Track reported campaigns, active threat actors and targeted sectors, including activity described before a CVE is named.
Updated 21 Aug 2026 · 17:05 UTC
Signals become useful when evidence, behaviour and targets are connected.
Evidence, not prediction.
Pre-CVE means a trusted source has described malicious activity or a previously unknown weakness without naming a CVE. ATT&CK mappings marked Explicit were stated by the source. Inferred mappings are conservative interpretations of source wording and must be verified against the original report.
1Reports in 24 hours
0Pre-CVE reports · 7 days
30Named actors · 30 days
7Targeted sectors · 30 days
2ATT&CK-mapped reports · 7 days
Target-sector mentions · 30 days
Where reported activity is focused
Counts reflect explicit sector mentions in collected reports. One report may mention several sectors, so this is a comparison of evidence coverage rather than a share of all attacks.
Written by: Tyler McLellan, Austin Larsen Introduction Google Threat Intelligence Group (GTIG) continues to track UNC6671 actively conducting compromises leading to data theft extortion, despite the alleged announced retirement of the BlackFile extortion brand in May 2026. Telemetry…
Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications, negotiations, and data leak operations alongside double extortion tactics used to pressure victims. The post DeadLock…
The dashboard currently uses freely available government, vendor and vendor-research reporting. A source problem is shown here instead of silently hiding stale data.
