Threat Intelligence Research. Our Own Findings.
Deep dives into live threats: exploited vulnerabilities, ransomware entry points and supply chain compromises.
Blog APT15 (Ke3Chang / Nylon Typhoon): China-Aligned Cyber Espionage APT APT15 is a long-running, China-aligned cyber espionage group linked to the MSS, targeting governments, defense organizations, NGOs, and technology sectors globally with sustained operations through 2025. 
APT Groups TA577 (Hive0118): The Evolving Phishing Specialist Behind Modern Malware Campaigns TA577 (Hive0118) is a financially motivated, Russian-speaking cybercrime group active since 2020, specializing in large-scale phishing, credential theft, and NTLM hash capture, with strong links to… 
APT Groups VanHelsing: Inside the Rise of a Multi‑Platform RaaS Threat Actor RomCom, also known as Void Rabisu or Storm-0978, is a Russia-aligned advanced persistent threat active since 2022. The group is known for combining espionage-driven operations with… 
APT Groups WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations Wizard Spider profile: aliases such as FIN12 and GOLD BLACKBURN, activity since 2016, and its role in TrickBot, Ryuk, Conti and Black Basta operations. 
APT Groups APT40 APT40 is a China-aligned advanced persistent threat (APT) group known for long-term cyber espionage campaigns targeting maritime, defense, academic, and government organizations, particularly across the Indo-Pacific… 
Malware Analysis Reports Grandoreiro Trojan Technical Analysis Grandoreiro is a Delphi banking trojan seen since 2016 and aimed at banking users in Latin America and Iberia. See what this technical report covers. 
APT Groups RomCom APT RomCom, also known as Void Rabisu or Storm-0978, is a Russia-aligned advanced persistent threat active since 2022. The group is known for combining espionage-driven operations with… 
APT Groups Inside the Operations of Cactus: The Rise of a Stealth-Focused Ransomware Threat Cactus is a financially motivated ransomware group leveraging VPN vulnerabilities, encrypted tunneling, and double extortion tactics to target enterprises across the US, UK, and Europe. 
APT Groups Operation ForumTroll: What Is Confirmed About the Chrome Zero-Day (CVE-2025-2783) A deep-dive into Operation ForumTroll, a high-risk Russia-aligned threat actor conducting espionage, phishing, and influence operations across Eastern Europe. All 19 pages
Questions About Threat Intelligence Researches.
Last updated June 9, 2026-
Research articles on exploited vulnerabilities, ransomware entry points, supply chain compromises and attacker methods, with the newest first.
-
New research is added several times a month. Every article shows its date.
-
Type a word in the search box or pick a year. The count above the list updates as you filter.
-
CISA maintains the Known Exploited Vulnerabilities Catalog, linked here.
-
Threat Intelligence Researches holds Brandefense's own findings on live threats. Security News explains regulation, standards and official guidance.
-
Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo on your own domain from the Request A Demo page.
-
The page lists 160 items. You can filter by year, from 2022 to 2026. The newest come first.
-
They give dates, fixes, attribution and what to check. Topics include exploited vulnerabilities, ransomware entry points and supply chain compromises.
-
Yes. One article covers five VPN and firewall flaws added to the CISA KEV catalog in 2025 and 2026 that carry a ransomware flag. It gives dates, fixed versions and what to check.
-
Yes. One article covers remote support and file transfer flaws that CISA flagged for ransomware use in 2025 and 2026. It gives dates, fixes, attribution and checks.
Research Is General. Your Exposure Is Not.
A demo of the platform, run on your own domain.