The updated CISA-FBI advisory puts Medusa at more than 500 victims as of April 2026, up from 300, with exploits weaponized within 24 hours and sometimes a week before disclosure.
Perspective Coverage
7 publishers
- Builder
- Builder 12%
- Operator
- Operator 79%
- Investor
- Investor 9%
Reality
- Evidence76
- Adoption
- Insufficient
- Hype gap+20
- Incentives40
- Confidence74
Researcher Dancho Danchev matched 205 handles from a 2005-2008 Exploit.in dump to private messages on five later forums, 26 of them from active early members. A matching handle does not prove a matching person, so 205 is a ceiling, but the forum's core was only about 90 accounts, few enough to follow from board to board.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence40
Karen Vardanyan was arrested in Kyiv in April 2025, extradited within two months, and sentenced this week to 24 months that run against custody already served. Prosecutors had argued that only meaningful sentences change a cybercriminal's math.
Perspective Coverage
5 publishers
- Builder
- Builder 9%
- Operator
- Operator 80%
- Investor
- Investor 11%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+10
- Incentives40
- Confidence66
Huntress reconstructed an INC intrusion from the logs that had survived. The tradecraft it found was ordinary operator work, the kind a name-based indicator list misses, and how the attackers first got in is still an open question.
Reality
- Evidence62
- Adoption28
- Hype gap−5
- Incentives65
- Confidence55
Intel 471's 18-month sweep of the underground counted 340 financial-sector extortion victims across 74 countries, 159 firms with access for sale and 562 claimed DDoS attacks. The dated intrusions came in through vendors and help-desk calls.
Reality
- Evidence40
- Adoption55
- Hype gap+22
- Incentives78
- Confidence47
Microsoft Threat Intelligence documents ChatGPT, Copilot, DeepSeek and Claude lures spanning phishing kits, adversary-in-the-middle credential theft, malvertising and fake GitHub installers. A broker it tracks as Storm-3075 resells the access it wins.
Reality
- Evidence42
- Adoption45
- Hype gap+15
- Incentives85
- Confidence50
Group-IB says the Exilware crew built BraZetsu to score compromised Iberian and Latin American machines by value and sell entry to whoever wants to run their own payload, which changes how a stealer alert should be triaged.
Reality
- Evidence55
- Adoption38
- Hype gap+18
- Incentives68
- Confidence48
The Threat Hunter Team says the technique has hit government departments, technology firms and hotels since February 2026. In one case, the operators moved to node.exe only after their Cobalt Strike beacons kept getting blocked.
Reality
- Evidence57
- Adoption58
- Hype gap+16
- Incentives66
- Confidence56
TheHatman's claimed Entra haul and the FortiBleed spraying wave share one detectable seam: a successful authentication landing just behind a spike of failures.
Reality
- Evidence46
- Adoption58
- Hype gap+12
- Incentives78
- Confidence44