— theaters at CRITICAL (—) and — escalating. — edge-device flaws reached KEV in 30 days, with a median —-day lag from publication this year; extortion claims against financial services moved — period on period.
Only MEDIUM or HIGH confidence judgments appear here, at most six. Likelihood uses ICD-203 terms; confidence is computed from the evidence each judgment cites, so a likely event can carry moderate confidence. Open a card for its argument map.
Cited reporting items dated within 7 days of the newest item, newest first. Grades are Admiralty reliability and credibility.
Takedowns, sanctions, charges and seizures that change the near-term threat (Bhardwaj p192-196).
Pulled in your browser from this site's threat-feeds service (ransomware.live, FIRST EPSS, abuse.ch). Use Refresh now or set an auto-refresh interval in the header. When the service does not answer these show as unavailable and the daily built data still stands.
Families and indicator types only; the raw indicators stay in the feed for blocking tools, so nothing here is a clickable link.
Upstream reachability as the proxy last saw it. Each feed's proxy cache bounds how fresh a refresh can be: claims 1 minute, indicators 5, EPSS an hour (FIRST publishes once a day). An interval shorter than a feed's cache returns the same rows.
The newest Item 1.05 filings by U.S.-listed companies, each linked to the 8-K itself. The Ransomware page lists every filing with the Item 8.01 candidates.
One picture of the kinetic and cyber situation. Theaters sit at their locations, colored by ThreatCon calibrated for the selected vertical. Live layers add reported botnet C2 servers, ThreatFox IOC endpoints, DShield scanning sources and URLhaus malware hosts by IP geolocation, cyberattacks disclosed in the press at the victim's country, GDELT armed-conflict arcs from the actor's location to the action, IODA internet disruptions and, on request, attributed state-nexus targeting. Hover anything for its record, click for the source, and use Replay to re-run the last 24 hours in reported order.
Live layers read this site's threat-feeds service, whose collector refreshes every 15 minutes. IP geolocation (ip-api.com, GeoJS) places the hosting, not the operator; a reported attack marks only the victim's country, as settled from ransomware.live's record; and an arc asserts no traffic between its ends: conflict arcs join GDELT's geocodes for the actor and the action of a press-reported event, and attribution arcs join an actor's attributed country to countries public reporting names as victims. Chokepoint oil flows are from the U.S. EIA, World Oil Transit Chokepoints.
Each theater's ThreatCon times the vertical's weight, rounded and held between 1 and 5. The weights are an analyst lens on sector exposure, set in the build and reviewed with the theaters.
Leak-site claims by victim country; the live set replaces the daily snapshot once the threat-feeds service answers.
One public indicator at a time, read by free analyzers: CIRCL BGP Ranking and IP-to-ASN history, cl0q's index of hosted sites, the Tranco research ranking, CIRCL hashlookup's known-software database, abuse.ch MalwareBazaar and YARAify for a file hash (read with the community Auth-Key held by the collector), the ORKL report library and the collector's own holdings for an address on the map. Each answer names its analyzer and when it was read, and the collector caches it for a day. Private and reserved addresses are refused. Nothing read here is added to the map or the cited items.
The most-reported material-conflict events involving an armed actor, one row per source article, machine-coded by GDELT from world news. Event type is the CAMEO root; mentions count how widely each is reported, a rough salience signal. These are press-reported events, not confirmed incidents.
Attacks disclosed in the press over recent weeks as ransomware.live collects them: the victim as it names them (some names in French), the outlet and headline, and the leak-site group where ransomware.live matched the report to a claim. Its country field is free text, so the threat-feeds service checks each code against the victim's domain, the outlet's domain and the headline before placing a mark; Basis gives the rule that settled each country, and a code that could name two countries with nothing to choose between them stays unplaced. Attack date is the date ransomware.live records for the attack or its discovery; Listed is when it added the report, months later for some state breach notices. Click a row to locate it.
Listed hosts per malware family across Feodo Tracker C2, ThreatFox ip:port indicators and URLhaus malware hosts; New counts mapped hosts listed by their source in the last 24 hours, or first observed by the collector in that window once it has watched for a day. Pick a family above to light it up on the map.
Country-level outage events detected by Georgia Tech's IODA from BGP, active probing and darknet telescope signals. A disruption can follow a cable cut, a power failure, a shutdown order or an attack; IODA records the signal, not the cause.
Origin and victim countries for named actors, as recorded in the MISP galaxy threat-actor cluster with the Council on Foreign Relations Cyber Operations Tracker fields. This is historical attribution from public reporting with each source's own confidence; it says where reporting placed targeting over the years, not what is happening now.
ThreatCon keeps MERIDIAN's 1-5 scale so levels compare, but each level here is set from named leading indicators and cited reporting. Bars show escalation indicators observed out of each theater's total. Pick a theater for its assessment.
States follow Suryavanshi ch4: not observed, emerging, observed, confirmed. Each observed state cites an item.
Every item links to its source. Veracity runs claimed, reported, corroborated, confirmed.
Each theater's tempo from five independent collection families: press events (GDELT conflict events against their 48-hour rate, and Lanes temperatures, which derive from GDELT and so count as the same family), satellite thermal anomalies (NASA FIRMS), internet measurement (IODA outages), maritime notices (NGA, MARAD, UKMTO) and sanctions actions (OFAC). Rising means a family's reading runs above its own baseline at the threshold its rules use (GDELT 1.5 times the 48-hour rate, Lanes up 0.05 week on week above the 0.3 amber line, FIRMS 1.5 times the daily median or three new cells, an IODA outage rated critical in 72 hours (IODA rates each event against its own baseline), OFAC actions outrunning the prior 14 days); Active marks maritime warnings, which carry no baseline. Hover a cell for the reading. Consistency is how many independent families rise together and momentum is each reading against its own baseline (Suryavanshi ch4); a single family never corroborates itself (Arici 3.5.2).
Analyst-set rules tie 26 of the 56 warning indicators to a live reading, each marked direct or proxy with its reason. One family above threshold proposes Emerging; two independent families, or one direct measurement, propose Observed; an observed state with no measured signal past three weeks asks for review. Indicators no feed can measure (statements, prices, sorties, sabotage) stay with reporting. Nothing changes until the analyst applies a proposal.
Lanes scores each country pair it tracks from GDELT events, article-weighted: 0.6 times the share of verbal and material conflict plus 0.4 times twice the share of material conflict, capped, from 0 cooperative to 1 open conflict; Lanes treats 0.3 as the amber line (dashed). The 7-day mean and its change against the prior 7 days are computed here from Lanes' daily rows. This measures how the pair's interactions were reported, so it moves with coverage. A pair attaches to a theater holding both countries, or by rule where one party sits outside the theater's list (Israel and Palestine to the Levant, the United States and Iran to Hormuz). Lanes' daily pages are AI-compiled from cited reporting and not human-reviewed. Open data, CC BY 4.0: Lanes News, derived from the GDELT Project.
The newest entries on OFAC's Recent Actions listing, the authoritative record behind the U.S. lists that sanctions search tools index. Programs and action types are matched in OFAC's own titles; a program tied to a theater (Iran to Hormuz, Russia to Ukraine, Venezuela, North Korea, Sudan, Yemen and the Houthis, Syria and Lebanon, Afghanistan, the Western Balkans, Somalia and Ethiopia, Mali, Mexican cartels) attaches the action to it, and a title naming no listed program attaches to none. Each action links to its Treasury page, which the collector reads once for the SDN entries it adds and removes under OFAC's own headings. Cyber marks a title naming the cyber-related program or an added entry tagged CYBER.
