📡 Sources¶
294 tracked intelligence sources across 9 categories. Status reflects reachability from the agent's cloud session and is refreshed by the daily routine; it is not a measure of source quality.
Status: 🟢 Reachable (155) · 🟡 Blocked direct / via fallback (139) · 🔴 Unreachable (0) · ⚪ Pending check (0)
General news & breaches¶
| Status | Source | Notes |
|---|---|---|
| 🟢 | BankInfoSecurity | ISMG title; financial-sector breach/compliance news |
| 🟢 | CSO Online | |
| 🟢 | CyberScoop | |
| 🟢 | Cybersecurity Dive | |
| 🟢 | Dark Reading | |
| 🟢 | DataBreaches.net | |
| 🟢 | DataBreachToday | ISMG title; breach news |
| 🟢 | GovInfoSecurity | ISMG title; government-sector breach/policy news |
| 🟢 | Help Net Security | Occasional 403 |
| 🟢 | HIPAA Journal | Healthcare breach/compliance news, heavily cited |
| 🟢 | Industrial Cyber (OT/ICS) | |
| 🟢 | MSSP Alert | |
| 🟢 | SC Media | Rebranded to SC World; scmagazine.com no longer cited while scworld.com is cited 11x in last ~4 weeks (ransomware/vuln briefs) — URL corrected (2026-10-18 weekly review) |
| 🟢 | Security Boulevard | Security news aggregator/syndication |
| 🟢 | The Cyber Express | Cyble-published outlet; breach/ransomware/threat-intel news, directly reachable |
| 🟢 | The Record (Recorded Future News) | Primary for breaches and policy |
| 🟢 | The Register (Security) | |
| 🟡 | ABC News | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — briefings have cited the abcnews.com short domain, which redirects to the canonical abcnews.go.com; US network news breaking major incidents (water-sector Iran-linked attacks, Independence Day Ukraine strikes), cited 4x — confirmed add (2026-08-30 weekly review). |
| 🟡 | ASCII.jp | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — long-running Japanese tech-news publisher (Kadokawa/ASCII Media Works), cited 3x for Japan-specific breach/incident coverage (IDCF Cloud fallout, GMO Internet VPS exposure) — confirmed add; complements Nippon.com for Japan-coverage depth (2026-10-25 weekly review). |
| 🟡 | Axios | 403 on direct fetch; read via search. General news with cyber/AI-safety coverage, cited 3x — confirmed add. |
| 🟡 | BleepingComputer | 403 on direct fetch; read via search snippets |
| 🟡 | CBS News | 403 on direct fetch; read via search. Major US broadcaster, cited 4x for distinct stories (energy-tanker cyberattacks/Coast Guard, Trump-Xi AI/trade summit) — confirmed add, same pattern as CNN/NBC/ABC News (2026-10-18 weekly review). |
| 🟡 | CNBC | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — dedicated Cybersecurity vertical, cited 9x in last ~4 weeks (breach data, AI-agent hacking, cyber-stock moves) — confirmed add (2026-08-16 review). |
| 🟡 | CNN | EGRESS_BLOCKED on direct fetch this session; briefings already cite live cnn.com article URLs directly (confirmed reachable via those citations) — major US broadcaster covering breaking cyber/tech stories (Australia OpenAI-agent hack, Pentagon personnel-data breach), cited 5x in last ~4 weeks for distinct incidents — confirmed add (2026-09-27 weekly review). |
| 🟡 | Computer Weekly | 403 on direct fetch; read via search. TechTarget/Informa UK security news, cited 4x — confirmed add. |
| 🟡 | Cyber Daily (Australia) | 403 on direct fetch; read via search. AU-focused cyber news, cited 4x — confirmed add. |
| 🟡 | CyberInsider | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — independent cybersecurity/privacy news outlet (successor to RestorePrivacy's news desk, relaunched 2024), cited 3x for breach coverage (McKesson, Questel) — confirmed add (2026-08-30 weekly review). |
| 🟡 | Cybernews | 403 on direct fetch; read via search snippets. Heavily cited (24x in ~4 weeks of briefings) — confirmed add. |
| 🟡 | CyberSecurityNews | 403 on direct fetch; read via search. Cited 4x — confirmed add. |
| 🟡 | Forbes | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — cybersecurity contributor network + AI-cybersecurity topic hub, cited 3x — confirmed add (2026-08-16 review). |
| 🟡 | Fortune | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — dedicated Cybersecurity section + annual Cyber 60 ranking, cited 7x in last ~4 weeks (AI-hacking incidents, cyber funding) — confirmed add (2026-08-16 review). |
| 🟡 | GBHackers | 403 on direct fetch; read via search. Security news aggregator, cited 6x — confirmed add. |
| 🟡 | GovTech | 403 on direct fetch; read via search. Government-sector IT/security news (state/local breach disclosures), cited 3x — confirmed add. |
| 🟡 | HackRead | 403 on direct fetch; read via search. Security news aggregator, cited 4x — confirmed add. |
| 🟡 | Infosecurity Magazine | 403 on direct fetch; monthly roundups via search |
| 🟡 | Krebs on Security | 403 on direct fetch; read via search snippets |
| 🟡 | Malwarebytes / ThreatDown | 403 on direct fetch; read via search. Consumer/enterprise threat news, cited 11x — confirmed add. |
| 🟡 | MedTech Dive | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Industry Dive title (sister to Cybersecurity Dive, already tracked), medical device/digital-health industry news incl. a dedicated cybersecurity topic page, cited 4x for Boston Scientific manufacturing-disruption coverage — confirmed add (2026-09-13 weekly review). |
