Nothing to seeこの日のランサムウェア被害組織とエッジのCVEとの間に関連は見つからなかった。SageworksとAkira、PolymarketとCursor拡張機能、スーパーマーケットの冷凍設備のインシデントは、同時に起きたというだけで、共通の主体も因果関係を示す証拠もない。04時のMastodonの41件のクラスターは、人々が起床した結果であり、シグナルではない。WARP PANDAのESXiゼロデイに関する主張は単一の情報源によるもので未確認であり、1日分のデータは、資料に載せようとしているいかなる傾向の基準にもならない。
At least one of N0n's anonymised 'Company #104' to '#109' entries is replaced by a named victim on ransomware.live or ransomlook.
Called Fri 23 Oct · due Mon 2 Nov
The due date has passed. The only N0n items are new anonymised entries (#113-#117 and #118-#122, all with placeholder names), and none shows #104-#109 being named.
right
CISA adds a third Ivanti Connect Secure CVE from the reported chain to the KEV catalogue by 8 November 2026.
Called Sun 1 Nov · due Sun 8 Nov
SecurityWeek reports CISA added two more Ivanti Connect Secure chain CVEs, CVE-2026-111357 and CVE-2026-118527, to KEV. This assumes the call's earlier two chain CVEs were already listed, so these are the third and fourth.
TheGentlemen posts fewer than ten new leak-site claims on ransomware.live between 2 and 8 November 2026, confirming the 31 October figure as a single burst rather than a new operating rate.
Called Sun 1 Nov · due Sun 8 Nov
On 2 November alone ransomlook shows about 24 new the gentlemen leaks, and the tempo report shows 50 claims in 7 days. That is already well over ten.
UpTransportation — 2.1× its own prior share (72 claims, 34 expected)
UpEducation — 2.1× its own prior share (56 claims, 27 expected)
DownAgriculture and Food Production — 0.7× its own prior share (22 claims, 34 expected)
23% of claims carry no sector label.
Brand churn
Of the 231 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 62% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 213 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 11 — newest: everstake (2026-10-29, 7 claims), Shiba (2026-10-29, 5 claims), Whitearmor (2026-10-23, 19 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 32% of its claims on Germany (6.2× every other brand's share); N0n put 33% of its claims on Transportation (7.3× every other brand's share); genesis put 95% of its claims on the United States (2.6× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 63% of its claims on Mondays, half of them in 18:00–19:59 UTC; akira posted only 1 of 195 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 32% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers