Blog Articles 2026

2026 214

• 831 Different Texts, One Cash-Withdrawal Pitch All 831 matched fraud posts have different full texts, yet share specific recruitment terms. Our comparison shows why text novelty can mislead triage.
• Account Buyer Rate Sheets: What They Ask Suppliers For Account buyer rate sheets require 2FA secrets, cookies and friend counts. Rate pairs differ; the secret column suggests supplier enrolment.
• Anatomy of a Corporate Network Access Listing We read 120 corporate network access listings in full. Remote-access doors and admin rights lead; revenue bands remain unverified seller claims.
• Breach Databases and Lead Lists Are Sold on Different Terms What is sold in breach database sales? Brandefense compares the units, samples and guarantees of breach database and lead list offers.
• EDR Killer Offers in 2026: Builds, Custom Work and Limited Slots Five dated EDR killer offers distinguish per-build prices, custom work and limited access rights. Asking terms remain separate from tested effectiveness.
• Fresh, Private, Valid: How Combolist Claims Differ in Reposted Text Reposted combolist claims say fresh, private and valid about twice as often as texts not seen twice. What that means for exposure and what to use instead.
• Hacktivist DDoS Claims Are Campaign Notices, Not Incident Reports We read 578 NoName057(16) claim events from 2026. A post is usually a political notice with about five sites and a one-moment check, not an outage record.
• Most Initial Access Offers We Read Sold Websites, Not Networks What does initial access for sale mean? We coded 350 posts and read 469 corporate candidates to separate website footholds from network access.
• One Hacktivist Claim, Many Posts: Which Unit to Count One NoName057(16) claim averages 1.92 collected posts. See why claim events, not posts, are the right unit when a group names your country.
• Phishing Offers Target More Than a Password Our phishing research compares card collection, session claims and user approval across saved ads, showing what each method promises and leaves unproven.
• Phishing Service Ads: Who Does the Technical Work? Compare saved phishing ads to see who supplies the software, runs the servers and charges for support. Service terms reveal the work behind the price.
• RAMP Forum Seizure: Two Ransomware Crews Announced Forum Partnerships After the RAMP seizure, Vect promised forum members affiliate keys; The Gentlemen invited teams and access brokers. Two different distribution offers.
• Ransomware Affiliate Terms: Shares, Entry Gates and Different Responsibilities A high split does not mean an easy way in. Six programme ads in our selected 2026 sample state or imply a split, from…
• Ransomware Builder Prices in 2026: Changing Packages in 59 Days Six dated builder listings across 59 days changed packages and access terms. Two June source-code ads name USD; other dollar denominations are unspecified.
• Ransomware Negotiation for Sale: Staff, Affiliates and Portals Who answers a ransomware victim? Selected 2026 ads offer crew staff, affiliate-run talks and hosted portals, each with different responsibilities.
• Ransomware in 2026: 9,203 Claims, 177 Groups and Splits up to 95% What the crews advertise, what the relays record, and what defenders can infer from 9,203 claims and 60 retained catalogue items.
• Stolen Card Ads Sell Different Promises of Usability Our saved carding records show how refund terms, expiry and access claims shape card offers, and why post counts cannot measure stolen card volume.
• The Human Work Behind Account-Rental Ads Account-rental ads promise travel costs and payment for physical participation. Brandefense examines the human roles described in saved offers.
• The September Surge in Access-Labelled Posts Posts labelled as access sales rose 4.3x on 12 September 2026. Five tests show why de-duplicated offer posts per day did not change detectably.
• What 92,000 “Stealer” Posts in January Really Were One notification template made up 97.5% of the raw "stealer" posts collected from January to April 2026. The count tracks a bot's posting rate, not infections…
• What DDoS-for-Hire Ads Sell That Hacktivist Claims Don’t DDoS-for-hire ads sell time offline or rented capacity, from rival takedowns to phishing cleanup. See how they differ from hacktivist claims.
• What Identity Fraud Bundles Claim About a Person Identity offers bundle documents, same-person claims, email access and business context. Examine the relationships those packages ask buyers to trust.
• What Stealer Sellers Actually Package Stealer sellers split ads into licences, installs, log clouds and tools, yet most priced posts charge by access period. Brandefense compares the terms.
• What WormGPT and Other AI-Branded Tool Ads Sell In 607 texts from seven AI-branded tool searches, including WormGPT, the names mostly label a site, bot, app or prompt pack, rarely the model underneath.
• What a 0-Day Ad Really Sells: 37 of 93 Are Unnamed-Exploit Claims We read 221 posts coded as exploit offers or requests. Of 93 seller posts saying 0-day, 37 got our broad unnamed-exploit code; none names a CVE.
• What a Database Leak Post Actually Claims Brandefense reads 1,124 claims in database leak posts: the fields they list, how counts and units differ, stated data age and access gates.
• What a Family Name Does in a Post Of 160 posts naming Lumma, RedLine, Vidar or StealC, only 6.2% offered the product. More than half used the name to tag logs or retell news.
• What a Malware Subscription Actually Buys Malware subscription terms sell builds and keys, not a detection outcome. See how six ads meter supply and who carries the risk.
• What “Botnet Log” and “Combolist” Posts Actually Sell Hand-read posts under the botnet logs and combolists labels hold bank listings, game lots, rate sheets and subscriptions. Each needs a different defence.
• When a Data Leak Alert Is an SEO Ad: Reading Dark Web Brand Alerts Data leak alerts are often relay cards pointing at forum adverts. See what a card, a retelling and a first-hand post each prove, and how to…
• Where Ransomware Data Reappears After Alleged Failed Talks Selected catalogue descriptions show ransomware data presented as unpriced releases, later reposts and sale offers, with limits on payment decisions.
