SOC status:Duty analyst on shift
Insights
Research, detection engineering notes and plain-English explanations for the questions UK boards, IT managers and security leads actually ask. One substantial piece a week; a short threat brief in between.
Get the fortnightly briefing
The collection picture this period is dominated by sustained state-aligned espionage activity (Salt Typhoon, Mustang Panda, APT28 and Screening Serpens all remain active), continued infostealer activity affecting contractor supply chains…
The threat profile of this vertical is shaped by the holding of large member-data sets, the use of legacy CMS / association-management software and the convening / publishing role that makes these organisations targets for influence operations as well as conventional cyber-crime.
During the reporting period the principal observations were the continued Scattered Spider / DragonForce cluster's UK-retail targeting (anniversary of the 2025 M&S, Co-op, Harrods campaign now approaching its first cycle); the persistent Magento / Adobe Commerce skimmer wave that Sansec…
During the reporting period the principal observations were a ransomware compromise of the Adriatic Port Authority by the Anubis ransomware group, reported on 13 June and disrupting maritime logistics across the region…
During the reporting period the principal observations were the continued INC Ransom group campaign against law firms - 20 victims claimed across 2026 to date including ten claimed in a recent 48-hour burst - and the Halcyon 200+ ransomware incident dataset that places the legal sector as the…
During the reporting period the principal observations were the continuing strategic consequence of the June 2024 Synnovis / NHS London pathology compromise - South London and Maudsley NHS Foundation Trust pathology systems remained partially un-restored into early 2026…
All assessments use estimative language and confidence ratings per Section 11.
During the reporting period the principal observations were the continued sustained cyber pressure on the Western defence industrial base from Russia- and China-linked actors as documented by Mandiant / Google Threat Intelligence (April 2026 report describing China-nexus groups as the most active…
The trade-body and membership-organisation collection picture this week sits against persistent high-volume phishing pressure (APWG Q1 2026 records 971,181 attacks, up 13.8% from Q4 2025) and the Verizon 2026 DBIR's continuing observation that the human element dominates breach causation.
The retail-sector collection picture this week continues to be framed by the Scattered Spider / DragonForce campaign that disrupted M&S, Co-op and Harrods through April-May 2025 and which has carried forward into a sustained 2026 pivot toward retail BPO and outsourced customer-service helpdesks.
The maritime-and-logistics collection picture this week has been dominated by the convergence of the new no-patch network-edge defects (Cisco Catalyst SD-WAN Manager CVE-2026-20245 and Arista EOS CVE-2026-7473) with the still-current US Coast Guard MTSA Cyber Regulations compliance window.
The legal-sector collection picture this week sits against an unusually material regulatory backdrop: the Solicitors Regulation Authority's April 2026 consultation on compliance demonstration remains open…
226 articles · page 5 of 19