Read from the Treasury page of each recent action: vessels designated or delisted with the name, IMO number, type, flag, call sign and MMSI OFAC prints, one row per IMO (a vessel listed under two names shows both), and every entry under a cyber-related program. A designation is a legal action against a named vessel or party; it reports no incident and carries no position.
One dot per cited item, colored by the theater's ThreatCon. Hover for the item.
MERIDIAN started each region from a fixed base and adjusted by keyword-scored incident counts. These levels come from indicators and cited items; blank baselines are theaters MERIDIAN did not cover.
Vector first, actor second: the Big 5 plus a fraud lens, with identity and valid accounts as its own card (Thomas p73-104). Threat is intent plus capability plus opportunity, each rated with its basis (Tiepolo and Sorensen p42-43).
Weekly multi-outlet incident clusters (ThreatCluster snapshot, model-generated summaries) mapped to vectors. This measures what the press covered, which is the availability-bias check (Arici 2.1.4); it ends at the snapshot date and the last week is partial.
Each CVE sits on the highest rung it has reached (Automating CTI p344). Rungs are not strictly nested: some CVEs are exploited with no public PoC. Log scale.
Share of each CVSS band among all new CVEs, all KEV entries and ransomware-linked KEV entries. Many exploited flaws score below Critical (Ransomware Analysis p85).
KEV CVEs by publication year since KEV opened (3 November 2021), with medians of days from CVE publication to the first public GitHub repository naming the CVE, to the first Nuclei template or Metasploit exploit module, and to CISA's listing. Risk rises sharply at weaponization (Automating CTI p344); a weaponized flaw is a patch priority before anyone confirms exploitation, the lesson of EternalBlue before WannaCry (Ali and Bhatti p175-178). A first repository can be a scanner, a write-up or a fake PoC, and a KEV date records when CISA catalogued the flaw, which can trail its first exploitation (Fleurat et al. ch13).
KEV CVEs published since KEV opened whose first Nuclei template or Metasploit exploit module predates the KEV listing. Lead is days from weaponization to listing.
Early-warning CVEs with a Nuclei template or Metasploit exploit module and no KEV listing, newest weaponization first. Mass-scanning templates and exploit modules lower the cost of exploitation for everyone.
Bars: CVEs added per month. Line: median days CISA allowed agencies to remediate, which fell from 21 to 3 under BOD 26-04 (June 2026).
Firewalls, VPNs, gateways, routers, mail and file-transfer appliances and remote-management tools are where state and criminal actors gain entry (Tiepolo and Sorensen p240-243). Median lag is days from CVE publication to KEV across all years.
Ordered by date added. Weaponized means a Metasploit module or Nuclei template exists. Data gaps flag missing CVSS v3+, CWE or SSVC (Kuhn p182-192). ATT&CK exploitation and impact are CTID's KEV mappings (419 CVEs, July 2025); the Defense page ranks those techniques.
CVEs from the last 200 days that CISA has not listed but that VulnCheck lists as exploited, that have a Metasploit module or Nuclei template, or that carry EPSS of 0.10 or more. Triage owned products weekly.
Pulled in your browser on refresh. A high exploitation probability with no KEV listing is a candidate for the early-warning watch; one already in KEV confirms the patch queue order.
CISA industrial control system advisories with sectors and deployment as the vendor reports them.
One small chart per group on a shared scale; the last month is partial.
Thin bar: prior 90 days.
ISO country codes as the collector assigns them.
Residual = inherent (vertical-calibrated vector level) x exposure (owned-asset match and dark-web read) x (1 - control coverage). Asset and control data are what turn the inherent read into residual risk (Thomas p178-183). Change the vertical in the header to recalibrate; hover a bar for the exposure basis.
Same estate and controls, each vertical's weights applied: the row for the selected vertical is outlined. Read across a row for where that sector's residual exposure concentrates, down a column for which sectors a vector hits hardest.
AutoRecon inventory joined by vendor and product against KEV and the pre-KEV early-warning list. Internet-facing assets with a match are the residual-risk surface. The join reads the product line and leaves version out, so a match flags exploited CVEs in that product for a version check against the advisory.
