Brandefense Blog. Cybersecurity And Risk.

Threat actors, dark web activity, ransomware and digital risk, explained by the analysts who track them.

Cracked glass padlock with red log fragments drifting from the keyhole Featured · Dark Web5 Min Read How to Check If Your Company Is in Infostealer Logs: Free Options Compared We ran the free infostealer log checks we could reach from a script on our own domain and a test mailbox, and show what each returned. Nov 01, 2026Read The Article
Glowing arrow signpost pointing to an empty frame, cover art for subdomain takeover and dangling DNS recordsBlog Subdomain Takeover: How It Happens and How to Find It First See a subdomain takeover step by step with real DNS output from our lab, then use outside-in checks and the right fix order to close dangling… Oct 31, 20268 Min Row of dark glass gauges with red needles, cover art for North Korea AI hackingAPT Groups North Korea AI Hacking: What Microsoft Documented Across Eight Groups Microsoft rated eight North Korean hacking groups on AI use. What it documented, what it only inferred, and what defenders should change now. Oct 30, 20267 Min Dark glass control console with an open service hatch and red neon lines, cover art for DevOps security lessonsBlog DevOps Security: What the Binance, PHP2Shell and WordPress Attacks Teach DevOps security protects the laptops, signing services, admin interfaces and update paths that run your systems. Three October attacks show where to start. Oct 30, 20268 Min Chain of glass speech bubbles relaying a red signal, cover for an analysis of how the Binance hack spread on Telegram and XDark Web Binance Hack on Telegram and X: Guesses in Minutes, a Name in Hours We traced 668 Blackhole posts and 2,255 X posts on the Binance hack: how guesses, facts and the attacker's name spread, and who tried to profit. Oct 30, 20267 Min Dark glass vault door with a glowing red crackFraud How Cybercriminals Are Attacking Financial Firms Worldwide See how financial firms face AI-assisted intrusions, payment API abuse, cloud desktop compromise, wallet theft and impersonation, with response priorities. Oct 29, 20267 Min Dark glass envelope inside red inspection rings, cover art for: Free Domain Security ChecksDigital Risk Protection Free Domain Security Checks: DMARC, TLS and Exposed Assets in One Afternoon Eight free domain checks with the exact commands: DMARC, SPF, DKIM, MTA-STS, TLS, CAA, certificate logs and security.txt, run on our own domain. Oct 28, 20267 Min Dark glass cascading row of glass padlocks with red neon lines, cover art for: The Gentlemen Ransomware Claims 38 Victims in One DayRansomware The Gentlemen Ransomware Claims 38 Victims in One Day On 26 October 2026 Blackhole recorded 38 victim entries credited to The Gentlemen, not verified by us. Here is the batch pattern and what to patch… Oct 27, 20266 Min Dark glass stacked glass ledger tablets with red neon lines, cover art for: Ransomware in September 2026: 857 Victims Across 82 GroupsRansomware Ransomware in September 2026: 857 Victims Across 82 Groups, and What October Added Atlas data: 857 ransomware victims from 82 groups in September 2026. See the top groups, sectors, countries and what October added so far. Oct 27, 20267 Min Dark glass two-way mirror with red neon lines, cover art for: CAASM vs EASMBlog CAASM vs EASM: The Inside View and the Outside View of Your Assets CAASM reads your own tools; EASM looks in from the internet. See what each one finds and misses, with CISA and NCSC guidance on asset discovery. Oct 27, 20267 Min Dark glass server block wired to four small glowing cubes, cover art for: Build a Threat Intel MCP Server in Python With No API KeysBlog Build a Threat Intel MCP Server in Python With No API Keys Build a read-only threat intelligence MCP server in Python with FastMCP, using NVD, CISA KEV, EPSS and Shodan InternetDB, then connect it to Claude Code. Oct 25, 202614 Min Dark glass small robot arm sorting alert cards into trays with red neon lines, cover art for: Claude Agent SDK in Python: Build an Alert Triage AgentBlog Claude Agent SDK in Python: Build an Alert Triage Agent A Claude Agent SDK tutorial in Python: build an alert triage agent that calls an MCP server, blocks other tools with a hook and waits for… Oct 25, 202623 Min Dark glass two vaults joined by a bridge with red neon lines, cover art for: OpenCTI vs MISP Compared: Run Both Locally and Query Them With an AI AgentBlog OpenCTI vs MISP Compared: Run Both Locally and Query Them With an AI Agent Compare OpenCTI and MISP side by side on data model, API, memory and license, then run both in Docker and query them with an AI agent… Oct 25, 202623 Min
All 42 pages

Most read

Start with what readers open most.

Browse by topic

FAQ

About The Blog.

Last updated June 9, 2026
  • Articles on ransomware, APT groups, the dark web, digital risk protection, fraud, sector analysis and VIP security, written for security teams.

  • New articles are added several times a month. The newest come first, and every article shows its publish date.

  • Use the topic chips above the list to open one topic, or type a word in the search box. Each topic has its own page.

  • Articles draw on public sources such as CISA advisories, MITRE ATT&CK and ENISA reports. Sources are listed at the end of an article when it cites them.

  • The site feed at brandefense.io/feed/ lists new posts. The email sign-up box is on the All Resources and Reports pages.

  • Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo on your own domain from the Request A Demo page.

  • The count at the top of the blog page shows the current total, and each topic chip shows how many articles that topic holds. You can open all of them or pick one topic, such as APT Groups, Dark Web, Ransomware or Fraud. Each article shows its publish date.

  • The blog describes its articles as explained by the analysts who track threats. They cover threat actors, dark web activity, ransomware and digital risk. The newest articles appear first.

  • Yes. APT Groups is one of the topic chips above the list, and it opens only the articles on that topic. The Knowledge Hub also holds profiles of threat groups.

  • The surface web is the part of the internet that search engines list. The deep web is content that search engines do not list, such as pages behind a login. The dark web needs special software to reach. The blog has an article that explains the three layers in plain words.