Every incident this desk has graded since 2019, with the vector, the actor, the dwell time, and how confident we are. Filter it, sort it, export it. Argue with our grades.
Not a threat feed. We publish no indicators, no hashes and no infrastructure: the desk has no telemetry, and a list assembled from other people’s reporting would be stale before it rendered. Every row here is a file we wrote, with its sources on the page.
How a file is graded →A file opens when we can name a target and a plausible vector, and closes when the affected organisation confirms containment or 180 days pass without new evidence. Dwell time runs from earliest evidenced access to the earlier of containment or public listing. Severity weighs affected population, data sensitivity, and operational disruption — never ransom size.
Read the full standard →