Threat Intelligence for Every Defender
ThreatPodium Token Impersonation/Theft (T1134.001) is a Windows privilege escalation technique in which an adversary duplicates an existing access token belonging to anot…
Report Date: 2026-07-12
New KEVs: 6 ▲ +4 vs last weekRansomware Victims: 219 ▲ +31 vs last week
6 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Joomshaper products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference ALPHV / BlackCat and Qilin. Ransomware activity is moderate with 219 new victims posted to leak sites over the last 7 days, with Deadlock posting the most victims.
DNS tunneling (T1071.004) is a command-and-control technique where adversaries embed data — including commands and exfiltrated output — inside DNS query and …
Report Date: 2026-07-11
New KEVs: 6 ▲ +4 vs last weekRansomware Victims: 222 ▲ +20 vs last week
6 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Icagenda products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference ALPHV / BlackCat and Qilin. Ransomware activity is moderate with 222 new victims posted to leak sites over the last 7 days, with Deadlock posting the most victims.
Web Protocols (T1071.001) describes adversaries using HTTP, HTTPS, and WebSocket as the transport layer for command-and-control (C2) communication. Rather th…
Report Date: 2026-07-10
New KEVs: 6 ▲ +4 vs last weekRansomware Victims: 197 ▼ -2 vs last week
6 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Langflow products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference ALPHV / BlackCat and Qilin. Ransomware activity is moderate with 197 new victims posted to leak sites over the last 7 days, with Deadlock posting the most victims.
Service Stop (T1489) is a technique where adversaries deliberately halt or disable running services on a target system to prevent legitimate users from acces…
Report Date: 2026-07-09
New KEVs: 4 ▲ +2 vs last weekRansomware Victims: 127 ▼ -75 vs last week
4 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Joomlack products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 127 new victims posted to leak sites over the last 7 days, with Qilin posting the most victims.