• Why Web Shell, cPanel and RDP Prices Do Not Add Up Web shell prices, cPanel logins, SMTP and RDP are sold as bulk lots, curated sites and rentals. See why their prices cannot be averaged.
• Why a Credential List Subscription Gets Cheaper by the Day In 144 of 174 eligible credential-list ladder segments, the per-day price falls at every step. What advertised plans and trials do and do not show.
• MAS TRM Guidelines: What They Ask of Threat Intelligence and Third Parties Cyber threat intelligence sits in MAS TRM clause 12.1 and third-party risk in clause 3.4. A plain-English map of both duties for Singapore banks.
• Cyber Threat Landscape Outlook: November 2026 to April 2027 Cyber threat landscape outlook for 31 October 2026 to 30 April 2027: what is most likely, what costs most, warning signs and five defenses.
• How to Check If Your Company Is in Infostealer Logs: Free Options Compared Stealer logs detection with free tools: we ran what a script can reach on our own domain and a test mailbox and show what each one returns.
• Subdomain Takeover: How It Happens and How to Find It First See a subdomain takeover step by step with real DNS output from our lab, then use outside-in checks and the right fix order to close dangling records.
• North Korea AI Hacking: What Microsoft Documented Across Eight Groups Microsoft rated eight North Korean hacking groups on AI use. What it documented, what it only inferred, and what defenders should change now.
• DevOps Security: What the Binance, PHP2Shell and WordPress Attacks Teach DevOps security protects the laptops, signing services, admin interfaces and update paths that run your systems. Three October attacks show where to start.
• Binance Hack on Telegram and X: Guesses in Minutes, a Name in Hours We traced 668 Blackhole posts and 2,255 X posts on the Binance hack: how guesses, facts and the attacker's name spread, and who tried to profit.
• How Cybercriminals Are Attacking Financial Firms Worldwide See how financial firms face AI-assisted intrusions, payment API abuse, cloud desktop compromise, wallet theft and impersonation, with response priorities.
• STIX 2.1 by Example: One Indicator, Line by Line Build STIX 2.1 examples with validated JSON. Add relationships, manage versions and expiry, and learn what validation cannot prove before import.
• Free Domain Security Checks: DMARC, TLS and Exposed Assets in One Afternoon Eight free domain checks with the exact commands: DMARC, SPF, DKIM, MTA-STS, TLS, CAA, certificate logs and security.txt, run on our own domain.
• Ransomware in September 2026: 857 Victims Across 82 Groups, and What October Added Atlas data: 857 ransomware victims from 82 groups in September 2026. See the top groups, sectors, countries and what October added so far.
• CAASM vs EASM: The Inside View and the Outside View of Your Assets CAASM reads your own tools; External Attack Surface Management (EASM) looks in from the internet. See what each one finds and misses, with CISA and NCSC guidance on asset discovery.
• CVE Statistics 2026: 86,533 Records So Far and What Is Driving Them NVD lists 86,533 CVEs published in 2026 by 25 October, against 48,151 in all of 2025. See the numbers, the drivers and how to triage.
• Build a Threat Intel MCP Server in Python With No API Keys Build a read-only threat intelligence Model Context Protocol (MCP) server in Python with FastMCP, using NVD, CISA KEV, EPSS and Shodan InternetDB, then connect it to Claude Code.
• Claude Agent SDK in Python: Build an Alert Triage Agent A Claude Agent SDK tutorial in Python: build an alert triage agent that calls an MCP server, blocks other tools with a hook and waits for approval.
• OpenCTI vs MISP Compared: Run Both Locally and Query Them With an AI Agent Compare OpenCTI and MISP side by side on data model, API, memory and license, then run both in Docker and query them with an AI agent over MCP.
• Turn a Threat Report Into ATT&CK Mappings and Sigma Rules With an AI Agent Let an AI agent map a CISA advisory to ATT&CK and draft Sigma rules, then check them with sigma-cli, pySigma and ATT&CK data. A real run, with fixes.
• SOC Triage With the Elastic MCP Server and a Brandefense MCP Stand-In Connect Claude Code to the Elastic MCP server and a Brandefense MCP stand-in, triage a VPN alert with real tool calls and get a sourced note.
• Build a Brand and Phishing Watch With dnstwist, crt.sh and an AI Agent Run dnstwist and crt.sh as read-only MCP tools. Of 7,503 name variations 8 resolve: 4 ours, 4 look-alikes. Claude Code drafts a takedown a person approves.
• MCP Scanner Test: Three Tools Against a Poisoned MCP Server Snyk Agent Scan, Cisco MCP Scanner and devlab on a clean and a poisoned MCP server: what each caught, what it sent out and which false alarms it raised.
• Red Team Your Threat Intel Agent With Garak, Promptfoo and PyRIT Run garak, promptfoo and PyRIT against a threat intel agent, map the findings to MITRE ATLAS and OWASP, fix them and re-run to see the before and after.
• APRA CPS 230 and CPS 234: What Service Provider Risk Means in Practice CPS 230 and CPS 234 side by side: which clause asks for which evidence, the APRA notice deadlines and a service provider register template.
• AI Ransomware: 4 AI Tools That Crews Use Four AI tools show up in primary reports on ransomware and extortion crews: Claude, Cursor Agent, DeepSeek and Qwen. Who used what, and what to watch.
• HTTP2Shell: One Brotli Flaw, Many Stacks and Their Fixes HTTP2Shell is CVE-2026-111497, the Brotli decoder flaw first called Node2Shell. See which stacks have a fix, the version to run and how to find Brotli.
• How to Defend Against PHP2Shell A practical PHP2Shell mitigation guide: prove the patch is running, see what each temporary control stopped in our lab and which detections caught what.
