FortiGuard Labs (Fortinet), Threat Research

https://www.fortinet.com/blog/threat-research

Added 2026-08-16 as this run's single new candidate. Named original-research primary for the Evooo1Bot Linux-botnet entry published this run, and the originating lab for several IoT/Mirai-derivative writeups cited by earlier fires without the publisher being tracked. Article bodies are client-rendered: a follow-up research pass reported the raw-HTML bridge returning only the page shell while WebFetch rendered it, but the main agent reached the full article body through `fetch_source.py url` on the same host later in the same run, so treat the bridge as working and WebFetch as the fallback. No RSS feed identified yet, worth another look before promotion. | 2026-08-16 weekly: candidate -> active. The state digest counted 10 distinct contributing runs, well past the 3-run promotion bar; promoted mechanically from the counted evidence per the allocation rule rather than by eyeball.