Expel
expel · B · candidate
Managed-detection-and-response provider publishing first-hand incident analysis from its own SOC. Surfaced 2026-08-24 by the weekly run as the primary for SynkLoader, a previously unidentified Teams-delivered loader family that no other source in the list carried. FETCH -> feed https://expel.com/blog/rss.xml (verified direct, dated items with full links); AVOID https://expel.com/feed/ and https://expel.com/blog/feed/, both return non-XML. Candidate - promote to active after 3 contributing runs.
Cited in 2 entries
Citation cadence
Citation days per ISO week (1 weeks of coverage span, total 1).
- SynkLoader: a Teams message from a lookalike tenant, an MSI called 'PowerShell Cleaner', and a six-module toolkit whose fake lock screen harvests the domain password its own tunnel then uses from the victim's IP2026-08-24
- Switzerland's federal cyber authority reports the public sector as still the largest share of mandatory critical-infrastructure notifications, and devotes its half-year report to two things a Swiss defender can act on: the anatomy of the Polish energy sabotage, and a crypto-theft playbook that recruits its victims on LinkedIn2026-08-24