Log in Request a demo

Threat Intelligence Research. Our Own Findings.

Deep dives into live threats: exploited vulnerabilities, ransomware entry points and supply chain compromises.

165 itemsPage 3 of 19
Dark glass dark glass steel bear trap with jaws open and a red glow ins with red neon lines, cover art for: Akira ransomware advisory AA24-109A: stages and tools Threat Intelligence Researches Akira ransomware advisory AA24-109A: stages and tools CISA and partners say Akira enters through VPNs without MFA and known CVEs, steals data, then encrypts. A read of advisory AA24-109A, updated Nov 13, 2025. Oct 09, 2026Read → Dark glass dark glass power pylon with a red glowing line sagging betwe with red neon lines, cover art for: Volt Typhoon advisory AA24-038A: what CISA says Threat Intelligence Researches Volt Typhoon advisory AA24-038A: what CISA says CISA, NSA and FBI advisory AA24-038A: how Volt Typhoon got in via routers, VPNs and firewalls, stayed up to five years, and what defenders were told… Oct 09, 2026Read → Dark glass three overlapping translucent dark glass discs with a red gl with red neon lines, cover art for: Software Shared Across ATT&CK Groups: Reuse Study Threat Intelligence Researches Software Shared Across ATT&CK Groups: Reuse Study MITRE ATT&CK v19.2 data: Mimikatz is linked to 51 of 176 groups, while 503 of 607 software entries tie to one group. See the top 10… Oct 09, 2026Read → Dark glass fan of dark glass arrows spreading outward from a glowing re with red neon lines, cover art for: ATT&CK groups by attributed origin: what is mapped Threat Intelligence Researches ATT&CK groups by attributed origin: what is mapped ATT&CK groups by origin named in their text: North Korea and Russia map more techniques (29.5, 27) than China (15.5) or Iran (17.5); T1486 differs most. Oct 09, 2026Read → Dark glass dark glass tree with branching red glowing nodes and twigs with red neon lines, cover art for: ATT&CK techniques most used across threat groups Threat Intelligence Researches ATT&CK techniques most used across threat groups In MITRE ATT&CK Enterprise data, version 19.2, the most widely mapped technique is Command and Scripting Interpreter. It is linked to 124 of 172 groups with… Oct 09, 2026Read → Dark glass dark glass sliding shutter half closed, red light underneath with red neon lines, cover art for: KEV due-date windows and pace of additions Threat Intelligence Researches KEV due-date windows and pace of additions CISA KEV due dates by year added: mostly 21 days from 2022 to 2025, 3 days in 2026. Plus additions per year and vendor spread across… Oct 09, 2026Read → Dark glass dark glass thermometer with the red column rising high with red neon lines, cover art for: Where KEV entries sit on the EPSS scale, October 2026 Threat Intelligence Researches Where KEV entries sit on the EPSS scale, October 2026 1739 KEV entries scored by EPSS on 2026-10-08: median 0.49, 1283 at or above 0.1, 466 at or above 0.9. Only 866 of 4322 CVEs at… Oct 09, 2026Read → Dark glass dark glass hanging tag label with a red glowing string, no t with red neon lines, cover art for: KEV and ransomware: which entries are flagged Threat Intelligence Researches KEV and ransomware: which entries are flagged 361 of 1739 CISA KEV entries (20.8 percent) are flagged as used in ransomware campaigns. Mail and file transfer servers lead at 38.7 percent by class. Oct 09, 2026Read → Dark glass dark glass fuse wire burning down with a red spark travellin with red neon lines, cover art for: KEV: days from CVE publication to listing, 2024 to 2026 Threat Intelligence Researches KEV: days from CVE publication to listing, 2024 to 2026 686 KEV entries added 2024 to 2026: median 20 days from CVE publication to listing, 137 on or before day zero, 151 over a year, by… Oct 09, 2026Read →
All 19 pages
FAQ

Questions About Threat Intelligence Researches.

Last updated June 9, 2026

  • Research articles on exploited vulnerabilities, ransomware entry points, supply chain compromises and attacker methods, with the newest first.

  • New research is added several times a month. Every article shows its date.

  • Type a word in the search box or pick a year. The count above the list updates as you filter.

  • CISA maintains the Known Exploited Vulnerabilities Catalog, linked here.

  • Threat Intelligence Researches holds Brandefense's own findings on live threats. Security News explains regulation, standards and official guidance.

  • Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo on your own domain from the Request A Demo page.

  • The page lists 160 items. You can filter by year, from 2022 to 2026. The newest come first.

  • They give dates, fixes, attribution and what to check. Topics include exploited vulnerabilities, ransomware entry points and supply chain compromises.

  • Yes. One article covers five VPN and firewall flaws added to the CISA KEV catalog in 2025 and 2026 that carry a ransomware flag. It gives dates, fixed versions and what to check.

  • Yes. One article covers remote support and file transfer flaws that CISA flagged for ransomware use in 2025 and 2026. It gives dates, fixes, attribution and checks.

Research Is General. Your Exposure Is Not.

A demo of the platform, run on your own domain.

Request a demo