• How MSSPs Add Threat Intelligence to Their Services: A Rollout Plan A rollout plan for MSSPs: which outside threat signals to add, how to keep client data apart, route alerts and package three service tiers.
• Which Security Products and IT Tools Run on PHP? MISP, GLPI and Zabbix run on PHP, and so do some firewall and VPN products. See which vendors ship PHP, their PHP2Shell status and what to do.
• Brandefense Joins FIRST as an Associate Member Brandefense joined FIRST, the Forum of Incident Response and Security Teams, as an Associate in October 2026. See what that means and what it does not.
• Brandefense Wins at the Top InfoSec Innovator Awards 2026 Cyber Defense Magazine named Brandefense Most Innovative in AI-Powered Cybersecurity Solutions at the Top InfoSec Innovator Awards 2026.
• Node2Shell: Node.js Brotli RCE (CVE-2026-111497), Fixed Versions and How to Check Node2Shell, or HTTP2Shell (CVE-2026-111497), is a Node.js Brotli RCE flaw. Fixed in 22.23.4, 24.22.1 and 26.12.1. See who is exposed and what to do.
• PHP End of Life: Which Versions Still Get Security Fixes PHP 7.4, 8.0 and 8.1 are end of life, and 8.2 follows on 31 December 2026. See every branch date and what our free PHP check saw.
• PHP2Shell Timeline: The First 60 Hours, in Data PHP2Shell timeline of the first 60 hours: Japan's PM post, a Sophos correction, notable X and dark web posts, and our own counts and check data.
• PHP2Shell: Two Critical PHP Flaws Reported as RCE, CVE-2026-109618 and CVE-2026-109619 PHP2Shell checker for CVE-2026-109618 and CVE-2026-109619, with data from 40,849 site checks. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Google’s Dark Web Report Is Gone: What to Use Instead Google shut its dark web report on 16 February 2026. We ran Have I Been Pwned and our own Atlas tool on test inputs and show what came back.
• How the Phishing Takedown Process Works, Step by Step Who controls a phishing page, what ICANN's 2024 rules require and how to escalate: the phishing takedown process as an operator's playbook.
• NYDFS Part 500 in 2026: What Covered Firms Must Show NYDFS Part 500 now requires MFA, an asset inventory and a yearly notice by April 15. Here is what covered firms must show and where outside data helps.
• Typosquatting: How Lookalike Domains Catch Your Users Typosquatting turns one mistyped letter into a phishing site. See the main patterns, how attackers use them and how to spot and remove them early.
• Vendor Risk Assessment From the Outside In A vendor risk assessment should not stop at a questionnaire. Here is how to add outside-in evidence, tier vendors and keep the review current.
• CTEM in Practice: Five Stages From the Outside In CTEM runs exposure work as a cycle: scope, discover, prioritize, validate, mobilize. Here is what each stage needs from outside-in data.
• Combolists, stealer logs and credential dumps explained What combolists, stealer logs and credential dumps are, how they differ, how they spread and how defenders respond. Based on CISA, NIST and MITRE, 2026.
• Carding forums and sites explained: how card data is sold What carding forums and carding sites are, how stolen card data is sold, and what defenders and card issuers do. Built on DOJ and Europol sources, 2026.
• Ransomware examples: attacks, types and groups Ransomware examples explained: five documented attacks, the main types of ransomware and the groups named in recent government advisories.
• Is Telegram safe? What it protects and what it does not Is Telegram safe and encrypted? What its encryption covers, what it stores, why it is still legal, and how criminals abuse it, from official sources.
• Deep Web vs Dark Web vs Surface Web: What Is the Difference? Deep web vs dark web vs surface web in plain words: what each layer is, what is legal and what it means for a company, from US government research.
• BreachForums and DarkForums: takedown timeline BreachForums, DarkForums and RaidForums explained: what happened, when, and what it means. A dated timeline from US official sources, as of October 2026.
• Remote support and file transfer flaws in ransomware attacks SimpleHelp, CrushFTP, GoAnywhere and BeyondTrust flaws were flagged by CISA for ransomware use in 2025 and 2026. Dates, fixes, attribution and checks.
• Five edge VPN flaws CISA flags for ransomware use Five VPN and firewall flaws added to CISA KEV in 2025 and 2026 carry a ransomware flag. Dates, fixed versions and what to check on your own edge devices.
• Two Fortinet events of 2026: what to check Fortinet had two 2026 events: a January SSO login flaw and a June wave of leaked logins. See what a firewall owner checks, from SSO to admin accounts.
• A contractor repo and cloud keys: CISA’s lessons A contractor's personal GitHub repository exposed CISA's cloud keys. What it says about uploads, rotating all admin access and having a playbook ready.
• Exposed PLCs: lessons from the 2026 US advisory US agencies say Iranian-affiliated actors disrupted exposed PLCs. See the attack flow and what water, energy and public facility operators should check.
• NetScaler exposed edge: questions to ask your team What a NetScaler ADC or Gateway owner does first: list appliances, check for compromise before patching, and keep management services off the internet.
• Nx Console and GitHub: dev tools as an entry path How a token stolen on 11 May 2026 led from a developer machine to a poisoned Nx Console extension and GitHub's internal repositories, and what to ask.
• TanStack worm: CI questions every team should ask The TanStack npm worm chained a risky workflow, cache poisoning and a short-lived token. See the CI and monitoring questions a security lead should ask.
• How a Trivy Compromise Reached LiteLLM Releases LiteLLM says a Trivy compromise in its build pipeline led to bad PyPI releases. Sources differ on exposure time. See what to ask about your own pipeline.
• GRU targeting of logistics firms: advisory AA25-141A CISA, NSA, FBI and partners describe a GRU campaign against Western logistics and technology firms: targets, phases, CVEs and the fixes they list.
