Log in Request a demo

Threat Intelligence Research. Our Own Findings.

Deep dives into live threats: exploited vulnerabilities, ransomware entry points and supply chain compromises.

165 itemsPage 11 of 19
Secure dark door with red light and lock, symbolizing cybersecurity and protection. Malware Analysis Reports BugSleep Backdoor Technical Analysis Technical analysis of the BugSleep backdoor attributed to MuddyWater: file transfer, reverse shell commands, scheduled task persistence and detections. Dec 11, 2025Read → Illustration of an octopus with glowing red eyes and glasses representing the TraderTraitor APT group, a North Korea–linked Lazarus subgroup targeting crypto and blockchain companies. APT Groups TraderTraitor: North Korea’s Crypto Heist Machine TraderTraitor—also known as Jade Sleet and UNC4899—is one of North Korea’s most aggressive financial APT groups. Responsible for major crypto thefts, including the $1.5B ByBit hack,… Dec 06, 2025Read → Illustration of Handala APT group represented as a dark porcupine with glowing red eyes used in Brandefense threat intelligence card. APT Groups Handala: The Rise of a Decentralized Pro-Palestinian Hacktivist Collective Handala is a pro-Palestinian hacktivist collective active since 2022, conducting defacements, DDoS attacks, and politically motivated data leaks targeting Israeli, U.S., and Western entities during regional… Dec 05, 2025Read → Illustration of Moonlight Tiger APT as a blue-black tiger symbolizing a stealthy India-linked cyber-espionage group. APT Groups Moonlight Tiger (APT-C-09, Patchwork, Dropping Elephant): India’s Silent Espionage Arm in the Digital Battlefield Moonlight Tiger (APT-C-09) is a long-running India-linked cyber-espionage group conducting spearphishing, modular malware campaigns, and intelligence-gathering operations across South and East Asia. Targeting government, defense, academic,… Dec 04, 2025Read → Illustration of WageMole APT represented as a glowing cyber-insect symbolizing North Korean cyber operations. APT Groups Inside WageMole: North Korea’s Fusion of Cybercrime and Espionage WageMole is a North Korean APT active since 2018, operating at the intersection of cyber-espionage and financial theft. The group targets cryptocurrency, fintech, and defense sectors… Dec 03, 2025Read → Illustration of Void Manticore, symbolizing Iran-aligned hacktivist APT operations targeting critical infrastructure. APT Groups Inside Void Manticore: Iran’s Hybrid Hacktivist for Information Warfare Void Manticore is an Iran-aligned APT group conducting hybrid cyber operations, destructive wiper attacks, and politically motivated leak campaigns targeting Israel, NATO members, NGOs, and critical… Nov 24, 2025Read → AI-rendered depiction of Sandworm APT44 as a cyber-themed worm emerging from a tunnel, used in Brandefense threat intelligence visuals. APT Groups Sandworm (APT44): Russia’s Most Destructive Cyber Weapon Sandworm (APT44) is Russia’s most destructive state-sponsored cyber unit. Known for NotPetya, Industroyer, and AcidPour, the group targets critical infrastructure across Ukraine, NATO states, and Europe,… Nov 23, 2025Read → Illustration of a hooded cyber actor representing APT37 (Famous Chollima) working on a laptop with DPRK-themed neon lighting. APT Groups APT37: North Korea’s Active Cyberespionage Group APT37 (Famous Chollima) remains one of North Korea’s most active and adaptive cyberespionage groups. This analysis highlights their 2025 evolution—cloud persistence, AI-driven social engineering, new RAT… Nov 22, 2025Read → Hooded figure representing APT42, the Iranian cyber espionage group, on Brandefense APT card. APT Groups APT42: Iran’s Shadow Operative in Global Cyberspace SilverFox APT is rapidly evolving into one of 2025’s most dangerous cyber threat actors. Combining espionage with financial motives, it exploits edge devices, cloud identities, and… Nov 21, 2025Read →
All 19 pages
FAQ

Questions About Threat Intelligence Researches.

Last updated June 9, 2026

  • Research articles on exploited vulnerabilities, ransomware entry points, supply chain compromises and attacker methods, with the newest first.

  • New research is added several times a month. Every article shows its date.

  • Type a word in the search box or pick a year. The count above the list updates as you filter.

  • CISA maintains the Known Exploited Vulnerabilities Catalog, linked here.

  • Threat Intelligence Researches holds Brandefense's own findings on live threats. Security News explains regulation, standards and official guidance.

  • Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo on your own domain from the Request A Demo page.

  • The page lists 160 items. You can filter by year, from 2022 to 2026. The newest come first.

  • They give dates, fixes, attribution and what to check. Topics include exploited vulnerabilities, ransomware entry points and supply chain compromises.

  • Yes. One article covers five VPN and firewall flaws added to the CISA KEV catalog in 2025 and 2026 that carry a ransomware flag. It gives dates, fixed versions and what to check.

  • Yes. One article covers remote support and file transfer flaws that CISA flagged for ransomware use in 2025 and 2026. It gives dates, fixes, attribution and checks.

Research Is General. Your Exposure Is Not.

A demo of the platform, run on your own domain.

Request a demo