Threat intelligence
Live Threat Snapshot
Public-source cyber threat intelligence and incident reporting
Threat activity by sector
Distinct incidents and campaigns (one incident covered by several outlets counts once). Click a bar to filter.
Attack types
Each incident is placed in one primary type for the chart; the number in brackets counts every associated type. Click to filter.
Incidents by region
Victim location as stated in the report. “Unspecified” means the source did not say.
Country table
| Country | Incidents |
|---|
Key trends & notable developments
Publicly disclosed financial impact
Only amounts a source explicitly ties to a cyber incident are listed. Ransom demands, estimates and allegations are shown but never added to the headline total, and an amount repeated across articles on one incident counts once.
Methodology & sources
This dashboard summarizes publicly available reporting. It shows what trusted publishers and regulators have reported, not a complete or independently verified view of global attacks. A rise in reports can reflect more media coverage rather than more attacks.
How numbers are counted
- Reports analyzed: distinct articles, advisories and filings published in the window.
- Incidents: reports are grouped when they share a CVE, or when headlines published within 5 days share at least three significant words (similarity ≥ 50%). One group is one incident.
- Confirmed incidents: incidents confirmed by a first-party source (regulator filing, government advisory) or where the report cites the organization’s own confirmation. Threat-actor claims are labelled Unconfirmed claim.
- APT activity: distinct incidents or campaigns that mention nation-state activity or a named APT group.
- Ransomware activity: distinct incidents classified as ransomware.
- Critical vulnerabilities: distinct vulnerability stories rated critical (CVSS 9+ or described as critical) or reported as actively exploited.
- Disclosed financial impact: summed per currency (no conversion) for directly disclosed costs, fines, theft losses, business-interruption losses and ransom reported as paid, excluding alleged or estimated figures and ransom demands.
- Severity is an automated estimate from the text (for example exploitation, ransomware or nation-state involvement) and is not an official rating.
- Period-over-period change appears only after two full windows of data have been collected; otherwise it reads “Insufficient data”.
- Geography uses the location stated in the report. A suspected attacker origin is shown only when the source states it and is never inferred from IP data.
Classification is rule-based and can be wrong. Always read the original source before acting on an item.
Sources
| Source | Access method | Status | Last success | Reports in window |
|---|
Sources without a permitted automated feed are listed as link-only and are never scraped. Each item links back to the original publisher; headlines are shown with a short excerpt only.