Threat Intelligence for Every Defender
ThreatPodium Exfiltration Over Alternative Protocol (T1048) describes adversaries stealing data by sending it out through a network protocol that differs from their prima…
Report Date: 2026-07-30
New KEVs: 3 ▼ -3 vs last weekRansomware Victims: 230 ▲ +52 vs last week
3 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Cisco products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference Lazarus Group (DPRK). Ransomware activity is moderate with 230 new victims posted to leak sites over the last 7 days, with Qilin posting the most victims.
Exfiltration Over C2 Channel (T1041) describes the technique where an adversary reuses an already-established command-and-control communication channel to sm…
Report Date: 2026-07-29
New KEVs: 3 ▼ -4 vs last weekRansomware Victims: 257 ▲ +93 vs last week
3 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Arista products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 257 new victims posted to leak sites over the last 7 days, with Thegentlemen posting the most victims.
Local Data Staging (T1074.001) is the practice of collecting and consolidating files of interest — credentials, documents, database dumps, configuration file…
Report Date: 2026-07-28
New KEVs: 4 ▼ -3 vs last weekRansomware Victims: 268 ▲ +108 vs last week
4 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Microsoft products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 268 new victims posted to leak sites over the last 7 days, with Qilin posting the most victims.
Archive via Utility (T1560.001) describes adversaries using compression and archiving tools — such as tar , zip , 7-Zip , WinRAR , makecab , or certutil — to…
Report Date: 2026-07-27
New KEVs: 7 — unchanged vs last weekRansomware Victims: 268 ▲ +98 vs last week
7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Microsoft products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 268 new victims posted to leak sites over the last 7 days, with Qilin posting the most victims.
Data Destruction (T1485) is an impact-phase technique where adversaries deliberately overwrite, corrupt, or permanently delete files and data to make recover…