| 🟡 | MLex | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — LexisNexis-owned regulatory/compliance news service (antitrust, data privacy & security, trade/sanctions), cited 3x for distinct stories (Japan breach cluster, Iran procurement-network sanctions) — confirmed add (2026-10-25 weekly review). |
| 🟡 | NBC News | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — dedicated Cyber Security vertical, cited 4x for distinct stories (Russia/Iran sanctions bill, Germany-Russia hybrid-attack summons, OpenAI/Hugging Face hack, Iran US-infrastructure targeting) — confirmed add (2026-09-06 weekly review). |
| 🟡 | Nippon.com | 403 on direct fetch; read via search. Multilingual nonprofit Japan-news outlet (Japan Echo Foundation), cited 6x for distinct Japan-specific cyber stories (Qilin suspect arrest/extradition, IDCF ransomware fallout) — confirmed add; fills a Japan-coverage gap alongside CTech (Israel) and Kyiv Independent (Ukraine) (2026-10-18 weekly review). |
| 🟡 | Rescana | 403 on direct fetch; read via search. Incident-analysis blog (breaches, active exploitation), cited 5x in last ~4 weeks — confirmed add. |
| 🟡 | SecurityAffairs | Intermittent 403 on direct fetch |
| 🟡 | SecurityWeek | 403 on direct fetch; read via search snippets |
| 🟡 | Semafor | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — business/politics/tech news site (founded 2022 by Ben Smith/Justin B. Smith), cited 3x for distinct stories (Thoma Bravo/Imprivata deal-process reporting, China travel-advisory wrongful-detention marker) — confirmed add (2026-10-25 weekly review). |
| 🟡 | TechCrunch | 403 on direct fetch; read via search. General tech news, cited 8x in ~4 weeks (funding rounds, breaking security stories) — confirmed add. |
| 🟡 | TechNadu | 403 on direct fetch; read via search. Cybersecurity news vertical, cited 4x — confirmed add. |
| 🟡 | TechRadar | 403 on direct fetch; read via search. General tech news with a security vertical, cited 4x — confirmed add. |
| 🟡 | TechTimes | 403 on direct fetch; read via search. General tech news, cited 5x — confirmed add. |
| 🟡 | The Block | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — dedicated Hacks category, crypto/DeFi exploit and breach tracking (relevant to ransom-payment/crypto-theft coverage), cited for distinct incidents (French tax-data breach, Cosmos Labs exploit) — confirmed add (2026-09-06 weekly review). |
| 🟡 | The CyberWire (N2K) | 403 on direct fetch; confirmed active via search — daily podcast + news briefing, latest episode Jul 30 2026. Reputable general cyber news source, not yet cited but a landscape gap fill (2026-08-02 review). |
| 🟡 | The Hacker News | Intermittent 403 on direct fetch |
| 🟡 | The Next Web | 403 on direct fetch; read via search. Tech news covering security/policy, cited 3x — confirmed add. |
| 🟡 | The Washington Post | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — "The Cybersecurity 202" policy newsletter + Technology section, cited 3x (Iran water-sector attacks, AI-hacking policy) — confirmed add (2026-08-16 review). |
| 🟡 | UpGuard | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — third-party cyber-risk vendor's breach-research/news desk (2026 pieces incl. a Higher Education third-party risk report, World Cup fan-data exposure, Lakelands Public Health breach), cited 3x in last ~4 weeks (Lakelands Public Health, Supabase systemic-exposure research) — confirmed add (2026-10-11 weekly review). |
| 🟡 | ZATAZ | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — French cybersecurity news outlet (est. 1989), weekly cyber-actualités roundups + breach coverage, cited 3x — confirmed add (2026-08-23 weekly review). |
M&A & funding¶
| Status | Source | Notes |
|---|---|---|
| 🟢 | Accesswire | Press wire, F-23 sweep family 1 |
| 🟢 | AGC Partners | Cyber-specific M&A boutique bank; quarterly cybersecurity market updates + deal tracker |
| 🟢 | Business Wire | Press wire, F-23 sweep family 1 |
| 🟢 | BusinessWire | Deal/press-release wire; primary source for buyer announcements |
| 🟢 | Channel Dive | Channel/MSSP press, F-23 sweep family 4. Industry Dive title, covers MSP/MSSP roll-ups |
| 🟢 | Channel Futures | Channel press, F-23 sweep family 4 |
| 🟢 | ChannelE2E | Channel/MSSP press, F-23 sweep family 4. MSP/MSSP M&A coverage |
| 🟢 | Cision News | Press wire, F-23 sweep family 1 (DEC-29). Nordic/European PE houses (EQT, IK Partners) publish here |
| 🟢 | CRN | Channel press, F-23 sweep family 4 |
| 🟢 | CTech (Calcalist) | Israeli market deals |
| 🟢 | Dealroom news | Deal-news aggregator, F-23 sweep family 3 |
| 🟢 | GlobeNewswire | Press wire, F-23 sweep family 1 |
| 🟢 | GlobeNewswire | Deal/press-release wire |
| 🟢 | Hampleton Partners | Cybersecurity M&A report (registration required for full download) |
| 🟢 | Kroll Cybersecurity M&A Insights | Periodic cyber-specific M&A sector report |
| 🟢 | Momentum Cyber | Quarterly reviews + annual almanac |
| 🟢 | PR Newswire | Press wire, F-23 sweep family 1. First publication point for many deals (Quorum Cyber → Ontinue, 2026-09-16) |
| 🟢 | PR Newswire | Deal/press-release wire |
| 🟢 | PRWeb | Press wire, F-23 sweep family 1. Mid-market/PE-backed services deals (CyberMaxx → Avertium, 2026-09-16) |
| 🟢 | Return on Security | Weekly funding/M&A deal tracker |
| 🟢 | Richard Stiennon / IT-Harvest | |
| 🟢 | SEC EDGAR (8-Ks) | Primary for US public-company deals |
| 🟢 | SiliconANGLE | |
