Threat Intelligence Research. Our Own Findings.
Deep dives into live threats: exploited vulnerabilities, ransomware entry points and supply chain compromises.
Malware Analysis Reports HermeticWiper Malware Technical Analysis Open Report Analysis of HermeticWiper destructive malware — wiper functionality, MBR corruption technique, deployment method chain, and forensic indicators from 
Malware Analysis Reports PetitPotam Vulnerability Analysis Open Report Learn what the PetitPotam vulnerability is, how the NTLM relay attack works, how CVE-2021-36942 is rated and how to mitigate it on AD CS systems. 
APT Groups [Research Summary]: SandWorm APT Group Intelligence Report Sandworm Team, also known as Unit 74455, is a Russian cyber espionage group that has been operating since 2009. They mainly target Ukrainian organizations. 
APT Groups European Focused Threat Actors – Who Actively Continue Their Strategies The main motivation of individual threat actors who carry out European-focused attacks is to earn financial gain. 
APT Groups European Focused Threat Actors – APT Groups It has been observed that the main motivation of individual threat actors who carry out European-focused attacks is to earn financial gain. 
APT Groups European Focused Threat Actors – Ransomware Groups Threat actors, some ransomware groups, that governments support usually organize longer-term operations in the interests of the state they are affiliated with. 
APT Groups Equation APT Group Equation Group profile: operations since 2001, zero-day exploits, hard drive firmware persistence, self-destructing malware and links to Stuxnet and Flame. 
APT Groups APT Groups Actively Involved During the Russia-Ukraine Cyber War Which APT groups took part in the Russia-Ukraine cyber war? See the groups named, what they hit in Ukraine, and why firewalls and antivirus fall short. 
APT Groups Lazarus APT Group (APT38) Lazarus APT is a North Korean state-sponsored group active since at least 2009. See its aliases, targets, history, tools and how to defend against it. All 19 pages
Questions About Threat Intelligence Researches.
Last updated June 9, 2026-
Research articles on exploited vulnerabilities, ransomware entry points, supply chain compromises and attacker methods, with the newest first.
-
New research is added several times a month. Every article shows its date.
-
Type a word in the search box or pick a year. The count above the list updates as you filter.
-
CISA maintains the Known Exploited Vulnerabilities Catalog, linked here.
-
Threat Intelligence Researches holds Brandefense's own findings on live threats. Security News explains regulation, standards and official guidance.
-
Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo on your own domain from the Request A Demo page.
-
The page lists 160 items. You can filter by year, from 2022 to 2026. The newest come first.
-
They give dates, fixes, attribution and what to check. Topics include exploited vulnerabilities, ransomware entry points and supply chain compromises.
-
Yes. One article covers five VPN and firewall flaws added to the CISA KEV catalog in 2025 and 2026 that carry a ransomware flag. It gives dates, fixed versions and what to check.
-
Yes. One article covers remote support and file transfer flaws that CISA flagged for ransomware use in 2025 and 2026. It gives dates, fixes, attribution and checks.
Research Is General. Your Exposure Is Not.
A demo of the platform, run on your own domain.