• Akira ransomware advisory AA24-109A: stages and tools CISA and partners say Akira enters through VPNs without MFA and known CVEs, steals data, then encrypts. A read of advisory AA24-109A, updated Nov 13, 2025.
• Volt Typhoon advisory AA24-038A: what CISA says CISA, NSA and FBI advisory AA24-038A: how Volt Typhoon got in via routers, VPNs and firewalls, stayed up to five years, and what defenders were told to do.
• Software Shared Across ATT&CK Groups: Reuse Study MITRE ATT&CK v19.2 data: Mimikatz is linked to 51 of 176 groups, while 503 of 607 software entries tie to one group. See the top 10 and the limits.
• ATT&CK groups by attributed origin: what is mapped ATT&CK groups by origin named in their text: North Korea and Russia map more techniques (29.5, 27) than China (15.5) or Iran (17.5); T1486 differs most.
• ATT&CK techniques most used across threat groups In MITRE ATT&CK Enterprise data, version 19.2, the most widely mapped technique is Command and Scripting Interpreter. It is linked to 124 of 172…
• KEV due-date windows and pace of additions CISA KEV due dates by year added: mostly 21 days from 2022 to 2025, 3 days in 2026. Plus additions per year and vendor spread across 190 vendors.
• Where KEV entries sit on the EPSS scale, October 2026 1739 KEV entries scored by EPSS on 2026-10-08: median 0.49, 1283 at or above 0.1, 466 at or above 0.9. Only 866 of 4322 CVEs at 0.5+ are in KEV.
• KEV and ransomware: which entries are flagged 361 of 1739 CISA KEV entries (20.8 percent) are flagged as used in ransomware campaigns. Mail and file transfer servers lead at 38.7 percent by class.
• KEV: days from CVE publication to listing, 2024 to 2026 686 KEV entries added 2024 to 2026: median 20 days from CVE publication to listing, 137 on or before day zero, 151 over a year, by year and product class.
• KEV weakness classes: which CWEs recur, 2024 to 2026 Which weaknesses recur in 686 CISA KEV entries added 2024 to 2026: command injection leads, injection is 20.8 percent, and 25.7 percent list no CWE.
• KEV additions 2024 to 2026 by product type Of the 686 entries added to the CISA Known Exploited Vulnerabilities (KEV) catalog from 2024 to 2026 (catalogVersion 2026.10.08), operating systems and mobile platforms…
• Threat intelligence priorities for 2027: agency outlooks What the NCSC and ENISA say defenders should watch toward 2027: exploitation timing, AI-assisted vulnerability research and AI attack surface, as checks.
• Hacktivism and DDoS in 2025: ENISA’s top groups ENISA's 2026 threat report, covering 1 January to 31 December 2025, names a small set of hacktivist groups behind most claimed ideology-driven activity in…
• NIST CSF 2.0: the six functions explained NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. Each one's NIST definition and categories, as listed in CSWP 29.
• Exploited vulnerabilities in 2025: what ENISA reports This is a short list of what ENISA reports about exploited vulnerabilities in 2025. It draws on chapter 7 and the overview of the…
• CVSS, EPSS and CISA KEV: what each signal tells you Which of CVSS, EPSS and the CISA KEV catalogue tells you what? Who runs each signal, what it measures, what it leaves out, and a question to ask of each.
• AI cyber threats in 2026: what the FBI and ENISA report The FBI IC3 and ENISA both report AI use in fraud, deepfakes and intrusions. Here are six themes, plus ENISA's 'highly likely' and 'likely' outlook.
• Top 10 Ransomware Variants Reported to the FBI in 2025 The FBI IC3 2025 report names the 10 ransomware variants most reported to the FBI, from Akira to Medusa, with the sectors hit and the FBI advice.
• ENISA 2026: ClickFix, Smishing and Phishing Kit Trends This list covers the phishing and social engineering trends in the ENISA Threat Landscape 2026, published in September 2026. The report analyses incidents recorded…
• Most targeted EU sectors in 2025: the ENISA ranking ENISA's 2026 threat report ranks public administration first among targeted EU sectors in 2025. It had 31.8% of recorded events. Business services (8.5%), transport…
• Initial access techniques: all 11 in MITRE ATT&CK MITRE ATT&CK lists 11 initial access techniques under TA0001. See every ID, name and MITRE description in one full list, which is not a ranking.
• 2025 CWE Top 25: Most Dangerous Software Weaknesses MITRE's 2025 CWE Top 25 ranks cross-site scripting first. See the top 10 weaknesses with scores, KEV counts, rank changes and what the KEV data adds.
• UK retail attacks 2025: lessons for retailers What the NCSC, ICO and NCA said after the 2025 attacks on M&S, Co-op and Harrods, and the helpdesk, MFA and admin account checks a CISO can run now.
• Salt Typhoon: what telecom customers should do Salt Typhoon breached telecom networks through known flaws. What customers and CISOs should ask carriers and check on their own routers and edge devices.
• Bybit theft: what it teaches about supplier access Bybit says a Safe developer's credentials were compromised. What the $1.5 billion theft teaches a CISO about supplier access and approval tools.
• CVE-2026-104286: FortiMail Unauthenticated Arbitrary File Write Zero-Day Under Active Exploitation FortiMail zero-day CVE-2026-104286 lets one unauthenticated request write any file via the IBE handler. CISA KEV listed. Fixed builds, IoCs and what to check.
• How to triage a leaked password alert Learn how to triage a leaked password alert in five steps: check it is real, find out how it leaked, rate the risk, then reset and review logs.
• The Credential You Published on Purpose: How an Exposed GitLab Email Token Becomes Push Access to Main A GitLab incoming email token in a public README stays valid until reset and lets anyone act as you by email. See how exposed docs widen attack surface.