NIST CSF 2.0 coverage per vector, owner-set (0 to 1); the residual column uses the selected vertical. Coverage values change by a reviewed commit to data/authored/controls.json.
Breach, infostealer, leak-site, paste and reputation reads for the organization's own domains and egress, from the darknet-mcp-server tools.
Pulled in your browser through the threat-feeds service: breaches of your domains (HIBP), leak-site listings that name you or a supplier (ransomware.live), and reputation of your egress IPs (Tor Project, abuse.ch, GreyNoise). It needs a watchlist; until one is set it returns nothing and the sample read above stands.
Both inputs are results about the organization's own estate. The page reads them; scanning and monitoring run in their own tools, under the operator's authorization.
Nexus exactly as ATT&CK's description states it. Dark: state-attributed; light: other groups.
New group-to-technique relationships are events: they record newly documented behaviour (Arici 6.3.2).
ATT&CK's nexus is quoted from its own description; MISP and the CFR tracker sit beside it. The page shows divergence and leaves it unresolved (Tiepolo and Sorensen p502-529). Pick a group for its profile.
Techniques per tactic for the selected group; empty tactics are documentation gaps.
Groups using each technique, split by the four state nexus most active against financial targets (Thomas p202-206).
Threat-informed defense for the selected vertical: the ATT&CK techniques to defend first under this dashboard's threat model, where public detection and test content runs out, which telemetry and controls cover the most of it, and what to hunt and test next. Public content counts describe what Sigma, Elastic, Splunk and Atomic Red Team have published; the organization's own rule inventory and log coverage decide its real gaps (Bhardwaj p179-182).
The 15 highest priorities for . Each bar stacks prevalence (how much of the threat model uses the technique and how often CTI reporting observes it), choke point and actionability, each 0 to 1: the CTID Top ATT&CK Techniques method recomputed for this vertical (Thomas p202-206). Pick a bar for the technique.
Bar: the share of each tactic's threat use that falls on leaf techniques (sub-techniques, and techniques without any) with at least one Sigma, Elastic or Splunk rule. Tick: the share on techniques with an Atomic Red Team test. ATT&CK read in reverse, as a map of where defenders have the least to start from (Arici 6.3.2). Reconnaissance and Resource Development happen outside the estate, where intelligence collection watches them.
Every ATT&CK v20 technique and sub-technique, ranked. A parent's counts include its sub-techniques. Shift is how many places this vertical's threat model moves a technique against plain ATT&CK frequency (every group weighing 1). Gap flags mark techniques no public rule or no Atomic test carries. Pick a row for its hunt hypothesis, content, telemetry and exploited CVEs.
Enter technique ids seen in an intrusion. Candidates are the techniques CTI reports most often observe with them in CTID's Technique Inference Engine dataset (4,466 reports with two or more techniques), scored by share of reports times the log of lift and summed across what was entered. Co-occurrence suggests where to hunt; it proves nothing about this intrusion (Fleurat et al. ch13).
Techniques inside the estate with threat use of 0.15 or more that no public rule or no Atomic test carries. They need in-house detection engineering or a custom test; check them against the organization's own rule inventory first. Reconnaissance and Resource Development happen outside the estate and are watched through intelligence collection, so they are left out here.
Groups weighing 0.6 or more for : a stated nexus whose theater stands at ThreatCon 3 or more and whose ATT&CK description or MISP entry names one of this vertical's sectors as a target (sector relevance, Tiepolo and Sorensen p573), or a financial motive meeting a Ransomware or Fraud vector at 3 or more. Beside each, the share of its ATT&CK techniques inside the estate that a public rule or an Atomic test covers: overlaying a playbook on coverage shows which steps of its attack path would pass unseen (Bhardwaj p181-182). Pick a group for its first uncovered technique.
