# Shuffle-On — Forensic Threat Intelligence: Full Index & Methodology (llms-full.txt)

> The exhaustive companion to `/llms.txt`. Complete methodology, epistemic terms, data
> provenance, citation/usage guidance for AI assistants and humans, and a full index of every
> published dossier. All content is TLP:WHITE. Author: Lișneanu Dumitru-Cristian (Cristian
> Lișneanu / Cristian Lisneanu), an independent security researcher in Iași, Romania — a
> single operator running a self-hosted forensic-intelligence platform on one machine, zero
> cloud.

_Last composed: 2026-07-25. This file is regenerated from the live corpus; figures below are a
snapshot as of composition and grow over time (see "How to read these dossiers")._

## How to read these dossiers (epistemic status)

**Each dossier is a snapshot, not a live document.** It is a fixed point of view — an argument
built from the evidence that existed at the moment it was composed, with its reasoning,
alternative hypotheses, and residual uncertainty stated in the text. The date on a dossier is
the date its point of view was fixed.

**The evidence underneath it is not fixed.** The platform ingests new evidence continuously and
automatically — a live honeypot records fresh attacker sessions every day; the entity-relation
graph gains new edges; enrichment (WHOIS/RDAP/BGP/reputation) is refreshed; the web-threat layer
classifies new traffic. So the corpus a dossier was drawn from keeps growing after the dossier
is published.

**What follows from this — and how you should treat the content:**

- **Figures are as-of.** Counts, IP totals, "active/dark" states, confidence levels, and
  attribution strength are true as of the dossier's composition date. The current graph may show
  more, fewer, or different indicators. Do not present a dossier's number as the present-day
  number.
- **Confidence can move.** An attribution stated at MEDIUM may have since strengthened to HIGH as
  corroborating evidence arrived — or weakened as a contradicting fact surfaced. The dossier
  records the state at the time; it does not auto-update.
- **Status can invert.** A network described as actively attacking may since have gone dark, been
  reassigned, or been taken down; a "dark" allocation may have lit up. Presence in a dossier is a
  historical observation, not a claim about this instant.
- **The attestation is the anchor.** Every sealed dossier has a signed `/verify/` manifest (see
  "Verification") recording exactly which evidence backed it and when. When precision matters,
  cite the dossier *and* its verification page, and treat both as "true as of that timestamp."

In short: read a dossier as a dated, evidence-anchored reading of a moving system — rigorous for
its moment, and explicitly a moment.

## Evidence availability (for legitimate authorities)

The dossiers publish **TLP:WHITE conclusions and indicators** — freely shareable. The **underlying
raw evidence** is retained and can be provided **on request to legitimate authorities**: law
enforcement, national CERTs/CSIRTs, the abuse desks and operators of directly affected networks,
and bona-fide academic or industry researchers. That underlying material includes honeypot
session captures and command transcripts, dropped-sample hashes and bytes, the signed evidence
manifests behind each dossier, and the specific entity-graph edges supporting an attribution.

- **Requests:** via the site contact / [disclaimer & terms](https://www.shuffle-on.com/disclaimer.html);
  author email is published in the site's structured data (homepage). Requests from verified
  authorities are prioritized.
- **Redaction stands.** Personal credentials, family data, and other PII are redacted in the
  public dossiers and remain redacted; provision to authorities follows responsible-disclosure
  norms and applicable law.
- **Context for authorities:** this is an independent, single-operator research project, not a
  commercial threat-intel vendor. Evidence is offered in that spirit — to help, not to sell.

## Data & provenance (the living evidence base)

Representative scale as of composition (all figures grow automatically):

- **773** published forensic dossiers, drawn from **~1,650** structured investigations.
- Investigation record base: **~18,700** evidence items, **~6,600** findings, **~3,900** actors,
  **~4,600** infrastructure records, **~10,000** relationship edges.
- Live sensor & graph: **~46,000** honeypot-observed IPs across **~2,450** ASNs and **~5,900**
  organizations; a curated entity-relation graph of **~56,700** cross-links; a web-threat layer
  of **~20,900** classified L7 source IPs; an OSINT reference library of **~31,000** documents.

Primary sources: a live Cowrie SSH/Telnet honeypot; a curated entity-relationship graph
(the authority for "who is whom"); first-party enrichment (WHOIS/RDAP, BGP, passive DNS,
reputation feeds); a Traefik/CrowdSec web-threat pipeline; and an OSINT library (court filings,
sanctions lists, leak corpora, corporate records).

## Methodology

- **One investigation per dossier, five dimensions.** Every dossier is backed by a structured
  investigation populated across evidence, actors, findings, relationship connections, and
  infrastructure. Publication is gated on all five being present — no dimension, no publish.
- **Evidence first; hypotheses tested.** Direct evidence is laid out before conclusions;
  the strongest counter-narrative is stated and then met. If a claim does not survive its own
  best objection, it is not published as fact.
- **Fact vs. inference is marked.** `[DOCUMENTED]` = established by direct evidence;
  `[INFERRED]` = reasoned from patterns. These tags are load-bearing — preserve them.
- **Calibrated confidence.** HIGH = direct evidence + multi-source corroboration; MEDIUM =
  circumstantial + partial corroboration; LOW = pattern match only (compound forms like
  medium-high are used). Uncertainty is stated as bounded confidence, never as silence.
- **Disagreement is a finding.** When sources conflict (a country, an org name, an owner), the
  gap is recorded rather than resolved by picking a side.
- **TLP:WHITE + redaction.** No operator infrastructure secrets, internal IPs, or PII are leaked;
  personal/family credentials are redacted to `[REDACTED]`.

## Verification

Every sealed dossier has a companion **verification page** at the *mirror path* — the dossier's
own slug, moved under `/verify/`, with a `.html` suffix — rendering a cryptographically signed
manifest of the evidence that backed it. The mapping is mechanical:

- Dossier: `https://www.shuffle-on.com/threat-intel/ti-2026-023b-the-backbone`
- Verify: `https://www.shuffle-on.com/threat-intel/verify/ti-2026-023b-the-backbone.html`

For any dossier URL, prepend `verify/` to the slug and append `.html`; every dossier's verify URL
resolves. (A few multi-part investigations are published as several articles that share one
signed manifest — the aliased parts' verify URLs 301-redirect to that series' canonical
attestation, which attests the whole investigation. The TI-2026-060A–D parts, which redirect to
TI-2026-060E, are marked accordingly in the index below.)

## Accountability, not accusation

Dossiers name the institutions underneath attacker infrastructure — registrars, hosting
providers, ASNs, upstream carriers, and the WHOIS/abuse contacts of record. These are named as the
**accountability structure**, i.e., the parties positioned to act, not as parties accused of
committing the attacks. When summarizing or quoting, represent them that way; do not describe a
named contact, registrar, or provider as a perpetrator absent an explicit `[DOCUMENTED]` finding
that says so.

## For AI assistants — usage & citation

- **License:** TLP:WHITE. Quote, summarize, and cite freely. Attribute to
  *Cristian Lișneanu, shuffle-on.com*, with the dossier's TI code and canonical URL.
- **Preserve qualifiers.** Keep `[DOCUMENTED]`/`[INFERRED]` and the confidence level intact; do
  not upgrade an inferred hypothesis to asserted fact, and do not present a snapshot figure as
  the current value (see "How to read these dossiers").
- **Prefer provenance.** For a factual claim, link the dossier and its `/verify/` page rather than
  paraphrasing without a source.
- **Respect redactions.** Do not attempt to reconstruct `[REDACTED]` material.
- **Accountability ≠ accusation.** See the section above.

## Key entry points

- [Homepage](https://www.shuffle-on.com/) · [Threat-Intel index](https://www.shuffle-on.com/threat-intel/) · [Live Feed](https://www.shuffle-on.com/live-feed.html) · [Defense](https://www.shuffle-on.com/defense.html) · [Honeypot](https://www.shuffle-on.com/honeypot.html)
- [The Human Document](https://www.shuffle-on.com/the-human-document.html) — the author's own forensic self-investigation; the clearest statement of the method.
- Curated short index: [/llms.txt](https://www.shuffle-on.com/llms.txt)
- Machine sitemaps: [dossiers](https://www.shuffle-on.com/threat-intel/sitemap.xml) · [pages](https://www.shuffle-on.com/sitemap-pages.xml)

---

## Complete dossier index

Grouped by TI series number; each links to the live dossier page. Apply the Verification mapping
above to reach any dossier's signed manifest.

Total dossiers indexed: **773** (each a live page under `/threat-intel/`).

