Log in Request a demo

Threat Intelligence Research. Our Own Findings.

Deep dives into live threats: exploited vulnerabilities, ransomware entry points and supply chain compromises.

165 itemsPage 10 of 19
PlushDaemon APT card representing a China-aligned cyber espionage threat actor APT Groups PlushDaemon APT: An In-Depth Analysis of a Stealthy China-Aligned Cyber Espionage Group PlushDaemon is a stealthy, China-aligned advanced persistent threat (APT) group focused on long-term cyber espionage. Active since the early 2010s, the group primarily targets government, defense,… Jan 05, 2026Read → Smishing Triad cybercrime group using SMS phishing and brand impersonation tactics APT Groups Smishing Triad: A Global Cybercrime Syndicate Targeting Postal and Financial Networks The Smishing Triad is a high-risk, financially motivated cybercrime syndicate operating smishing-as-a-service campaigns since 2022. By impersonating postal, banking, and public service brands, the group targets… Jan 04, 2026Read → Silent Chollima APT45 APT card showing a North Korea–linked threat actor focused on cyber espionage and revenue generation APT Groups Silent Chollima: North Korea’s Dual-Track Cyber Weapon Silent Chollima (APT45), also known as Onyx Sleet, is a North Korea–linked threat actor operating at the intersection of cyber espionage and financially motivated attacks. Active… Dec 30, 2025Read → OldGremlin APT threat group profile visual representing a Russian-speaking hybrid ransomware and espionage actor APT Groups OldGremlin: A Stealthy Russian-Speaking Ransomware and Espionage Threat Group Evolving Into a Precision Striking APT OldGremlin is a high-risk, Russian-speaking threat group operating since 2020 that blends APT-level stealth, long-term reconnaissance, and double-extortion ransomware. Its precision-driven campaigns pose significant risk to… Dec 29, 2025Read → OilRig APT34 Helix Kitten Iran-linked cyber espionage threat actor targeting energy and defense sectors APT Groups OilRig: Iran’s Persistent Espionage Arm in Cyberspace OilRig, also known as APT34 or Helix Kitten, is one of Iran’s most persistent cyber espionage groups. Active since 2014, the group targets energy, defense, and… Dec 24, 2025Read → Callisto APT cyber espionage group – Russia-linked threat actor targeting NATO and government institutions APT Groups Callisto APT: Russia’s Persistent Espionage Operator Callisto is a long-running Russia-linked APT group specializing in cyber espionage against NATO, EU, and government organizations. This analysis explores its identity, tactics, cloud-focused operations, and… Dec 23, 2025Read → Crafty Camel APT card representing Iran-linked cyber espionage group targeting government and energy sectors APT Groups Crafty Camel APT: Iran’s Expanding Espionage Footprint in the Modern Cyber Battlespace Crafty Camel is an Iran-aligned advanced persistent threat leveraging spearphishing, cloud credential theft, and identity-centric attacks to conduct long-term cyber espionage. Active since 2017, the group… Dec 18, 2025Read → Angry Likho APT group profile representing a pro-Russian cyber espionage threat APT Groups Angry Likho: Inside a Rapidly Growing Espionage Threat Targeting Eastern Europe Angry Likho is a rapidly evolving pro-Russian cyber espionage group targeting Eastern European governments and defense organizations. This in-depth threat intelligence report analyzes its motivations, TTPs,… Dec 17, 2025Read → GALLIUM APT group profile showing China-linked cyber espionage targeting telecom and government networks APT Groups GALLIUM APT: What MITRE ATT&CK Says GALLIUM is a cyberespionage group that MITRE ATT&CK says has been active since at least 2012, mainly targeting telecom, finance and government. See what is confirmed… Dec 16, 2025Read →
All 19 pages
FAQ

Questions About Threat Intelligence Researches.

Last updated June 9, 2026

  • Research articles on exploited vulnerabilities, ransomware entry points, supply chain compromises and attacker methods, with the newest first.

  • New research is added several times a month. Every article shows its date.

  • Type a word in the search box or pick a year. The count above the list updates as you filter.

  • CISA maintains the Known Exploited Vulnerabilities Catalog, linked here.

  • Threat Intelligence Researches holds Brandefense's own findings on live threats. Security News explains regulation, standards and official guidance.

  • Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo on your own domain from the Request A Demo page.

  • The page lists 160 items. You can filter by year, from 2022 to 2026. The newest come first.

  • They give dates, fixes, attribution and what to check. Topics include exploited vulnerabilities, ransomware entry points and supply chain compromises.

  • Yes. One article covers five VPN and firewall flaws added to the CISA KEV catalog in 2025 and 2026 that carry a ransomware flag. It gives dates, fixed versions and what to check.

  • Yes. One article covers remote support and file transfer flaws that CISA flagged for ransomware use in 2025 and 2026. It gives dates, fixes, attribution and checks.

Research Is General. Your Exposure Is Not.

A demo of the platform, run on your own domain.

Request a demo