the gentlemenは約2時間で約25の被害組織を、Curious Wormは7分間で約10組織を投稿した。ransomware.liveはCurious Wormの9ドメインにわたり、ransomlookをほぼ一定の2.1~2.2時間上回っていた。この規則性は攻撃者のタイミングではなく、ポーリング間隔である。
確度0.60
Wrong if
リークサイト自体の投稿時刻が、追跡サービスの遅延から推測されるものとは異なる周期を示した場合。
Watch
the gentlemenの保留中の被害組織が裏付けられるか、Curious Wormが再び一括投稿を行うか。
Nothing to seeAtlasの複合危機に関する記事、ハッシュタグの急増、時間帯ごとの大きな集中は、ソーシャルメディアの投稿量とCurious Wormの一括公開によるものであり、攻撃者による組織的な活動ではない。ThreatFoxのUnknown Loader、Mozi、Remcosのアップロードは通常の大量投稿である。ダークネット上の侵害の主張(27億件の社会保障番号、トヨタおよび日本関連の項目)は未検証で、関連性も弱い。NVDにおけるWordPressプラグインの急増は事実だが、無関係な数十の製品に分散している。
No public vendor or CISA advisory ties the Ivanti Connect Secure exploitation chain to a specific named threat actor or ransomware group by 2026-11-12.
Called Mon 2 Nov · due Thu 12 Nov
No item in today's feed names a threat actor behind CVE-2026-111357 Ivanti chain; Ivanti/CISA advisory items mention other CVEs only.
partly
At least one of Everstake's two scheduled releases (582.69 Gb due 10 November, 473.05 Gb due 12 November) appears on the leak sites, with the victim named, by 13 November 2026.
Called Tue 3 Nov · due Fri 13 Nov
Everstake actor on ransomware.live posted a new claim (ki*****o.com, redacted) on 2026-11-11, but neither the 582.69 Gb nor 473.05 Gb Everstake releases appear as named/published victims; the new entry is still redacted.
open
IHG Hotels & Resorts does not publicly confirm the BYOD intrusion claim.
Called Thu 5 Nov · due Thu 12 Nov
No IHG statement or regulatory filing acknowledging the BYOD intrusion claim appears in today's feed by the 12 November deadline.
wrong
No independent confirmation of the Whitearmor claim against the named shipping line will appear in these feeds; it stays an unverified leak-site listing.
Called Sun 8 Nov · due Fri 13 Nov
Maersk publicly confirmed the breach attributed to WhiteArmor ransomware, with a company statement reported in mainstream outlets.
UpEducation — 1.4× its own prior share (49 claims, 34 expected)
DownAgriculture and Food Production — 0.5× its own prior share (20 claims, 38 expected)
DownProfessional Services — 0.8× its own prior share (126 claims, 151 expected)
29% of claims carry no sector label.
Brand churn
Of the 239 leak-site brands first seen since 2021-09-30, 75% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 67% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 214 old enough to judge posted on one day and never again; 37% made at least half their claims in their first week. New brands this month: 8 — newest: Curious Worm (2026-11-11, 9 claims), osiris (2026-11-11, 8 claims), Climax Inc (2026-11-10, 17 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.3× every other brand's share); N0n put 28% of its claims on Transportation (6.2× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.2× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 59% of its claims on Mondays, half of them in 18:00–19:59 UTC; akira posted only 2 of 196 claims at weekends and half its claims in 12:00–13:59 UTC; half of thegentlemen's claims appeared in 06:00–09:59 UTC. Leak sites overall are 34% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–20:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers