News Explainer
CTEM in Practice: Five Stages From the Outside In
CTEM runs exposure work as a cycle: scope, discover, prioritize, validate, mobilize. Here is what each stage needs from outside-in data.
Blog · 528 Articles
Blog. Cybersecurity And Risk.
Threat actors, dark web activity, ransomware and digital risk, explained by the analysts who track them.
02 All Articles
All Blog Articles. Newest First.
Dark Web
Combolists Explained: How Combo Lists Are Built, Sold and Recycled
A combolist is a file of username and password pairs compiled from many breaches. See how it differs from stealer logs and credential dumps and what to do.
Dark Web
Carding Forums and Sites: How Stolen Card Data Is Sold and How Banks Detect It
What carding forums and card shops sell, how stolen card data reaches them, and how banks and merchants detect the fraud, with our own 2026 data.
Ransomware
Ransomware examples: attacks, types and groups
Ransomware examples explained: five documented attacks, the main types of ransomware and the groups named in recent government advisories.
Dark Web
Is Telegram Safe? What It Protects and What Security Teams See on It
Is Telegram safe? Only secret chats and calls are end-to-end encrypted. What it stores, how accounts get hijacked, what criminals post, and what to do.
Dark Web
Deep Web vs Dark Web vs Surface Web: What Is the Difference?
Deep web vs dark web vs surface web in plain words: what each layer is, what is legal and what it means for a company, from US government research.
Dark Web
BreachForums and DarkForums: Timeline, Successors and What to Watch
DarkForums is a forum that security vendors describe as a successor to BreachForums. See the dated RaidForums and BreachForums timeline from US sources.
Ransomware
Top 10 Ransomware Variants Reported to the FBI in 2025
The FBI IC3 2025 report names the 10 ransomware variants most reported to the FBI, from Akira to Medusa, with the sectors hit and the FBI advice.
Sector Analysis
Most targeted EU sectors in 2025: the ENISA ranking
ENISA’s 2026 threat report ranks public administration first among targeted EU sectors in 2025. It had 31.8% of recorded events. Business services (8.5%), transport (8%), manufacturing (6.9%) and finance/banking (5.6%)...
Sector Analysis
UK retail attacks 2025: lessons for retailers
What the NCSC, ICO and NCA said after the 2025 attacks on M&S, Co-op and Harrods, and the helpdesk, MFA and admin account checks a CISO can run now.
Vulnerability Advisory
CVE-2026-104286: FortiMail Unauthenticated Arbitrary File Write Zero-Day Under Active Exploitation
A CVSS 9.8 FortiMail zero-day (CVE-2026-104286) lets an unauthenticated attacker write any file on the appliance through the IBE handler. Here is what is affected, how to check for compromise, and how to fix it.
How-To Guide
How to triage a leaked password alert
Learn how to triage a leaked password alert in five steps: check it is real, find out how it leaked, rate the risk, then reset and review logs.
03 More To Read
010203040506
Threat Research
What a 0-Day Ad Really Sells: 37 of 93 Are Unnamed-Exploit Claims
Threat Research
What WormGPT and Other AI-Branded Tool Ads Sell
Threat Research
Why Web Shell, cPanel and RDP Prices Do Not Add Up
Threat Research
The September Surge in Access-Labelled Posts
Threat Research
Most Initial Access Offers We Read Sold Websites, Not Networks
Threat Research
Anatomy of a Corporate Network Access Listing
05 FAQ
About The Blog.
Knowledge Hub →01What does the Brandefense blog cover?
Articles on ransomware, APT groups, the dark web, digital risk protection, fraud, sector analysis and VIP security, written for security teams.
02How often is the blog updated?
The newest articles appear first, and every article shows its publish date.
03How do I find articles on one topic?
Use the topic links above the list to open one topic, or type a word in the search box. Search and topic filters cover the full article collection.
04Where do the facts in the articles come from?
Articles draw on public sources such as CISA advisories, MITRE ATT&CK and ENISA reports. Sources are listed at the end of an article when it cites them.
05How do I get new articles by email or feed?
The site feed at brandefense.io/feed/ lists new posts. The email sign-up box is on the All Resources and Reports pages.
06What does Brandefense do?
Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo from the Request A Demo page.
07How many articles are on the Brandefense blog?
This collection currently contains 528 public articles. The page shows the total at the top and the count for each topic next to its name. Each article shows its publish date.
08Who writes the Brandefense blog?
The blog describes its articles as explained by the analysts who track threats. They cover threat actors, dark web activity, ransomware and digital risk. The newest articles appear first.
09Does the blog have articles about APT groups?
Yes. The Knowledge Hub also holds profiles of threat groups. Use the topic links or article search to explore the coverage.
10What is the difference between the deep web, the dark web and the surface web?
The surface web is the part of the internet that search engines list. The deep web is content that search engines do not list, such as pages behind a login. The dark web needs special software to reach.
Stay Ahead of Digital Threats.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.