Threat Intelligence for Every Defender
ThreatPodium Report Date: 2026-07-06
New KEVs: 1 ▼ -6 vs last weekRansomware Victims: 192 ▲ +75 vs last week
One new vulnerability was added to the CISA KEV catalog this period. Microsoft products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 192 new victims posted to leak sites over the last 7 days, with Thegentlemen posting the most victims.
Spearphishing Link (T1566.002) is a targeted email attack where adversaries send carefully crafted messages containing malicious URLs to specific individuals…
Report Date: 2026-07-05
New KEVs: 2 ▼ -4 vs last weekRansomware Victims: 188 ▲ +74 vs last week
2 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Microsoft products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 188 new victims posted to leak sites over the last 7 days, with Thegentlemen posting the most victims.
Spearphishing Attachment (T1566.001) is a targeted email-based attack where an adversary sends a crafted email to a specific individual, company, or industry…
Report Date: 2026-07-04
New KEVs: 2 ▼ -4 vs last weekRansomware Victims: 202 ▲ +107 vs last week
2 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Microsoft products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 202 new victims posted to leak sites over the last 7 days, with Thegentlemen posting the most victims.
Service Execution (T1569.002) describes how adversaries abuse the Windows Service Control Manager (SCM) to run malicious commands or payloads — either by cre…
Report Date: 2026-07-03
New KEVs: 2 ▼ -4 vs last weekRansomware Victims: 199 ▲ +46 vs last week
2 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Microsoft products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 199 new victims posted to leak sites over the last 7 days, with Thegentlemen posting the most victims.
SMB/Windows Admin Shares (T1021.002) is a lateral movement technique where attackers use valid credentials — stolen, brute-forced, or obtained through creden…
Report Date: 2026-07-02
New KEVs: 2 ▼ -4 vs last weekRansomware Victims: 202 ▲ +46 vs last week
2 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Simplehelp products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference INC Ransom and Scattered Spider. Ransomware activity is moderate with 202 new victims posted to leak sites over the last 7 days, with Thegentlemen posting the most victims.
Remote Desktop Protocol (RDP) lateral movement occurs when an adversary uses valid credentials to interactively log into a remote Windows system via port 338…