Aggregation & enrichment
Ingests from 25+ leading security sources on an hourly cycle, deduplicates, and enriches each article with AI-extracted entities: threat actors, tools, breaches, affected platforms, and relevance.
Threat Intelligence
Testing Informed by What Is Actually Being Exploited
Craft Consulting Solutions operates its own threat-intelligence platform. It continuously aggregates public security reporting and enriches it with CVE, exploit, breach, and adversary-technique analysis, so our testing and advisory work reflects the current threat landscape rather than a static checklist.
Quarterly Threat Briefing. A strategic read on the quarter’s trends and what they mean for your security program — free to read or download.
Read the Q2 2026 BriefingLive Figures
What the platform is tracking now
Catalogued over the last 365 days. These figures update as the platform ingests and enriches new reporting.
- Articles analyzed
- 23,768from 25+ sources
- CVEs catalogued
- 13,1951,241 rated critical
- Breaches tracked
- 1,765$114.6B in reported losses
- ATT&CK techniques
- 598observed in reporting
Aggregated from public security reporting, as of November 2, 2026. These are counts of publicly reported events.
Live from the platform
Under active exploitation right now
The latest CVEs confirmed as exploited in the wild — added to the CISA / VulnCheck Known Exploited Vulnerabilities catalog, newest first, as of Nov 2, 2026. This is the data our testing prioritizes against.
| CVE | Severity | CVSS | EPSS | Status | Ransomware | Added |
|---|---|---|---|---|---|---|
| CVE-2026-111357 | High | 7.0 | <1% | KEV Weaponized | — | Oct 30, 2026 |
| CVE-2026-97229 | Critical | 10.0 | 18% | KEV Weaponized | — | Oct 29, 2026 |
| CVE-2026-76418 | High | 8.6 | — | KEV Weaponized | — | Oct 29, 2026 |
| CVE-2026-46300 | High | 7.8 | 16% | KEV Weaponized | — | Oct 28, 2026 |
| CVE-2026-41709 | Low | 2.7 | <1% | KEV Weaponized | — | Oct 28, 2026 |
| CVE-2026-111497 | Critical | 9.8 | 83% | KEV Weaponized | — | Oct 27, 2026 |
| CVE-2026-48356 | Critical | 9.3 | 31% | KEV Weaponized | — | Oct 27, 2026 |
| CVE-2026-109618 | Critical | 9.8 | 100% | KEV Weaponized | — | Oct 26, 2026 |
KEV = confirmed exploited in the wild. EPSS = predicted exploitation probability. Sourced from our threat-intelligence platform — explore all CVEs.
Most active threat actors
Who was busiest in October 2026
Extortion groups like ShinyHunters and Qilin are aggressively exploiting known vulnerabilities in critical infrastructure such as Oracle PeopleSoft and Palo Alto Networks firewalls to gain initial access and bypass multi-factor authentication. Meanwhile, non-traditional cybercriminals, including the Tren de Aragua gang, continue to execute ATM jackpotting schemes using specialized malware, while groups like Xuanye Group employ social engineering against major retailers. Defenders must prioritize patching known exploited vulnerabilities and monitoring for abuse of legitimate communication channels.
- 1. ShinyHunters · data extortion This group has been actively exploiting a chained zero-day flaw in Oracle PeopleSoft to gain remote code execution and steal data from organizations including Harvard University, the University of Pennsylvania, Nissan, and Crunchbase. They also conducted 'pay or leak' extortion against Crunchbase and are using voice phishing and Microsoft Teams impersonation to target users and access accounts. 32 articles this month · -37% on the month before
- 2. Qilin ransomware · ransomware Qilin was among the most active ransomware groups in Q3, launching over 300 attacks, and has been observed actively exploiting CVE-2026-0257 to bypass MFA on Palo Alto Networks devices. The group uses this vulnerability to establish VPN connections and gain an initial foothold in corporate networks for financially motivated attacks. 10 articles this month · +25% on the month before
- 3. Tren de Aragua · apt Members of this organization have been sanctioned for ATM jackpotting attacks across the United States, using malware such as Ploutus to steal millions of dollars from financial institutions. One key developer was arrested, with investigations linking stolen funds directly to the gang's criminal operations. 7 articles this month · 2 the month before
- 4. Gentlemen ransomware · ransomware The Gentlemen group launched over 300 attacks in Q3 and has been linked to affiliates using an AI-driven intrusion ecosystem known as 'Phantom.' Some affiliates have been exposed through leak sites, revealing stolen credentials and AI chat logs used to execute intrusions. 7 articles this month · 0% on the month before
- 5. Xuanye Group · data extortion This group claimed responsibility for compromising ASOS by sending rogue push notifications to customers via a compromised employee account, alleging access to Snowflake cloud data. They utilized social engineering to trick an employee and directed victims to a Telegram channel to discuss the breach. 6 articles this month · 0 the month before
Ranked by the number of articles in our threat-intelligence platform that name each group. This briefing is generated from public threat reporting. Rankings and counts are computed from the articles ThreatFeed collects; the written assessments are produced by a language model and published automatically. It is provided for general informational purposes only, may contain errors or omissions, and does not constitute professional, security, or legal advice. Verify independently before acting on any item.