ATT&CK v20 data components ranked by the summed priority of the top 100 techniques whose ATT&CK detection analytics read them. This is the public half of a DeTT&CT assessment; scoring the organization's own visibility for each component (-1 to 5 on completeness, timeliness, consistency and retention) turns it into a gap list (Bhardwaj p179-182).
The financial sector's Cyber Risk Institute Profile diagnostic statements, ranked by the share of top-100 prevalence carried by techniques each statement mitigates (CTID Mappings Explorer, ATT&CK 16.1 mappings carried to v20).
The 15 highest-priority techniques that in-scope groups use and Atomic Red Team can exercise, as the test-definition half of a purple-team register: the behavior, the intelligence that justifies testing it, the scenario, the telemetry the detection relies on, the testable hypothesis and the adversary-prevalence band (Tiepolo and Sorensen p572-575). Asset criticality and results belong to the exercise: record each as Detected-Alerted, Detected-Noisy, Detected-Late, Logged-Not-Detected or Missed, with a content, telemetry or process root cause.
CISA KEV entries grouped by the ATT&CK technique CTID maps as the way each is exploited (419 KEV CVEs mapped as of the 28 July 2025 KEV mapping). Exposure to these techniques is where patching and detection meet.
A layer for to open in ATT&CK Navigator (Open Existing Layer, Upload from local): the top 100 priorities scored 0 to 3, or the public detection gaps scored by prevalence. Each technique's comment carries its drivers. Combine it with a group's layer by score expression to see where that group's playbook meets the gaps (Bhardwaj p140-147).
Each repository at the commit the build read. Rule titles and links only; rule bodies stay in their repositories under their own licenses.
Each is one question tied to one decision, scored QIR = (S x D x F) x (R + T) on 1-4 scales, maximum 512; a weak core sends a requirement back for rework (Fleurat et al. ch6). Pick one for its SIRs, EEIs and gaps.
Requirement to source traceability (Arici 2.1.2). Gap and planned rows are where collection is missing.
Feedback on this site becomes FP-numbered requirements, classified and prioritised for approval (Fleurat et al. ch12; Arici 2.5).
Version or snapshot date of each machine-collected catalog.
The closed catalog the daily run may cite. Admiralty reliability A-F and default credibility 1-6; tier T1-T3; validity; and the seven feed criteria (timeliness, relevancy, accuracy, context, format, enrichment, licensing) rated H, M or L (Bhardwaj p169).
The analyst tools added to The OSINT Newsletter's toolkit and how this dashboard uses each: ingested as a feed, linked as a pivot, kept as a reference, or held because it searches for look-alikes of the organization and waits on the owner's decision. Each row was checked against the tool's entry in the OSINT Tools Library and, where the Checked column says so, against the tool's own pages on 2026-10-19. A tool whose site is a JavaScript application with no published link pattern opens on its front page.
What the collector could not read at its last run, in each source's own answer. A refused or frozen source leaves its layer dark; nothing stands in for it.
Items are what a source reported; judgments are built on them and stored apart (Arici 12.3.3). Score = reliability x credibility.
The calculation behind every confidence badge.
Each design choice and the book and page of the CTI literature it comes from.
Admiralty credibility for a host on the threat map counts independent operators: the map source's operator plus each list operator that names it. Aggregates, derived lists and Tor exits sit beside the count, never in it. The item score is source reliability times credibility weight (Tiepolo and Sorensen p525). Classes follow ENISA's Reference Security Incident Taxonomy.
Each entry hashes the run's datasets and the previous entry, so any edit to history breaks the chain (Gupta and Tennin p117).
Every dataset the page reads. Built files are rebuilt by the site's workflow (machine-collected) or revised by the daily reassessment (analyst-authored) and can be downloaded as JSON; live queries are read from the threat-feeds service when the page opens and on refresh.
Key judgments as STIX opinion-style notes with their cited reports, marked TLP:AMBER and PAP:AMBER, the most restrictive marking of their inputs. Select all and copy.