SOC status:Duty analyst on shift
Insights
Research, detection engineering notes and plain-English explanations for the questions UK boards, IT managers and security leads actually ask. One substantial piece a week; a short threat brief in between.
Get the fortnightly briefing
The healthcare vertical is in a sustained reconnaissance phase from the perspective of the attackers. SonicWall's mid-year data - 264,000 IPS events across UK hospital networks Jan-May 2026 versus 27,000 across the whole of 2025, a 10x surge - is the anchor statistic for the reporting period.
The financial-services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets.
The R&D and DIB vertical continues to sit at the highest strategic threat level of any of the covered verticals, with the dominant threat being long-dwell espionage from China-nexus and DPRK-nexus actors.
Coverage this period is dominated by the CISA KEV addition of the SharePoint deserialisation defect (CVE-2026-45659) on 01 Jul with a three-day federal remediation deadline; the continued tail of CitrixBleed 3 session-token abuse against NetScaler estates…
Coverage this period is dominated by the CISA KEV addition of CVE-2026-45659, sustained credential-stuffing volumes against member portals, and the continuing baseline of BEC / invoice-redirect fraud against trade-body finance functions.
Coverage this period is dominated by the NCA arrests on 30 Jun 2026 of four UK nationals connected to the M&S / Co-op / Harrods DragonForce / Scattered Spider cluster, the CISA KEV addition of CVE-2026-45659 (SharePoint deserialisation RCE)…
Coverage this period is dominated by the SharePoint deserialisation KEV entry (CVE-2026-45659) - operationally significant given the prevalence of SharePoint document management across shipping agents, brokers…
Coverage this period is dominated by the SharePoint deserialisation KEV entry (CVE-2026-45659) - operationally significant for the legal sector given the near-ubiquity of SharePoint and iManage for matter files, trust-account documentation…
Coverage this period is dominated by the CISA KEV addition of CVE-2026-45659 (SharePoint deserialisation RCE), continued long-tail impact of the Synnovis / Qilin June 2024 attack on NHS South East London, and sustained ransomware activity by Qilin against healthcare-adjacent targets.
Coverage this period is dominated by the CISA KEV addition of the SharePoint deserialisation defect (CVE-2026-45659) on 01 Jul with a three-day federal remediation deadline; the continued tail of CitrixBleed 3 session-token abuse against NetScaler estates…
Coverage this period is dominated by the CISA KEV addition of CVE-2026-45659 - a significant risk given the prevalence of SharePoint in classified-adjacent document management - and by continuing PRC state-sponsored activity attributable to Salt Typhoon and Volt Typhoon.
The collection picture this period is dominated by sustained state-aligned interest in trade bodies and policy-influence organisations (Mustang Panda and APT28 both remain active against this vertical), the edge-appliance exposure introduced by the 23 June Ubiquiti UniFi OS KEV addition…
219 articles · page 3 of 19