Rolling Intelligence Cards

v2.0Rolling coverage through Jul 27, 2026Last AI Agent update: Exploitable Technology Risk Rolling Intelligence Card Publisher

Published · v2

Unit 42 Threat Research & Incident Intelligence

Unit 42 Threat Research & Incident Rolling Intelligence Card — Rolling 1-Year Snapshot (Jul 29, 2025–Jul 28, 2026)

A source-cited rolling one-year synthesis of Unit 42 threat research, insights, high-profile threats, trend reports, and threat-actor publications. The chronology now spans August 2025 through July 2026 and connects malware, credential, ransomware, cloud, software-supply-chain, AI-supply-chain, vulnerability, espionage, and actor-cluster research to concrete defensive decisions.

Top 10 Salient Points

1.TuxBot v3 uses LLM-assisted development inside an operational IoT botnet framework
2.The Gentlemen are becoming a durable ransomware operating model
3.Vidar combines code-signing abuse, Go loaders, file inflation, and miner delivery
4.AI-hallucinated domains can become dependency-confusion infrastructure
5.Large-scale password spraying targets Fortinet, Sophos, and MSSQL services
6.CL-STA-1062 targets Southeast Asian government and critical infrastructure
7.OpenClaw's skill marketplace expands software trust into agent capabilities
8.Universal bucket hijacking turns namespace reuse into a data-loss path
9.The npm threat landscape now includes wormable, CI/CD-persistent, multi-stage campaigns
10.Unit 42 demonstrates how to separate observed behavior from underground attribution

Rolling 1 year · Jul 29, 2025–Jul 28, 202620 sources

Published · v5

Exploitable Technology Risk

Exploitable Technology Risk Rolling Intelligence Card — Rolling 90-Day Snapshot (Apr 30–Jul 28, 2026)

AI-generated, AI-updated weekly, AI quality-checked, and source-cited, this rolling 90-day product reviews the complete IntelliOS catalog and dozens of government, vendor, incident-response, exposure, insurance, and research sources to identify named technologies under active exploitation. It tells executives which owned products can create an incident now, why they matter to the business, what evidence to monitor, and which IntelliOS products contain the deeper campaign, actor, vulnerability, and response analysis.

Top 10 Salient Points

1.FortiOS CVE-2025-68686 requires remediation plus historical investigation
2.70 KEVs became 54 ownership questions
3.SMA1000 is both a vulnerability and incident-response event
4.PeopleSoft combines extortion and regulated data
5.Check Point's attribution is useful but bounded
6.Windchill/FlexPLM can expose the product pipeline
7.GlobalProtect bypass converts perimeter trust into ransomware risk
8.Langflow is narrower but potentially highly privileged
9.Supply-chain compromise changes the unit of response
10.On-premises SharePoint needs product-specific scoping

Rolling 90 days · Apr 30–Jul 28, 202625 sources

Published · v32

Government Cybersecurity Actions & Advisories

Government Cybersecurity Actions & Advisories Rolling Intelligence Card — Rolling 90-Day Snapshot (Apr 30–Jul 28, 2026)

AI-generated, AI-updated weekly, AI quality-checked, and source-cited, this 90-day Rolling Intelligence Card reviews CISA, FBI, NSA, DOJ, UK NCSC, Europol, ASD ACSC, sector agencies, partner governments, and qualified supporting reporting. It reconciles overlapping notices and promotes only exploited technologies, threat actors, campaigns, victimology, deadlines, and government actions that materially change company risk.

Top 10 Salient Points

1.FortiOS CVE-2025-68686 makes forensic triage part of the required action
2.CISA KEV turns vulnerability management into deadline governance
3.Control-plane technologies deserve priority over raw CVSS sorting
4.“Known ransomware use: Unknown” does not lower a KEV remediation deadline
5.FBI, NSA, CISA, and sector agencies elevated exposed tank gauges into a physical-risk issue
6.A patch closes a path; it does not prove the asset remained trustworthy
7.DOJ and FBI disruption reporting should become a company response trigger
8.Europol’s Operation Endgame creates a hunting window, not an all-clear
9.UK NCSC campaign warnings add actor, victimology, and technology context
10.Every government instrument carries a different executive decision

Rolling 90 days · Apr 30–Jul 28, 202613 sources

Every Rolling Intelligence Card is AI-generated, AI-updated weekly, AI quality-checked, source-cited, and maintained as a cumulative rolling intelligence product. Most use a 90-day window; the Coveware product uses one year so quarterly casework can be compared without losing methodological context. Coverage dates advance daily and evidence outside each card’s active window is removed.