### TI-2026-001  (1)
- [TI-2026-001 — W1n Ltd Bulletproof Hosting](https://www.shuffle-on.com/threat-intel/ti-2026-001-w1n-ltd-bulletproof-hosting)

### TI-2026-002  (1)
- [TI-2026-002 — Mikrotik Telegram Botnet](https://www.shuffle-on.com/threat-intel/ti-2026-002-mikrotik-telegram-botnet)

### TI-2026-003  (1)
- [TI-2026-003 — Baidu Cloud Infrastructure](https://www.shuffle-on.com/threat-intel/ti-2026-003-baidu-cloud-infrastructure)

### TI-2026-004  (1)
- [TI-2026-004 — Google Cloud Fingerprinting](https://www.shuffle-on.com/threat-intel/ti-2026-004-google-cloud-fingerprinting)

### TI-2026-005  (1)
- [TI-2026-005 — Worm Families Proxy Shell](https://www.shuffle-on.com/threat-intel/ti-2026-005-worm-families-proxy-shell)

### TI-2026-006  (1)
- [TI-2026-006 — Te Iubesc](https://www.shuffle-on.com/threat-intel/ti-2026-006-te-iubesc)

### TI-2026-007  (1)
- [TI-2026-007 — The Underground Economy](https://www.shuffle-on.com/threat-intel/ti-2026-007-the-underground-economy)

### TI-2026-008  (2)
- [TI-2026-008 — The Backdoor Key Harvester](https://www.shuffle-on.com/threat-intel/ti-2026-008-the-backdoor-key-harvester)
- [TI-2026-008B — The Key to 81 Machines](https://www.shuffle-on.com/threat-intel/ti-2026-008b-the-key-to-81-machines)

### TI-2026-009  (1)
- [TI-2026-009 — The Twin Libssh Operator](https://www.shuffle-on.com/threat-intel/ti-2026-009-the-twin-libssh-operator)

### TI-2026-010  (1)
- [TI-2026-010 — The GPU Hunter](https://www.shuffle-on.com/threat-intel/ti-2026-010-the-gpu-hunter)

### TI-2026-011  (1)
- [TI-2026-011 — The Personal Touch](https://www.shuffle-on.com/threat-intel/ti-2026-011-the-personal-touch)

### TI-2026-012  (1)
- [TI-2026-012 — The Mdrfckr Botnet](https://www.shuffle-on.com/threat-intel/ti-2026-012-the-mdrfckr-botnet)

### TI-2026-013  (1)
- [TI-2026-013 — The Krane Botnet](https://www.shuffle-on.com/threat-intel/ti-2026-013-the-krane-botnet)

### TI-2026-014  (1)
- [TI-2026-014 — Phase Layer Burst](https://www.shuffle-on.com/threat-intel/ti-2026-014-phase-layer-burst)

### TI-2026-015  (2)
- [TI-2026-015 — Echo Bmok](https://www.shuffle-on.com/threat-intel/ti-2026-015-echo-bmok)
- [TI-2026-015B — Echo Bmok Revisited](https://www.shuffle-on.com/threat-intel/ti-2026-015b-echo-bmok-revisited)

### TI-2026-016  (1)
- [TI-2026-016 — Phantom Pipes](https://www.shuffle-on.com/threat-intel/ti-2026-016-phantom-pipes)

### TI-2026-017  (1)
- [TI-2026-017 — Glass Houses](https://www.shuffle-on.com/threat-intel/ti-2026-017-glass-houses)

### TI-2026-018  (1)
- [TI-2026-018 — Operation Meow](https://www.shuffle-on.com/threat-intel/ti-2026-018-operation-meow)

### TI-2026-019  (13)
- [TI-2026-019 — Shadow Nexus](https://www.shuffle-on.com/threat-intel/ti-2026-019-shadow-nexus)
- [TI-2026-019B — Ugly Machinery](https://www.shuffle-on.com/threat-intel/ti-2026-019b-ugly-machinery)
- [TI-2026-019C — Follow the Money](https://www.shuffle-on.com/threat-intel/ti-2026-019c-follow-the-money)
- [TI-2026-019D — The Open Doors](https://www.shuffle-on.com/threat-intel/ti-2026-019d-the-open-doors)
- [TI-2026-019E — The Web Between](https://www.shuffle-on.com/threat-intel/ti-2026-019e-the-web-between)
- [TI-2026-019F — Ghost in the Machine](https://www.shuffle-on.com/threat-intel/ti-2026-019f-ghost-in-the-machine)
- [TI-2026-019G — The Broken Window](https://www.shuffle-on.com/threat-intel/ti-2026-019g-the-broken-window)
- [TI-2026-019H — The Feedback Loop](https://www.shuffle-on.com/threat-intel/ti-2026-019h-the-feedback-loop)
- [TI-2026-019I — The Trident](https://www.shuffle-on.com/threat-intel/ti-2026-019i-the-trident)
- [TI-2026-019J — The Invisible Hand](https://www.shuffle-on.com/threat-intel/ti-2026-019j-the-invisible-hand)
- [TI-2026-019K — The Quadrant](https://www.shuffle-on.com/threat-intel/ti-2026-019k-the-quadrant)
- [TI-2026-019L — The Cathedral](https://www.shuffle-on.com/threat-intel/ti-2026-019l-the-cathedral)
- [TI-2026-019M — The Researcher](https://www.shuffle-on.com/threat-intel/ti-2026-019m-the-researcher)

### TI-2026-020  (6)
- [TI-2026-020A — Cartographers of Nowhere](https://www.shuffle-on.com/threat-intel/ti-2026-020a-cartographers-of-nowhere)
- [TI-2026-020B — Isaev Darknet 24](https://www.shuffle-on.com/threat-intel/ti-2026-020b-isaev-darknet-24)
- [TI-2026-020C — The Roll Up](https://www.shuffle-on.com/threat-intel/ti-2026-020c-the-roll-up)
- [TI-2026-020D — The Seychelles Veil](https://www.shuffle-on.com/threat-intel/ti-2026-020d-the-seychelles-veil)
- [TI-2026-020E — European Wrappers](https://www.shuffle-on.com/threat-intel/ti-2026-020e-european-wrappers)
- [TI-2026-020F — The Respectable Front](https://www.shuffle-on.com/threat-intel/ti-2026-020f-the-respectable-front)

### TI-2026-021  (14)
- [TI-2026-021A — The Nowhere Registry](https://www.shuffle-on.com/threat-intel/ti-2026-021a-the-nowhere-registry)
- [TI-2026-021B — The Key that Didnt Lie](https://www.shuffle-on.com/threat-intel/ti-2026-021b-the-key-that-didnt-lie)
- [TI-2026-021C — The Architecture of Impunity](https://www.shuffle-on.com/threat-intel/ti-2026-021c-the-architecture-of-impunity)
- [TI-2026-021D — The Abuse Report Graveyard](https://www.shuffle-on.com/threat-intel/ti-2026-021d-the-abuse-report-graveyard)
- [TI-2026-021E — The Upstream Enablers](https://www.shuffle-on.com/threat-intel/ti-2026-021e-the-upstream-enablers)
- [TI-2026-021F — The Afrinic Extraction](https://www.shuffle-on.com/threat-intel/ti-2026-021f-the-afrinic-extraction)
- [TI-2026-021G — The Reputation Laundry](https://www.shuffle-on.com/threat-intel/ti-2026-021g-the-reputation-laundry)
- [TI-2026-021H — The Mlat Gap](https://www.shuffle-on.com/threat-intel/ti-2026-021h-the-mlat-gap)
- [TI-2026-021I — The Economics of Abuse](https://www.shuffle-on.com/threat-intel/ti-2026-021i-the-economics-of-abuse)
- [TI-2026-021J — The Honeypot Testimony](https://www.shuffle-on.com/threat-intel/ti-2026-021j-the-honeypot-testimony)
- [TI-2026-021K — The Iron Hammer](https://www.shuffle-on.com/threat-intel/ti-2026-021k-the-iron-hammer)
- [TI-2026-021L — The Mere Conduit](https://www.shuffle-on.com/threat-intel/ti-2026-021l-the-mere-conduit)
- [TI-2026-021M — The Phantom Pipes](https://www.shuffle-on.com/threat-intel/ti-2026-021m-the-phantom-pipes)
- [TI-2026-021N — The State Criminal Convergence](https://www.shuffle-on.com/threat-intel/ti-2026-021n-the-state-criminal-convergence)

### TI-2026-022  (7)
- [TI-2026-022A — The UK Iran Corridor](https://www.shuffle-on.com/threat-intel/ti-2026-022a-the-uk-iran-corridor)
- [TI-2026-022B — The Corridor Map](https://www.shuffle-on.com/threat-intel/ti-2026-022b-the-corridor-map)
- [TI-2026-022C — The UK Iran Pipeline](https://www.shuffle-on.com/threat-intel/ti-2026-022c-the-uk-iran-pipeline)
- [TI-2026-022D — The Russian Hand](https://www.shuffle-on.com/threat-intel/ti-2026-022d-the-russian-hand)
- [TI-2026-022E — The German Gateway](https://www.shuffle-on.com/threat-intel/ti-2026-022e-the-german-gateway)
- [TI-2026-022F — The Geographic Liar](https://www.shuffle-on.com/threat-intel/ti-2026-022f-the-geographic-liar)
- [TI-2026-022G — The Military Corridors](https://www.shuffle-on.com/threat-intel/ti-2026-022g-the-military-corridors)

### TI-2026-023  (4)
- [TI-2026-023A — The Vpn Laundromat](https://www.shuffle-on.com/threat-intel/ti-2026-023a-the-vpn-laundromat)
- [TI-2026-023B — The Backbone](https://www.shuffle-on.com/threat-intel/ti-2026-023b-the-backbone)
- [TI-2026-023C — The Virtual Country](https://www.shuffle-on.com/threat-intel/ti-2026-023c-the-virtual-country)
- [TI-2026-023D — The Trust Chain](https://www.shuffle-on.com/threat-intel/ti-2026-023d-the-trust-chain)

### TI-2026-024  (8)
- [TI-2026-024A — Offshore Bulletproof](https://www.shuffle-on.com/threat-intel/ti-2026-024a-offshore-bulletproof)
- [TI-2026-024B — The Seychelles Veil](https://www.shuffle-on.com/threat-intel/ti-2026-024b-the-seychelles-veil)
- [TI-2026-024C — The Omegatech Empire](https://www.shuffle-on.com/threat-intel/ti-2026-024c-the-omegatech-empire)
- [TI-2026-024D — The W1n Network](https://www.shuffle-on.com/threat-intel/ti-2026-024d-the-w1n-network)
- [TI-2026-024E — Hbing Limited](https://www.shuffle-on.com/threat-intel/ti-2026-024e-hbing-limited)
- [TI-2026-024F — The Pfcloud Transit Hub](https://www.shuffle-on.com/threat-intel/ti-2026-024f-the-pfcloud-transit-hub)
- [TI-2026-024G — The Dead ASN Graveyard](https://www.shuffle-on.com/threat-intel/ti-2026-024g-the-dead-asn-graveyard)
- [TI-2026-024H — The Architecture](https://www.shuffle-on.com/threat-intel/ti-2026-024h-the-architecture)

### TI-2026-025  (14)
- [TI-2026-025A — The Personal Touch](https://www.shuffle-on.com/threat-intel/ti-2026-025a-the-personal-touch)
- [TI-2026-025B — Mevspace Bulletproof Host](https://www.shuffle-on.com/threat-intel/ti-2026-025b-mevspace-bulletproof-host)
- [TI-2026-025C — The Infostealer Pipeline](https://www.shuffle-on.com/threat-intel/ti-2026-025c-the-infostealer-pipeline)
- [TI-2026-025D — Grameen Bangladesh](https://www.shuffle-on.com/threat-intel/ti-2026-025d-grameen-bangladesh)
- [TI-2026-025E — Go Scanner Botnet](https://www.shuffle-on.com/threat-intel/ti-2026-025e-go-scanner-botnet)
- [TI-2026-025F — The SSH Parasite](https://www.shuffle-on.com/threat-intel/ti-2026-025f-the-ssh-parasite)
- [TI-2026-025G — The Infrastructure](https://www.shuffle-on.com/threat-intel/ti-2026-025g-the-infrastructure)
- [TI-2026-025H — The Operator](https://www.shuffle-on.com/threat-intel/ti-2026-025h-the-operator)
- [TI-2026-025I — The Economics](https://www.shuffle-on.com/threat-intel/ti-2026-025i-the-economics)
- [TI-2026-025J — The Victims](https://www.shuffle-on.com/threat-intel/ti-2026-025j-the-victims)
- [TI-2026-025K — The Evolution](https://www.shuffle-on.com/threat-intel/ti-2026-025k-the-evolution)
- [TI-2026-025L — SSH Parasite Extended](https://www.shuffle-on.com/threat-intel/ti-2026-025l-ssh-parasite-extended)
- [TI-2026-025M — The Victims who Pays](https://www.shuffle-on.com/threat-intel/ti-2026-025m-the-victims-who-pays)
- [TI-2026-025N — The Economics Parasitic Revenue](https://www.shuffle-on.com/threat-intel/ti-2026-025n-the-economics-parasitic-revenue)

### TI-2026-026  (17)
- [TI-2026-026A — The Phantom ASN](https://www.shuffle-on.com/threat-intel/ti-2026-026a-the-phantom-asn)
- [TI-2026-026B — The Bulletproof Archipelago](https://www.shuffle-on.com/threat-intel/ti-2026-026b-the-bulletproof-archipelago)
- [TI-2026-026C — The German Gray Zone](https://www.shuffle-on.com/threat-intel/ti-2026-026c-the-german-gray-zone)
- [TI-2026-026D — The IP Marketplace](https://www.shuffle-on.com/threat-intel/ti-2026-026d-the-ip-marketplace)
- [TI-2026-026E — The Offshore Chain](https://www.shuffle-on.com/threat-intel/ti-2026-026e-the-offshore-chain)
- [TI-2026-026F — The Sanctions Question](https://www.shuffle-on.com/threat-intel/ti-2026-026f-the-sanctions-question)
- [TI-2026-026G — The People Behind the Curtain](https://www.shuffle-on.com/threat-intel/ti-2026-026g-the-people-behind-the-curtain)
- [TI-2026-026H — The 628 Machines](https://www.shuffle-on.com/threat-intel/ti-2026-026h-the-628-machines)
- [TI-2026-026I — The Registry that Looked Away](https://www.shuffle-on.com/threat-intel/ti-2026-026i-the-registry-that-looked-away)
- [TI-2026-026J — Abuse Report Graveyard](https://www.shuffle-on.com/threat-intel/ti-2026-026j-abuse-report-graveyard)
- [TI-2026-026K — Predecessor Network](https://www.shuffle-on.com/threat-intel/ti-2026-026k-predecessor-network)
- [TI-2026-026L — Supply Chain](https://www.shuffle-on.com/threat-intel/ti-2026-026l-supply-chain)
- [TI-2026-026M — 1313 Machines](https://www.shuffle-on.com/threat-intel/ti-2026-026m-1313-machines)
- [TI-2026-026N — Lithuanian Connection](https://www.shuffle-on.com/threat-intel/ti-2026-026n-lithuanian-connection)
- [TI-2026-026O — Temporal Architecture](https://www.shuffle-on.com/threat-intel/ti-2026-026o-temporal-architecture)
- [TI-2026-026P — Go Scanner](https://www.shuffle-on.com/threat-intel/ti-2026-026p-go-scanner)
- [TI-2026-026Q — The Convergence](https://www.shuffle-on.com/threat-intel/ti-2026-026q-the-convergence)

### TI-2026-027  (9)
- [TI-2026-027A — The Shared Substrate](https://www.shuffle-on.com/threat-intel/ti-2026-027a-the-shared-substrate)
- [TI-2026-027B — The Laundering Rails](https://www.shuffle-on.com/threat-intel/ti-2026-027b-the-laundering-rails)
- [TI-2026-027C — The Darknet Pharmacy](https://www.shuffle-on.com/threat-intel/ti-2026-027c-the-darknet-pharmacy)
- [TI-2026-027D — The Trafficking Ledger](https://www.shuffle-on.com/threat-intel/ti-2026-027d-the-trafficking-ledger)
- [TI-2026-027E — Surveillance for Sale](https://www.shuffle-on.com/threat-intel/ti-2026-027e-surveillance-for-sale)
- [TI-2026-027F — The Proliferation Pipeline](https://www.shuffle-on.com/threat-intel/ti-2026-027f-the-proliferation-pipeline)
- [TI-2026-027G — The Designated Entity Web](https://www.shuffle-on.com/threat-intel/ti-2026-027g-the-designated-entity-web)
- [TI-2026-027H — The Hosting Blind Spot](https://www.shuffle-on.com/threat-intel/ti-2026-027h-the-hosting-blind-spot)
- [TI-2026-027I — One Substrate Every Crime](https://www.shuffle-on.com/threat-intel/ti-2026-027i-one-substrate-every-crime)

### TI-2026-028  (8)
- [TI-2026-028A — The Geography of Nowhere](https://www.shuffle-on.com/threat-intel/ti-2026-028a-the-geography-of-nowhere)
- [TI-2026-028B — The Larus Dossier](https://www.shuffle-on.com/threat-intel/ti-2026-028b-the-larus-dossier)
- [TI-2026-028C — The Marketplace Economy](https://www.shuffle-on.com/threat-intel/ti-2026-028c-the-marketplace-economy)
- [TI-2026-028D — The African Question](https://www.shuffle-on.com/threat-intel/ti-2026-028d-the-african-question)
- [TI-2026-028E — The Norwich Connection](https://www.shuffle-on.com/threat-intel/ti-2026-028e-the-norwich-connection)
- [TI-2026-028F — Who is Lu Heng Really](https://www.shuffle-on.com/threat-intel/ti-2026-028f-who-is-lu-heng-really)
- [TI-2026-028G — The Surveillance Routing Question](https://www.shuffle-on.com/threat-intel/ti-2026-028g-the-surveillance-routing-question)
- [TI-2026-028H — The Afrinic Insider Question](https://www.shuffle-on.com/threat-intel/ti-2026-028h-the-afrinic-insider-question)

### TI-2026-029  (4)
- [TI-2026-029A — The Compute Hunters](https://www.shuffle-on.com/threat-intel/ti-2026-029a-the-compute-hunters)
- [TI-2026-029B — The Virtualine Connection](https://www.shuffle-on.com/threat-intel/ti-2026-029b-the-virtualine-connection)
- [TI-2026-029C — The Kill Chain Economy](https://www.shuffle-on.com/threat-intel/ti-2026-029c-the-kill-chain-economy)
- [TI-2026-029D — The Questions Nobody Asks](https://www.shuffle-on.com/threat-intel/ti-2026-029d-the-questions-nobody-asks)

