Nothing to see11月12日00:21以降のNVDの「沈黙」は取り込みのタイミングによるもので、実際の停止ではない。窓内の百件のNVD項目はすべて11月10日付である。Zoho、Hitachi、Siemens、WordPressのCVEの一括公開は、ベンダーが調整したリリース時期によるもので、攻撃者の協調行動ではない。日本、インドネシア、フィリピン、台湾、パナマなどを挙げたAtlasの「複合危機」の国別シグナルは、名指しされた攻撃者のいない確度の低い集計である。データが一日分しかない以上、傾向があると誠実に主張できる者はいない。
No public vendor or CISA advisory ties the Ivanti Connect Secure exploitation chain to a specific named threat actor or ransomware group by 2026-11-12.
Called Mon 2 Nov · due Thu 12 Nov
Due date 2026-11-12 passed; no item in today's feed ties the Ivanti CVE-2026-111357 chain to a named actor or ransomware group.
open
IHG Hotels & Resorts does not publicly confirm the BYOD intrusion claim.
Called Thu 5 Nov · due Thu 12 Nov
Due date 2026-11-12 passed with no IHG statement or regulatory filing acknowledging the BYOD intrusion claim in any feed item.
right
At least one ransomware or extortion leak-site claim published between now and 19 November will name an MSP or its downstream customers in connection with ScreenConnect or N-central access.
Called Thu 12 Nov · due Thu 19 Nov
SCKit malware campaign explicitly targeted MSPs via ScreenConnect, with leak-site and news items naming MSP victims and the ScreenConnect platform.
UpEducation — 1.5× its own prior share (54 claims, 37 expected)
DownAgriculture and Food Production — 0.5× its own prior share (21 claims, 40 expected)
DownProfessional Services — 0.8× its own prior share (134 claims, 161 expected)
29% of claims carry no sector label.
Brand churn
Of the 239 leak-site brands first seen since 2021-09-30, 75% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 67% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 214 old enough to judge posted on one day and never again; 37% made at least half their claims in their first week. New brands this month: 8 — newest: Curious Worm (2026-11-11, 10 claims), osiris (2026-11-11, 8 claims), Climax Inc (2026-11-10, 17 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.3× every other brand's share); N0n put 28% of its claims on Transportation (6.2× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.2× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 59% of its claims on Mondays, half of them in 18:00–19:59 UTC; akira posted only 2 of 196 claims at weekends and half its claims in 12:00–13:59 UTC; half of thegentlemen's claims appeared in 06:00–09:59 UTC. Leak sites overall are 36% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 09:00–17:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers