FortiGuard Labs (Fortinet), Threat Research

https://www.fortinet.com/blog/threat-research

Added 2026-08-16 as this run's single new candidate. Named original-research primary for the Evooo1Bot Linux-botnet entry published this run, and the originating lab for several IoT/Mirai-derivative writeups cited by earlier fires without the publisher being tracked. Article bodies are client-rendered: a follow-up research pass reported the raw-HTML bridge returning only the page shell while WebFetch rendered it, but the main agent reached the full article body through `fetch_source.py url` on the same host later in the same run, so treat the bridge as working and WebFetch as the fallback. No RSS feed identified yet, worth another look before promotion. | 2026-08-16 weekly: candidate -> active. The state digest counted 10 distinct contributing runs, well past the 3-run promotion bar; promoted mechanically from the counted evidence per the allocation rule rather than by eyeball. | 2026-10-02 (2026-10-02T0404Z-intel): `extract` of /blog/threat-research returns undated teasers; the raw `url` fetch carries 'Month DD, YYYY' beside each card, so use `url` and regex the card dates. | 2026-10-06 (S3): in the raw `url` card list each card's author/date line comes AFTER its title, so pairing a date with the following title is off by one; attach each date to the preceding title or confirm on the article page.