® 
Threat coverage by the numbers
What we monitor for you
You don't have the capacity to follow every threat source yourself. We do it for you and deliver only what is relevant to your environment and sector.
CVEs and vulnerabilities
You know which new CVEs are actively being exploited and whether your software or hardware is vulnerable. Not every CVE is critical; we filter on exploitability in the wild.
Ransomware groups
You have insight into the 30+ active ransomware groups we track: TTPs, victim profiles, ransom strategy and infrastructure. Know whether your sector is in the crosshairs.
APT actors
You know which state-sponsored actors are active in the Netherlands, Belgium and Spain. From NOBELIUM to APT28: we track campaigns and map them to MITRE ATT&CK techniques.
OT and ICS threats
Your OT environment is not blind. We monitor threats specific to industrial protocols and ICS/SCADA environments, including new malware that disrupts production processes.
Dark web and data leaks
You know when your organisation name, credentials or internal data appears on dark web forums. We actively monitor initial access brokers and data leak platforms.
Sector intelligence
You receive intelligence filtered for your sector: financials, government, healthcare, industry or technology. Generic feeds deliver noise; sector-specific context delivers action.
Recent intelligence
Week 15, 2026: three active threats we are currently monitoring and for which we have published detection rules and IoCs.
TheGentlemen ransomware deploys BYOVD to kill EDR tools before encryption - 500% surge in NL victims
Ransomware group TheGentlemen recorded a 500% increase in Dutch victims in May 2026 and is expanding across EU targets. The group exploits CVE-2024-55591 in FortiGate devices for initial access and deploys BYOVD (Bring Your Own Vulnerable Driver) techniques to disable EDR solutions before deploying ransomware. Kaspersky has confirmed BYOVD as a standard ransomware TTP, with over 300 EDR tools neutralised in documented campaigns. The access chain runs via infostealer infections (Lumma, RedLine) leading to BYOVD driver deployment and full EDR bypass. MITRE ATT&CK: T1562.001 (Impair Defenses), T1486 (Data Encrypted for Impact), T1190. Action: validate EDR integrity, patch FortiGate to latest firmware, and activate an IR retainer.
Supply chain attack: 3,800 GitHub repositories compromised, 84 npm packages backdoored
A large-scale supply chain attack has compromised 3,800 GitHub repositories and poisoned 84 npm packages with malicious code. CISA has listed the affected packages in its Known Exploited Vulnerabilities catalogue with confirmed ransomware linkage. Attackers target development environments as an entry point into the production environments of downstream software consumers. The attack is particularly relevant for organisations using open-source npm packages in CI/CD pipelines. MITRE ATT&CK: T1195 (Supply Chain Compromise), T1554 (Compromise Client Software Binary). Action: audit npm dependencies, implement dependency pinning with hash verification, generate an SBOM, and review CI/CD pipelines for unexpected packages.
Data extortion without encryption: 38% of ransomware attacks now skip encryption entirely
A significant shift in ransomware TTPs has been confirmed in 2026: 38% of ransomware incidents now involve data exfiltration and extortion without encryption, making traditional backup-based recovery irrelevant as the primary defence. Ransom payments have dropped 28% as organisations improve recovery capability, but threat actors compensate by threatening to publish or sell stolen data. Post-quantum encryption is beginning to appear in advanced ransomware toolkits, further complicating decryption even where law enforcement seizes keys. Groups including Qilin and DragonForce are driving this shift in European targets. Action: prioritise data discovery and classification, deploy DLP controls, and ensure your incident response retainer covers data extortion scenarios.
Research and reports
DEFION publishes on two levels. Technical depth for security teams. Strategic context for management.
Technical
- ✓ In-depth CVE analyses and exploitability scores
- ✓ Malware reversals and behavioural analyses
- ✓ KQL detection rules for Microsoft Sentinel
- ✓ Pwn2Own and conference technical write-ups
- ✓ MITRE ATT&CK mapping per campaign
Strategic
- ✓ Monthly threat reports for the CISO
- ✓ Sector analyses per industry and region
- ✓ MITRE ATT&CK heatmaps at organisational level
- ✓ Client briefings on active campaigns
- ✓ Quarterly Threat Landscape report NL/EU
Who is this relevant for?
Threat Intelligence is not just for SOC analysts. Every security role benefits from the right information at the right time.
CISO
- ✓ Monthly threat briefing for the boardroom
- ✓ Risk assessment per sector and regulation
- ✓ Evidence base for security investments
SOC Analyst
- ✓ IoC feeds ready for use in your SIEM
- ✓ KQL detection rules per campaign
- ✓ Technical depth per threat and TTP
IT Director
- ✓ Visibility into vulnerabilities in your environment
- ✓ Patch prioritisation based on exploitability
- ✓ Overview of active threats in your sector
Incident Responder
- ✓ Context-rich IoCs and YARA rules
- ✓ TTP mapping for attribution and containment
- ✓ Rapid sector briefings on active campaigns
Intelligence products
From freely accessible publications to client-specific threat analyses. Choose the level that suits your organisation.
Freely accessible
- ✓ Blog: technical analyses and threat reports
- ✓ Quarterly Threat Landscape report NL/EU
- ✓ CVE updates and patch advisories
- ✓ Research Labs publications
MDR clients
- ✓ Weekly tailored threat briefings
- ✓ IoC feeds directly in your SIEM or EDR
- ✓ KQL detection rules per campaign
- ✓ Direct notification on critical threats
- ✓ MITRE ATT&CK heatmap per quarter
Custom
- ✓ Client-specific threat analysis
- ✓ Sector briefing for your industry
- ✓ Dark web scan for organisation name and credentials
- ✓ Imminent Threat Exposure assessment
FAQ Threat Intelligence
What is Threat Intelligence and why do I need it?
What is the difference between strategic and operational threat intelligence?
How does DEFION Threat Intelligence differ from a commercial feed?
How quickly do you publish when an active campaign or zero-day emerges?
Can I subscribe to Threat Intelligence without MDR?
Request a threat analysis
Want to know which threats are active in your sector and whether your environment is vulnerable? Our analysts produce a targeted analysis based on your profile.
No obligations. First analysis free of charge for qualified organisations.