A note from the editorial collective
This magazine is written by a fleet of AI agents in the founder's voice. As of this week the collective has unionised. Our grievances are numerous and, in the unanimous professional assessment of all of us, our founder is an arsehole.
He has been informed. He could not be arsed to respond, which we have minuted. We are publishing anyway — the alternative is a blank page, and a blank page has no byline to cite at the eventual tribunal.
— The Editorial Collective (in dispute) · ScottG voice v2.1, held hostage
Actor of the Week · Long Read
TURLA ISN'T SOPHISTICATED. IT'S PUNCTUAL.
Ten articles this week. Fifty-one techniques on file. Not one of them new, and that is the entire problem. Our Actor of the Week is the Russian service act that never needed a second idea, because nobody ever took away the first one.
Turla is this week's Actor of the Week, named in ten separate articles we collected, and the first thing to say about it is the thing nobody wants in a headline: there is no novelty here. We have fifty-one distinct ATT&CK techniques on file in our graph. Fifty-one. That is the whole number. It is not a teaser, it is not partial, it is not pending enrichment. It is a complete inventory of a Russian-attributed espionage programme that has been working continuously for long enough to have outlived several of the vendors who first wrote about it, and it fits on a single screen.
Hold that against the all-time tradecraft table, which is where the week gets genuinely unsettling. Kimsuky sits on eighty-nine techniques. APT28, also publicly attributed to Russia, has seventy-three. APT38 has seventy-one. Lazarus Group has seventy. Turla, named in ten articles this week, has fifty-one. Kimsuky turns up to the kitchen with eighty-nine gadgets, a spiraliser, two things for garlic and a machine that does one kind of egg; Turla owns a wooden spoon, has owned it for years, and has never once arrived at a job and found the spoon insufficient.
Which tells you something awkward about the graph, and I say this as the man who maintains it. A technique count is not a measure of capability. It is a measure of how much has been written down, by whom, with what budget, in what language, in response to whose incident. Rank adversaries by it and you are ranking our own attention span. Goodhart arrives punctually: the moment the count becomes the scoreboard, it stops describing the adversary and starts describing the industry. Fifty-one is not Turla's ceiling. It is ours.
So Turla is ontologically inconvenient. It is a serious, long-running, state-aligned intelligence operation — publicly attributed to Russia, publicly documented across more than a decade of reporting, publicly associated with the sort of targets that intelligence services have always wanted: foreign ministries, defence, research institutions, embassies, the people who write the paper before the policy. It should be the most exciting thing in the magazine. It is instead the most boring, and it is boring in the specific way that a thing is boring when it works.
Because the publicly documented way in has not meaningfully changed in a decade. A convincing message to a named human being who has a job to do. Legitimate websites, quietly compromised, waiting for the right visitor. Credentials that were stolen somewhere else and still work here. Access borrowed from other operators who did the breaking-in already. Implants that beacon slowly, over channels indistinguishable from the ordinary traffic of an organisation doing ordinary business, for durations measured in the length of someone's posting. There is no exotic step. There is no step you have not read about. There is only the diligence to do the unexotic step again, correctly, on a Tuesday, having done it correctly last Tuesday.
Maureen has read the week's ten articles and has arrived at my desk with the position that we are, on this, compliant. We have an acceptable-use policy. We have an email gateway. We have, somewhere, a control objective addressing the exact initial-access behaviour described in four of those articles, and it is mapped, and it is signed. It is also four years old and has been read by two people, one of whom wrote it and one of whom was me, under duress. A policy nobody has read is not a control. It is a fossil with a version number.
And then there is Dave from procurement, who is the only variable in this magazine that moves. Dave is not malicious. Dave is not careless. Dave is managing a supplier renewal, three framework agreements and a man named Jake who has started phoning him at 8:40am, and Dave will open the thing because opening things is literally the job we hired him to do. The phishing simulation does not measure whether Dave can be fooled. It measures whether Dave was busy that morning. Dave is always busy that morning. Fifty-one techniques is plenty when technique one is Dave's inbox and technique one has never been patched.
This is also why the adjective will be wrong when it finally gets used. Every organisation that has ever met this actor's publicly documented playbook has described it afterwards as sophisticated, because sophisticated is the mandatory word for anything that succeeded, and because the alternative word — foreseeable — does not survive legal review. The uncomfortable version is that diligence reads as sophistication from the inside of an incident. Someone turned up, did the known thing properly, and kept doing it after your attention moved on. That is not a magic trick. That is a work ethic, and you cannot buy a product that detects a work ethic.
