Topic
Security discipline of tracking threat actors, their tools and campaigns, and of detecting, containing and recovering from intrusions such as ransomware.
Group-IB found a public reference to a KGB RAT server at version 0.1 from January 2022, years before the trojan went on sale from $150 a month. Group-IB says the "administration tool" pitch covers a surveillance and control toolkit.
Reality
Cisco Talos's February 2025 analysis of Salt Typhoon's telecom intrusions found the actor used stolen legitimate logins on Cisco devices in all but one case. It then pulled more logins from weakly encrypted router configs and captured TACACS and RADIUS keys, so credentials stored on network gear are the first exposure for defenders to close.
Reality
Cisco Talos tracks UAT-11985, an APT sending Taiwan research affiliates fake event invites that lead to a Google login proxy capturing MFA codes. The proxy relays entries to Google in real time, so a code typed into the fake page reaches the attacker first.
Reality
Recorded Future says TAG-217 was testing infrastructure and assembling attack tools in August 2026, weeks before South Korea's bank breaches surfaced. Insikt says exposed directories gave it the timeline and give defenders openings to spot related activity.
Reality
Unit 42 tracks CL-UNK-1211, which hit government Linux systems from October 2025 to April 2026 and planted fake red-team markers. Unit 42 has not determined whether a state or a criminal group is behind it.
Reality
Cisco Talos and Recorded Future tie a June 2025 to August 2026 campaign against CIS governments to UAT-6275. Talos rates its Kazakhstan nexus at medium confidence, and Recorded Future tracks the same activity as TAG-193.
Perspective Coverage
4 publishersReality
Infoblox ties the Help TDS traffic distribution system, active since at least 2017, to a Russian-language affiliate program called Hotejka. The Hacker News reports the scams run on more than 20,000 Cloudflare Pages domains and aim to put remote desktop tools on victims' machines.
Reality
Recorded Future's Insikt Group assesses that Russia's VPN, platform and shutdown controls since mid-2025 will likely fall short of a sovereign internet. Organizations operating in Russia face rising surveillance and legal risk from the controls, Insikt says.
Reality
Check Point researchers tied 10,187 domains in one September window to a phishing network whose root pages return 404 while lures sit on hidden paths. A root-page check can clear a live site when the full URL arrives by SMS, email or WhatsApp.
Reality
ReversingLabs says it expanded the two file hashes in Anthropic's Midnight Blizzard report into a campaign map in five pivots. RL says Anthropic's appendix does not list the servers, lures and domain links it found.
Reality
Check Point's October 9 analysis of leaked Luna Moth files describes one operator calming the victim by phone while another runs the remote session. The files surfaced on an anonymous onion site and Check Point words its conclusion conditionally, so the call pattern is usable for training but unverified.
Reality
Cohesity data puts Qilin and The Gentlemen behind 32% of UK ransomware attacks. UK volume rose 60% on the quarter, and a watchlist of two names covers a third of it, leaving 68% with other actors.
Reality
Comparitech counted 2,627 ransomware attacks claimed in Q3 2026, a quarterly record up 27% on Q2 and 61% on a year earlier. Victims have confirmed 247 of those claims, so the record is mostly a count of what the gangs themselves assert.
Reality
A single actor used a free Chinese pentest agent and four commercial AI models to breach South Korean financial firms in about two weeks. The free, resold toolkit let one person breach several firms at once, and researchers expect adversaries to keep using it to lift their tempo.
Reality
A public proof-of-concept for CVE-2026-88771 pushed a stealthy NetScaler zero-day into mass exploitation, with fewer than 10% of exposed hosts patched. Citrix admits its detection script may miss intrusions, so exposed appliances should be treated as breached.
Reality
Microsoft's 2026 Digital Defense Report says intrusions spanning identity, cloud and supply chains become clearer when defenders join separate signals. Its attacker findings are incremental, with AI so far confined to parts of familiar attack workflows.
Perspective Coverage
7 publishersReality
Huntress found legitimate remote management software abused in 45% of the endpoint incidents it logged in the first quarter of 2026. A rogue copy can behave like IT's approved one, so defenders have to know which tools are sanctioned and how each install arrived.
Reality
Attacker server logs show the Coruna iOS WebKit kit compromising a live iPhone's browser in six seconds, two months after Google published its teardown. It fired with no tap from the user, on a phone still running iOS 15.8.3.
Reality
NCC Group counted 1,073 ransomware attacks in August, a second straight 2026 high and 12% above July. Industrial companies took 31% of them, up from 28% in July, so the hardest-hit sector drew a larger slice of a larger total.
Reality
Disclosures doubled year over year while actually-exploited vulnerabilities rose 8%. The arithmetic retires patch-everything SLAs and leaves exploitability triage as the defensible option.
Perspective Coverage
3 publishersReality
Security · August 25, 2026 · Confirmed2 publishers
Security · August 29, 2026 · Confirmed3 publishers
Product · September 10, 2026 · Confirmed2 publishers