| 🟡 | Capstone Partners | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Boston-based mid-market investment bank (Huntington Bancshares-owned), regular Cybersecurity Market Update reports. Landscape-scan add, not yet cited (2026-08-09 review) — M&A section boutique-advisory coverage gap fill. |
| 🟡 | Crunchbase | 403 on direct fetch; confirmed active via search — news.crunchbase.com publishes free cybersecurity funding/M&A news regularly (2026 H1 funding trend pieces); the core data platform stays paywalled. |
| 🟡 | Houlihan Lokey | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — major global investment bank (NYSE-listed, ticker HLI) with a dedicated Cybersecurity practice inside its Technology Group, publishing recurring Cybersecurity Quarterly Market Updates covering MSSP/platform M&A, disclosed multiples and deal-flow commentary. Landscape-scan add, not yet cited — boutique/large-bank advisory coverage gap fill alongside AGC/Hampleton/Momentum/Kroll (2026-09-27 weekly review). |
| 🟡 | Pinpoint Search Group | Confirmed active via search (403 on direct fetch) — Q1 2026 report tracked 159 vendor transactions, $4.62B raised; monthly M&A/funding briefs continue. |
| 🟡 | PitchBook | 403 on direct fetch; confirmed active via search — Q1 2026 Cybersecurity VC Trends report and ongoing M&A report series; full reports paywalled to clients but summaries reach trade press. |
| 🟡 | Pulse2 | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Ann Arbor-based business/deal-flow news site, daily funding coverage. Cited 3x for cybersecurity funding rounds (Mate Security, MDSec, Obsidian Security) — confirmed add (2026-08-09 review). |
| 🟡 | SecurityWeek M&A tracker | 403 direct; monthly roundups via search |
| 🟡 | Solganick | 403 on direct fetch; confirmed active via search — IT/software services investment bank publishing a recurring Cybersecurity Services M&A market update (Q4 2025/YTD 2026 edition). New add (2026-08-02 review); M&A section hadn't picked up a genuinely new boutique advisory source in a while. |
| 🟡 | Windsor Drake | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Toronto/New York/London boutique investment bank (founded 2018) running sell-side cybersecurity M&A processes across 9 subsectors, publishing a recurring Cybersecurity M&A Report + Valuation Report (2026 H1 edition — 219 deals, $9.1B disclosed). Landscape-scan add — M&A section's boutique-advisory coverage hadn't had a genuinely new addition since Solganick/Capstone/Pulse2 in early August (2026-09-13 weekly review). |
Private equity & investors¶
| Status | Source | Notes |
|---|---|---|
| 🟢 | Accel-KKR | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Advent International | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Apax Partners | PE newsroom, F-23 sweep family 6 (DEC-29). Confirmed active via search — filterable News & Views hub, ongoing 2026 deal activity (2026-09-20 weekly review) |
| 🟢 | August Equity | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Blackstone | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Bregal Sagemount | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Bridgepoint | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Carlyle | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Charlesbank | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Clearlake Capital | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Crosspoint Capital Partners | PE newsroom, F-23 sweep family 6 (DEC-29). Confirmed active via search — cybersecurity/privacy/infra-software focused fund, recent Feb 2026 SynthBee deal (2026-09-20 weekly review) |
| 🟢 | CVC Capital Partners | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | EQT | PE newsroom, F-23 sweep family 6 (DEC-29). Also publishes via news.cision.com/eqt (Ontinue sale to Quorum Cyber, 2026-09-16) |
| 🟢 | Eterna Growth Partners | PE newsroom, F-23 sweep family 6 (DEC-29). Majority investor in Quorum Cyber; spun out of Charlesbank in Feb 2026. Confirmed active via search — newsroom publishing regularly through Sep 2026 (2026-09-20 weekly review) |
| 🟢 | Eurazeo | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Evolution Equity Partners | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Francisco Partners | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | GI Partners | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Haveli Investments | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Hellman & Friedman | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Hg | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | IK Partners | PE newsroom, F-23 sweep family 6 (DEC-29). Also publishes via news.cision.com |
| 🟢 | Insight Partners | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Investcorp | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | KKR | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Main Capital Partners | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Marlin Equity Partners | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Nordic Capital | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Paladin Capital Group | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Periscope Equity | PE newsroom, F-23 sweep family 6 (DEC-29). Backs CyberMaxx (MDR roll-up, Avertium 2026-09-16) |
| 🟢 | Permira | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | PSG Equity | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Sunstone Partners | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Thoma Bravo | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | TPG | PE newsroom, F-23 sweep family 6 (DEC-29). Confirmed active via search — also publishes via press.tpg.com and shareholders.tpg.com (2026-09-20 weekly review) |
| 🟢 | Turn/River Capital | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Vista Equity Partners | PE newsroom, F-23 sweep family 6 (DEC-29) |
| 🟢 | Warburg Pincus | PE newsroom, F-23 sweep family 6 (DEC-29). Confirmed active via search — 24 pages of news, regular 2026 deal announcements (2026-09-20 weekly review) |
| 🟡 | ABRY Partners | PE newsroom, F-23 sweep family 6 (DEC-29). EGRESS_BLOCKED on direct fetch this session; confirmed active via search — regular 2026 deal activity incl. a June 2026 investment in KaufmanIT (managed IT/cybersecurity firm) (2026-09-27 weekly review) |
| 🟡 | Cinven | PE newsroom, F-23 sweep family 6 (DEC-29). EGRESS_BLOCKED on direct fetch this session; confirmed active via search — regular 2026 deal announcements (Envu, Optio, Salsify) (2026-09-27 weekly review) |
| 🟡 | Inflexion | PE newsroom, F-23 sweep family 6 (DEC-29). EGRESS_BLOCKED on direct fetch this session; confirmed active via search — press-releases page live, 2026 exit/deal activity confirmed (2026-09-27 weekly review) |
| 🟡 | Keensight Capital | PE newsroom, F-23 sweep family 6 (DEC-29). Confirmed active via search (2026 leadership announcements, portfolio-company acquisitions incl. a Sep 24 2026 Nomios/Orbcom cybersecurity add-on) — URL updated to keensight.com (no www), the form every search result resolves to (2026-09-27 weekly review) |
| 🟡 | Livingbridge | PE newsroom, F-23 sweep family 6 (DEC-29). EGRESS_BLOCKED on direct fetch this session; confirmed active via search — News Archives category page live, 2026 fundraise/deal activity confirmed (2026-09-27 weekly review) |
| 🟡 | The Riverside Company | PE newsroom, F-23 sweep family 6 (DEC-29). EGRESS_BLOCKED on direct fetch this session; confirmed active via search — "Currents" section regularly updated with investment/exit announcements (2026-09-27 weekly review) |
| 🟡 | Tikehau Capital | PE newsroom, F-23 sweep family 6 (DEC-29). EGRESS_BLOCKED on direct fetch this session; confirmed active via search — regular 2026 press releases and publications, incl. a "Barometer of European Investment in Cybersecurity" report; URL corrected to /en/views-and-insights (old /en/news-and-views path no longer resolves) (2026-09-27 weekly review) |
| 🟡 | Vitruvian Partners | PE newsroom, F-23 sweep family 6 (DEC-29). EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Sep 15 2026 Smartling investment announcement; portfolio includes Darktrace (2026-09-27 weekly review) |
| 🟡 | Welsh, Carson, Anderson & Stowe | PE newsroom, F-23 sweep family 6 (DEC-29). EGRESS_BLOCKED on direct fetch this session; confirmed active via search — regular 2026 operating-partner and fundraise announcements, also publishes via PR Newswire (2026-09-27 weekly review) |
Ransomware / DLS / victims¶
| Status | Source | Notes |
|---|---|---|
| 🟢 | Acronis | Ransomware threat reports |
| 🟢 | Arctic Wolf | Threat-actor profiles |
| 🟢 | Blackpoint Cyber | Ransomware threat-actor profiles |
| 🟢 | Breachsense | Monthly reports |
| 🟢 | Comparitech ransomware tracker | |
| 🟢 | Coveware | Ransom economics |
| 🟢 | CybelAngel | Ransomware group profiles |
| 🟢 | Cyble | |
| 🟢 | Darktrace | Ransomware/APT campaign tracking |
| 🟢 | FalconFeeds | |
| 🟢 | Flare | DLS victim-mapping research |
| 🟢 | GuidePoint Security GRIT | Quarterly ransomware & cyber threat report; leaderboard-quality victim/group stats |
| 🟢 | Halcyon | |
| 🟢 | Huntress | Threat-actor profiles, frequently cited |
| 🟢 | NCC Group monthly threat pulse | |
| 🟢 | Picus Security | Ransomware group deep-dives, heavily cited |
| 🟢 | RansomLook | Open aggregator with RSS + API; reliable fallback |
| 🟢 | ReliaQuest | Threat research |
| 🟢 | ZeroFox | |
| 🟡 | AttackIQ | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — breach/adversary-emulation (BAS) vendor publishing per-group ransomware TTP emulation writeups (Nova, Chaos, NightSpire, BlackByte), active 2026 cadence, cited 3x in last ~4 weeks — confirmed add (2026-10-11 weekly review). |
| 🟡 | Black Kite | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — third-party cyber risk vendor, annual Ransomware Report (7,551 victims 2025-26, up 24.9%) is a leaderboard-quality dataset, cited 7x (both "Black Kite 2026 Report" and "Black Kite 2026 Ransomware Report" variants) — confirmed add (2026-08-23 weekly review). |
| 🟡 | BreachNews | 403 on direct fetch; read via search. Data-breach/ransomware news and DLS tracking, cited 4x — confirmed add. |
| 🟡 | Check Point Research | 403 on direct fetch; read via search snippets. Current ransomware-report and advisory posts also publish under blog.checkpoint.com/research/ and /security/ — same publisher, cited 3x via that path (2026-10-18 weekly review) |
| 🟡 | Cyber Kendra | 403 on direct fetch; read via search. Vuln/exploit-focused security blog (est. 2012), cited 3x — confirmed add. |