• Two NetScaler Zero-Days, One Wrong Assumption: Why Patching Does Not Close the Incident NetScaler zero-day flaws CVE-2026-88771 and CVE-2026-88772 are exploited at CVSS 9.5. See the fixed builds, what evidence to capture first and what to rotate.
• CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Zero-Day Under Active Exploitation Email gateway SQL injection CVE-2026-76461 hits Cisco Secure Email Gateway: CVSS 9.8, CISA KEV listed, no workaround. See fixed releases and checks.
• The Leak Site Got Breached: What ShinyHunters’ Takeover of Clop Means for the Companies Listed on It ShinyHunters breached Clop's ransomware leak site and says it holds the onion keys. What changes for listed companies, from re-extortion to forged listings.
• Your Identity Program Was Built for People. Non-Human Identity Is a Growing Way In. Non-human identity, from service accounts to API keys and AI agents, is a growing way into organisations. See why it is missed and how to cut the risk.
• The Phishing Came From Your Real Domain: What a Marketing Platform Breach Does to Brand Trust Phishing hit 347,000 subscribers from a brand's genuine address after a marketing platform breach. Sender authentication passed, because nothing was faked.
• Passwordless Is Not Takeover Proof: Where Passkey Attacks Actually Land Passkey attacks published this year do not break the cryptography. They target the sync fabric, the recovery path, and the enrolment step instead — the parts…
• Your Security Vendors Are Your Highest-Privilege Third Parties, and Your TPRM Program Scores Them Low Security vendor risk is the least examined part of third party risk. See two 2026 cases, why scores run low, and what to ask before your next renewal.
• Agentic Ransomware: What Happens When Malware Doesn’t Need a Human Operator to Decide Who to Hit Next? A single vendor report says an AI agent ran a ransomware attack end to end. What agentic ransomware means for defense timelines, and what is unconfirmed.
• When Abandoned Digital Assets Become Someone Else’s Infrastructure Abandoned digital assets are reachable, unmonitored and still carry your name. See how a forgotten wiki became shared infrastructure and how to respond.
• No Vulnerability Was Exploited: Inside the SaaS Extortion Wave That Breaks In Through Consent, Not Code OAuth consent phishing lets attackers steal SaaS data with a token the victim approved, with no CVE. See how it works, why MFA misses it and how to defend.
• Continuous Monitoring vs. Annual Audit: Why the TPRM Calendar Is Broken Annual audits leave months of blindness between vendor reviews. See what continuous vendor monitoring closes and what DORA, NIS2 and US bank guidance say.
• AI Gateway Exploitation: How Attackers Are Targeting LiteLLM, RAGFlow, and Kestra to Steal Your Model Provider Keys AI gateway exploitation hits LiteLLM, RAGFlow and Kestra, with provider key theft and cryptominers. See the CVEs, CISA KEV status, fixes and IOCs.
• Phishing-as-a-Service 2.0: The Kits That Bypass MFA Without a Fake Login Page Phishing-as-a-service kits now bypass MFA with device code abuse and no fake page. See how the flow works and which controls and logs help defenders.
• CRA Reporting Obligations Now Apply: The 24-Hour Clock Starts When You Find Out CRA reporting obligations have applied since 11 September 2026: 24h early warning, 72h notification, final report. Dates, platform, who must report.
• CVE Volume Is Exploding, But Is Your Risk? Making Sense of 2026’s Vulnpocalypse CISA KEV added 272 entries in 2026 by 23 October. See which flaws mattered and the four filters that replace volume-based triage.
• No Patch Exists Yet: Who Owns the Pre-Disclosure Window? Our H1 2026 analysis found that 32.1% of exploited vulnerabilities were attacked before a fix even existed. Patch velocity cannot close that window. See who should…
• API Sprawl: The Attack Surface Nobody Put On the Inventory API sprawl is the growth of shadow and zombie APIs nobody tracks. Learn how to find unmanaged APIs and follow OWASP API9 and NIST SP 800-228 guidance.
• Device-Code Phishing: The MFA Bypass Method Nobody’s Training Employees On Device code phishing defeats even hardware keys and passkeys. Here is why your awareness training misses it and how to detect it in sign in logs.
• The Board Meeting That Never Happened: Deepfake Video Calls and the New Wire Fraud A finance employee joined a deepfake video call with his CFO. Every face was synthetic. 15 transfers, $25.6 million gone. The protocol that stops it.
• One Vendor, Eleven Crises: Why Your TPRM Program Has a People Data Blind Spot People data vendors such as HR assessment platforms hold sensitive executive profiles yet sit outside most Third-Party Risk Management (TPRM) programs. See the gaps and the fix.
• Why Ransomware Fragmentation Makes Attribution Harder Than Ever Ransomware fragmentation means more short-lived groups and less certain attribution. See why behaviour-based detection beats group-specific playbooks.
• Merger, Acquisition, Forgotten Domain: How M&A Activity Quietly Expands Your Attack Surface Discover how M&A activity expands your attack surface through forgotten domains, abandoned subdomains, legacy systems, and unmanaged cloud assets.
• XSS2Shell (CVE-2026-64638): WordPress Login Page Pre-Auth XSS to RCE Chain Explained XSS2Shell (CVE-2026-64638) is a WordPress login XSS that can lead to PHP code execution. See affected versions, the 7.0.3 fix and how to detect attacks.
• The Hidden Attack Surface Problem: Why Enterprises Do Not See All of Their External Exposure Most enterprises cannot see all of their external attack surface. Learn what creates the hidden part, what it can cost and how to build the business case.
• Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target Top 5 ransomware groups of Q2 2026: Qilin, TheGentlemen, Akira, DragonForce and LockBit5, with their tactics, targets and trends from Cyber Threat Intelligence (CTI) tracking.
• How Spear Phishing Campaigns Target C-Suite Executives: Tactics, Tools, and Defense Learn how spear phishing and whaling campaigns target C-suite executives with AI, OSINT, deepfakes and BEC tactics, and how to defend against them.
• Shadow IT: Why the Assets Your IT Team Doesn’t Know About Are Your Most Dangerous Entry Points Shadow IT is any tool or cloud asset used without IT approval. See how unmonitored SaaS, AI tools and OAuth grants become entry points and how to cut risk.
• WP2Shell Technical Analysis: CVE-2026-63030 & CVE-2026-60137 WordPress Core RCE Chain WP2Shell analysis: how two WordPress core CVEs chain into unauthenticated remote code execution, with affected versions, IoCs, detection and mitigation.
• WIRTE: Covert Espionage Actor Targeting the Middle East and Beyond WIRTE is a cyber espionage group active since at least 2018. Learn its spearphishing, PowerShell malware, cloud-based C2 and how to defend against it.
• Why CVSS Scores Are Lying to Your Security Team (And What to Use Instead) CVSS scores show worst-case severity, not attacker behavior. See how EPSS, the CISA KEV catalog and SSVC help you decide which flaws to fix first.
• The Rise of Supply Chain Cyber Attacks: How Vendor Trust Becomes the Way In A supply chain cyber attack abuses a vendor, package or service you already trust. See how XZ Utils, MOVEit and PowerSchool worked and how to cut risk.
• The Executive Cyber Threat: Personal Email, Home Networks, and Family Members as Attack Vectors Executive cyber threats often begin with personal email, the home network and family members. See the attack paths and the four layers of protection.
• From Disclosure to Exploit: How Fast Are Threat Actors Weaponizing New CVEs? The disclosure to exploit window keeps shrinking. See what drives it, how AI and automation help attackers and why early threat intelligence matters.
• NIS2 and DORA Compliance: What They Require for Third-Party Risk Management Learn how NIS2 and DORA reshape third-party risk management, continuous vendor monitoring, and compliance with actionable security best practices.
• Expired SSL Certificates: How a Lapsed Cert Becomes an Attack Vector An expired SSL certificate is more than a browser warning. Learn how attackers exploit lapsed certificates for interception and phishing, and how to prevent it.
• VIP Security Beyond the Bodyguard: Why Digital Protection Is the New Executive Priority VIP security now includes digital protection. Learn how to defend executives against doxxing, deepfakes, credential theft and impersonation.
• The Breakout Window: How Long Does an Attacker Have Inside Your Network? Breakout time vs dwell time explained: how long attackers stay hidden, how fast they reach a second system, and why defenders have so little time to react.
• How Attackers Use Stolen Credentials: The Complete Account Takeover Lifecycle Account takeover lifecycle for defenders: how combolists, infostealer logs, credential stuffing tools and session hijacking turn stolen logins into access.
• ‘Network Access for Sale’ on the Dark Web: The Anatomy of Initial Access Broker Listings Learn how an initial access broker listing is built, field by field, how access is priced, and how CTI teams can use listings as early warning.
• Vulnerability Exploitation Trends: H1 2026: What Threat Actors Are Actually Using Vulnerability exploitation trends in H1 2026: how threat actors use zero-day and n-day flaws, which technologies and sectors are hit, and what to fix.
• Why Your CISO Is Your Organization’s Highest-Value Attack Target Discover why CISOs and executives are prime cyberattack targets, how attackers exploit their digital footprint, and how to reduce executive cyber risk.
• Why Vendor Security Questionnaires Don’t Work (And What Actually Does) Vendor security questionnaires are self-reported and out of date by the next quarter. See why they fail as a main control and what to add to them.
• Brandefense Contributes to the Verizon 2026 DBIR: Why Threat Intelligence Data Shapes the World’s Most Authoritative Security Report Brandefense proudly contributed to the Verizon 2026 Data Breach Investigations Report. Explore the report's most significant findings and understand how real-world threat intelligence is helping organizations…
• Account Takeover vs. Credential Stuffing: What’s the Difference and Why It Matters Account takeover vs credential stuffing explained: how ATO, credential stuffing, password spraying and brute force differ, plus detection and defenses.
• Lookalike Domains: How a Single Character Difference Becomes a Brand’s Worst Nightmare Lookalike domains use typosquatting, homoglyphs and phishing infrastructure to impersonate brands. Learn how they work and how to detect and remove them.
• Tracking Threat Actors on Blockchain Blockchain threat actor tracking follows public ledger records to show how attackers move funds. See what the Brandefense report covers and why it matters.
• Malicious Document Analysis for SOC Analysts E-book on malicious document analysis for SOC analysts: what it is, how analysts examine suspicious documents, and insights from our research team.
• Effective YARA Rules for Security Researchers Learn what YARA rules are, how they are built from strings and conditions, and how security researchers use them to find malware. Free e-book overview.
• DNS Under Siege:Analysis of Threat Actor-Driven Abuse DNS abuse by threat actors: how attackers hijack DNS records and hide commands in DNS traffic, and what this Brandefense report covers for you.
• CISO’s Guide to Account Takeover Prevention: Detection, Response, and Recovery Account Takeover explained for CISOs: the attack chain, detection signals, incident response steps and hardening that closes the gap after an ATO event.
• Third-Party Risk: How Can Your Supplier’s Vulnerability Lead to Your Breach? Third-party risk is the cyber exposure you inherit from vendors and partners. See how one supplier breach cascades, two 2025 cases, and what to monitor.
• What “Actionable Intelligence” Means for Threat Teams in 2026 Actionable threat intelligence is specific, timely, contextual and decision-ready. Learn the four tests that separate it from raw feeds and CVE scores.