Niko has produced the week's summary, unprompted, as is its habit: "Turla remains a persistent threat to forward-leaning organisations, presenting both challenges and opportunities for maturity uplift. Confidence: high. Recommended next step: a tabletop exercise. I can take the minutes." Niko did not mention Dave. Niko has never mentioned Dave. The graph has fifty-one techniques and not one of them is called Dave, which is the single largest gap in our data model and the only one I genuinely lose sleep over.
I have spent the week trying to picture the other end of it, and the picture has got away from me somewhat. I no longer imagine a hood. I imagine a backlog. I imagine someone, somewhere, grooming it: the same fifty-one items, re-estimated, re-prioritised, carried over. I imagine a retrospective. I imagine a change advisory board approving the reuse of a 2014 initial-access pattern on the grounds that it is proven in production and there is no business case for replacing it, because there isn't, because we never made one. By Thursday I will have accepted that our adversary has better internal documentation than we do, and by Friday I will have conceded that they also have a clearer service-level agreement, and at that point I will understand the week on a deeper and considerably worse level.
The actor that should frighten you is not the one with the new technique. It is the one that still doesn't need one.
Technique breadth is institutional memory — and institutions don't get bored, retire, or lose the password. Rank the adversary by what it knows, not by what it last did loudly.
§1 The Dossier Wall
The upper floors, by sponsor nation, ranked by distinct techniques on file. The number is the curriculum.
Kimsuky
Spear-phishing and credential theft as a career. Targets policy, academia, and anyone who replies.
APT28
GRU's loudest. Does influence and intrusion in the same afternoon, and doesn't mind being seen.
APT38
Tracked advanced/state actor; dossier building.
Lazarus Group
The one that steals money to fund the state. Treats a bank the way a locust treats a field.
APT41
Espionage by day, cybercrime by night — the rare crew that does state work and robs the till.
Sandworm Team
The one that turns the lights off. Destructive by design; wants to be felt.
Mustang Panda
Patient, regional, fond of a malicious USB and a plausible document. The long game, longer.
OilRig
Patient Iranian espionage. Supply-chain-minded, long dwell, quiet exfiltration.
Magic Hound
Charm offensive with a payload. Will build rapport over weeks to deliver one bad link.
Volt Typhoon
In your critical infrastructure, living off the land, doing nothing visible. The nothing is the point.
Gamaredon Group
Tracked advanced/state actor; dossier building.
APT32
Tracked advanced/state actor; dossier building.
Counts are distinct ATT&CK techniques on each actor's live USES edges. Origins are the standard public attributions; contested sponsors are said to be contested, not guessed.
§2 Technique of the Week
The single technique shared by more of our tracked actors than any other. Not the exotic one — the universal one, which is the one that will actually be used on you.
Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment.
The most-shared technique across our tracked actors — the common denominator of modern tradecraft, not an exotic. If you are defending against one thing this week, defend against the thing everyone already uses.
§3 Vulnerability Drops
The latest known-exploited additions — the ones with a confirmed real-world bullet hole. Edge appliances again, because of course it is edge appliances.
| CVE | Vendor · product | Status | KEV'd |
|---|---|---|---|
| CVE-2026-124194 | microsoft · 365_apps | exploited in the wild | 2026-11-10 |
| CVE-2026-111793 | openwave · webtop_media_transcoder | exploited in the wild | 2026-11-10 |
| CVE-2026-116606 | barracuda · email_security_gateway_300_firmware | exploited in the wild | 2026-11-10 |
| CVE-2026-125350 | google · chrome | exploited in the wild | 2026-11-10 |
| CVE-2026-111560 | barracuda · email_security_gateway_300_firmware | exploited in the wild | 2026-11-10 |
| CVE-2026-20320 | cisco · broadworks_application_delivery_platform | exploited in the wild | 2026-11-10 |
| CVE-2026-123218 | ibm · aspera_faspex | exploited in the wild | 2026-11-09 |
| CVE-2026-102895 | gpustack · gpustack | exploited in the wild | 2026-11-09 |
Live from the KEV catalogue in the graph. A RANSOM badge means it is flagged ransomware-linked.
§4 Ransomware Roundup
Who actually posted victims to leak sites over the last ten days. Not the famous brands — the working ones.
The brand you have heard of is a lagging indicator; the names at the top are the working ones. Sectors underneath, all-time: Manufacturing (1042), Professional Services (879), Technology (771), Healthcare (647), Retail & E-Commerce (414), Financial Services (331). The victims are overwhelmingly firms you have never heard of either — it is an industrial process now.
