Ransomware. From Our Analysts.
Ransomware research: active groups, leak-site activity, attack methods and trends, plus practical steps to reduce your exposure and prepare your response.
Ransomware Ransomware 101 Ransomware attacks have become increasingly common and can be devastating for individuals and organizations. Learn how they work and how to prevent them. 
Ransomware [Research Summary]:Pandora Ransomware Technical Analysis Report Pandora ransomware targets corporate networks and uses double extortion. Learn its .pandora file extension, ransom note name and how to reduce the risk. 
Ransomware [Research Summary]: AvosLocker Ransomware AvosLocker ransomware is a RaaS operation first detected in 2021. See how its affiliates extort victims, which countries and sectors it targets. 
Ransomware Most Common Attack Vectors & Ransomware Threat Relation Learn the most common attack vectors, from phishing to brute force, and the top 10 MITRE ATT&CK techniques ransomware operators use, with detection tips. 
Ransomware YES! Ransom Gangs Retarget Same Companies, Learn Why! Ransom gangs often retarget the same companies. Learn why ransomware victims are hit again, how attacks start and what to do to cut the risk. 
Ransomware How Ransomware Groups Evolve in Time and What to Expect in the Future Ransomware, in which an attacker steals or freezes an organization's computer systems or data and demands a ransom payment to restore access to them. 
Ransomware The Most Affected Products by Vulnerabilities Which products are hit hardest by vulnerabilities? See the most exploited CVEs and CWEs, how ransomware groups use them, and how to reduce the risk. 
Ransomware [Research Summary]: Zebrocy Malware Zebrocy malware is a Trojan used by APT28 (Sofacy) since 2015 for espionage. See its components, targets, collected file types and how it works. 
Ransomware What Should You Know About Ransomware Ransomware is an easy way to profit since attackers directly demand ransom. They do not have to infiltrate sensitive data and sell them to others. 
Ransomware Initial Access Methods: How Malicious Actors Do Infiltrate Companies? Initial access explained: the five MITRE ATT&CK techniques attackers use to get into a network, how to detect each one, and how to reduce the risk. 
Ransomware Learn How to Avoid Hackers with 3 Easy Steps Hackers are constantly operating in the dark web network. They share among themselves the evil deeds they do to do business or to gain a reputation. 
Ransomware LockBit 3.0 Technical Analysis Report LockBit 3.0, also called LockBit Black, followed LockBit 2.0 with Zcash payments, a leak site search and a bug bounty program. See what changed. All 5 pages
About The Blog.
Last updated June 9, 2026-
Articles on ransomware, APT groups, the dark web, digital risk protection, fraud, sector analysis and VIP security, written for security teams.
-
New articles are added several times a month. The newest come first, and every article shows its publish date.
-
Use the topic chips above the list to open one topic, or type a word in the search box. Each topic has its own page.
-
Articles draw on public sources such as CISA advisories, MITRE ATT&CK and ENISA reports. Sources are listed at the end of an article when it cites them.
-
The site feed at brandefense.io/feed/ lists new posts. The email sign-up box is on the All Resources and Reports pages.
-
Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo on your own domain from the Request A Demo page.
-
The count at the top of the blog page shows the current total, and each topic chip shows how many articles that topic holds. You can open all of them or pick one topic, such as APT Groups, Dark Web, Ransomware or Fraud. Each article shows its publish date.
-
The blog describes its articles as explained by the analysts who track threats. They cover threat actors, dark web activity, ransomware and digital risk. The newest articles appear first.
-
Yes. APT Groups is one of the topic chips above the list, and it opens only the articles on that topic. The Knowledge Hub also holds profiles of threat groups.
-
The surface web is the part of the internet that search engines list. The deep web is content that search engines do not list, such as pages behind a login. The dark web needs special software to reach. The blog has an article that explains the three layers in plain words.