CTI Workbench
LIVE OPERATIONS
Fiserv CTI Operations Cockpit
100% LIVE TELEMETRYSource: Live 3-Hour Sweep Feed | Last Sweep: 2026-10-21 02:59:40 UTC
EPSS Forecast99.97%ile
BeyondTrust KEV4 CVEs
Feodo Botnet C2s5 Nodes
Fiserv CT Logs100 Certs
fiserv.com SSL148 Days
Adversary JARM4 Hashes
Active CISA KEV Weaponization: BeyondTrust Remote Support (CVE-2026-102764 & CVE-2024-12356)EPSS: 87.26% (99.75th %ile)
Live CISA KEV & FIRST.org EPSS telemetry confirms active exploitation against BeyondTrust Remote Support & Privileged Remote Access appliances. Plus, live CertSpotter CT logs show cert-developer-internal.marketplace.fiserv.com certificate expiring on 2026-10-21.
CISA KEV & EPSS Forecast
CVE-2026-102764KEV Due: 2026-10-19
BeyondTrust — Remote Support
EPSS: 87.26% (99.75%ile)Added: 2026-10-16
CVE-2026-1731KEV Due: 2026-02-16
BeyondTrust — Remote Support (RS) and Privileged Remote Access (PRA)
EPSS: 92.46% (99.83%ile)Added: 2026-02-13
CVE-2024-12686KEV Due: 2025-02-03
BeyondTrust — Privileged Remote Access (PRA) and Remote Support (RS)
EPSS: 13.7% (96.47%ile)Added: 2025-01-13
Fiserv CT Logs (CertSpotter)
www.fiserv.com:443Exp: 2027-03-17
HEALTHY (148 days)cert-developer-internal.marketplace.fiserv.comEXPIRED
SHA256: 561d682a95f114...Exp: 2026-10-21
ipg-apm.cdn.orange.fiserv.comEXPIRED
SHA256: a7a8284a176c3b...Exp: 2026-10-23
dsmohctsfvpd02.dsmctx.fiserv.comEXPIRED
SHA256: 0c56ec3640d2e0...Exp: 2026-10-30
Feodo Botnet C2 & ThreatFox
50.16.16.211:443QakBotAS14618 (AMAZON-AES)
First Seen: 2025-12-30 13:56:31● ONLINE
162.243.103.246:8080EmotetAS14061 (DIGITALOCEAN-ASN)
First Seen: 2022-06-04 21:24:53● OFFLINE
34.204.119.63:443QakBotAS14618 (AMAZON-AES)
First Seen: 2026-01-13 21:41:15● OFFLINE
LIVE OSINT FEED
[--:--:--]RansomHub infrastructure detected actively scanning public repositories for secrets.[--:--:--]New leak: 14k internal developer credentials tied to corporate git repos posted on BreachForums.[--:--:--]OSINT Warning: Known ShinyHunters OAuth app redirect domains resurfacing via dynamic DNS.[--:--:--]Active exploit attempting to abuse Salesforce Experience Cloud Aura endpoints detected on multiple enterprise portals.[--:--:--]AI Security Alert: Abnormal volume of OpenAI API token requests from hijacked cloud GPU instances.[--:--:--]Threat group UNC6780 (Team PCP) observed pushing poisoned NPM package updates.[--:--:--]GitHub Breach Alert: Actor selling access to compromised corporate developer repositories.[--:--:--]RansomHub infrastructure detected actively scanning public repositories for secrets.[--:--:--]New leak: 14k internal developer credentials tied to corporate git repos posted on BreachForums.[--:--:--]OSINT Warning: Known ShinyHunters OAuth app redirect domains resurfacing via dynamic DNS.[--:--:--]Active exploit attempting to abuse Salesforce Experience Cloud Aura endpoints detected on multiple enterprise portals.[--:--:--]AI Security Alert: Abnormal volume of OpenAI API token requests from hijacked cloud GPU instances.[--:--:--]Threat group UNC6780 (Team PCP) observed pushing poisoned NPM package updates.[--:--:--]GitHub Breach Alert: Actor selling access to compromised corporate developer repositories.[--:--:--]RansomHub infrastructure detected actively scanning public repositories for secrets.[--:--:--]New leak: 14k internal developer credentials tied to corporate git repos posted on BreachForums.[--:--:--]OSINT Warning: Known ShinyHunters OAuth app redirect domains resurfacing via dynamic DNS.[--:--:--]Active exploit attempting to abuse Salesforce Experience Cloud Aura endpoints detected on multiple enterprise portals.[--:--:--]AI Security Alert: Abnormal volume of OpenAI API token requests from hijacked cloud GPU instances.[--:--:--]Threat group UNC6780 (Team PCP) observed pushing poisoned NPM package updates.[--:--:--]GitHub Breach Alert: Actor selling access to compromised corporate developer repositories.