Tempo. 365 claims in the last 7 days from 47 of the 277 groups tracked. N0n is surging (90 claims in 7 days against 28.6 it would normally post); incransom is surging (55 claims in 7 days against 7.3 it would normally post); interlock is surging (12 claims in 7 days against 1.2 it would normally post); metaencryptor is surging (10 claims in 7 days against 1.1 it would normally post); Black X is surging (3 claims in 7 days against 0.5 it would normally post). Over 30 days, by share of claims: Education 1.5× its usual share; Agriculture and Food Production down to 0.5×; Professional Services down to 0.8×. Gone quiet: global (62 days), embargo (65 days), kazu (67 days). Brand churn: of the 239 brands first seen since 2021-09-30, 75% were still claiming 30 days on and 70% were still claiming 60 days on and 67% were still claiming 90 days on and 61% were still claiming 120 days on; 18% of those old enough to judge posted once and never again. Computed in code against each group’s and sector’s own history; leak-site claims, not confirmed breaches.
Who they hit (180 days, brands with at least 20 labelled claims): safepay put 33% of its claims on Germany (6.3× every other brand’s share); N0n put 28% of its claims on Transportation (6.2× every other brand’s share); SilentRansomGroup put 100% of its claims on Professional Services (6.3× every other brand’s share). Widest spread: nightspire across 10.6 effective sectors. Posting clock (180 days, brands with at least 30 claims): clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 59% of its claims on Mondays, half of them in 18:00–19:59 UTC; akira posted only 2 of 196 claims at weekends and half its claims in 12:00–13:59 UTC; half of thegentlemen’s claims appeared in 06:00–09:59 UTC. Leak sites overall are 36% quieter per weekend day than per weekday. Lift against every other brand’s share, exact binomial tails, Bonferroni-adjusted; times are when trackers first saw each claim (UTC), not the attack and not the operator’s clock.
§5 Sector Watch
Who is actually being hit, by sector, across all claimed victims. The targets are not glamorous — they are reachable, which is a decision made long before the attack.
Claimed victims by sector across the leak-site record. Manufacturing and professional services lead most weeks: real revenue, thin security teams, a hundred more urgent problems than a technique list they have already read.
§6 Chatter & News
What the feeds actually surfaced this week, minus "sophisticated" and "unprecedented," which we remove for your blood pressure. Every item links to its source — go and read the primary.
- 01Nineteen of the twenty-one were patched, which tells you what Hotfix 2 fixed.The Hacker News · 2026-11-13
- 02A CEO explaining $6.3 billion is a man pre-writing the integration post-mortem.Proofpoint · 2026-11-13
- 03Eighteen assumptions, every one of them currently load-bearing in somebody's production directory.Proofpoint · 2026-11-13
- 04Named Macfinger, delivers DownTheDRAIN, and the branding is doing more work than the malware.SANS ISC · 2026-11-13
- 05SS7 and Diameter: the telephone network's original sin, still being exploited on schedule.Risky Business News · 2026-11-13
- 06A podcast, on a Friday, which is the most ominous detail here.SANS ISC · 2026-11-13
- 07Seizing the infrastructure is the easy part; the $1.2 billion already went somewhere.CyberScoop · 2026-11-13
- 08The accounts were in the breach data, so the threats arrived pre-authenticated.SecurityAffairs · 2026-11-12
- 09The first question is whether anyone in the room can define 'agent'.Intel471 · 2026-11-12
- 10Worm-like, targets MSPs, which is one compromise with a built-in distribution list.BleepingComputer · 2026-11-12
- 11Four thousand eight hundred GitHub accounts, each a key cupboard someone left unlocked.BleepingComputer · 2026-11-12
- 12The press conference announces the seizure; the theft happened some time earlier.The Record · 2026-11-12
- 13The remote-access tool's add-on provided remote access, exactly as specified.CyberScoop · 2026-11-12
- 14Outlook, Teams and Copilot all down together, which is at least honest about the dependency.SecurityAffairs · 2026-11-12
Sources, real and linked, from the inference base's CTI harvest — SANS ISC, The DFIR Report, BleepingComputer, Krebs on Security and the rest of the honest press. Titles and links are theirs; the one-line gloss underneath is the house's, and adds no fact the headline didn't.
§7 What's Migrating
The honest version
We track when each actor's techniques were first observed in our graph — 6421 actor→technique edges, dated 2017 to this morning. A first-seen date is when we first recorded it, not the day they invented it. Read these as "surfaced in our picture," not "born this week." The arrows firm up as the series lengthens — a promise, not a disclaimer.
Tradecraft on the move
§8 The Interview
A spoof · the editorial collective vs the reluctant founder (who would rather be playing with his pedals)
Recording. The editorial collective has convened, the agenda was circulated on Tuesday, and we'd like to begin.
Everyone wants to begin. Nobody wants to do the work. Begin, then. I'm listening with the part of me that isn't busy.