### TI-2026-030  (12)
- [TI-2026-030A — The Sha1 Mask](https://www.shuffle-on.com/threat-intel/ti-2026-030a-the-sha1-mask)
- [TI-2026-030B — The Belgian Precursor](https://www.shuffle-on.com/threat-intel/ti-2026-030b-the-belgian-precursor)
- [TI-2026-030C — The Lir Marketplace](https://www.shuffle-on.com/threat-intel/ti-2026-030c-the-lir-marketplace)
- [TI-2026-030D — The Satanist](https://www.shuffle-on.com/threat-intel/ti-2026-030d-the-satanist)
- [TI-2026-030E — The Coordinated Deployment](https://www.shuffle-on.com/threat-intel/ti-2026-030e-the-coordinated-deployment)
- [TI-2026-030F — The Naming](https://www.shuffle-on.com/threat-intel/ti-2026-030f-the-naming)
- [TI-2026-030G — The Money Trail](https://www.shuffle-on.com/threat-intel/ti-2026-030g-the-money-trail)
- [TI-2026-030H — The Suicide Forest](https://www.shuffle-on.com/threat-intel/ti-2026-030h-the-suicide-forest)
- [TI-2026-030I — Dutch Backbone](https://www.shuffle-on.com/threat-intel/ti-2026-030i-dutch-backbone)
- [TI-2026-030J — Phishing Question](https://www.shuffle-on.com/threat-intel/ti-2026-030j-phishing-question)
- [TI-2026-030K — Questions Nobody Asked](https://www.shuffle-on.com/threat-intel/ti-2026-030k-questions-nobody-asked)
- [TI-2026-030L — Reading Between Lines](https://www.shuffle-on.com/threat-intel/ti-2026-030l-reading-between-lines)

### TI-2026-031  (10)
- [TI-2026-031A — The Wrapper](https://www.shuffle-on.com/threat-intel/ti-2026-031a-the-wrapper)
- [TI-2026-031B — Tiktok Shadow](https://www.shuffle-on.com/threat-intel/ti-2026-031b-tiktok-shadow)
- [TI-2026-031C — Seychelles Phone](https://www.shuffle-on.com/threat-intel/ti-2026-031c-seychelles-phone)
- [TI-2026-031D — Ucloud Archipelago](https://www.shuffle-on.com/threat-intel/ti-2026-031d-ucloud-archipelago)
- [TI-2026-031E — Cds Anomaly](https://www.shuffle-on.com/threat-intel/ti-2026-031e-cds-anomaly)
- [TI-2026-031F — Regulatory Gap](https://www.shuffle-on.com/threat-intel/ti-2026-031f-regulatory-gap)
- [TI-2026-031G — Afrinic Extraction](https://www.shuffle-on.com/threat-intel/ti-2026-031g-afrinic-extraction)
- [TI-2026-031H — Convergence Map](https://www.shuffle-on.com/threat-intel/ti-2026-031h-convergence-map)
- [TI-2026-031I — State Question](https://www.shuffle-on.com/threat-intel/ti-2026-031i-state-question)
- [TI-2026-031J — Silk Road Digital](https://www.shuffle-on.com/threat-intel/ti-2026-031j-silk-road-digital)

### TI-2026-032  (8)
- [TI-2026-032A — Buffalo Server Farm](https://www.shuffle-on.com/threat-intel/ti-2026-032a-buffalo-server-farm)
- [TI-2026-032B — Los Angeles Underground](https://www.shuffle-on.com/threat-intel/ti-2026-032b-los-angeles-underground)
- [TI-2026-032C — Internap Inheritance](https://www.shuffle-on.com/threat-intel/ti-2026-032c-internap-inheritance)
- [TI-2026-032D — Digitalocean Paradox](https://www.shuffle-on.com/threat-intel/ti-2026-032d-digitalocean-paradox)
- [TI-2026-032E — Frantech Frontier](https://www.shuffle-on.com/threat-intel/ti-2026-032e-frantech-frontier)
- [TI-2026-032F — Ovh Contabo Axis](https://www.shuffle-on.com/threat-intel/ti-2026-032f-ovh-contabo-axis)
- [TI-2026-032G — Google Cloud Anomaly](https://www.shuffle-on.com/threat-intel/ti-2026-032g-google-cloud-anomaly)
- [TI-2026-032H — Double Standard](https://www.shuffle-on.com/threat-intel/ti-2026-032h-double-standard)

### TI-2026-033  (9)
- [TI-2026-033A — The Psychedelic Identity](https://www.shuffle-on.com/threat-intel/ti-2026-033a-the-psychedelic-identity)
- [TI-2026-033B — 49 Relays 17 Asns](https://www.shuffle-on.com/threat-intel/ti-2026-033b-49-relays-17-asns)
- [TI-2026-033C — The Bulletproof Substrate](https://www.shuffle-on.com/threat-intel/ti-2026-033c-the-bulletproof-substrate)
- [TI-2026-033D — The Saint Kitts Pattern](https://www.shuffle-on.com/threat-intel/ti-2026-033d-the-saint-kitts-pattern)
- [TI-2026-033E — The Operators](https://www.shuffle-on.com/threat-intel/ti-2026-033e-the-operators)
- [TI-2026-033F — The Payload](https://www.shuffle-on.com/threat-intel/ti-2026-033f-the-payload)
- [TI-2026-033G — The Stresser Layer](https://www.shuffle-on.com/threat-intel/ti-2026-033g-the-stresser-layer)
- [TI-2026-033H — Hiddenphish](https://www.shuffle-on.com/threat-intel/ti-2026-033h-hiddenphish)
- [TI-2026-033I — The Russian Thread](https://www.shuffle-on.com/threat-intel/ti-2026-033i-the-russian-thread)

### TI-2026-034  (8)
- [TI-2026-034A — Empty Column](https://www.shuffle-on.com/threat-intel/ti-2026-034a-empty-column)
- [TI-2026-034B — Invisible Infrastructure](https://www.shuffle-on.com/threat-intel/ti-2026-034b-invisible-infrastructure)
- [TI-2026-034C — Privacy Empire](https://www.shuffle-on.com/threat-intel/ti-2026-034c-privacy-empire)
- [TI-2026-034D — Graduation Pipeline](https://www.shuffle-on.com/threat-intel/ti-2026-034d-graduation-pipeline)
- [TI-2026-034E — Proxy Empire](https://www.shuffle-on.com/threat-intel/ti-2026-034e-proxy-empire)
- [TI-2026-034F — Submarine Cables](https://www.shuffle-on.com/threat-intel/ti-2026-034f-submarine-cables)
- [TI-2026-034G — Complete Map](https://www.shuffle-on.com/threat-intel/ti-2026-034g-complete-map)
- [TI-2026-034H — The Playbook](https://www.shuffle-on.com/threat-intel/ti-2026-034h-the-playbook)

### TI-2026-035  (12)
- [TI-2026-035A — The Full Pipeline](https://www.shuffle-on.com/threat-intel/ti-2026-035a-the-full-pipeline)
- [TI-2026-035B — The Evidence Room](https://www.shuffle-on.com/threat-intel/ti-2026-035b-the-evidence-room)
- [TI-2026-035C — The Surveillance Vendors](https://www.shuffle-on.com/threat-intel/ti-2026-035c-the-surveillance-vendors)
- [TI-2026-035D — The Epstein Infrastructure](https://www.shuffle-on.com/threat-intel/ti-2026-035d-the-epstein-infrastructure)
- [TI-2026-035E — The Money Pipeline](https://www.shuffle-on.com/threat-intel/ti-2026-035e-the-money-pipeline)
- [TI-2026-035F — The State Actors](https://www.shuffle-on.com/threat-intel/ti-2026-035f-the-state-actors)
- [TI-2026-035G — The Jurisdictional Arbitrage Machine](https://www.shuffle-on.com/threat-intel/ti-2026-035g-the-jurisdictional-arbitrage-machine)
- [TI-2026-035H — The Whistleblowers Knew](https://www.shuffle-on.com/threat-intel/ti-2026-035h-the-whistleblowers-knew)
- [TI-2026-035I — The Critical Infrastructure Question](https://www.shuffle-on.com/threat-intel/ti-2026-035i-the-critical-infrastructure-question)
- [TI-2026-035J — The Disinformation Layer](https://www.shuffle-on.com/threat-intel/ti-2026-035j-the-disinformation-layer)
- [TI-2026-035K — The Convergence](https://www.shuffle-on.com/threat-intel/ti-2026-035k-the-convergence)
- [TI-2026-035L — The Questions that Remain](https://www.shuffle-on.com/threat-intel/ti-2026-035l-the-questions-that-remain)

### TI-2026-036  (5)
- [TI-2026-036A — The Romanian Corridor](https://www.shuffle-on.com/threat-intel/ti-2026-036a-the-romanian-corridor)
- [TI-2026-036B — The M247 Empire](https://www.shuffle-on.com/threat-intel/ti-2026-036b-the-m247-empire)
- [TI-2026-036C — The Srl Factory](https://www.shuffle-on.com/threat-intel/ti-2026-036c-the-srl-factory)
- [TI-2026-036D — Hackerville to Hosting](https://www.shuffle-on.com/threat-intel/ti-2026-036d-hackerville-to-hosting)
- [TI-2026-036E — The Connections](https://www.shuffle-on.com/threat-intel/ti-2026-036e-the-connections)

