Evidence-led cyber threat intelligence for defenders. Incident reports, actor profiles and vulnerability analysis — written for the people who have to act on it.
Salt Typhoon / OPERATOR PANDA, researched to 31 October 2026: aliases by publisher, evidence for telecom edge-device access, credential capture, collection and persistence, CVE-2023-20198 use, and Q3 2026 incident-response findings.
VYPR is a Conti-derived ransomware seen in one Talos engagement in Q3 2026: vishing to Quick Assist, RMM and MSI delivery, multi-day exfiltration and BYOVD. Its operators are unidentified.
Updated through October 2026: Qilin affiliate operations, Check Point VPN exploitation, broker overlap and the limits of shared-service attribution. Historical credential theft and MSP cases remain clearly dated.
Current evidence connects Rhysida deployments to signed fake installers, Gootloader and persistent backdoors. This profile separates the ransomware service from Vanilla Tempest and shared suppliers, with investigation and recovery priorities.
Profile of The Gentlemen (Storm-2697), a ransomware-as-a-service operation active since at least July 2025: affiliate model, maintained EDR-killer suite, reported initial access routes, claimed victimology, detection pivots and attribution limits.
TraderTraitor’s developer targeting, transaction manipulation and measured persistence, with source-specific actor names and the limits of each investigation kept distinct.
Binance reports about $6.3bn affected. On-chain evidence exposes withdrawal and delegation abuse; TRM attributes the attack to TraderTraitor. What the evidence establishes and what remains unresolved.
An investigation of UEFI rootkits and bootkits: persistence layers, campaign evidence, attribution limits, forensic artefacts and recovery beyond a Windows rebuild.
APT41 tradecraft, verified vendor names and persistence, with Kaspersky’s medium-confidence BlackX assessment distinguished from the separate FishMonger reporting.
Mandiant's BeyondTrust findings show how appliance compromise becomes persistent access. The SolarWinds comparison concerns trust and recovery, without implying common attribution.
CVE-2026-97631 exposes vulnerable EDK II systems during PXE network boot. The urgent questions are network reachability, the firmware build and whether its vendor has shipped the fix.
ESET reports Sednit activity in April–September 2026. This APT28 profile separates recurrent mail and router operations from documented LoJax firmware persistence and measured surveillance duration.