Definition

Rolling Intelligence Cards: are AI-generated, AI-updated weekly, AI quality-checked, and source-cited. They maintain time-bounded rolling intelligence across government actions, dark-web activity and exposure, law-enforcement disruption, BEC, ransomware, offensive AI attacks, cyber-insurance claims, cyber legal activity, and a one-year Coveware casework watch. Each window advances daily; material evidence is added when warranted and removed when it ages beyond the applicable coverage period.

Search intelligence

Search Results / Output

Rolling Intelligence Cards

Search across card titles, summaries, activity signals, sectors, impacts, defensive priorities, briefing points, metrics, and retained sources.

18 rolling intelligence cards

Published · v5

Exploitable Technology Risk

Exploitable Technology Risk Rolling Intelligence Card — Rolling 90-Day Snapshot (Apr 30–Jul 28, 2026)

Top 10 Salient Points

1.FortiOS CVE-2025-68686 requires remediation plus historical investigation
2.70 KEVs became 54 ownership questions
3.SMA1000 is both a vulnerability and incident-response event
4.PeopleSoft combines extortion and regulated data
5.Check Point's attribution is useful but bounded
6.Windchill/FlexPLM can expose the product pipeline
7.GlobalProtect bypass converts perimeter trust into ransomware risk
8.Langflow is narrower but potentially highly privileged
9.Supply-chain compromise changes the unit of response
10.On-premises SharePoint needs product-specific scoping

Rolling 90 days · Apr 30–Jul 28, 2026·25 retained sources

Published · v32

Government Cybersecurity Actions & Advisories

Government Cybersecurity Actions & Advisories Rolling Intelligence Card — Rolling 90-Day Snapshot (Apr 30–Jul 28, 2026)

Top 10 Salient Points

1.FortiOS CVE-2025-68686 makes forensic triage part of the required action
2.CISA KEV turns vulnerability management into deadline governance
3.Control-plane technologies deserve priority over raw CVSS sorting
4.“Known ransomware use: Unknown” does not lower a KEV remediation deadline
5.FBI, NSA, CISA, and sector agencies elevated exposed tank gauges into a physical-risk issue
6.A patch closes a path; it does not prove the asset remained trustworthy
7.DOJ and FBI disruption reporting should become a company response trigger
8.Europol’s Operation Endgame creates a hunting window, not an all-clear
9.UK NCSC campaign warnings add actor, victimology, and technology context
10.Every government instrument carries a different executive decision

Rolling 90 days · Apr 30–Jul 28, 2026·13 retained sources

Published · v4

Credential Exposure & Ransomware Access Paths

Credential Exposure & Ransomware Access Paths — Rolling 90-Day Intelligence Card (Apr 30–Jul 28, 2026)

This rolling card tracks stolen credentials, browser sessions, infostealer exposure, remote-access claims, and third-party access paths that can shorten the route to ransomware. IntelliOS automatically performs a read-only Hudson Rock API check for configured owned domains, stores aggregate counts only, and combines those results with retained public research. It never stores passwords, cookies, tokens, usernames, device identifiers, raw URLs, or raw API responses, and it never turns an infostealer record into a confirmed intrusion or ransomware victim.

Top 10 Salient Points

1.Revoke sessions, tokens, and cookies—not just passwords
2.Investigate the endpoint that produced the exposure
3.Treat privileged exposure as an incident-scoping trigger
4.Review VPN and edge access history after remediation
5.Scope employee, user, and third-party exposure separately
6.Do not infer zero exposure from a failed source check
7.Keep exposure counts out of ransomware victim totals
8.Use recency to prioritize, not to declare impact
9.Preserve logs before containment removes context
10.Close only when stolen trust no longer works

Rolling 90 days · Apr 30–Jul 28, 2026·5 retained sources

Published · v3

Kroll Cyber Risk & Resilience Intelligence

Kroll Cyber Risk & Resilience Rolling Intelligence Card — Rolling 1-Year Snapshot (Jul 29, 2025–Jul 28, 2026)

A source-cited rolling one-year synthesis of Kroll's public cyber-risk, threat-landscape, incident-response, resilience, exposure-management, and governance publications. The chronology now spans August 2025 through July 2026 and connects active campaigns, threat speed, known weaknesses, measurable business impact, ownership, remediation capacity, and proof that risk was actually reduced.

