Blog
Threat intel
Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incidentCylindricalCanine is a new threat group within GoldenEyeDog, and they're actively using their malware for email phishing. Here's what you need to know.
Threat intel | 17 min read
SynkLoader: when you throw in everything but the kitchen sinkDiscover a new malware family, SynkLoader. See how we reverse-engineered its phishing tactics to expose its attack chain.
Security operations | 4 min read
New Ruxie AI power-up: Phishing classification AI turns benign inbox noise into SOC focusRuxie's latest power-up, phishing classification, is an additive skill for our automated marketing engine; it automatically closes reported benign phishing.
Threat intel | 1 min read
Patch Tuesday: August 2026 (Expel’s version)August's Patch Tuesday is here, and it includes 398 CVEs, with three zero-days we recommend adding to the top of your priority list.
MDR | 3 min read
The hidden cost of alert fatigue (and how agentic MDR fixes it)Alert fatigue causes analysts to miss real threats—not from lack of skill, but from queue pressure. Here's how agentic MDR handles the volume.
Threat intel | 10 min read
Reading the certificate leaves: Understanding GoldenEyeDog’s teams—CylindricalCanine and CuboidalCanine—through code-signing certificatesIn part two of this blog series, we're exploring CubodialCanine (Expel-TA-0003), and comparing their attack styles to CylindricalCanine (Expel-TA-0002).
Rapid response | 4 min read
ChainDrop: The Mini Shai Hulud npm worm’s latest wave hits keyv and cacheableA self-propagating npm worm hit keyv, cacheable, and hundreds of dependent packages to steal CI/CD, cloud, and API credentials. Here's what to do now.
Product | 3 min read
Expel now covers the full AI attack surfaceExpel is the top MDR provider covering the full AI attack surface: AI-powered attacks, employee misuse, and exposure inside AI systems. See what's live now.
Product | 3 min read
What we built: July 2026In July, Expel launched six new threat hunts spanning the AI attack surface, for new features, and one integration update.
Threat intel | 2 min read
Expel’s Q2 2026 threat report: Identity’s back on top, and Teams phishing isn’t slowing downExpel's Q2 2026 threat data: identity attacks jump to 68.1%, Teams phishing drives an endpoint spike, and a new supply chain worm hits cloud infrastructure.
Expel culture | 4 min read
Meet the Expletive: Josh Carter, SOC ManagerMeet Josh Carter, SOC manager at Expel. He's a self-taught multi-instrumentalist with a firm stance on pizza: triangles only.
Threat intel | 8 min read
When red teams go off the rails, who’s at fault?Why do red team reports focus on tactics attackers rarely use? Expel's data reveals the misalignment—and a better model.
Threat intel | 6 min read
The feature that stops BYOVD (bring your own vulnerable driver)BYOVD attacks beat driver blocklists every time. See how WDAC/App Control for Business—deployed via Active Directory—closes the gap for good.