Cybersecurity threat intelligence
and research

Real attacks. Real analysis. Zero fluff.

Thumbnail for Expel 2026 Annual Threat Report

Annual Report

2026 Threat Report

Expel’s Annual Threat Report 2026 takes real-life cybersecurity lessons learned and transforms them into actionable insights for security operators.
resource thumbnail for quarterly threat report

Threat Report

Quarterly threat intelligence report

Get the latest threat intelligence data, straight from our SOC to you.
Thumbnail with shield icon

Threat Intel

Patch Tuesday: April 2026 (Expel’s version)

We're highlighting two critical CVEs, and we're also reviewing the Axios npm compromise from the end of March.

Check out the latest

View all articles
Placeholder image for Reading the certificate leaves: Understanding GoldenEyeDog’s teams—CylindricalCanine and CuboidalCanine—through code-signing certificates
August 6, 2026  |  Aaron Walton

Reading the certificate leaves: Understanding GoldenEyeDog’s teams—CylindricalCanine and CuboidalCanine—through code-signing certificates

In part two of this blog series, we're exploring CubodialCanine (Expel-TA-0003), and comparing their attack styles to CylindricalCanine (Expel-TA-0002).
Placeholder image for Expel’s Q2 2026 threat report: Identity’s back on top, and Teams phishing isn’t slowing down
August 3, 2026  |  Scout Scholes

Expel’s Q2 2026 threat report: Identity’s back on top, and Teams phishing isn’t slowing down

Expel's Q2 2026 threat data: identity attacks jump to 68.1%, Teams phishing drives an endpoint spike, and a new supply chain worm hits cloud infrastructure.
Placeholder image for When red teams go off the rails, who’s at fault?
July 27, 2026  |  James Shank

When red teams go off the rails, who’s at fault?

Why do red team reports focus on tactics attackers rarely use? Expel's data reveals the misalignment—and a better model.
Placeholder image for The feature that stops BYOVD (bring your own vulnerable driver)
July 23, 2026  |  Brandon Overstreet

The feature that stops BYOVD (bring your own vulnerable driver)

BYOVD attacks beat driver blocklists every time. See how WDAC/App Control for Business—deployed via Active Directory—closes the gap for good.
Placeholder image for Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident
July 15, 2026  |  Aaron Walton

Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident

CylindricalCanine is a new threat group within GoldenEyeDog, and they're actively using their malware for email phishing. Here's what you need to know.