Research lab
Recorded Future's threat intelligence research division, publishing reports tracking nation-state hacking groups, cybercrime, and fraud schemes.
Recorded Future says TAG-217 was testing infrastructure and assembling attack tools in August 2026, weeks before South Korea's bank breaches surfaced. Insikt says exposed directories gave it the timeline and give defenders openings to spot related activity.
Reality
The new backdoor, HOOKEDGE, is a Windows batch script that beacons to a free webhook.site endpoint. Insikt Group calls the BlueDelta attribution moderate confidence, resting on overlap with the older HEADLACE implant.
Perspective Coverage
3 publishersReality
Huntress found suspected DPRK workers inside an Australian healthcare company and a sales hire wearing a stolen identity, which puts the screening that catches them in the hands of recruiters and background-check vendors.
Reality
Recorded Future's Insikt Group says Russia-linked sabotage in Europe rose four-fold from 2023 to 2024 and held at that level in 2025. It expects Russia to escalate in the near term, possibly into a full-scale New Generation Warfare campaign.
Reality
Recorded Future's profile of a phishing and money-laundering vendor on the Dabai and Xinbi guarantee marketplaces documents at least 100 Telegram usernames and multiple virtual numbers bought via Fragment Market.
Reality
Insikt Group counted 215 actively exploited CVEs in six months, up 34% year on year, and describes attackers running them through remote access utilities, package registries and payment flows defenders already permit.
Reality
The National Cybersecurity Plan 2025-2030 loads its operational machinery into a single legislative year. Firms operating in Mexico should budget for weak state incident response until it lands.
Reality
Recorded Future logged three CopyCop impersonations against the US-Armenian Firebird AI data center in a 20-day window, the last of them fabricating an Iranian military case for hitting it.
Reality
Recorded Future says one PurpleDelta cluster applied at more than 1,100 companies and was likely employed at ten or more. The control point is the recruiting funnel, not the SOC.
Reality