Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild. The vulnerabilities, both rated 10.0 on the CVSS scoring system, are below - CVE-2026-48939 - A vulnerability in the iCagenda and …

https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html

sha256:558ee31f8532b0039c37e39789f667e16110827f0a602aa9da9065f02e3c6836

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve12
md50
url0
ipv40
ipv60
sha10
domain2
sha2560
malware_token1
attack_pattern0
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	mysites.guru	Open →
cve	CVE-2026-3844	Open →
cve	CVE-2026-48907	Open →
cve	CVE-2026-0740	Open →
cve	CVE-2025-12057	Open →
cve	CVE-2025-7852	Open →
cve

Malware families

Allowlist token matches only.

Metasploitmalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

Scattered Spider

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports