Threat Intelligence Research. Our Own Findings.
Deep dives into live threats: exploited vulnerabilities, ransomware entry points and supply chain compromises.
Threat Intelligence Researches Five edge VPN flaws CISA flags for ransomware use Five VPN and firewall flaws added to CISA KEV in 2025 and 2026 carry a ransomware flag. Dates, fixed versions and what to check on your… 
Threat Intelligence Researches Two Fortinet events of 2026: what to check Fortinet had two 2026 events: a January SSO login flaw and a June wave of leaked logins. See what a firewall owner checks, from SSO to… 
Threat Intelligence Researches A contractor repo and cloud keys: CISA’s lessons A contractor's personal GitHub repository exposed CISA's cloud keys. What it says about uploads, rotating all admin access and having a playbook ready. 
Threat Intelligence Researches Exposed PLCs: lessons from the 2026 US advisory US agencies say Iranian-affiliated actors disrupted exposed PLCs. See the attack flow and what water, energy and public facility operators should check. 
Threat Intelligence Researches NetScaler exposed edge: questions to ask your team What a NetScaler ADC or Gateway owner does first: list appliances, check for compromise before patching, and keep management services off the internet. 
Threat Intelligence Researches Nx Console and GitHub: dev tools as an entry path How a token stolen on 11 May 2026 led from a developer machine to a poisoned Nx Console extension and GitHub's internal repositories, and what to… 
Threat Intelligence Researches TanStack worm: CI questions every team should ask The TanStack npm worm chained a risky workflow, cache poisoning and a short-lived token. See the CI and monitoring questions a security lead should ask. 
Threat Intelligence Researches How a Trivy Compromise Reached LiteLLM Releases LiteLLM says a Trivy compromise in its build pipeline led to bad PyPI releases. Sources differ on exposure time. See what to ask about your own… 
Threat Intelligence Researches GRU targeting of logistics firms: advisory AA25-141A CISA, NSA, FBI and partners describe a GRU campaign against Western logistics and technology firms: targets, phases, CVEs and the fixes they list. All 19 pages
Questions About Threat Intelligence Researches.
Last updated June 9, 2026-
Research articles on exploited vulnerabilities, ransomware entry points, supply chain compromises and attacker methods, with the newest first.
-
New research is added several times a month. Every article shows its date.
-
Type a word in the search box or pick a year. The count above the list updates as you filter.
-
CISA maintains the Known Exploited Vulnerabilities Catalog, linked here.
-
Threat Intelligence Researches holds Brandefense's own findings on live threats. Security News explains regulation, standards and official guidance.
-
Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo on your own domain from the Request A Demo page.
-
The page lists 160 items. You can filter by year, from 2022 to 2026. The newest come first.
-
They give dates, fixes, attribution and what to check. Topics include exploited vulnerabilities, ransomware entry points and supply chain compromises.
-
Yes. One article covers five VPN and firewall flaws added to the CISA KEV catalog in 2025 and 2026 that carry a ransomware flag. It gives dates, fixed versions and what to check.
-
Yes. One article covers remote support and file transfer flaws that CISA flagged for ransomware use in 2025 and 2026. It gives dates, fixes, attribution and checks.
Research Is General. Your Exposure Is Not.
A demo of the platform, run on your own domain.