Microsoft and Health-ISAC seized domains behind YAM Store, CoGUI and Iron Man, phishing services tied to more than 1 billion messages since January. Microsoft's Steven Masada wrote that the three are only part of a larger criminal network.
Perspective Coverage
14 publishers
- Builder
- Builder 11%
- Operator
- Operator 68%
- Investor
- Investor 21%
Reality
- Evidence70
- Adoption70
- Hype gap+15
- Incentives55
- Confidence74
SOCRadar estimates broker CyberXero stole more than 628,000 records from four Ukrainian organizations with Claude Code and Cobalt Strike. The actor left a server open, and its logs show where the model's refusals held and where a fresh session got around them.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence60
Access broker BraZetsu changed hosts nearly five months before the report that named it
Hunt.io found that BraZetsu's servers had moved hosts months before Group-IB's August 31 report named them. Defenders who block only the published addresses are pointing at infrastructure the operators had already abandoned.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+8
- Incentives45
- Confidence58
UAC-0099, a Russia-aligned group, has pushed its MATCHBOIL downloader from Ukrainian transport firms into a manufacturer and an energy company, ESET says. The researchers tracked the tool for almost two years; it installs MATCHWOK, a C# backdoor that grabs screenshots and runs PowerShell.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence66
The FBI and Secret Service warned Tuesday that FortiBleed is still scanning Fortinet firewalls and SSL VPN gateways with 86,644 stolen credentials. Patching and a password reset will not clear it.
Perspective Coverage
10 publishers
- Builder
- Builder 22%
- Operator
- Operator 69%
- Investor
- Investor 9%
Reality
- Evidence72
- Adoption62
- Hype gap+25
- Incentives40
- Confidence68
The updated CISA-FBI advisory puts Medusa at more than 500 victims as of April 2026, up from 300, with exploits weaponized within 24 hours and sometimes a week before disclosure.
Perspective Coverage
7 publishers
- Builder
- Builder 12%
- Operator
- Operator 79%
- Investor
- Investor 9%
Reality
- Evidence76
- Adoption
- Not scored
- Hype gap+20
- Incentives40
- Confidence74
Researcher matches 205 early Exploit.in handles to later criminal forums
Researcher Dancho Danchev matched 205 handles from a 2005-2008 Exploit.in dump to private messages on five later forums, 26 of them from active early members. A matching handle does not prove a matching person, so 205 is a ceiling, but the forum's core was only about 90 accounts, few enough to follow from board to board.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence40
Karen Vardanyan was arrested in Kyiv in April 2025, extradited within two months, and sentenced this week to 24 months that run against custody already served. Prosecutors had argued that only meaningful sentences change a cybercriminal's math.
Perspective Coverage
5 publishers
- Builder
- Builder 9%
- Operator
- Operator 80%
- Investor
- Investor 11%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence66
Huntress rebuilt a 175-endpoint INC ransomware case from scheduled tasks and a driver fragment
Huntress reconstructed an INC intrusion from the logs that had survived. The tradecraft it found was ordinary operator work, the kind a name-based indicator list misses, and how the attackers first got in is still an open question.
Reality
- Evidence62
- Adoption28
- Hype gap−5
- Incentives65
- Confidence55
Both banks Everest named in April traced the breach to a third-party vendor
Intel 471's 18-month sweep of the underground counted 340 financial-sector extortion victims across 74 countries, 159 firms with access for sale and 562 claimed DDoS attacks. The dated intrusions came in through vendors and help-desk calls.
Reality
- Evidence40
- Adoption55
- Hype gap+22
- Incentives78
- Confidence47
A fake ChatGPT Plus billing alert pushed up to 100,000 emails in a single day
Microsoft Threat Intelligence documents ChatGPT, Copilot, DeepSeek and Claude lures spanning phishing kits, adversary-in-the-middle credential theft, malvertising and fake GitHub installers. A broker it tracks as Storm-3075 resells the access it wins.
Reality
- Evidence42
- Adoption45
- Hype gap+15
- Incentives85
- Confidence50
A $5.80 deposit buys remote execution on hosts BraZetsu has already catalogued
Group-IB says the Exilware crew built BraZetsu to score compromised Iberian and Latin American machines by value and sell entry to whoever wants to run their own payload, which changes how a stealer alert should be triaged.
Reality
- Evidence55
- Adoption38
- Hype gap+18
- Incentives68
- Confidence48
Symantec finds attackers installing the signed Node.js runtime to run their payloads
The Threat Hunter Team says the technique has hit government departments, technology firms and hotels since February 2026. In one case, the operators moved to node.exe only after their Cobalt Strike beacons kept getting blocked.
Reality
- Evidence57
- Adoption58
- Hype gap+16
- Incentives66
- Confidence56
Unit 42's Credential Brief: Hunt The Login That Succeeds Right After The Failures
TheHatman's claimed Entra haul and the FortiBleed spraying wave share one detectable seam: a successful authentication landing just behind a spike of failures.
Reality
- Evidence46
- Adoption58
- Hype gap+12
- Incentives78
- Confidence44