Evidence-led cyber threat intelligence for defenders. Incident reports, actor profiles and vulnerability analysis — written for the people who have to act on it.
Updated through October 2026: Qilin affiliate operations, Check Point VPN exploitation, broker overlap and the limits of shared-service attribution. Historical credential theft and MSP cases remain clearly dated.
Current evidence connects Rhysida deployments to signed fake installers, Gootloader and persistent backdoors. This profile separates the ransomware service from Vanilla Tempest and shared suppliers, with investigation and recovery priorities.
Profile of The Gentlemen (Storm-2697), a ransomware-as-a-service operation active since at least July 2025: affiliate model, maintained EDR-killer suite, reported initial access routes, claimed victimology, detection pivots and attribution limits.
TraderTraitor’s developer targeting, transaction manipulation and measured persistence, with source-specific actor names and the limits of each investigation kept distinct.
Binance reports about $6.3bn affected. On-chain evidence exposes withdrawal and delegation abuse; TRM attributes the attack to TraderTraitor. What the evidence establishes and what remains unresolved.
An investigation of UEFI rootkits and bootkits: persistence layers, campaign evidence, attribution limits, forensic artefacts and recovery beyond a Windows rebuild.
APT41 tradecraft, verified vendor names and persistence, with Kaspersky’s medium-confidence BlackX assessment distinguished from the separate FishMonger reporting.
Mandiant's BeyondTrust findings show how appliance compromise becomes persistent access. The SolarWinds comparison concerns trust and recovery, without implying common attribution.
CVE-2026-97631 exposes vulnerable EDK II systems during PXE network boot. The urgent questions are network reachability, the firmware build and whether its vendor has shipped the fix.
ESET reports Sednit activity in April–September 2026. This APT28 profile separates recurrent mail and router operations from documented LoJax firmware persistence and measured surveillance duration.
Brotli's CVE-2026-111497 is now in CISA's exploited-vulnerability catalogue. Exposure depends on the decoder and data path, with distinct fixes for Node.js, Python, .NET and PHP Windows builds.
CISA lists PHP's CVE-2026-109618 and CVE-2026-109619 as exploited. Complete remediation requires patched serving runtimes, worker restarts and checks for distribution backports.
