.3; until you upgrade, restrict
RESTOREwith ACLs. Recheck Oct 20. - Deferred, npm
imgdecode(MALFEX): Only SafeDep has analyzed it, and the package is still live on npm. Blockimgdecodein your package proxy now. Recheck Oct 20. - Deferred, Drupal SA-CORE-2026-014 / CVE-2026-108097: No exploitation yet. Update to 10.6.19, 11.3.19, or 11.4.10. Recheck Oct 21.
- Deferred, OpenCode Console breach: Rotate any provider API keys saved in OpenCode Console. No indicators are public yet. Recheck Oct 20.
- Deferred, carried: BlockStrap CVE-2026-103849 and PwnEscape CVE-2026-99999 (Oct 19, no change); Langflow CVE-2026-105740 (Oct 20, still single-origin).
- Watching (no change): UNC7017 / AOMEI (10-17); CVE-2026-110447 Collabora CODE (10-15); CVE-2026-102255 SonicWall SMA1000, still not in KEV (10-10); FROMAGEGATE (10-13); GhostAction (10-10); CVE-2026-97229 GitLab, Rapid7 PoC already noted and still no exploitation (10-13); CVE-2026-85097 and CVE-2026-107406 (10-09); CVE-2026-82077 (10-11); CVE-2026-61500 and CVE-2026-88062 (10-04).