| 🟡 | Daily Security Review | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — ransomware/vulnerability-focused news site with dedicated Ransomware section, cited 3x in last ~4 weeks (proxy-network takedown, SiteGuard zero-day, legacy Nova/RALord CIS-rule item) — confirmed add (2026-10-25 weekly review). |
| 🟡 | DeXpose | 403 on direct fetch; read via search. DLS/ransomware-victim tracker, cited 32x in last ~4 weeks — confirmed add. |
| 🟡 | ExZec Cyber | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — independent cyber-intelligence newsletter (4,000+ CISOs/analysts/founders subscribers, twice-weekly), cited 3x for the McKesson/ShinyHunters extortion-deadline coverage — confirmed add (2026-09-13 weekly review). Smaller/newer outlet than most tracked sources; corroborate its claims against a second source before repeating a figure. |
| 🟡 | GalaxyWarden | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — DLS/ransomware breach tracker (per-group incident logs, e.g. L Group, Cmdorganization, N0n, Dark Project), cited 6x in last ~4 weeks (Clark Hill/ SilentRansomGroup and others) plus historical use in the frozen tracker — confirmed add (2026-10-04 weekly review). |
| 🟡 | hendryadrian.com | 403 on direct fetch; read via search. Ransomware monitor/dashboard, cited 8x — confirmed add. |
| 🟡 | HookPhish | Confirmed active via search (403 on direct fetch) — cited 13x in last ~4 weeks for ransomware-victim blog posts. |
| 🟡 | PurpleOps | 403 on direct fetch; read via search. CTI platform publishing daily ransomware-victim reports, cited 3x — confirmed add. |
| 🟡 | Ransom-DB | Confirmed active via search (403 on direct fetch) — live ransomware threat map, alerting, API. |
| 🟡 | Ransom-ISAC | 403 on direct fetch; confirmed active via search — open (no-paywall) ransomware-defender ISAC publishing leak-site analysis and affiliate tracking; already cited once. New add (2026-08-02 review). |
| 🟡 | ransomware.live | 403 on direct fetch; read via search/mirror |
| 🟡 | RedPacket Security | 403 on direct fetch; read via search. DLS/ransomware-victim tracker, cited 29x — confirmed add. |
| 🟡 | Security Arsenal | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — publishes multiple ransomware-gang victim-tracking posts daily with Sigma/KQL/VQL detection rules and IR playbooks (Panzer, INC Ransom, MedusaLocker, IAH6477 and others), cited 3x — confirmed add (2026-09-20 weekly review). |
Vulnerabilities & exploitation¶
| Status | Source | Notes |
|---|---|---|
| 🟢 | Cisco PSIRT | |
| 🟢 | CrowdStrike | |
| 🟢 | Fortinet PSIRT | |
| 🟢 | GreyNoise | In-the-wild telemetry |
| 🟢 | Horizon3.ai | Exploit/PoC research |
| 🟢 | Ivanti / Citrix / Palo Alto PSIRTs | Vendor advisory portals |
| 🟢 | JFrog Security Research | Supply-chain/vuln research |
| 🟢 | Microsoft MSRC | |
| 🟢 | NVD | |
| 🟢 | Qualys | |
| 🟢 | Rapid7 | |
| 🟢 | Shadowserver | |
| 🟢 | Tenable | |
| 🟢 | VulnCheck | KEV + State of Exploitation |
| 🟢 | Zero Day Initiative | |
| 🟡 | CERT Polska | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Poland's national CERT (CSIRT NASK, FIRST member since 1998), confirmed active exploitation and issued primary-source advisories for the Zimbra CVE-2026-73570 and MikroTik "MikroTrick" CVE-2026-67276/86060 campaigns, cited 4x — confirmed add. Vulnerabilities section hadn't had a genuinely new addition since SafeDep/Chainguard in early August (2026-09-13 weekly review). |
| 🟡 | Chainguard (Unchained blog) | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — regular 2026 posts (State of Trusted Open Source series, Gartner MQ Leader). Co-broke the Aug 2026 keyv/cacheable npm supply-chain attack — cited 3x — confirmed add (2026-08-09 review). |
| 🟡 | CISA KEV | 403 on direct fetch; KEV JSON + search work |
| 🟡 | ENISA EU Vulnerability Database (EUVD) | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — live since May 2025 under the NIS2 Directive mandate, aggregates CVE/CSIRT/ vendor data with exploitation status (EU counterpart to NVD/CISA KEV); corroborated by SecurityWeek, Computer Weekly and Industrial Cyber coverage. Landscape-scan add, not yet cited — Vulnerabilities section hadn't had a genuinely new addition since CERT Polska in mid-September (2026-10-04 weekly review). |
| 🟡 | SafeDep | EGRESS_BLOCKED on direct fetch this session; confirmed active via search. OSS supply-chain security vendor, broke Aug 2026 keyv/cacheable npm (Shai-Hulud) compromise research — cited 3x — confirmed add (2026-08-09 review). |
| 🟡 | SonicWall | 403 on direct fetch; read via search. Vendor PSIRT advisories at psirt.global.sonicwall.com/vuln-list (SNWLID-YYYY-NNNN); cited 3x for exploited SMA/firewall CVEs and ransomware-TTP research — confirmed add, same pattern as Fortinet/Citrix/Palo Alto PSIRTs (2026-10-18 weekly review). |
| 🟡 | watchTowr Labs | 403 on direct fetch; read via search. Vuln research/PoC blog, cited 4x — confirmed add. |
IOC feeds (reference/context, not auto-ingested)¶
| Status | Source | Notes |
|---|---|---|
| 🟢 | C2IntelFeeds | Community-sourced C2 indicator feed (Censys-derived, Modat data since May 2026); confirmed active with recent commits (2026-08-30 weekly review) |
| 🟡 | AbuseIPDB | Crowd-sourced malicious-IP abuse reports. EGRESS_BLOCKED on direct fetch this session; confirmed active via search (2026-08-23 weekly review). |
| 🟡 | AlienVault OTX | Open threat exchange — community pulse IOCs. EGRESS_BLOCKED on direct fetch this session; confirmed active via search — status page shows 100% uptime over trailing 90 days (2026-08-23 weekly review). |
| 🟡 | Feodo Tracker (abuse.ch) | Botnet C2 server IOCs — context for grounding actor/campaign writeups, not a citable news source. EGRESS_BLOCKED on direct fetch this session; confirmed active via search — abuse.ch (Swiss non-profit) industry-standard feed (2026-08-23 weekly review). |
| 🟡 | MalwareBazaar (abuse.ch) | Malware sample-sharing platform (abuse.ch) — completes the abuse.ch family alongside Feodo Tracker/URLhaus/ThreatFox. EGRESS_BLOCKED on direct fetch this session; confirmed active via search (2026-09-27 weekly review). |
| 🟡 | ThreatFox (abuse.ch) | Malware/C2 IOC sharing platform (abuse.ch + Spamhaus) — same trusted org as the already-tracked Feodo Tracker/URLhaus. EGRESS_BLOCKED on direct fetch this session; confirmed active via search — live daily IOC postings through Sep 26 2026. Landscape-scan add — IOC feeds section hadn't had a genuinely new addition since 2026-08-30 (2026-09-27 weekly review). |
| 🟡 | URLhaus (abuse.ch) | Malware distribution URL IOCs. EGRESS_BLOCKED on direct fetch this session; confirmed active via search — abuse.ch project (2026-08-23 weekly review). |
Threat actors / APT / CTI vendors¶
| Status | Source | Notes |
|---|---|---|
| 🟢 | Binarly | Firmware/supply-chain research |
| 🟢 | Cisco Talos | |
| 🟢 | Datadog Security Labs | Directly reachable; active 2026 publication cadence (npm worm/Shai-Hulud follow-on research, eBPF rootkit detection), cited 3x — confirmed add (2026-08-16 review). |
| 🟢 | Dragos (OT) | |
| 🟢 | ESET WeLiveSecurity | |
| 🟢 | Google Threat Intelligence / Mandiant | Authoritative for APT attribution |
| 🟢 | Group-IB | |
| 🟢 | IBM X-Force | APT/ransomware ecosystem research |
| 🟢 | Kaspersky Securelist | APT/ransomware research |
| 🟢 | KELA | |
| 🟢 | Microsoft MSTIC | |
| 🟢 | MITRE ATT&CK | TTP reference |
| 🟢 | Recorded Future | Insikt Group research |
| 🟢 | Red Canary | Detection/IR research |
| 🟢 | SentinelLabs | |
| 🟢 | SOCRadar | |
| 🟢 | Sophos X-Ops | |
| 🟢 | Trend Micro Research | Ransomware Spotlight series, frequently cited |
| 🟢 | Unit 42 (Palo Alto) | |
| 🟢 | Vectra AI | TTP/detection research |
| 🟢 | Volexity | APT/IR research |
| 🟢 | Wiz Research | Cloud threat research |
| 🟢 | Zscaler ThreatLabz | |
| 🟡 | Anthropic Threat Intelligence | EGRESS_BLOCKED on direct fetch this session; confirmed active via repeated briefing citations — publishes primary-source threat-intelligence reports and disclosures naming specific actors and campaigns (GTG-1002 AI-orchestrated espionage disclosure, quarterly threat-intelligence reports naming China-linked distillation operators, model-safety/cyber-incident alignment assessments), cited 7x+ across recent weeks — confirmed add (2026-09-20 weekly review). |
| 🟡 | AWS Security Blog | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Amazon Threat Intelligence team, broke the DPRK Sapphire Sleet npm (axios/debug/chalk) supply-chain attribution, cited 3x — confirmed add (2026-08-16 review). |
| 🟡 | Bitdefender (HotForSecurity) | 403 on direct fetch; read via search. Vendor CTI/consumer-threat blog, cited 5x — confirmed add. |
| 🟡 | Censys | 403 on direct fetch; confirmed active via search — Censys ARC research team publishing regularly through 2026 (SOC/threat-intel posts) |
| 🟡 | CloudSEK | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — threat intel vendor, active 2026 coverage (LiteLLM AI supply-chain attack, npm typosquatting, geopolitical cyber-conflict research), cited 3x — confirmed add (2026-08-23 weekly review). |
| 🟡 | Cybersixgill (Bitsight) | 403 on direct fetch; confirmed active via search (part of Bitsight since Nov 2024, blog still publishing CTI content) |
| 🟡 | DomainTools | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — regular 2026 blog posts (Jun 22 "Blueprint of Bad Actors" infrastructure-mapping post, plus May/Apr/Mar/Jan 2026 posts) — blog cadence confirmed (2026-08-23 weekly review). |
| 🟡 | EclecticIQ | 403 on direct fetch; confirmed active via search — Jul 2026 posts (MCP server for AI agents, regional-conflict cyber-risk analysis) |
| 🟡 | Flashpoint | Illicit-community intel. Confirmed active via search (403 on direct fetch) — 2026 Global Threat Intelligence Report. |
| 🟡 | Intel 471 | HUMINT-led CTI. Confirmed active via search (403 on direct fetch) — 2026 threat-trends report, extortion-surge tracking. |
| 🟡 | Orange Cyberdefense | 403 on direct fetch; confirmed active via search — Security Navigator 2026 annual report + active CERT-News/Research blog sections |
| 🟡 | Proofpoint Threat Insight | 403 on direct fetch; confirmed active via search — Jul 2026 posts (CVE exploitation trends, TA446 Atlantic Council spoofing campaign) |
| 🟡 | Resecurity | 403 on direct fetch; confirmed active via search — Jul 2026 posts (SharePoint attack analysis, CVE-2026-20253 Splunk RCE) |
| 🟡 | Secureworks CTU | 403 on direct fetch; confirmed active via search — CTU (now joint Sophos X-Ops task force) continues publishing threat-group research |
| 🟡 | Sekoia.io | EU CTI vendor. Confirmed active via search (403 on direct fetch) — blog remains live at blog.sekoia.io, active cadence confirmed through Aug 21 2026 (SOC runbooks, AI SOC integrations, ChocoPoC PyPI campaign) (2026-08-30 weekly review). |
