Brandefense Blog. Cybersecurity And Risk.
Threat actors, dark web activity, ransomware and digital risk, explained by the analysts who track them.
Featured · Dark Web5 Min Read
How to Check If Your Company Is in Infostealer Logs: Free Options Compared
We ran the free infostealer log checks we could reach from a script on our own domain and a test mailbox, and show what each returned.
Nov 01, 2026Read The Article
Blog Subdomain Takeover: How It Happens and How to Find It First See a subdomain takeover step by step with real DNS output from our lab, then use outside-in checks and the right fix order to close dangling…
APT Groups North Korea AI Hacking: What Microsoft Documented Across Eight Groups Microsoft rated eight North Korean hacking groups on AI use. What it documented, what it only inferred, and what defenders should change now.
Blog DevOps Security: What the Binance, PHP2Shell and WordPress Attacks Teach DevOps security protects the laptops, signing services, admin interfaces and update paths that run your systems. Three October attacks show where to start.
Dark Web Binance Hack on Telegram and X: Guesses in Minutes, a Name in Hours We traced 668 Blackhole posts and 2,255 X posts on the Binance hack: how guesses, facts and the attacker's name spread, and who tried to profit.
Fraud How Cybercriminals Are Attacking Financial Firms Worldwide See how financial firms face AI-assisted intrusions, payment API abuse, cloud desktop compromise, wallet theft and impersonation, with response priorities.
Digital Risk Protection Free Domain Security Checks: DMARC, TLS and Exposed Assets in One Afternoon Eight free domain checks with the exact commands: DMARC, SPF, DKIM, MTA-STS, TLS, CAA, certificate logs and security.txt, run on our own domain.
Ransomware The Gentlemen Ransomware Claims 38 Victims in One Day On 26 October 2026 Blackhole recorded 38 victim entries credited to The Gentlemen, not verified by us. Here is the batch pattern and what to patch…
Ransomware Ransomware in September 2026: 857 Victims Across 82 Groups, and What October Added Atlas data: 857 ransomware victims from 82 groups in September 2026. See the top groups, sectors, countries and what October added so far.
Blog CAASM vs EASM: The Inside View and the Outside View of Your Assets CAASM reads your own tools; EASM looks in from the internet. See what each one finds and misses, with CISA and NCSC guidance on asset discovery.
Blog Build a Threat Intel MCP Server in Python With No API Keys Build a read-only threat intelligence MCP server in Python with FastMCP, using NVD, CISA KEV, EPSS and Shodan InternetDB, then connect it to Claude Code.
Blog Claude Agent SDK in Python: Build an Alert Triage Agent A Claude Agent SDK tutorial in Python: build an alert triage agent that calls an MCP server, blocks other tools with a hook and waits for…
Blog OpenCTI vs MISP Compared: Run Both Locally and Query Them With an AI Agent Compare OpenCTI and MISP side by side on data model, API, memory and license, then run both in Docker and query them with an AI agent… All 42 pages
Most read
Start with what readers open most.
Blog How Nation-State Cyber Threats Are Evolving – Part I How nation-state groups such as Mustang Panda, Sandworm, OilRig and Lazarus operate in 2025, and how defenders can prepare.
Blog Using Bettercap in Penetration Testing Bettercap is MITM attack tool developed to for users who are likely to be penetration testers to test and improve the security of networks.
Blog From Shadow IT to Shadow AI: Clawdbot (Moltbot/Openclaw) and the Rise of Unmanaged Agent Gateways Shadow AI is emerging as the next evolution of Shadow IT. This analysis reveals how misconfigured Clawdbot agent gateways expose LLM keys, corporate data, and integration…
APT Groups APT29 (Cozy Bear): Aliases, Attacks and Defenses APT29, also known as Cozy Bear, is one of Russia’s most persistent cyber espionage groups. From SolarWinds to Microsoft, their operations highlight the sophistication of identity-based…
Blog What Is NIST Cybersecurity Framework v2.0? Key Updates and Benefits Discover NIST Cybersecurity Framework v2.0, its new “Govern” function, benefits, and how it compares to ISO 27001 for managing cyber risks.
Blog What Is Credential Stuffing? How the Attack Works and How to Stop It Credential stuffing explained: how attackers test real stolen username and password pairs across services, where the lists come from, and how to detect it. Browse by topic
- Security News 273
- Threat Intelligence Researches 165
- Digital Risk Protection 126
- APT Groups 85
- Ransomware 51
- Malware Analysis Reports 43
- Sector Analysis 34
- Dark Web 31
- Reports 19
- Fraud 16
- Ransomware Trends Reports 15
- We in the Press 11
- VIP Security 7
- Whitepapers 7
- Country Reports 6
- Customer Stories 4
- E-Book 4
- Pharmaceutical 1
- Technology 1
- Aviation & Aerospace 1
- Retail & Fashion 1
About The Blog.
Last updated June 9, 2026-
Articles on ransomware, APT groups, the dark web, digital risk protection, fraud, sector analysis and VIP security, written for security teams.
-
New articles are added several times a month. The newest come first, and every article shows its publish date.
-
Use the topic chips above the list to open one topic, or type a word in the search box. Each topic has its own page.
-
Articles draw on public sources such as CISA advisories, MITRE ATT&CK and ENISA reports. Sources are listed at the end of an article when it cites them.
-
The site feed at brandefense.io/feed/ lists new posts. The email sign-up box is on the All Resources and Reports pages.
-
Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo on your own domain from the Request A Demo page.
-
The count at the top of the blog page shows the current total, and each topic chip shows how many articles that topic holds. You can open all of them or pick one topic, such as APT Groups, Dark Web, Ransomware or Fraud. Each article shows its publish date.
-
The blog describes its articles as explained by the analysts who track threats. They cover threat actors, dark web activity, ransomware and digital risk. The newest articles appear first.
-
Yes. APT Groups is one of the topic chips above the list, and it opens only the articles on that topic. The Knowledge Hub also holds profiles of threat groups.
-
The surface web is the part of the internet that search engines list. The deep web is content that search engines do not list, such as pages behind a login. The dark web needs special software to reach. The blog has an article that explains the three layers in plain words.