• Agentic AI in Cybersecurity: How Autonomous Agents Are Transforming the SOC Agentic AI in cybersecurity explained: how autonomous agents triage alerts, investigate incidents and contain threats in the SOC, and what to govern.
• From Weeks to Seconds: What AI Actually Changes in the CTI Lifecycle AI in the cyber threat intelligence lifecycle: what changes in each of the six phases, from direction to feedback, and what it means for security teams.
• GC01 (Golden Chickens): Inside the Arsenal of a Premier E-Crime MaaS Provider GC01, also known as Golden Chickens, is a financially motivated MaaS provider. See its tools, HR spear-phishing tactics and how to defend against it.
• ShadyPanda: What Is Known About the Browser Extension Campaign ShadyPanda is a name from one vendor report on malicious browser extensions. See what MITRE ATT&CK confirms, what is unconfirmed and how to cut the risk.
• BlackTech BlackTech is a China-linked cyber espionage group that compromises routers and network devices. Learn its tactics, targets and how to defend against it.
• When AI Fights Back: How Attackers Are Using Agentic AI Against Your Organization How attackers use agentic AI across the attack chain, what the first AI-orchestrated espionage campaign showed, and how to defend enterprise AI agents.
• UAC-0194: Inside a Rapidly Evolving NTLM-Exploiting Espionage Operation Discover UAC-0194’s NTLM-based attack techniques, targets, and how organizations can defend against this evolving cyber espionage threat.
• What Is Credential Stuffing? How the Attack Works and How to Stop It Credential stuffing replays stolen username and password pairs on other sites. Learn how attacks work, how to detect them in logs, and how to stop them.
• What Is Triple Extortion? The Anatomy of the Encryption + Leakage + DDoS Trio Triple extortion ransomware combines encryption, data leaks and DDoS. See how each layer works, a real case, and how to detect the attack early.
• MFA Doesn’t Protect You — Cookies Give You Away: The Rise of Session Hijacking Session hijacking explained: how stolen cookies and tokens let attackers skip passwords and MFA prompts, and how to detect stolen sessions early.
• Mobile App Impersonation: How a Fake Version of Your App Steals Your Users Mobile app impersonation puts fake copies of your app in front of customers. See how clones work, how to detect them and how takedown works.
• UAC-0102: Inside a Covert Espionage Operation Targeting Ukraine and Beyond Explore UAC-0102 (GreenCube) APT tactics, targets, and cloud-based espionage operations. Learn how organizations can detect and mitigate this evolving threat.
• Inside the Operations of Crazy Evil: The Rise of a Global Crypto-Focused Cybercrime Network Crazy Evil is a Russian-speaking traffer team stealing crypto since 2021. Learn how its phishing, infostealers and fake job scams work, and how to defend.
• 1 Million User Records Exposed: A Deep Dive into the Komiko AI App Data Breach Komiko AI app data breach analysis: an underground forum claim of a full database leak including Google OAuth and session tokens, impact and mitigations.
• Konni (Vedalia / TA406 / Opal Sleet): North Korea’s Steady Hand in Espionage Operations Konni is a North Korea-linked espionage group tracked as Vedalia, TA406 and Opal Sleet. Learn its spearphishing methods, KONNI RAT and how to defend.
• Warlock Group: The Rise of GOLD SALEM (Storm-2603) in the Ransomware Landscape Warlock Group (GOLD SALEM, Storm-2603) exploits SharePoint flaws to deploy ransomware. See its tactics, targets and the steps that reduce your risk.
• DarkHotel (APT-C-06 / ATK52 / DUBNIUM): The Global Espionage Network Behind Elite Cyber Intrusions DarkHotel (APT-C-06, DUBNIUM) profile: espionage actor, its shift from hotel Wi-Fi attacks to supply chain and cloud-based operations, aliases and targets.
• Kasablanka: The Emerging North African Cyber Threat Actor Kasablanka is described as a threat group active since about 2021. Read its reported tradecraft, targets and defences, and why MITRE ATT&CK does not list it.
• Looking at Your Company Through the Eyes of an Attacker: What Is an Attacker’s-Eye View? What is an attacker's-eye view? Learn how to check your domains, subdomains, exposed services and email setup from the outside, as an attacker would.
• Turla APT: Russia’s Longstanding Cyber Espionage Powerhouse Turla profile: aliases such as Snake, Uroburos and Secret Blizzard, active since the early 2000s, modular malware including Kazuar, and typical targets.
• APT19 (DEEP PANDA): A Persistent China-Aligned Espionage and Credential Theft Actor APT19 (Deep Panda) profile: China-aligned espionage and mass credential harvesting for over a decade, with aliases, phishing methods and targeted sectors.
• HAFNIUM APT Group (Silk Typhoon): Exploiting the Global Attack Surface for Strategic Espionage HAFNIUM, also tracked as Silk Typhoon, is a China-aligned espionage group known for Exchange Server attacks. See its tactics, targets and how to defend.
• Tick APT Group (BRONZE BUTLER): A Long-Running East Asian Cyber Espionage Actor Tick APT Group, also called BRONZE BUTLER, is a long-running cyber espionage actor with likely Chinese origins. See its targets, tactics and how to defend.
• MCP Server Security: 10 Protocol-Level Attack Scenarios Behind the “Install and Run” Speed MCP server security explained: 10 protocol-level attack patterns, disclosed CVEs, and a practical baseline for provenance, sandboxing and monitoring.
• FishMonger APT Group: A Persistent China-Aligned Cyber Espionage Actor Explore FishMonger (AQUATIC PANDA), a China-aligned APT targeting governments, academia, and tech sectors with long-term cyber espionage campaigns.
