n0nは一日の午後のうちに、保険ブローカーのHigginbothamについて2013年から2026年までの顧客の保険契約・業務文書21万7,000件超、Infutor Data Solutionsについて消費者の本人情報590,404,149行のプロファイル済み本番テーブル、Lampenweltについて検索ボックスに入力された実在の顧客メールアドレス数百件を含む約8,100万件の生の検索クエリ、Staplesについて64,041製品を対象とする製品別マージン記録381,964件を、それぞれ自らの成果として主張した。その後、カナダの財務助言から米国のコーヒー小売まで、業種のみで社名のない十件を「Company #138」から「#147」として掲載した。この期間の前半には、同じ名前がサウジアラビアの小売業者Centrepointに対する主張、すなわち3,094,863人のロイヤルティプログラム会員に関するものと結び付けられていた。
Nothing to seeAI、暗号資産、フランス、日本、OTの各報道の間に関連を示す証拠はなく、それぞれが一、二の情報源に基づく個別の項目である。対象期間は一日のみで、項目の三分の一は取り込み時刻しか持たないため、傾向に関する主張は根拠が弱い。ゼロデイの一括広告、ShinyHunters名義のチャンネル、ハクティビストとDDoSの投稿、悪意あるChrome拡張機能のクラスター、ThreatFoxのIOCの急増は、情報源間での裏付けが得られず、未検証として扱う。
At least one of Everstake's scheduled releases (the 494 Gb entry dated 4 November or the 370.73 Gb entry dated 6 November) appears as published on ransomlook or ransomware.live.
Called Fri 30 Oct · due Sat 7 Nov
Due date 7 November passed; no Everstake ransomlook/ransomware.live entries appear in today's feed. No confirmation of published status found, but feed may be incomplete.
right
Qilin posts at least five further named victims to its leak site, mirrored on at least one tracker, by 2026-11-09.
Called Mon 2 Nov · due Mon 9 Nov
Qilin posted at least five new named victims between 2026-11-02 and 2026-11-09: Acondistec, Amber Management Ltd, Gandol Doors, Oak Green School, AXE-EXPERTS, Roxfarma, Simply UK, J.J. Louro Pereira, BOSH Engineering, XK net SA de CV — well over five distinct claims on ransomware.live/ransomlook.
A second, independent report of SSHole (CVE-2026-123158) exploitation or mass scanning — honeypot, vendor telemetry or CERT advisory — appears in these feeds.
Called Sat 7 Nov · due Wed 11 Nov
A second independent source (thehackernews/@thehackernews) reported CVE-2026-123158 SSHole exploitation on a honeypot, confirming scanning/exploitation beyond the original Previdian report.
CISA adds at least one more network-edge appliance vulnerability (SonicWall, Zyxel, D-Link, Barracuda or QNAP class) to the KEV catalogue.
Called Sat 7 Nov · due Sat 14 Nov
SonicWall SSL-VPN MFA bypass flaw (CVE-2026-19868) is being exploited in attacks and patches released — SonicWall is a network-edge appliance vendor in the specified class.
UpTransportation — 1.9× its own prior share (71 claims, 36 expected)
UpEducation — 1.4× its own prior share (44 claims, 32 expected)
DownAgriculture and Food Production — 0.5× its own prior share (19 claims, 36 expected)
25% of claims carry no sector label.
Brand churn
Of the 235 leak-site brands first seen since 2021-09-30, 75% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 67% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 214 old enough to judge posted on one day and never again; 38% made at least half their claims in their first week. New brands this month: 4 — newest: Destello (2026-11-05, 1 claim), Aoqin (2026-11-04, 5 claims), OBSOFT (2026-11-03, 7 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.2× every other brand's share); N0n put 29% of its claims on Transportation (6.5× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.2× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 59% of its claims on Mondays, half of them in 18:00–19:59 UTC; akira posted only 1 of 200 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 34% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers