Sources come first
Every report starts from primary material: the vendor or government advisory, the court filing, the regulator's notice, the researcher's own write-up. News coverage tells us where to look; it is not the evidence. Where a news report is the only source, we say so.
Every page we cite is fetched and recorded at the time of writing, including the date the page states for itself. A page that does not contain what it is cited for is not cited. A date that a page does not state is not used.
Public datasets are cited to their publishers: vulnerability records to NVD and the CISA Known Exploited Vulnerabilities catalogue, techniques to MITRE ATT&CK, and leak-site figures to ransomware.live.
Facts and assessments are kept apart
Statements of fact carry an inline attribution to their source. Our judgements are labelled as assessments and use estimative language: almost certain, highly likely, likely, a realistic possibility, unlikely, highly unlikely and remote chance, in the order of the UK Professional Head of Intelligence Assessment probability yardstick.
We record each claim as one of four classes:
| Class | Meaning |
|---|---|
| Direct observation | Something we observed ourselves |
| Derived analysis | Our analysis of recorded evidence |
| Citation | Something a source reports, attributed to that source |
| Assertion | A claim a source makes without supporting evidence |
A source reporting an observation is still a citation in our work. It does not become our observation.
Admiralty grading
Key judgements carry an Admiralty code. The letter grades the source's reliability and the number grades the information's credibility. The two are assessed separately and by hand.
| Reliability | Meaning | Credibility | Meaning |
|---|---|---|---|
| A | Completely reliable | 1 | Confirmed by other sources |
| B | Usually reliable | 2 | Probably true |
| C | Fairly reliable | 3 | Possibly true |
| D | Not usually reliable | 4 | Doubtful |
| E | Unreliable | 5 | Improbable |
| F | Reliability cannot be judged | 6 | Truth cannot be judged |
The codes are judgements, not probabilities. See Intelligence Reliability for how the system is applied. Articles published before 2026 that use "High" or "Moderate" confidence keep that legacy grading as published.
Attribution and names
Threat groups carry different names from different vendors. We list each alias with the vendor that uses it, and we do not merge names on the strength of a chain of overlaps. A country or government is named as responsible only as an assessment with its source, unless an official government advisory states it.
Victims and leak sites
Ransomware leak-site postings are criminal claims. We report them as counts by group, sector and country, attributed to ransomware.live. We name a victim only when the organisation itself, a regulator or a reputable outlet has confirmed the incident.
Safety
We describe attacker techniques at the level defenders need. We do not publish exploit code, proof-of-concept material, bypass steps or build instructions. Commands appear only for detection, hunting or remediation. Indicators of compromise are defanged, for example example[.]com and 192.0.2[.]1.
The weekly and monthly series
The weekly threat briefings and monthly threat reviews from March to October 2026 were compiled retrospectively. Each is dated to the week or month it covers and cites only sources dated on or before that date. Later developments appear in later briefings and in the actor profiles.
Actor profiles are living documents. Each profile shows its version history, and earlier profile articles remain in the archive as they were published.
AI assistance
Drafts are prepared with the help of AI tools. Before publication, every citation is checked against the recorded source, and a separate review tests each claim against the passage that supports it.
Corrections
When we get something wrong, we correct it openly. A correction states what changed, when, and why, and is listed on the Corrections page. We do not silently rewrite published reporting.