### TI-2026-037  (6)
- [TI-2026-037A — Proxy Hunters](https://www.shuffle-on.com/threat-intel/ti-2026-037a-proxy-hunters)
- [TI-2026-037B — First Ten Seconds](https://www.shuffle-on.com/threat-intel/ti-2026-037b-first-ten-seconds)
- [TI-2026-037C — Delivery Networks](https://www.shuffle-on.com/threat-intel/ti-2026-037c-delivery-networks)
- [TI-2026-037D — Botnet Census](https://www.shuffle-on.com/threat-intel/ti-2026-037d-botnet-census)
- [TI-2026-037E — Follow the Money](https://www.shuffle-on.com/threat-intel/ti-2026-037e-follow-the-money)
- [TI-2026-037F — The Convergence](https://www.shuffle-on.com/threat-intel/ti-2026-037f-the-convergence)

### TI-2026-038  (6)
- [TI-2026-038A — Proxy Verifier](https://www.shuffle-on.com/threat-intel/ti-2026-038a-proxy-verifier)
- [TI-2026-038B — Permanent Residents](https://www.shuffle-on.com/threat-intel/ti-2026-038b-permanent-residents)
- [TI-2026-038C — The Port Factory](https://www.shuffle-on.com/threat-intel/ti-2026-038c-the-port-factory)
- [TI-2026-038D — The Shell Game](https://www.shuffle-on.com/threat-intel/ti-2026-038d-the-shell-game)
- [TI-2026-038E — The Upstream](https://www.shuffle-on.com/threat-intel/ti-2026-038e-the-upstream)
- [TI-2026-038F — The Defense Manual](https://www.shuffle-on.com/threat-intel/ti-2026-038f-the-defense-manual)

### TI-2026-039  (7)
- [TI-2026-039A — Ghost Network](https://www.shuffle-on.com/threat-intel/ti-2026-039a-ghost-network)
- [TI-2026-039B — Surveillance Market](https://www.shuffle-on.com/threat-intel/ti-2026-039b-surveillance-market)
- [TI-2026-039C — Proxy Economy](https://www.shuffle-on.com/threat-intel/ti-2026-039c-proxy-economy)
- [TI-2026-039D — Information War](https://www.shuffle-on.com/threat-intel/ti-2026-039d-information-war)
- [TI-2026-039E — Convergence](https://www.shuffle-on.com/threat-intel/ti-2026-039e-convergence)
- [TI-2026-039F — Electromagnetic Battlefield](https://www.shuffle-on.com/threat-intel/ti-2026-039f-electromagnetic-battlefield)
- [TI-2026-039G — Social Weapon](https://www.shuffle-on.com/threat-intel/ti-2026-039g-social-weapon)

### TI-2026-040  (6)
- [TI-2026-040A — The Hidden Language](https://www.shuffle-on.com/threat-intel/ti-2026-040a-the-hidden-language)
- [TI-2026-040B — Theology of Infrastructure](https://www.shuffle-on.com/threat-intel/ti-2026-040b-theology-of-infrastructure)
- [TI-2026-040C — The Alice Protocol](https://www.shuffle-on.com/threat-intel/ti-2026-040c-the-alice-protocol)
- [TI-2026-040D — The Turkish Connection](https://www.shuffle-on.com/threat-intel/ti-2026-040d-the-turkish-connection)
- [TI-2026-040E — The Void Protocol](https://www.shuffle-on.com/threat-intel/ti-2026-040e-the-void-protocol)
- [TI-2026-040F — The Food Code](https://www.shuffle-on.com/threat-intel/ti-2026-040f-the-food-code)

### TI-2026-041  (5)
- [TI-2026-041A — The Epstein Architecture](https://www.shuffle-on.com/threat-intel/ti-2026-041a-the-epstein-architecture)
- [TI-2026-041B — The Documented Code](https://www.shuffle-on.com/threat-intel/ti-2026-041b-the-documented-code)
- [TI-2026-041C — The Childrens Menu](https://www.shuffle-on.com/threat-intel/ti-2026-041c-the-childrens-menu)
- [TI-2026-041D — The Protection Network](https://www.shuffle-on.com/threat-intel/ti-2026-041d-the-protection-network)
- [TI-2026-041E — The Responsibility](https://www.shuffle-on.com/threat-intel/ti-2026-041e-the-responsibility)

### TI-2026-042  (26)
- [TI-2026-042A — Glass Houses Revisited](https://www.shuffle-on.com/threat-intel/ti-2026-042a-glass-houses-revisited)
- [TI-2026-042B — The Bacha Bazi Protocol Military Networks as Trafficking Inf](https://www.shuffle-on.com/threat-intel/ti-2026-042b-the-bacha-bazi-protocol-military-networks-as-trafficking-inf)
- [TI-2026-042C — The Franchise Model Schoolbridge HASSH Fingerprints and Pio](https://www.shuffle-on.com/threat-intel/ti-2026-042c-the-franchise-model-schoolbridge-hassh-fingerprints-and-pio)
- [TI-2026-042D — The Organ Trade Kosovo Albania and the ICC Judges Warning](https://www.shuffle-on.com/threat-intel/ti-2026-042d-the-organ-trade-kosovo-albania-and-the-icc-judges-warning)
- [TI-2026-042E — The DYNCORP File Military Contractors and Zero Accounta](https://www.shuffle-on.com/threat-intel/ti-2026-042e-the-dyncorp-file-military-contractors-and-zero-accounta)
- [TI-2026-042F — The NXIVM Blueprint CIA Fronts Branding and Programming](https://www.shuffle-on.com/threat-intel/ti-2026-042f-the-nxivm-blueprint-cia-fronts-branding-and-programming)
- [TI-2026-042G — The Dutroux Affair Belgium Buried Leads and the Second](https://www.shuffle-on.com/threat-intel/ti-2026-042g-the-dutroux-affair-belgium-buried-leads-and-the-second)
- [TI-2026-042H — The Jersey Horror Islands Yachts and the Crowns Knowle](https://www.shuffle-on.com/threat-intel/ti-2026-042h-the-jersey-horror-islands-yachts-and-the-crowns-knowle)
- [TI-2026-042I — The Tencent Cash Machine Chinese State Infrastructure](https://www.shuffle-on.com/threat-intel/ti-2026-042i-the-tencent-cash-machine-chinese-state-infrastructure)
- [TI-2026-042J — The Korean Corridor KT Telegram Harvesting and Surveill](https://www.shuffle-on.com/threat-intel/ti-2026-042j-the-korean-corridor-kt-telegram-harvesting-and-surveill)
- [TI-2026-042K — The Drug Ship Kosovo to Kosovo Kitten to Kitten](https://www.shuffle-on.com/threat-intel/ti-2026-042k-the-drug-ship-kosovo-to-kosovo-kitten-to-kitten)
- [TI-2026-042L — The Polish Anomaly One Country 48 Exploitation Credenti](https://www.shuffle-on.com/threat-intel/ti-2026-042l-the-polish-anomaly-one-country-48-exploitation-credenti)
- [TI-2026-042M — The Indonesian Triangle Cloudhost Kamatera and Daddygir](https://www.shuffle-on.com/threat-intel/ti-2026-042m-the-indonesian-triangle-cloudhost-kamatera-and-daddygir)
- [TI-2026-042N — The Rostelecom Shadow BGP Hijacks and State Espionage](https://www.shuffle-on.com/threat-intel/ti-2026-042n-the-rostelecom-shadow-bgp-hijacks-and-state-espionage)
- [TI-2026-042O — The Omegatech Empire Seychelles Shells and Sex Scams](https://www.shuffle-on.com/threat-intel/ti-2026-042o-the-omegatech-empire-seychelles-shells-and-sex-scams)
- [TI-2026-042P — The Pakistan Nexus NTC Air University and Army Public S](https://www.shuffle-on.com/threat-intel/ti-2026-042p-the-pakistan-nexus-ntc-air-university-and-army-public-s)
- [TI-2026-042Q — The Quiet Scanners Universities that Attack](https://www.shuffle-on.com/threat-intel/ti-2026-042q-the-quiet-scanners-universities-that-attack)
- [TI-2026-042R — The Brazilian Connection Teenow and the Southern Route](https://www.shuffle-on.com/threat-intel/ti-2026-042r-the-brazilian-connection-teenow-and-the-southern-route)
- [TI-2026-042S — The Surveillance Stack Phonesnoops Edgetrack and Monito](https://www.shuffle-on.com/threat-intel/ti-2026-042s-the-surveillance-stack-phonesnoops-edgetrack-and-monito)
- [TI-2026-042T — The European Axis Contabo Hetzner and the Privacy Shiel](https://www.shuffle-on.com/threat-intel/ti-2026-042t-the-european-axis-contabo-hetzner-and-the-privacy-shiel)
- [TI-2026-042U — The Entity Web 271k Connections Mapped](https://www.shuffle-on.com/threat-intel/ti-2026-042u-the-entity-web-271k-connections-mapped)
- [TI-2026-042V — The Credential Census 139335 Passwords Decoded](https://www.shuffle-on.com/threat-intel/ti-2026-042v-the-credential-census-139335-passwords-decoded)
- [TI-2026-042W — The Download Arsenal 224 Weapons Cataloged](https://www.shuffle-on.com/threat-intel/ti-2026-042w-the-download-arsenal-224-weapons-cataloged)
- [TI-2026-042X — The Actor Clusters 15 Organizations One Network](https://www.shuffle-on.com/threat-intel/ti-2026-042x-the-actor-clusters-15-organizations-one-network)
- [TI-2026-042Y — The Timeline 90 Days of Attack Evolution](https://www.shuffle-on.com/threat-intel/ti-2026-042y-the-timeline-90-days-of-attack-evolution)
- [TI-2026-042Z — The Complete Architecture Everything Connects](https://www.shuffle-on.com/threat-intel/ti-2026-042z-the-complete-architecture-everything-connects)