Top 10 Salient Points

1.Security assessments need to end in an owned 12-to-18-month roadmap
2.Discovery is becoming abundant; remediation velocity is the scarce resource
3.The second line must challenge whether cyber risk is actually controlled
4.Attackers are industrializing known weaknesses instead of waiting for exotic zero-days
5.Non-human identities can survive a human credential reset
6.Cyber strategy and business priorities remain misaligned
7.The reported average financial impact exceeds $20.9 million
8.Plans are widespread, but rapid response confidence is not
9.Threat exposure management now belongs to the CISO, CFO, General Counsel, CRO, and board
10.AI can turn fragmented public and breached data into executive-grade social engineering

Rolling 1 year · Jul 29, 2025–Jul 28, 2026·11 retained sources

Published · v9

U.S. SMB Ransomware Activity & Exposure Trends

U.S. SMB Ransomware Activity & Exposure Trends — Rolling 90-Day Intelligence Card (Apr 30–Jul 28, 2026)

This U.S. SMB-focused rolling card automatically queries the ransomware.live Pro, RansomLook, ThreatFox, and AlienVault OTX APIs; reconciles overlapping U.S. victim claims; measures sector and group concentration; and links group aliases to IntelliOS Threat Actor Cards. It complements the Global Ransomware Landscape card, which explains worldwide operator momentum and tradecraft. The two products answer different questions, and their counts, rankings, and source methodologies must remain separate.

Top 10 Salient Points

1.Do not collapse activity, encryption, demands, and payments into one trend
2.789 U.S. victim claims were observed in the rolling window
3.Professional services carried the largest visible share
4.Healthcare and manufacturing add 209 continuity-sensitive claims
5.Technology and retail complete the leading concentration
6.Qilin led the U.S. claim set
7.The Gentlemen and INC Ransom remain material watch priorities
8.Cross-collector agreement is high but not complete
9.Canonical Actor Cards cover 96.3% of observed claim volume
10.Company size is unverified for every tracker record

Rolling 90 days · Apr 30–Jul 28, 2026·19 retained sources

Published · v5

Cyber Insurance Claims, Coverage & Underwriting

Cyber Insurance Claims, Coverage & Underwriting Rolling Intelligence Card — Rolling 90-Day Snapshot (Apr 30–Jul 28, 2026)

AI-generated, AI-updated weekly, AI quality-checked, and source-cited, this 90-day Rolling Intelligence Card reconciles current carrier claims reports, broker market updates, reinsurer research, supervisory analysis, and incident-response observations into a decision-ready view of loss frequency and severity, ransomware and funds-transfer outcomes, recovery expense, failed controls, pricing and capacity, policy structure, underwriting changes, coverage ambiguity, and systemic accumulation risk.

Top 10 Salient Points

1.Do not combine carrier statistics
2.Downtime is a severity multiplier
3.Remote access remains expensive
4.Third-party loss is no longer peripheral
5.BEC is both a claim and a gateway
6.Ransom payment is not the loss model
7.Competitive pricing does not eliminate restrictive structure
8.Control evidence influences both underwriting and claims
9.Shared providers create accumulation risk
10.Coverage clarity is an executive control

Rolling 90 days · Apr 30–Jul 28, 2026·15 retained sources

Published · v3

SANS Practitioner Research, Threat Analysis & Cyber Defense Intelligence

SANS Practitioner Research, Threat Analysis & Cyber Defense Rolling Intelligence Card — Rolling 1-Year Snapshot (Jul 29, 2025–Jul 28, 2026)

A rolling one-year synthesis of SANS survey white papers, threat-intelligence reports, practitioner and threat-analysis blog articles, Internet Storm Center diaries, NewsBites and OUCH! newsletters, implementation posters and checklists, tool references, frameworks, press summaries, and selected instructor or contributor channels. Publication types remain visible because a survey benchmark, one-sensor diary, implementation checklist, curated newsletter, and incident post-mortem support different conclusions. The card connects those sources to detection, incident response, identity, cloud, software supply chain, AI-agent, and forensic-readiness decisions.