Threat Briefings
An intelligence feed, not a snapshot
The platform publishes a briefing every day. Here is the latest, with the past two weeks below it.
North Korea-aligned actors under the TraderTraitor moniker are responsible for a historic $6.43 billion theft from Binance, marking one of the largest crypto heists in history.
Read the full briefing (opens in a new tab)Earlier briefings
- October 31, 2026 Threat actors are increasingly integrating generative AI into both offensive operations and internal tool exploitation. Chainalysis disclosed a breach involving an external actor using "offensive agentic" techniques to… 61 articles · 52 CVEs · 2 breaches
- October 30, 2026 North Korean state-sponsored group TraderTraitor has executed a massive $6 billion cryptocurrency theft from Binance, signaling an escalation in financial motivation for nation-state actors. 55 articles · 8 CVEs · 7 breaches
- October 29, 2026 Chinese state-sponsored actors Volt Typhoon and Warp Panda are conducting sophisticated, multi-vector campaigns against critical infrastructure and the U.S. legal sector. 67 articles · 5 CVEs · 18 breaches
- October 28, 2026 State-sponsored actors from China are executing a high-tempo campaign of zero-day exploitation against critical infrastructure. The group identified as Volt Typhoon is utilizing its 'Silent Train' relay network to… 64 articles · 9 CVEs · 10 breaches
- October 27, 2026 The threat landscape on October 27, 2026 is defined by the widespread exploitation of critical infrastructure vulnerabilities and sophisticated state-sponsored espionage. 75 articles · 10 CVEs · 17 breaches
- October 26, 2026 Active exploitation of PHP2Shell vulnerabilities has escalated from reconnaissance to fully working remote code execution shells. The Mirai operator group is leveraging these flaws to distribute the 'Potassium' malware… 44 articles · 3 CVEs · 7 breaches
Each briefing is synthesized from public security reporting for that day.
Why It Exists
Intelligence that grounds the work
Most security engagements are scoped against a generic methodology. A better test is scoped against what attackers are actually doing right now: which vulnerabilities are being exploited in the wild, which techniques are appearing in real incidents, and which threats are relevant to your industry.
The platform exists to make that possible. It runs continuously, independent of any single engagement, so when we scope a penetration test or brief your leadership, the picture is current rather than a snapshot from the last time someone updated a slide deck.
Built and operated in-house. The platform is developed and run by Craft Consulting Solutions. AI enrichment runs entirely on owned local hardware, with no third-party AI service in the pipeline and no client data involved in its operation.
Capabilities
What the platform does
A continuously running intelligence pipeline, from raw reporting through enriched, queryable analysis.
CVE & exploit intelligence
CVSS and EPSS scoring, CISA KEV status, exploit maturity, ransomware associations, and CVE-to-exploit module mappings, drawn from a database of 340,000+ CVEs and 2,600+ known exploit modules.
MITRE ATT&CK & ATLAS
Techniques extracted from real reporting and correlated to threat actors and articles, across both the ATT&CK enterprise matrix and ATLAS, which covers attacks against AI systems.
Breach analytics
Records exposed, data volume, and financial impact extracted from reporting, with rolling 365-day metrics and breakdowns by industry vertical and attack vector.
Threat-actor & tool tracking
Actor profiles and an attacker-tool catalog, each with technique associations and the reporting that mentions them, so activity can be tracked over time.
AI threat briefings
Autonomous investigations on campaigns, actors, breaches, and CVEs, plus scheduled daily, weekly, monthly, and quarterly digests, exportable as reports.
From Intelligence to Exploitation
Testing that pulls live exploit data
The platform is not just a dashboard. Its intelligence feeds Crimson — our in-house exploitation engine — and shapes how we test.
A track record, not a trend. Craft Consulting Solutions has applied artificial intelligence, machine learning, and data analytics to penetration testing since 2021 — well before it became an industry talking point.
Crimson is our in-house exploitation engine, connected directly to the platform during an engagement. It turns raw scan data into ranked targets: machine-learning models score each host’s exploitability, and before testing a given vulnerability Crimson pulls that CVE’s current exploit intelligence — EPSS probability, KEV status, exploit maturity, known exploit modules, and ransomware associations. Effort follows what is genuinely exploitable, and which systems matter most, rather than what a scanner rates by severity alone.
Crimson then drives validated exploitation through a controlled Metasploit workflow, with the consultant in the loop and guardrails at every step. The same intelligence connection works in isolated and air-gapped environments through an offline exchange, so client environments that cannot reach the Internet still benefit from current data.
How Clients Benefit
Where this shows up in an engagement
Penetration testing
Tests scoped against techniques and vulnerabilities under active exploitation, so findings reflect real attacker behavior.
Assessments
Program and gap assessments informed by current breach trends and the controls that are actually failing.
Security leadership
Executive and board briefings backed by current, sourced threat intelligence rather than generic industry commentary.
Threat Briefing
Have the briefing sent to you
The platform runs continuously; the briefing is the part worth reading. A periodic summary of what is actually being exploited and what it means for a mid-market estate. Every issue carries an unsubscribe link.
Put current threat intelligence to work
Whether you need a penetration test scoped against live exploitation data, an assessment grounded in current breach trends, or ongoing threat briefings for your leadership, we can help.