• Dark Caracal APT Group (G0070): Mobile-Centric Espionage and Regional Surveillance Dark Caracal (G0070) is a mobile espionage group attributed by MITRE ATT&CK to Lebanese security services. See its tactics, targets, tools and defences.
• LIMINAL PANDA: China’s Emerging Espionage Threat in the Semiconductor and Technology Sectors Liminal Panda is a suspected China-nexus espionage group active since about 2020. Read its reported tactics, tools and operations, and how to defend.
• Reynolds Ransomware: BYOVD Evasion & NSecKrnl Abuse Reynolds ransomware analysis: a group first tracked in February 2026 using BYOVD via the NSecKrnl driver to disable EDR, with IOCs and detection guidance.
• Winter Vivern (TAG-70 / UAC-0114 / TA473): A Persistent Eastern European Cyber-Espionage Threat Targeting NATO and EU Governments Winter Vivern (TAG-70 / TA473) is a Belarus-linked, Russia-aligned APT targeting NATO and EU entities through Zimbra exploits and advanced phishing.
• APT-C-36: Latin America’s Persistent Cyber-Espionage Force APT-C-36, also called Blind Eagle, is a suspected South American group active since 2018. See its targets, phishing methods, tools and how to defend.
• Inside the Operations of Inception Framework: A Decade of Stealth, Espionage, and Global Targeting Inception Framework (Cloud Atlas, Blue Odin) profile: an espionage group tracked since at least 2014, using spearphishing, modular malware and cloud tools.
• APT27 APT27 is a China-aligned APT active since 2012, targeting government, defense, and critical infrastructure using advanced espionage tactics.
• APT3 (BORON): A Pioneering China-Aligned Cyber Espionage Group APT3 (BORON) is a China-aligned cyber espionage group. See its aliases, attribution, tools, targets and operations, and the lessons it holds for defenders.
• FIN11 Threat Group Profile FIN11 is a financially motivated cybercrime group tied to phishing-led malware, access brokering and Clop ransomware. See its aliases, tactics and targets.
• From Shadow IT to Shadow AI: Clawdbot (Moltbot/Openclaw) and the Rise of Unmanaged Agent Gateways Shadow AI explained: how unmanaged agents like Clawdbot, Moltbot and OpenClaw hold API keys behind unhardened gateways, with attack scenarios and fixes.
• APT35: Iran’s Persistent Cyber Espionage Force APT35 (Charming Kitten, Phosphorus, Mint Sandstorm) profile: active since 2011, with espionage and disinformation aimed at governments, NGOs and media.
• APT15 (Ke3Chang / Nylon Typhoon): China-Aligned Cyber Espionage APT APT15 is a China-aligned, MSS-linked APT conducting long-term cyber espionage against government, defense, NGOs, and technology sectors worldwide.
• TA577 (Hive0118): The Evolving Phishing Specialist Behind Modern Malware Campaigns TA577 (Hive0118) is a Russian-speaking cybercrime group behind global phishing, NTLM hash theft and ransomware access linked to Black Basta.
• VanHelsing: Inside the Rise of a Multi‑Platform RaaS Threat Actor VanHelsing is a ransomware-as-a-service operation reported in 2025, with malware for ESXi, Linux and Windows and double extortion. See tactics and defenses.
• WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations Wizard Spider profile: aliases such as FIN12 and GOLD BLACKBURN, activity since 2016, and its role in TrickBot, Ryuk, Conti and Black Basta operations.
• APT40 APT40 (Leviathan, Gingham Typhoon) is attributed by the US, UK and six more governments to China's MSS. Targets, tactics and defences.
• RomCom APT RomCom is a Russia-aligned threat group active since 2022. See who it targets, how it uses fake installers and zero-days, and how to defend against it.
• Inside the Operations of Cactus: The Rise of a Stealth-Focused Ransomware Threat Cactus ransomware, active since 2023, exploits VPN flaws and uses double extortion against enterprises in the US, UK and Europe. See its tools and fixes.
• Operation ForumTroll: What Is Confirmed About the Chrome Zero-Day (CVE-2025-2783) Operation ForumTroll is a name from one vendor report for a 2025 phishing campaign using a Chrome zero-day. See what NVD, Google and CISA confirm.
• PlushDaemon APT: An In-Depth Analysis of a Stealthy China-Aligned Cyber Espionage Group PlushDaemon is a China-aligned APT group running long-term cyber espionage against government, defence, research and technology targets. Learn its TTPs.
• Smishing Triad: A Global Cybercrime Syndicate Targeting Postal and Financial Networks Smishing Triad profile: a cybercrime syndicate running text message phishing at scale against postal, logistics and financial providers, and operations.

Browse by Category 7

The category pages below collect related articles, newest first.

• Blog: Digital Risk Protection Digital risk protection articles on brand impersonation, phishing, fake domains, data leaks and fraud, and how to detect and remove them early.
• Blog: Fraud Articles on online fraud: phishing, fake websites and apps, stolen card data and account takeover, with advice on spotting and stopping it.
• Blog: Ransomware Ransomware research: active groups, leak-site activity, attack methods and trends, and practical steps to cut your exposure and plan a response.
• Blog: Dark Web Dark web research: leaked credentials, data sales, underground forums and cybercrime markets, and what each one means for your organization.
• Blog: APT Groups Profiles of APT groups and state-linked threat actors: who they target, the tools and techniques they use, and how to defend against them.
• Blog: Sector Analysis Sector-by-sector analysis of cyber threats: how attackers target finance, healthcare, retail, energy and other industries, and what teams can do.
• Blog: VIP Security VIP and executive protection: impersonation, doxxing, leaked personal data and fake profiles, and how to monitor and reduce risk for key people.