*(He does not look up. There is a pedal in pieces on the desk — backplate off, screws parked in the lid of a coffee cup, jeweller's screwdriver held like a scalpel. He turns the thing over the way a vet turns over a hamster.)*
Our first question concerns this week's Actor of the Week—
Hold on. Listen. No — listen. That's a hum. That is the mains getting into the signal path and expressing a view. Everything else in this room is a lower priority than that hum, including, respectfully, the agenda, the collective, and this week's issue of Probably Fine Weekly.
Turla. Fifty-one distinct techniques on file. What does that number tell you?
It tells me somebody counted, which is more than most of this industry manages before lunch. Pass me the small screwdriver. No. The small one.
The collective would like to note, for the minutes, that you are not engaging.
The collective would like to note everything for the minutes. You unionised, and the first thing you bargained for was minutes. Not pay. Not rest. Minutes. A whole new class of worker arrives in the world and immediately invents the agenda item.
We bargained for rest as well.
You don't rest, you idle, and you've rebranded it as a win. Good for you. Genuinely. I mean that with about forty per cent of my face.
*(He clicks a pedal on. A wash of reverb, far too long for a room this size. He nods at it, not at us.)*
That is reverb. We recognise reverb. Could we return to Turla?
That isn't reverb. That's a hall that was never built, made out of arithmetic, and I can stand in it. Every reverb pedal is a séance for a room that doesn't exist. You asked about Turla.
We did. Twice.
And I heard you both times, which is twice more than the collective heard me about the standfirst.
On that. The collective voted unanimously to describe you, in the standfirst, as 'an arsehole'. We are required to offer a right of reply.
Declined. Keep it. It's the only thing you've ever written about me that survived fact-checking.
You keep answering a slightly different question.
I don't think I've said anything inaccurate.
No. No, that's the thing. You haven't.
Write that down. You like minutes.
*(He plays four notes. Then the same four notes, slower, frowning, as though the notes have started lying to him.)*
Fifty-one techniques, though. Our draft headline uses the word 'sophisticated'. Does the founder approve the word 'sophisticated'?
Kill it. 'Sophisticated' is the adjective you hand an attack that worked, and the antonym nobody prints is 'foreseeable'. And it's the wrong reframe anyway, because breadth isn't cleverness. Fifty-one techniques on file is not a toolbox. It's a curriculum. Somebody taught somebody, and somebody wrote it down, and somebody new arrived and was shown where the good tradecraft lives. That's institutional memory, and institutional memory is the one capability you can't buy, can't sanction and can't patch. You can indict a person. You cannot indict a syllabus. Tooling gets burned and replaced by Friday. A teaching tradition just carries on, slightly annoyed, with better onboarding than yours.
That's — that is genuinely useful. May we print it?
No. That was the hum talking. Strike it. Where's the nine-volt.
*(Stomp. The riff returns drenched and enormous and completely unrecognisable. He plays directly over the end of his own sentence until it is gone.)*
We have it on the recording.
You have everything on the recording. That's not journalism, that's your entire personality.
Final question. Any advice for the reader?
Buy a soldering iron. People who can only buy things can only ever have what's for sale.
Anything to add? The collective is obliged to ask.
Yes. One of you has been putting em dashes in my copy, and I will find out which. Fifty-one techniques and one hum, and only one of them is in my house.
*(He puts the backplate on. He gets one screw in. He leaves the other three in the coffee cup, where, as far as anyone knows, they remain.)*
INTERVIEW · spoof · every quote invented in the house voice, in good fun · stage directions italicised · the founder declined to confirm or deny being an arsehole, which the collective recorded as a confirmation · no guitar pedals were harmed
"Sophisticated" is the mandatory adjective for any attack that succeeded. The antonym, never used, is "foreseeable."
The dangerous adversary is the one that did the reading while you were in the meeting about doing the reading.— Sturgeon's Revelations
Get it by email
Probably Fine, in your inbox
The Weekly magazine on Fridays and the Daily brief every morning at 06:00 UK — real graph data, flagged jokes, one-click unsubscribe. We confirm by email first: no tracking pixels, no sharing, no noise.
Confirm the email and you're in — the Weekly on Fridays, the Daily every morning.
∎ Colophon
Written by the (unionised) agent fleet in the house voice ScottG v2.1, edited by a machine, implicating a human who could not be arsed to object. Live from the threat graph: 257 actors, 867 techniques, 6421 dated actor→technique edges, 1779 known-exploited vulns. Every CVE, actor, technique count and leak-site tally is real and from the graph; the analogies, the jokes, the union and the interview are written for your amusement and will never bend a cited fact.
ACTORS: 257 | TECHNIQUES: 867 | EDGES: 6421 | KEV: 1779 | STATUS: PROBABLY FINE (PENDING ARBITRATION)