This pack covers five intelligence items spanning ransomware infrastructure disruption, state-affiliated credential theft, a critical zero-day RCE in ASP.NET-based LMS platforms, CDN-layer C2 concealment, and new NIST guidance for ICS/OT ransomware recovery. The most urgent item is CVE-2026-5426 (CVSS 9.5), which enables unauthenticated remote code execution via shared ASP.NET machine keys and has an active Mandiant-confirmed post-exploitation chain including in-memory web shell deployment and Cobalt Strike delivery. Defenders should simultaneously address credential-based data exfiltration risks exposed by the Lithuania national registry breach and CDN-layer C2 blind spots introduced by the Underminr technique, as both represent gaps that perimeter and DNS-based controls will not close without targeted tuning.