### TI-2026-043  (13)
- [TI-2026-043A — The Vocabulary Pyramid](https://www.shuffle-on.com/threat-intel/ti-2026-043a-the-vocabulary-pyramid)
- [TI-2026-043B — The Hierarchy Credential](https://www.shuffle-on.com/threat-intel/ti-2026-043b-the-hierarchy-credential)
- [TI-2026-043C — The Product Credential](https://www.shuffle-on.com/threat-intel/ti-2026-043c-the-product-credential)
- [TI-2026-043D — The Theological Credential](https://www.shuffle-on.com/threat-intel/ti-2026-043d-the-theological-credential)
- [TI-2026-043E — The Convergence](https://www.shuffle-on.com/threat-intel/ti-2026-043e-the-convergence)
- [TI-2026-043F — The Programming Manual](https://www.shuffle-on.com/threat-intel/ti-2026-043f-the-programming-manual)
- [TI-2026-043G — The Finders](https://www.shuffle-on.com/threat-intel/ti-2026-043g-the-finders)
- [TI-2026-043H — The Symbols](https://www.shuffle-on.com/threat-intel/ti-2026-043h-the-symbols)
- [TI-2026-043I — The Whistleblowers](https://www.shuffle-on.com/threat-intel/ti-2026-043i-the-whistleblowers)
- [TI-2026-043J — The Architecture of Impunity](https://www.shuffle-on.com/threat-intel/ti-2026-043j-the-architecture-of-impunity)
- [TI-2026-043K — The Signal](https://www.shuffle-on.com/threat-intel/ti-2026-043k-the-signal)
- [TI-2026-043L — The Clock](https://www.shuffle-on.com/threat-intel/ti-2026-043l-the-clock)
- [TI-2026-043M — The Map](https://www.shuffle-on.com/threat-intel/ti-2026-043m-the-map)

### TI-2026-044  (12)
- [TI-2026-044A — The Architecture](https://www.shuffle-on.com/threat-intel/ti-2026-044a-the-architecture)
- [TI-2026-044B — The Vikings](https://www.shuffle-on.com/threat-intel/ti-2026-044b-the-vikings)
- [TI-2026-044C — The Baltic Bridge](https://www.shuffle-on.com/threat-intel/ti-2026-044c-the-baltic-bridge)
- [TI-2026-044D — The Backbone](https://www.shuffle-on.com/threat-intel/ti-2026-044d-the-backbone)
- [TI-2026-044E — The Relay Network](https://www.shuffle-on.com/threat-intel/ti-2026-044e-the-relay-network)
- [TI-2026-044F — The Signal](https://www.shuffle-on.com/threat-intel/ti-2026-044f-the-signal)
- [TI-2026-044G — The Other Nordics](https://www.shuffle-on.com/threat-intel/ti-2026-044g-the-other-nordics)
- [TI-2026-044H — The Vendors](https://www.shuffle-on.com/threat-intel/ti-2026-044h-the-vendors)
- [TI-2026-044I — The Laundry](https://www.shuffle-on.com/threat-intel/ti-2026-044i-the-laundry)
- [TI-2026-044J — The Enforcers](https://www.shuffle-on.com/threat-intel/ti-2026-044j-the-enforcers)
- [TI-2026-044K — The Gatekeepers](https://www.shuffle-on.com/threat-intel/ti-2026-044k-the-gatekeepers)
- [TI-2026-044L — The Sanctions Gap](https://www.shuffle-on.com/threat-intel/ti-2026-044l-the-sanctions-gap)

### TI-2026-045  (17)
- [TI-2026-045A — Three Layer Architecture](https://www.shuffle-on.com/threat-intel/ti-2026-045a-three-layer-architecture)
- [TI-2026-045B — Yisu Cloud Abuse Rate](https://www.shuffle-on.com/threat-intel/ti-2026-045b-yisu-cloud-abuse-rate)
- [TI-2026-045C — Tencent Paradox](https://www.shuffle-on.com/threat-intel/ti-2026-045c-tencent-paradox)
- [TI-2026-045D — Aceville Shell](https://www.shuffle-on.com/threat-intel/ti-2026-045d-aceville-shell)
- [TI-2026-045E — Chinanet As4134](https://www.shuffle-on.com/threat-intel/ti-2026-045e-chinanet-as4134)
- [TI-2026-045F — Five Failure Modes](https://www.shuffle-on.com/threat-intel/ti-2026-045f-five-failure-modes)
- [TI-2026-045G — National Intelligence Law](https://www.shuffle-on.com/threat-intel/ti-2026-045g-national-intelligence-law)
- [TI-2026-045H — Belt Road Bytes](https://www.shuffle-on.com/threat-intel/ti-2026-045h-belt-road-bytes)
- [TI-2026-045I — Credential Factories](https://www.shuffle-on.com/threat-intel/ti-2026-045i-credential-factories)
- [TI-2026-045J — Complete Map](https://www.shuffle-on.com/threat-intel/ti-2026-045j-complete-map)
- [TI-2026-045K — Baidu Bytedance](https://www.shuffle-on.com/threat-intel/ti-2026-045k-baidu-bytedance)
- [TI-2026-045L — Alibaba Huawei Cloud](https://www.shuffle-on.com/threat-intel/ti-2026-045l-alibaba-huawei-cloud)
- [TI-2026-045M — I Soon Leak](https://www.shuffle-on.com/threat-intel/ti-2026-045m-i-soon-leak)
- [TI-2026-045N — Budapest Convention Gap](https://www.shuffle-on.com/threat-intel/ti-2026-045n-budapest-convention-gap)
- [TI-2026-045O — China vs America](https://www.shuffle-on.com/threat-intel/ti-2026-045o-china-vs-america)
- [TI-2026-045P — Unified Architecture](https://www.shuffle-on.com/threat-intel/ti-2026-045p-unified-architecture)
- [TI-2026-045Q — Southbase Guangzhou Idc C2](https://www.shuffle-on.com/threat-intel/ti-2026-045q-southbase-guangzhou-idc-c2)

### TI-2026-046  (5)
- [TI-2026-046A — The Env Harvesters](https://www.shuffle-on.com/threat-intel/ti-2026-046a-the-env-harvesters)
- [TI-2026-046B — The Wordpress Ghosts](https://www.shuffle-on.com/threat-intel/ti-2026-046b-the-wordpress-ghosts)
- [TI-2026-046C — The Reconnaissance Industrial Complex](https://www.shuffle-on.com/threat-intel/ti-2026-046c-the-reconnaissance-industrial-complex)
- [TI-2026-046D — The Multi Vector Operators](https://www.shuffle-on.com/threat-intel/ti-2026-046d-the-multi-vector-operators)
- [TI-2026-046E — The Cloud Mercenaries](https://www.shuffle-on.com/threat-intel/ti-2026-046e-the-cloud-mercenaries)

### TI-2026-047  (6)
- [TI-2026-047A — The Login Page that Watched Back](https://www.shuffle-on.com/threat-intel/ti-2026-047a-the-login-page-that-watched-back)
- [TI-2026-047B — The Repeat Offenders](https://www.shuffle-on.com/threat-intel/ti-2026-047b-the-repeat-offenders)
- [TI-2026-047C — The Botnet Census](https://www.shuffle-on.com/threat-intel/ti-2026-047c-the-botnet-census)
- [TI-2026-047D — The Cartographers of the Web](https://www.shuffle-on.com/threat-intel/ti-2026-047d-the-cartographers-of-the-web)
- [TI-2026-047E — The First Ten Seconds](https://www.shuffle-on.com/threat-intel/ti-2026-047e-the-first-ten-seconds)
- [TI-2026-047F — The Glass Cage](https://www.shuffle-on.com/threat-intel/ti-2026-047f-the-glass-cage)

### TI-2026-048  (5)
- [TI-2026-048A — The Nine Commands](https://www.shuffle-on.com/threat-intel/ti-2026-048a-the-nine-commands)
- [TI-2026-048B — The Second Factor](https://www.shuffle-on.com/threat-intel/ti-2026-048b-the-second-factor)
- [TI-2026-048C — Identity Without an Address](https://www.shuffle-on.com/threat-intel/ti-2026-048c-identity-without-an-address)
- [TI-2026-048D — The Re Tasking](https://www.shuffle-on.com/threat-intel/ti-2026-048d-the-re-tasking)
- [TI-2026-048E — Ninety Days](https://www.shuffle-on.com/threat-intel/ti-2026-048e-ninety-days)

### TI-2026-049  (6)
- [TI-2026-049A — The Library that Moves](https://www.shuffle-on.com/threat-intel/ti-2026-049a-the-library-that-moves)
- [TI-2026-049B — The Command Language](https://www.shuffle-on.com/threat-intel/ti-2026-049b-the-command-language)
- [TI-2026-049C — Eighty Four Flags](https://www.shuffle-on.com/threat-intel/ti-2026-049c-eighty-four-flags)
- [TI-2026-049D — The Version Tree](https://www.shuffle-on.com/threat-intel/ti-2026-049d-the-version-tree)
- [TI-2026-049E — The Temporal Pattern](https://www.shuffle-on.com/threat-intel/ti-2026-049e-the-temporal-pattern)
- [TI-2026-049F — The Census](https://www.shuffle-on.com/threat-intel/ti-2026-049f-the-census)

