Detection Engineering: news, advisories and analysis

Latest coverage

• 

  Research·Education & Academia

  Eight new ransomware brands in one week: why tracking group names has stopped working

  One tracker logged 315 leak-site posts from 40 groups in a single August week, eight of them new. Brand-based detection cannot keep pace. Here is what to instrument instead.

  Daniel Okafor10 Sep 20266 min read
• Threats·Gov & DefenceHigh

  APT28 Ran Its C2 Through Filen Cloud Storage. Reputation Filtering Never Stood a Chance

  Trellix says APT28 routed command-and-control through filen.io during a three-day European phishing burst. Here is the behavioural detection logic that catches it when reputation cannot.

  Mei-Lin Chen10 Sep 20266 min read
• 

  Research·Education & Academia

  Iran-Linked Screening Serpens Shipped Six RAT Builds in Ten Weeks

  Unit 42 documented six new RAT variants from Iran-nexus Screening Serpens between February and April 2026. The hashes rotate; the AppDomainManager config file does not.

  Mei-Lin Chen9 Sep 20266 min read
• Cyber Attack·Gov & Defence

  Gunra ransomware: what AA26-222A actually gives your detection engineers

  Six agencies detailed Gunra's Fortinet entry, its forticloud-sync backdoor and an MFA bypass planted in a VDI server. Here is how to turn that into detection coverage.

  Daniel Okafor8 Sep 20266 min read
• 

  Guides·Industrial & OT

  Playbook: hardening the edge appliance you cannot put an agent on

  Two of this year’s fastest CISA remediation deadlines hit devices that cannot run EDR. A practical checklist for the class attackers reach for first.

  Aisha Noor8 Sep 20267 min read
• 

  Research·Education & Academia

  Breakout time falls to 72 minutes — and most SOCs are not built for it

  The 2026 benchmark from foothold to active exfiltration is 72 minutes, a fourfold reduction. Human-paced triage no longer fits inside the window.

  Priya Raman5 Sep 20267 min read