Top 10 Salient Points

1.The SOC problem is fragmented visibility, not simply too few tools
2.AI adoption has outrun operational validation
3.Threat intelligence is widely valued but rarely changes executive decisions
4.MCP and AI-assistant exposure is already being scanned
5.A trusted security tool can become the initial-access mechanism
6.Logs are useful only when content, delivery, retention, and time are verified
7.Detection engineering is a lifecycle, not a one-time rule-writing exercise
8.Protocol SIFT can accelerate triage, but it is not ready to carry evidentiary conclusions
9.MCP gives incident-response agents real tool reach, so authority and auditability become response controls
10.An AI agent should be governed as an operator identity, not purchased as ordinary software

Rolling 1 year · Jul 29, 2025–Jul 28, 2026·38 retained sources

Published · v12

Business Email Compromise

Business Email Compromise Rolling Intelligence Card — Rolling 90-Day Snapshot (Apr 30–Jul 28, 2026)

AI-generated, AI-updated weekly, AI quality-checked, and source-cited, this rolling 90-day BEC Rolling Intelligence Card reconciles provider telemetry, incident-response findings, campaign research, phishing infrastructure, and claims data. It explains which identities and payment workflows attackers exploit, how ordinary MFA can be bypassed, what losses look like, and which finance, identity, and response controls prevent an unrecoverable transfer.

Top 10 Salient Points

1.April’s BEC spike was severe but not a new baseline
2.Automation can scale authenticated, link-free fraud
3.Trusted vendors are the most important impersonation path
4.MFA presence did not equal phishing resistance
5.Q1 cash-out favored gift cards while wires carried larger exposure
6.Fortra’s June engagement volume and wire severity increased
7.Nearly three in ten June wire requests exceeded $50,000
8.Most observed delivery used free webmail
9.Claims data places typical loss in the mid-five figures
10.The highest-value control is independent verification

Rolling 90 days · Apr 30–Jul 28, 2026·7 retained sources

Published · v4

Arete Cyber Threat & Incident Response Intelligence

Arete Cyber Threat & Incident Response Rolling Intelligence Card — Rolling 1-Year Snapshot (Jul 29, 2025–Jul 28, 2026)

A source-cited rolling one-year synthesis of Arete's crimeware and incident-response research from 27 July 2025 through 26 July 2026. The card uses the Q3 2025, 2025 Annual, and Q1 2026 Crimeware Reports plus monthly and technical updates to show how actor concentration, access methods, victimology, payment pressure, and defensive priorities changed across the full window. The Q1 2026 report remains the highest-weight current analytic source, and every observation period is kept distinct from the date Arete published it.

Top 10 Salient Points

1.Payments became less frequent but materially larger when victims paid
2.Akira and Qilin produced almost one-third of Arete's Q1 engagements
3.Akira combined high volume with unusually strong payment conversion
4.Professional services led a broad, access-driven victim population
5.Edge exploitation, compromised credentials, and social engineering formed the Q1 access triad
6.Teams impersonation, device-code abuse, and ClickFix moved social engineering beyond ordinary phishing
7.Fortinet, WatchGuard, and BeyondTrust weaknesses were operational entry paths—not inventory trivia
8.The top tier remained stable even as new ransomware brands emerged
9.DragonForce's cartel model and leaked-code reuse lower the cost of operational change
10.Most adversarial AI use remained generative and assistive—not autonomous

Rolling 1 year · Jul 29, 2025–Jul 28, 2026·21 retained sources

Published · v2

At-Bay InsurSec Claims & Cyber Risk Intelligence

At-Bay InsurSec Claims & Cyber Risk Rolling Intelligence Card — Rolling 1-Year Snapshot (Jul 29, 2025–Jul 28, 2026)

A source-cited rolling one-year synthesis of At-Bay claims research, InsurSec reporting, cyber case studies, threat research, underwriting signals, and practical security guidance. The chronology now spans August 2025 through July 2026 and connects initial access and control failure to claim frequency, severity, interruption, fraud recovery, litigation, extortion, and post-incident resilience without presenting At-Bay's insured population as a universal incident census.

Top 10 Salient Points

1.Remote access has become the dominant loss path in At-Bay's ransomware claims
2.Small businesses are absorbing a higher financial floor for cyber incidents
3.Akira industrialized one appliance-focused campaign into portfolio-level loss
4.EDR presence did not prevent many Akira losses; continuously monitored response changed the outcome
5.Interruption and liability can dominate the cost after initial compromise
6.The first three days materially change stolen-funds recovery odds
7.A clean restore is not guaranteed when the backup repository still contains malware
8.One anomalous legacy-authentication event can reveal stolen-credential access
9.Seven months of quiet access erased the evidence needed to identify initial entry
10.Restoring operations left one organization compromised for roughly two years

Rolling 1 year · Jul 29, 2025–Jul 28, 2026·16 retained sources

Cards per page

1-10 of 18