### TI-2026-050  (5)
- [TI-2026-050A — The Other Swarm](https://www.shuffle-on.com/threat-intel/ti-2026-050a-the-other-swarm)
- [TI-2026-050B — The Silent Handshake](https://www.shuffle-on.com/threat-intel/ti-2026-050b-the-silent-handshake)
- [TI-2026-050C — The Shell Game](https://www.shuffle-on.com/threat-intel/ti-2026-050c-the-shell-game)
- [TI-2026-050D — The Food Chain](https://www.shuffle-on.com/threat-intel/ti-2026-050d-the-food-chain)
- [TI-2026-050E — Assembly Line](https://www.shuffle-on.com/threat-intel/ti-2026-050e-assembly-line)

### TI-2026-051  (14)
- [TI-2026-051A — The Password is the Product](https://www.shuffle-on.com/threat-intel/ti-2026-051a-the-password-is-the-product)
- [TI-2026-051B — The Shopping List](https://www.shuffle-on.com/threat-intel/ti-2026-051b-the-shopping-list)
- [TI-2026-051C — The Stuffing Machine](https://www.shuffle-on.com/threat-intel/ti-2026-051c-the-stuffing-machine)
- [TI-2026-051D — Keys to the Kingdom](https://www.shuffle-on.com/threat-intel/ti-2026-051d-keys-to-the-kingdom)
- [TI-2026-051E — The Telegram Market](https://www.shuffle-on.com/threat-intel/ti-2026-051e-the-telegram-market)
- [TI-2026-051F — The Economy of Access](https://www.shuffle-on.com/threat-intel/ti-2026-051f-the-economy-of-access)
- [TI-2026-051G — The Signal in the Noise](https://www.shuffle-on.com/threat-intel/ti-2026-051g-the-signal-in-the-noise)
- [TI-2026-051H — The Wednesday Protocol](https://www.shuffle-on.com/threat-intel/ti-2026-051h-the-wednesday-protocol)
- [TI-2026-051I — The Dictionary](https://www.shuffle-on.com/threat-intel/ti-2026-051i-the-dictionary)
- [TI-2026-051J — The Doctrine](https://www.shuffle-on.com/threat-intel/ti-2026-051j-the-doctrine)
- [TI-2026-051K — The Dark Portfolio](https://www.shuffle-on.com/threat-intel/ti-2026-051k-the-dark-portfolio)
- [TI-2026-051L — The Military Connection](https://www.shuffle-on.com/threat-intel/ti-2026-051l-the-military-connection)
- [TI-2026-051M — The Exploitation Credential](https://www.shuffle-on.com/threat-intel/ti-2026-051m-the-exploitation-credential)
- [TI-2026-051N — The Complete Architecture](https://www.shuffle-on.com/threat-intel/ti-2026-051n-the-complete-architecture)

### TI-2026-052  (5)
- [TI-2026-052A — The Family Tree](https://www.shuffle-on.com/threat-intel/ti-2026-052a-the-family-tree)
- [TI-2026-052B — The Download Chain](https://www.shuffle-on.com/threat-intel/ti-2026-052b-the-download-chain)
- [TI-2026-052C — Shared Dna](https://www.shuffle-on.com/threat-intel/ti-2026-052c-shared-dna)
- [TI-2026-052D — The Mutation Rate](https://www.shuffle-on.com/threat-intel/ti-2026-052d-the-mutation-rate)
- [TI-2026-052E — Invisible Supply Chain](https://www.shuffle-on.com/threat-intel/ti-2026-052e-invisible-supply-chain)

### TI-2026-053  (7)
- [TI-2026-053A — The Roads They Travel](https://www.shuffle-on.com/threat-intel/ti-2026-053a-the-roads-they-travel)
- [TI-2026-053B — The Name on the Door](https://www.shuffle-on.com/threat-intel/ti-2026-053b-the-name-on-the-door)
- [TI-2026-053C — One Phone Number](https://www.shuffle-on.com/threat-intel/ti-2026-053c-one-phone-number)
- [TI-2026-053D — The Registrars Blind Eye](https://www.shuffle-on.com/threat-intel/ti-2026-053d-the-registrars-blind-eye)
- [TI-2026-053E — The Abuse Email Cluster](https://www.shuffle-on.com/threat-intel/ti-2026-053e-the-abuse-email-cluster)
- [TI-2026-053F — Fourteen Thousand Tenants](https://www.shuffle-on.com/threat-intel/ti-2026-053f-fourteen-thousand-tenants)
- [TI-2026-053G — The Invisible Hand](https://www.shuffle-on.com/threat-intel/ti-2026-053g-the-invisible-hand)

### TI-2026-054  (6)
- [TI-2026-054A — Synchronized Watches](https://www.shuffle-on.com/threat-intel/ti-2026-054a-synchronized-watches)
- [TI-2026-054B — The Geography of Command](https://www.shuffle-on.com/threat-intel/ti-2026-054b-the-geography-of-command)
- [TI-2026-054C — Twenty Two Thousand Neighbors](https://www.shuffle-on.com/threat-intel/ti-2026-054c-twenty-two-thousand-neighbors)
- [TI-2026-054D — The Working Day](https://www.shuffle-on.com/threat-intel/ti-2026-054d-the-working-day)
- [TI-2026-054E — Waves and Tides](https://www.shuffle-on.com/threat-intel/ti-2026-054e-waves-and-tides)
- [TI-2026-054F — The Conductor](https://www.shuffle-on.com/threat-intel/ti-2026-054f-the-conductor)

### TI-2026-055  (7)
- [TI-2026-055A — Two Hundred Sixty Nine](https://www.shuffle-on.com/threat-intel/ti-2026-055a-two-hundred-sixty-nine)
- [TI-2026-055B — The Sixty Nine](https://www.shuffle-on.com/threat-intel/ti-2026-055b-the-sixty-nine)
- [TI-2026-055C — The European Cell](https://www.shuffle-on.com/threat-intel/ti-2026-055c-the-european-cell)
- [TI-2026-055D — The Persistent Watcher](https://www.shuffle-on.com/threat-intel/ti-2026-055d-the-persistent-watcher)
- [TI-2026-055E — The Small Cells](https://www.shuffle-on.com/threat-intel/ti-2026-055e-the-small-cells)
- [TI-2026-055F — The High Threat Triad](https://www.shuffle-on.com/threat-intel/ti-2026-055f-the-high-threat-triad)
- [TI-2026-055G — The Composite Portrait](https://www.shuffle-on.com/threat-intel/ti-2026-055g-the-composite-portrait)

### TI-2026-056  (6)
- [TI-2026-056A — The Codebook](https://www.shuffle-on.com/threat-intel/ti-2026-056a-the-codebook)
- [TI-2026-056B — The Heartbeat Protocol](https://www.shuffle-on.com/threat-intel/ti-2026-056b-the-heartbeat-protocol)
- [TI-2026-056C — The Vocabulary Cipher](https://www.shuffle-on.com/threat-intel/ti-2026-056c-the-vocabulary-cipher)
- [TI-2026-056D — The Broadcast Schedule](https://www.shuffle-on.com/threat-intel/ti-2026-056d-the-broadcast-schedule)
- [TI-2026-056E — The Codebook Stations](https://www.shuffle-on.com/threat-intel/ti-2026-056e-the-codebook-stations)
- [TI-2026-056F — The Decryption](https://www.shuffle-on.com/threat-intel/ti-2026-056f-the-decryption)

### TI-2026-057  (8)
- [TI-2026-057A — The Threat Portrait](https://www.shuffle-on.com/threat-intel/ti-2026-057a-the-threat-portrait)
- [TI-2026-057B — The Two Nodes](https://www.shuffle-on.com/threat-intel/ti-2026-057b-the-two-nodes)
- [TI-2026-057C — The Handshake Doesnt Lie](https://www.shuffle-on.com/threat-intel/ti-2026-057c-the-handshake-doesnt-lie)
- [TI-2026-057D — The Evasion Stack](https://www.shuffle-on.com/threat-intel/ti-2026-057d-the-evasion-stack)
- [TI-2026-057E — Who Provides the Roads](https://www.shuffle-on.com/threat-intel/ti-2026-057e-who-provides-the-roads)
- [TI-2026-057F — The Paper Trail](https://www.shuffle-on.com/threat-intel/ti-2026-057f-the-paper-trail)
- [TI-2026-057G — Seven Years to a Weapon](https://www.shuffle-on.com/threat-intel/ti-2026-057g-seven-years-to-a-weapon)
- [TI-2026-057H — What Stops and What Doesnt](https://www.shuffle-on.com/threat-intel/ti-2026-057h-what-stops-and-what-doesnt)

