CISA、ファイアウォールが落ちること自体が攻撃の全容であるCiscoのゼロデイをKEVに追加

• SurgingBooba Project — 17 claims in 7 days against 2.4 expected from its own prior rate (p < 0.001)
• Surgingrhysida — 6 claims in 7 days against 1.4 expected from its own prior rate (p = 0.003)
• Surgingeverest — 8 claims in 7 days against 2.7 expected from its own prior rate (p = 0.007)
• SurgingFalcon — 3 claims in 7 days against 0.4 expected from its own prior rate (p = 0.007)
• Surgingemperador — 10 claims in 7 days against 4.6 expected from its own prior rate (p = 0.020)
• Surgingpayload — 5 claims in 7 days against 1.6 expected from its own prior rate (p = 0.022)

Gone quiet: lynx (62 days), AiLock (65 days), abyss (65 days), blackwater (67 days).

Sector pressure, 30 days

• UpTransportation — 2.3× its own prior share (71 claims, 31 expected)
• UpEducation — 2.1× its own prior share (54 claims, 25 expected)
• UpEnergy & Utilities — 1.4× its own prior share (34 claims, 24 expected)
• UpHealthcare — 1.4× its own prior share (108 claims, 79 expected)

22% of claims carry no sector label.

Brand churn

Of the 229 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 212 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 9 — newest: Whitearmor (2026-10-23, 16 claims), Mimori (2026-10-20, 2 claims), THE SEVEN DEADLY SINS (2026-10-16, 8 claims).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 34% of its claims on Germany (6.7× every other brand's share); N0n put 34% of its claims on Transportation (7.5× every other brand's share); Storm put 78% of its claims on the United States (2.1× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 64% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 196 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 38% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →