The Record
Cybersecurity: Threats and Defences
What we told you to watch, what each side claimed, and what we got wrong. Every verdict shows its evidence.
Open 60 · Corrections 120
What we told you to watch
Still open · 60
Show the 10 most recentWhether the UK Cyber Resilience Pledge attracts signatories before its summer launch, or stays voluntary theatre.
From the 29 May briefing
Whether MuddyWater's Langflow access produces a named downstream breach before the 4 June KEV deadline.
From the 29 May briefing · Deadline: 4 June
Whether **Microsoft** ships an out-of-band patch for Exchange CVE-2026-42897 before CISA's 29 May federal deadline, and whether CISA acknowledges in writing that the deadline preceded the patch.
From the 20 May briefing · Deadline: 29 May
Whether **RansomHouse** publishes the full Trellix source-code dump, and whether **Cisco** confirms the scope of the 300+ stolen repositories beyond the named AI Defense and AI Assistant projects.
From the 20 May briefing
Whether **GTIG** or partner Computer Emergency Response Teams name additional AI-infrastructure CVEs in the LiteLLM, BerriAI, or vector-store stack within the next reporting window.
From the 20 May briefing
Whether the **ICO** opens further enforcement against UK water companies on the South Staffordshire template, or whether the Cyber Security and Resilience Bill reaches the Lords before the next enforcement action lands.
From the 20 May briefing
Will **Palo Alto Networks** ship the **PAN-OS** patch on 13 May, or does the gap widen, and does **CISA** issue a follow-up **KEV** note acknowledging the deadline-before-patch precedent.
From the 8 May briefing · Deadline: 13 May
RansomHouse: publishes **Trellix** source code, or quiet extortion, and whether peers cite the 21-day delay during the **CS&R Bill** Second Reading in the Lords.
From the 8 May briefing
Whether the **'Sorry'** ransomware crew or another ransomware-as-a-service operation scales the **cPanel** **CRLF** flaw beyond opportunistic encryption into bulk credential harvesting against the 1.5 million exposed hosts.
From the 8 May briefing
Whether **GTIG** or partner CERTs name additional npm packages compromised by **UNC1069** beyond **Axios**, given the maintainer-targeting tradecraft suggests a broader operation.
From the 8 May briefing
Whether **Shadowserver** or **Censys** publishes ASA/FTD anomaly counts that would put a number on FIRESTARTER mass-exploitation beyond the unnamed federal agency.
From the 30 Apr briefing
**Cisco** customer guidance on hardening, advisory updates and whether the vendor moves to a planned-outage eviction template.
From the 30 Apr briefing
**PRA** and **MoD** clearance review timelines for the **Airbus**/**Ultra Cyber** acquisition, and whether **Financial Conduct Authority (FCA)** or **PRA** sign-offs delay the **Beazley/Zurich** integration.
From the 30 Apr briefing
Whether the next emergency Cisco CVE shrinks the **CISA KEV** federal deadline below the 23 April three-day mark.
From the 30 Apr briefing · Deadline: 23 April
**Stokes** extradition timeline from Helsinki to Chicago, and downstream **Scattered Spider** charges off the same indictment.
From the 30 Apr briefing
**CitrixBleed 3** (CVE-2026-3055) escalating from active reconnaissance to mass exploitation within 30 days, repeating the CitrixBleed 2023 arc that landed LockBit and state groups inside enterprise SAML brokers.
From the 17 Apr briefing · Deadline: within 30 days
**OFAC** secondary PAIPA designations against other exploit brokers now that the first action has set the legal template, and whether Gulf-based shell vehicles are explicitly named in any follow-on tranche.
From the 17 Apr briefing
The **$707m CISA cut** surviving Congressional markup through the FY27 appropriations process, or whether hearings and committee amendments restore some of the counter-ransomware and election-security programmes.
From the 17 Apr briefing
Whether the **UK Cyber Security and Resilience Bill** returns from the House of Lords with material amendments to the **24-hour incident reporting** window, and whether the Lords push back on data-centre classification as essential services.
From the 17 Apr briefing
Whether additional **MDM-level, identity-only wipes** follow the Handala playbook against other multinationals, and whether Microsoft tightens Intune's default Conditional Access and break-glass posture in response.
From the 17 Apr briefing
What each side claimed
Claims are what a named side said at the time. We record them as said and judge them only against later evidence.
No claims recorded yet.
What we got wrong
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- SignificantCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.