Threat Intelligence for Every Defender
ThreatPodium System Owner/User Discovery (T1033) is a reconnaissance technique where adversaries enumerate the current user, active sessions, and account listings on a co…
Report Date: 2026-07-18
New KEVs: 7 ▲ +1 vs last weekRansomware Victims: 160 ▼ -62 vs last week
7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Microsoft products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 160 new victims posted to leak sites over the last 7 days, with Dragonforce posting the most victims.
System Network Configuration Discovery (T1016) is a technique where adversaries enumerate network settings on a compromised host — collecting IP addresses, M…
Report Date: 2026-07-17
New KEVs: 7 ▲ +1 vs last weekRansomware Victims: 171 ▼ -26 vs last week
7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Microsoft products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 171 new victims posted to leak sites over the last 7 days, with Thegentlemen posting the most victims.
Disable Windows Event Logging (T1562.002) covers attacker actions that stop, corrupt, or suppress the Windows event logging pipeline — most commonly by tampe…
Report Date: 2026-07-16
New KEVs: 7 ▲ +3 vs last weekRansomware Victims: 231 ▲ +104 vs last week
7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Fortinet products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference Sandworm (Russia) and Scattered Spider. Ransomware activity is moderate with 231 new victims posted to leak sites over the last 7 days, with Deadlock posting the most victims.
Disable or Modify Security Tools (T1562.001) describes attacker actions taken to impair, stop, or tamper with defensive software — including antivirus engine…