Cybersecurity threat intelligence
and research

Real attacks. Real analysis. Zero fluff.

Thumbnail for Expel 2026 Annual Threat Report

Annual Report

2026 Threat Report

Expel’s Annual Threat Report 2026 takes real-life cybersecurity lessons learned and transforms them into actionable insights for security operators.

Threat Report

Quarterly threat intelligence report

Get the latest threat intelligence data, straight from our SOC to you.

Threat Intel

Patch Tuesday: April 2026 (Expel’s version)

We're highlighting two critical CVEs, and we're also reviewing the Axios npm compromise from the end of March.

Check out the latest

View all articles

August 20, 2026 | Marcus Hutchins

SynkLoader: when you throw in everything but the kitchen sink

Discover a new malware family, SynkLoader. See how we reverse-engineered its phishing tactics to expose its attack chain.

August 13, 2026 | Matt Jastram

Patch Tuesday: August 2026 (Expel’s version)

August's Patch Tuesday is here, and it includes 398 CVEs, with three zero-days we recommend adding to the top of your priority list.

Placeholder image for Reading the certificate leaves: Understanding GoldenEyeDog’s teams—CylindricalCanine and CuboidalCanine—through code-signing certificates

August 6, 2026 | Aaron Walton

Reading the certificate leaves: Understanding GoldenEyeDog’s teams—CylindricalCanine and CuboidalCanine—through code-signing certificates

In part two of this blog series, we're exploring CubodialCanine (Expel-TA-0003), and comparing their attack styles to CylindricalCanine (Expel-TA-0002).

August 3, 2026 | Scout Scholes

Expel’s Q2 2026 threat report: Identity’s back on top, and Teams phishing isn’t slowing down

Expel's Q2 2026 threat data: identity attacks jump to 68.1%, Teams phishing drives an endpoint spike, and a new supply chain worm hits cloud infrastructure.