Evidence-led cyber threat intelligence for defenders. Incident reports, actor profiles and vulnerability analysis — written for the people who have to act on it.
Profile of The Gentlemen (Storm-2697), a ransomware-as-a-service operation active since at least July 2025: affiliate model, maintained EDR-killer suite, reported initial access routes, claimed victimology, detection pivots and attribution limits.
Binance reports about $6.3bn affected. On-chain evidence exposes withdrawal and delegation abuse; TRM attributes the attack to TraderTraitor. What the evidence establishes and what remains unresolved.
TraderTraitor’s developer targeting, transaction manipulation and measured persistence, with source-specific actor names and the limits of each investigation kept distinct.
An investigation of UEFI rootkits and bootkits: persistence layers, campaign evidence, attribution limits, forensic artefacts and recovery beyond a Windows rebuild.
APT41 tradecraft, verified vendor names and persistence, with Kaspersky’s medium-confidence BlackX assessment distinguished from the separate FishMonger reporting.
Mandiant's BeyondTrust findings show how appliance compromise becomes persistent access. The SolarWinds comparison concerns trust and recovery, without implying common attribution.
CVE-2026-97631 exposes vulnerable EDK II systems during PXE network boot. The urgent questions are network reachability, the firmware build and whether its vendor has shipped the fix.
ESET reports Sednit activity in April–September 2026. This APT28 profile separates recurrent mail and router operations from documented LoJax firmware persistence and measured surveillance duration.
Brotli's CVE-2026-111497 is now in CISA's exploited-vulnerability catalogue. Exposure depends on the decoder and data path, with distinct fixes for Node.js, Python, .NET and PHP Windows builds.
CISA lists PHP's CVE-2026-109618 and CVE-2026-109619 as exploited. Complete remediation requires patched serving runtimes, worker restarts and checks for distribution backports.
Node.js fixes ten vulnerabilities across supported release lines, including Brotli memory corruption, hostname verification errors and repeated random values in application snapshots.
PHP's 23 October notice identifies a narrow session configuration exposed to a further code execution vector and recommends disabling upload progress pending a regular bugfix release.