| 🟡 | Silent Push | Infrastructure/pre-attack intel. Confirmed active via search (403 on direct fetch) — 2026 predictions, active blog. |
| 🟡 | SOC Prime | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — detection-engineering/Threat Detection Marketplace vendor (Uncoder AI), cited for Ukraine-focused threat-actor detection content (UAC-0099) — confirmed add (2026-08-30 weekly review). |
| 🟡 | Symantec / Broadcom Threat Hunter Team | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Symantec's threat-research blog consolidated onto security.com (was symantec-enterprise-blogs.security.com); active 2026 cadence (RSAC 2026 coverage, threat predictions), cited in actor cards (DragonForce, Medusa) — confirmed add (2026-09-06 weekly review). |
| 🟡 | Sysdig | 403 on direct fetch; read via search. Sysdig TRT broke JADEPUFFER (first documented agentic ransomware, Jul 1) and CVE-2026-33017 Langflow exploitation — cited 5x, confirmed add. |
| 🟡 | Team Cymru | 403 on direct fetch; confirmed active via search — 2026 Voice of the Cybersecurity Strategist report + Feb/Apr 2026 threat research posts |
Geopolitics & policy¶
| Status | Source | Notes |
|---|---|---|
| 🟢 | Al Jazeera | Qatar-based international broadcaster, directly reachable (briefings cite live aljazeera.com article URLs); cited 7x in last ~4 weeks for distinct Russia-Ukraine/Iran conflict and cyber-infrastructure stories (Yandex datacenter drone strike, French supermarket cyberattack) — confirmed add (2026-10-18 weekly review). |
| 🟢 | AP | |
| 🟢 | Atlantic Council (DFRLab / Cyber Statecraft) | |
| 🟢 | Canadian Centre for Cyber Security | Five Eyes — Canada's lead cyber agency (part of CSE); directly reachable |
| 🟢 | CERT-EU | |
| 🟢 | Council of the EU (Consilium) | EU's own primary-source sanctions press releases (Russia hybrid-threats regime, Iran human-rights measures); directly cited 3x — confirmed add, EU counterpart to OFAC/Treasury (2026-10-18 weekly review). |
| 🟢 | CSIS | |
| 🟢 | ENISA | |
| 🟢 | FBI IC3 | |
| 🟢 | Government of Canada Travel Advisories | Five Eyes — directly reachable; official Canadian risk-level-by-country advisories |
| 🟢 | Lawfare | |
| 🟢 | NCSC-NZ | Five Eyes — New Zealand's lead cyber agency; CERT NZ fully merged into NCSC-NZ in 2024, so incident/alert citations under either name resolve here |
| 🟢 | NCSC-UK | |
| 🟢 | New Zealand SafeTravel | Five Eyes — directly reachable; MFAT's official country travel-advisory levels |
| 🟢 | NSA Cybersecurity | |
| 🟢 | OFAC / Treasury sanctions | Sanctions notices. Individual press releases also post at home.treasury.gov/news/press-releases (sbNNNN URLs) — same agency, cited 4x via that path (2026-10-18 weekly review) |
| 🟢 | Reuters | |
| 🟢 | Risky Business | |
| 🟢 | The Record | |
| 🟡 | ACSC (Australia) | 403 on direct fetch |
| 🟡 | American Enterprise Institute (AEI) | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — DC think tank running a Coalition Defense of Taiwan project (w/ Institute for the Study of War) covering China/Taiwan state-strategy, cited 4x in last ~4 weeks for Geopolitics commentary (Taiwan-China analysis) — confirmed add (2026-10-11 weekly review). Geopolitics & policy section hadn't had a genuinely new addition since Foreign Policy in late September. |
| 🟡 | Australia DFAT Smartraveller | 403 on direct fetch; confirmed active via search — 24 countries under "do not travel" as of Jul 2026, Middle East situation actively updated |
| 🟡 | Bloomberg | Paywalled; via search snippets |
| 🟡 | CERT-UA | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Ukraine's national CERT (State Service for Special Communications and Information Protection, FIRST-accredited since 2009), primary-source advisories on Russia-linked campaigns against Ukrainian government/critical infrastructure, cited (direct + via SOC Prime detection writeups) — structural gap fill for the ongoing Russia-Ukraine cyber-conflict beat (2026-09-06 weekly review). |
| 🟡 | Chatham House (Cyber & Technology) | 403 on direct fetch; read via search. International-affairs think tank, Journal of Cyber Policy — state-strategy/policy analysis angle |
| 🟡 | CISA advisories | 403 on direct fetch; read via search |
| 🟡 | DOJ | 403 on direct fetch; read via search. Press releases for cybercrime prosecutions/ extraditions/takedowns, cited 7x — confirmed add. |
| 🟡 | EEAS (European External Action Service) | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — EU's own diplomatic service, primary source for EU sanctions/foreign-policy actions (Russia hybrid-activities sanctions regime extension), cited 5x in last ~4 weeks — confirmed add; EU counterpart to OFAC/Treasury and Council of the EU, already tracked (2026-10-25 weekly review). |
| 🟡 | Euronews | EGRESS_BLOCKED on direct fetch this session (ENOTFOUND); briefings already cite live euronews.com article URLs directly for 3 distinct stories in the last ~4 weeks (EU cyberattack-shield accountability piece, Yandex datacentre drone strike, Japanese firm cyberattack compensation) — confirmed add, same pattern as Al Jazeera/CNN (2026-11-01 weekly review). |
