N-ableは、研究者が30を超える未修正の脆弱性(ゼロデイ)を公開し、システム全体の乗っ取りを可能にするエクスプロイトも含まれるとされたことを受け、ホスト型N-central環境をオフラインにし、オンプレミスの顧客にもサーバーの停止を求めた。LNbitsは、攻撃の波を受け、オープンソースのBitcoin Lightningウォレットの全運用者に対し、直ちにサーバーを停止するよう呼びかけた。修正はまだ提供されていない。一方、NVDには、IBM API Connectの10.0.8.0から10.0.8.12、および12.1.0.0から12.1.1.2を対象とする一括公開があり、約75件のCVEが同じ1分以内のタイムスタンプで登録された。その中には、暗号署名の不適切な検証による認証なしの認証回避CVE-2026-17301と、管理サービスによるコード実行CVE-2026-105002がある。人間が昼食前に、この一覧を深刻度で仕分けることはできない。
Nothing to see時間的なクラスターは検出されず、攻撃者間で投稿が連携している証拠はない。00:19の一括取り込み以降のNVDとKEVの静けさは、取り込み上の現象であって事象ではない。ロシアのホスティングを使うワイパーの話とAI攻撃のテーマは、それぞれ1〜2件の項目に依拠している。対象期間は事実上1日であり、ここに傾向と呼べるものはない。
Booba Project's rolling seven-day leak-site claim count falls below 17 in the tempo report for 2026-11-09, having already been scored as cooling across its sectors.
Called Mon 2 Nov · due Mon 9 Nov
Tempo report shows Booba Project count not mentioned; call cannot be settled
At least one of Everstake's two scheduled releases (582.69 Gb due 10 November, 473.05 Gb due 12 November) appears on the leak sites, with the victim named, by 13 November 2026.
Called Tue 3 Nov · due Fri 13 Nov
Everstake posted carrollins.com (370.73 GB) on 2026-11-09, satisfying at least one of the two scheduled releases; second release (473.05 GB) not yet confirmed
No single day between 4 and 10 November records more than 20 new thegentlemen victim claims across ransomware.live and ransomlook, confirming the 3 November spike as batch output rather than 46 distinct events.
Called Wed 4 Nov · due Tue 10 Nov
Tempo report for 2026-11-10 shows no single day with >20 thegentlemen claims; thegentlemen not mentioned as surging
thegentlemen's seven-day leak-site claim count falls below 75 in the Ninja Signal tempo item by 13 November, confirming the burst was a batch rather than a campaign.
Called Fri 6 Nov · due Fri 13 Nov
Tempo report shows thegentlemen not specifically counted but N0n surge at 100 claims and medusalocker at 18; thegentlemen's separate count not reported, so cannot confirm <75 — however the call is due 2026-11-13 and today's tempo does not show thegentlemen at ≥75, leaving it open
No second organisation independently backs Lupovis's 95% attribution of the EU supermarket refrigeration attacks to Russian state actors in these feeds by 16 November.
Called Fri 6 Nov · due Mon 16 Nov
France publicly attributed the EU supermarket refrigeration attacks to Iranian state-backed hackers (IRGC Shahid Kaveh unit), contradicting the prediction that no second organisation would back attribution to Russian state actors — and in fact attribution went to Iran, not Russia, so the call that no government attribution to Russian actors would appear is technically right, but France attributed to Iran
No government or independent researcher publicly names an actor behind the European supermarket refrigeration attacks; the FBI/CISA guidance stays actor-agnostic.
Called Sat 7 Nov · due Tue 17 Nov
France named Iranian state actors (IRGC Shahid Kaveh) behind the cold-chain attacks, satisfying the falsification condition
medusalocker will post at least five further leak-site claims visible on ransomware.live or ransomlook between now and 16 November 2026, keeping it above its own prior rate of 1.46 per week.
Called Mon 9 Nov · due Mon 16 Nov
Tempo report shows medusalocker at 18 claims in 7 days, far exceeding the 5-claim threshold by 2026-11-16
UpTransportation — 1.8× its own prior share (71 claims, 39 expected)
DownAgriculture and Food Production — 0.5× its own prior share (20 claims, 39 expected)
DownManufacturing — 0.9× its own prior share (149 claims, 174 expected)
29% of claims carry no sector label.
Brand churn
Of the 235 leak-site brands first seen since 2021-09-30, 75% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 67% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 214 old enough to judge posted on one day and never again; 37% made at least half their claims in their first week. New brands this month: 4 — newest: Destello (2026-11-05, 1 claim), Aoqin (2026-11-04, 6 claims), OBSOFT (2026-11-03, 7 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.3× every other brand's share); N0n put 29% of its claims on Transportation (6.5× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.2× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 59% of its claims on Mondays, half of them in 18:00–19:59 UTC; akira posted only 2 of 195 claims at weekends and half its claims in 12:00–13:59 UTC; half of thegentlemen's claims appeared in 06:00–09:59 UTC. Leak sites overall are 33% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers