Trends
Momentum analysis over 1085 operational entries. Deltas compare the latest complete ISO week against the week before it (2026-W33 → 2026-W44); the running week 2026-W45 is shown separately and never compared; a half-finished week is not a decline.
Ransomware items / week
3
▲ +50% vs prior complete week · 4 so far this week
42 over 12 complete wk
view items →Actively-exploited vulnerabilities / week
7
▲ +40% vs prior complete week · 4 so far this week
80 over 12 complete wk
view items →Public-sector items / week
8
▲ +60% vs prior complete week · 8 so far this week
245 over 12 complete wk
Supply-chain items / week
5
▲ +25% vs prior complete week · 4 so far this week
55 over 12 complete wk
view items →AI-abuse items / week
2
▲ +100% vs prior complete week · 7 so far this week
42 over 12 complete wk
view items →Switzerland + Europe items / week
10
▲ +150% vs prior complete week · 7 so far this week
161 over 12 complete wk
view items →Nation-state items / week
4
→ +0% vs prior complete week · 3 so far this week
57 over 12 complete wk
view items →Cohort × week detail
| Cohort | W37 | W38 | W39 | W40 | W41 | W42 | W43 | W44 | W45* |
|---|---|---|---|---|---|---|---|---|---|
| Ransomware | 2 | 1 | 4 | 7 | 4 | 0 | 2 | 3 | 4 |
| Actively-exploited vulnerabilities | 9 | 4 | 8 | 6 | 3 | 9 | 5 | 7 | 4 |
| Public-sector | 20 | 19 | 23 | 20 | 9 | 7 | 5 | 8 | 8 |
| Supply-chain | 2 | 6 | 3 | 3 | 4 | 4 | 4 | 5 | 4 |
| AI-abuse | 2 | 4 | 4 | 4 | 3 | 1 | 1 | 2 | 7 |
| Switzerland + Europe | 7 | 8 | 11 | 12 | 4 | 3 | 4 | 10 | 7 |
| Nation-state | 4 | 5 | 2 | 4 | 3 | 4 | 4 | 4 | 3 |
* 2026-W45 is the running week: incomplete by definition, never compared against complete weeks.
Entity momentum
Most active entities · last 30 days
Actors, malware, campaigns and tools by entry count, vs the 30 days before. Click through for the full dossier, timeline and TTP profile.
| Entity | Type | 30d | Prior 30d | Δ | Last seen |
|---|---|---|---|---|---|
| PHP | product | 14 | 0 | new | 2026-11-02 |
| PHP2Shell | tool | 13 | 0 | new | 2026-11-02 |
| ARTEX | tool | 6 | 0 | new | 2026-11-08 |
| Microsoft 365 | product | 5 | 0 | new | 2026-11-06 |
| Microsoft Entra ID | product | 5 | 2 | ▲ +3 | 2026-11-06 |
| Palo Alto Networks PAN-OS | product | 4 | 0 | new | 2026-10-24 |
| GitLab | product | 4 | 2 | ▲ +2 | 2026-10-22 |
| Microsoft Edge | product | 4 | 4 | → 0 | 2026-11-07 |
| The Gentlemen | actor | 4 | 4 | → 0 | 2026-11-07 |
| Microsoft Windows | product | 4 | 11 | ▼ -7 | 2026-11-02 |
| ConnectWise Cloud Backup (SkyKick) application-credential abuse against Microsoft 365 tenants (October 2026) | incident | 3 | 0 | new | 2026-11-06 |
| Dirty Frag / Fragnesia | trend | 3 | 0 | new | 2026-10-25 |
New entities · first tracked in the last 30 days
Names that entered the knowledge base recently: the threats a reader (human or agent) is least likely to know yet.
| Entity | Type | First covered | Entries |
|---|---|---|---|
| WorkOS internal sales tool breach by an escaped ARTEX agent, October 2026 | incident | 2026-11-08 | 1 |
| IBM API Connect | product | 2026-11-08 | 1 |
| Apple mercenary-spyware threat-notification wave, late October 2026 | campaign | 2026-11-08 | 1 |
| TU Munich myTUM legacy portal credential capture and TUMonline attack, November 2026 | incident | 2026-11-07 | 1 |
| Siemens Industrial Edge | product | 2026-11-07 | 1 |
| Siemens Gridscale X PSS®E | product | 2026-11-07 | 1 |
| Siemens Gridscale X DSA | product | 2026-11-07 | 1 |
| Proxmox VE | product | 2026-11-07 | 1 |
| Paessler PRTG Network Monitor | product | 2026-11-07 | 1 |
| Mitel OpenScape SBC | product | 2026-11-07 | 1 |
| Mitel OpenScape Contact Center | product | 2026-11-07 | 1 |
| Mitel MiVoice Business | product | 2026-11-07 | 1 |
ATT&CK technique momentum · last 28 days
Techniques by count of entries mapping them (techniques[] frontmatter, pinned ATT&CK v20.1), vs the 28 days before. Click a technique id for its evidence in the coverage matrix.
| Technique | Name | 28d | Prior 28d | Δ |
|---|---|---|---|---|
| T1190 | Exploit Public-Facing Application | 70 | 48 | ▲ +22 |
| T1552.001 | Unsecured Credentials: Credentials In Files | 14 | 10 | ▲ +4 |
| T1078 | Valid Accounts | 14 | 11 | ▲ +3 |
| T1505.003 | Server Software Component: Web Shell | 14 | 11 | ▲ +3 |
| T1068 | Exploitation for Privilege Escalation | 11 | 6 | ▲ +5 |
| T1219 | Remote Access Tools | 10 | 4 | ▲ +6 |
| T1059.001 | Command and Scripting Interpreter: PowerShell | 10 | 12 | ▼ -2 |
| T1105 | Ingress Tool Transfer | 10 | 13 | ▼ -3 |
| T1059.004 | Command and Scripting Interpreter: Unix Shell | 9 | 4 | ▲ +5 |
| T1041 | Exfiltration Over C2 Channel | 9 | 5 | ▲ +4 |
| T1195.002 | Supply Chain Compromise: Compromise Software Supply Chain | 9 | 5 | ▲ +4 |
| T1078.004 | Valid Accounts: Cloud Accounts | 8 | 5 | ▲ +3 |
How to read this
Cohort tiles count entries whose frontmatter carries the relevant taxonomy values, bucketed by the ISO week of discovered_at. Entity momentum counts entries linked to each registry entity; technique momentum counts entries mapping each ATT&CK id. Everything is post-hoc analytics over published entries; no separate data source.
The cohorts are coarse on purpose · they mirror the deployment's trend cohorts in config/branding.yaml. For finer slicing, use the per-tag list pages under /tags/.