| 🟡 | Federal News Network | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — dedicated Cybersecurity vertical, US federal IT/cyber policy news (CIRCIA rulemaking, agency cyber posture, offensive-hacking policy debates), cited 3x for distinct stories — confirmed add (2026-09-06 weekly review). |
| 🟡 | Foreign Policy | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Graham Holdings-owned global-affairs magazine (est. 1970), daily online publication, cited 3x for state-strategy/hybrid-warfare analysis (Russia gray-zone campaign, US hack-back policy) — confirmed add (2026-09-20 weekly review). |
| 🟡 | HSToday | 403 on direct fetch; confirmed active via search — Government Technology & Services Coalition's homeland-security trade publication, cited for the FBI FLASH Silent Ransom Group law-firm advisory — confirmed add; fills out the federal policy cluster alongside Nextgov/FCW and Federal News Network (2026-11-01 weekly review). |
| 🟡 | Korea JoongAng Daily | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — English edition of JoongAng Ilbo, one of Korea's three major English dailies (est. 2000, co-published with the NYT), cited 3x for the South Korea bank AI-assisted-intrusion/regulatory-review story — confirmed add (2026-10-25 weekly review). |
| 🟡 | Kyiv Independent | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Ukrainian English-language outlet (est. 2021, reader-funded, no state/oligarch ownership), primary ground-level source for Russia-Ukraine cyber/kinetic conflict coverage, cited 4x — confirmed add; also fills a gap noted this review (Geopolitics & policy section hadn't had a genuinely new, dated addition in recent weekly reviews relative to other sections) (2026-08-30 weekly review). |
| 🟡 | Nextgov/FCW | 403 on direct fetch; read via search. US federal IT/cyber policy news, cited 5x — confirmed add. |
| 🟡 | SCMP (South China Morning Post) | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Hong Kong's flagship English-language newspaper (Alibaba-owned), cited 3x for distinct China-nexus stories (Nexperia/Wingtech chip-control arbitration, AI-chip smuggling indictment, China travel-advisory change) — confirmed add (2026-10-25 weekly review). |
| 🟡 | The National (UAE) | EGRESS_BLOCKED on direct fetch this session; confirmed active via search — Abu Dhabi-based English-language daily (est. 2008), cited for Iran-nexus Handala/CyberAv3ngers infrastructure-attack reporting, cited 3x — confirmed add (2026-09-13 weekly review). State-owned (Abu Dhabi royal family); FT describes it as reflecting Abu Dhabi's official worldview — cross-check its framing of Gulf-state geopolitics against an independent source. |
| 🟡 | UK FCDO Travel Advice | 403 on direct fetch; confirmed active via search — current 2026 country advisories (Afghanistan, Belarus, Haiti, Iran, Russia, South Sudan, Syria, Yemen at "do not travel") |
| 🟡 | US State Dept Travel Advisories | 403 on direct fetch; confirmed active via search — 22 countries at Level 4 as of this review. Official government risk assessment by country. |
Forums & signals (sentiment, not news)¶
| Status | Source | Notes |
|---|---|---|
| 🟡 | Hacker News | Technical/founder-class sentiment; often leads mainstream coverage by days. Confirmed active via search — ongoing front-page activity through Sep 2026, brief Sep 2 outage otherwise healthy (2026-09-06 weekly review). |
| 🟡 | r/artificial | AI-specific sentiment (cost, labor displacement, trust). Confirmed active via search — ~1.3M members as of Aug 2026 (2026-09-20 weekly review). |
| 🟡 | r/AskNetsec | Practitioner Q&A — early behaviour-shift signals. Confirmed active via search — ~150k members (2026-09-20 weekly review). |
| 🟡 | r/CredibleDefense | Higher-signal defense/geopolitics discussion, sourced comments required by the sub. Confirmed active via search — ~117k members as of Aug 5 2026 (2026-09-13 weekly review). |
| 🟡 | r/cybersecurity | Practitioner sentiment — market/vendor/customer reactions. Confirmed active via search — established, widely-cited practitioner community (2026-09-06 weekly review). |
| 🟡 | r/FlockSurveillance | Anti-ALPR activist hub; example of a topic-specific signal subreddit worth tracking directly. Confirmed active via search — ~422k members, 11,000+ weekly contributions as of mid-2026 (2026-09-06 weekly review). |
| 🟡 | r/geopolitics | State-strategy sentiment, cross-checked against the Geopolitics & policy sources above. Confirmed active via search — ~758-787k members (2026-09-13 weekly review). |
| 🟡 | r/msp | MSP/defender-side sentiment on vendors, pricing, incident response. Confirmed active via search — 241k members as of Jun 3 2026 (2026-09-13 weekly review). |
| 🟡 | r/netsec | Security research/discussion — threat-actor tradecraft chatter. Signals only, not news. Confirmed active via search — ~460-560k members, high activity (2026-09-06 weekly review). |
| 🟡 | r/news | General public pulse (e.g. Flock ALPR camera backlash). Confirmed active via search — 25M+ members, one of Reddit's largest general-news communities (2026-09-20 weekly review). |
| 🟡 | r/sysadmin | Defender-side sentiment, tooling/vendor backlash signals. Confirmed active via search — 1.3M members as of Aug 25 2026 (2026-09-06 weekly review). |
| 🟡 | r/technology | General public sentiment on AI/tech backlash trends. Confirmed active via search — 17.9M+ members, one of Reddit's largest communities (2026-09-13 weekly review). |