Threat research from FireIntel.

Investigations into ransomware operations and dark-web activity — what was reported, what our collection adds, and what defenders can do about it.

Threat investigation · October 2026ASOSA ransom note sent through the retailer’s own app
1. 08:30Channel live
2. ≈10:00Push to customers
3. 10:57“Not affected”
4. 14:52“Final statement”
A ransom note sent through ASOS’s own app, and what it does and doesn’t prove
Attackers pushed an extortion demand to ASOS app users on 6 October. Our collection shows their channel went live 90 minutes earlier — and the last time a company’s own channel was turned on its customers, the data was on a leak site in 14 days.
Threat investigation7 October 202615 min read
Threat investigation · October 2026SpetsvuzavtomatikaAn SVR contractor’s workshop, and how its tools were sold
1. 24 MayOffered for sale
2. 8 Jun“Several buyers”
3. 27 JulClaims a sale
4. 7 AugThread closed
Inside an SVR contractor’s workshop, and how its tools were sold
Seven projects from a sanctioned Rostov-on-Don institute cover almost every stage of an intelligence operation. Our dark-web collection shows how the files were marketed for eleven weeks — and names a tool the published analysis does not.
Threat investigation7 October 202617 min read
Threat investigation · October 2026WarlockFrom SharePoint web shell to ransomware in nine days
1. 22 JulWeb shell
2. 27 JulCanary request
3. 28 JulViewState + MSI
4. 31 JulRansomware
Warlock’s nine-day SharePoint intrusion, and the dark-web trail behind it
A host-by-host reconstruction of Warlock’s July 2026 attack on a critical-infrastructure operator, set against 78 leak-site listings, underground forum chatter and the group’s actor profile — with an ATT&CK mapping, hunting queries and indicators to download.
Threat investigation3 October 202618 min read