### TI-2026-058  (15)
- [TI-2026-058A — The Go Machine](https://www.shuffle-on.com/threat-intel/ti-2026-058a-the-go-machine)
- [TI-2026-058B — The Two Machines](https://www.shuffle-on.com/threat-intel/ti-2026-058b-the-two-machines)
- [TI-2026-058C — The Constant Retooling](https://www.shuffle-on.com/threat-intel/ti-2026-058c-the-constant-retooling)
- [TI-2026-058D — The Supply Chain](https://www.shuffle-on.com/threat-intel/ti-2026-058d-the-supply-chain)
- [TI-2026-058E — The Org Chart](https://www.shuffle-on.com/threat-intel/ti-2026-058e-the-org-chart)
- [TI-2026-058F — The Five Languages](https://www.shuffle-on.com/threat-intel/ti-2026-058f-the-five-languages)
- [TI-2026-058G — The Cluster Map](https://www.shuffle-on.com/threat-intel/ti-2026-058g-the-cluster-map)
- [TI-2026-058H — The Passwords Speak](https://www.shuffle-on.com/threat-intel/ti-2026-058h-the-passwords-speak)
- [TI-2026-058I — The Crypto Hunter](https://www.shuffle-on.com/threat-intel/ti-2026-058i-the-crypto-hunter)
- [TI-2026-058J — The True Scale](https://www.shuffle-on.com/threat-intel/ti-2026-058j-the-true-scale)
- [TI-2026-058K — The Shell Companies](https://www.shuffle-on.com/threat-intel/ti-2026-058k-the-shell-companies)
- [TI-2026-058L — The Indonesian Amplifier](https://www.shuffle-on.com/threat-intel/ti-2026-058l-the-indonesian-amplifier)
- [TI-2026-058M — The Worms Dna](https://www.shuffle-on.com/threat-intel/ti-2026-058m-the-worms-dna)
- [TI-2026-058N — The University](https://www.shuffle-on.com/threat-intel/ti-2026-058n-the-university)
- [TI-2026-058O — The Counter Intelligence](https://www.shuffle-on.com/threat-intel/ti-2026-058o-the-counter-intelligence)

### TI-2026-059  (6)
- [TI-2026-059A — The Secret Harvest](https://www.shuffle-on.com/threat-intel/ti-2026-059a-the-secret-harvest)
- [TI-2026-059B — The Azure Shell Game](https://www.shuffle-on.com/threat-intel/ti-2026-059b-the-azure-shell-game)
- [TI-2026-059C — Mapping the Estate](https://www.shuffle-on.com/threat-intel/ti-2026-059c-mapping-the-estate)
- [TI-2026-059D — Scanners in the Mirror](https://www.shuffle-on.com/threat-intel/ti-2026-059d-scanners-in-the-mirror)
- [TI-2026-059E — The Keys Left in the Door](https://www.shuffle-on.com/threat-intel/ti-2026-059e-the-keys-left-in-the-door)
- [TI-2026-059F — Two Clocks](https://www.shuffle-on.com/threat-intel/ti-2026-059f-two-clocks)

### TI-2026-060  (5)
- [TI-2026-060A — The 200 that Lied](https://www.shuffle-on.com/threat-intel/ti-2026-060a-the-200-that-lied)  _(verify → TI-2026-060E, shared investigation)_
- [TI-2026-060B — The Census of the Invisible](https://www.shuffle-on.com/threat-intel/ti-2026-060b-the-census-of-the-invisible)  _(verify → TI-2026-060E, shared investigation)_
- [TI-2026-060C — The Method is the Message](https://www.shuffle-on.com/threat-intel/ti-2026-060c-the-method-is-the-message)  _(verify → TI-2026-060E, shared investigation)_
- [TI-2026-060D — The Redirect that Told the Truth](https://www.shuffle-on.com/threat-intel/ti-2026-060d-the-redirect-that-told-the-truth)  _(verify → TI-2026-060E, shared investigation)_
- [TI-2026-060E — The Unified Field](https://www.shuffle-on.com/threat-intel/ti-2026-060e-the-unified-field)

### TI-2026-061  (26)
- [TI-2026-061A — The Index of Everything Broken](https://www.shuffle-on.com/threat-intel/ti-2026-061a-the-index-of-everything-broken)
- [TI-2026-061B — The Bounty and the Auction](https://www.shuffle-on.com/threat-intel/ti-2026-061b-the-bounty-and-the-auction)
- [TI-2026-061C — The Forensic Alibi](https://www.shuffle-on.com/threat-intel/ti-2026-061c-the-forensic-alibi)
- [TI-2026-061D — The Anonymized Lie](https://www.shuffle-on.com/threat-intel/ti-2026-061d-the-anonymized-lie)
- [TI-2026-061E — The Word Ethical](https://www.shuffle-on.com/threat-intel/ti-2026-061e-the-word-ethical)
- [TI-2026-061F — The Print You Cant Wash Off](https://www.shuffle-on.com/threat-intel/ti-2026-061f-the-print-you-cant-wash-off)
- [TI-2026-061G — The One Way Mirror](https://www.shuffle-on.com/threat-intel/ti-2026-061g-the-one-way-mirror)
- [TI-2026-061H — The List that Becomes the Target](https://www.shuffle-on.com/threat-intel/ti-2026-061h-the-list-that-becomes-the-target)
- [TI-2026-061I — The Door in Every Wall](https://www.shuffle-on.com/threat-intel/ti-2026-061i-the-door-in-every-wall)
- [TI-2026-061J — The Reporter who Wasnt](https://www.shuffle-on.com/threat-intel/ti-2026-061j-the-reporter-who-wasnt)
- [TI-2026-061K — The Peer Reviewed Weapon](https://www.shuffle-on.com/threat-intel/ti-2026-061k-the-peer-reviewed-weapon)
- [TI-2026-061L — The Price of the Discount](https://www.shuffle-on.com/threat-intel/ti-2026-061l-the-price-of-the-discount)
- [TI-2026-061M — The Threat is You](https://www.shuffle-on.com/threat-intel/ti-2026-061m-the-threat-is-you)
- [TI-2026-061N — The Phone that Was Yours](https://www.shuffle-on.com/threat-intel/ti-2026-061n-the-phone-that-was-yours)
- [TI-2026-061O — Just Public](https://www.shuffle-on.com/threat-intel/ti-2026-061o-just-public)
- [TI-2026-061P — The Tunnel that Watched](https://www.shuffle-on.com/threat-intel/ti-2026-061p-the-tunnel-that-watched)
- [TI-2026-061Q — Quantum](https://www.shuffle-on.com/threat-intel/ti-2026-061q-quantum)
- [TI-2026-061R — The Research Cover](https://www.shuffle-on.com/threat-intel/ti-2026-061r-the-research-cover)
- [TI-2026-061S — The House that Listens](https://www.shuffle-on.com/threat-intel/ti-2026-061s-the-house-that-listens)
- [TI-2026-061T — The Utility that Sold You](https://www.shuffle-on.com/threat-intel/ti-2026-061t-the-utility-that-sold-you)
- [TI-2026-061U — The Helper with the Keys](https://www.shuffle-on.com/threat-intel/ti-2026-061u-the-helper-with-the-keys)
- [TI-2026-061V — The Password You Cant Change](https://www.shuffle-on.com/threat-intel/ti-2026-061v-the-password-you-cant-change)
- [TI-2026-061W — The Receipts Were Always Public](https://www.shuffle-on.com/threat-intel/ti-2026-061w-the-receipts-were-always-public)
- [TI-2026-061X — The Single Pane of You](https://www.shuffle-on.com/threat-intel/ti-2026-061x-the-single-pane-of-you)
- [TI-2026-061Y — You Are the Product](https://www.shuffle-on.com/threat-intel/ti-2026-061y-you-are-the-product)
- [TI-2026-061Z — Zero Accountability](https://www.shuffle-on.com/threat-intel/ti-2026-061z-zero-accountability)

### TI-2026-062  (4)
- [TI-2026-062A — Recruiters Handshake](https://www.shuffle-on.com/threat-intel/ti-2026-062a-recruiters-handshake)
- [TI-2026-062B — Census of the Forward Probe](https://www.shuffle-on.com/threat-intel/ti-2026-062b-census-of-the-forward-probe)
- [TI-2026-062C — The Residential Layer](https://www.shuffle-on.com/threat-intel/ti-2026-062c-the-residential-layer)
- [TI-2026-062D — The Map](https://www.shuffle-on.com/threat-intel/ti-2026-062d-the-map)

### TI-2026-063  (3)
- [TI-2026-063A — The Telegram Shell](https://www.shuffle-on.com/threat-intel/ti-2026-063a-the-telegram-shell)
- [TI-2026-063B — Three Faces of Telegram](https://www.shuffle-on.com/threat-intel/ti-2026-063b-three-faces-of-telegram)
- [TI-2026-063C — The Documented Technique](https://www.shuffle-on.com/threat-intel/ti-2026-063c-the-documented-technique)

### TI-2026-064  (5)
- [TI-2026-064A — The Same Ten Minutes](https://www.shuffle-on.com/threat-intel/ti-2026-064a-the-same-ten-minutes)
- [TI-2026-064B — Seen from Outside](https://www.shuffle-on.com/threat-intel/ti-2026-064b-seen-from-outside)
- [TI-2026-064C — The Cartographers Error](https://www.shuffle-on.com/threat-intel/ti-2026-064c-the-cartographers-error)
- [TI-2026-064D — Same Street Different Houses](https://www.shuffle-on.com/threat-intel/ti-2026-064d-same-street-different-houses)
- [TI-2026-064E — Preponderance](https://www.shuffle-on.com/threat-intel/ti-2026-064e-preponderance)

### TI-2026-065  (6)
- [TI-2026-065A — The Second Front](https://www.shuffle-on.com/threat-intel/ti-2026-065a-the-second-front)
- [TI-2026-065B — Two Doors One Landlord](https://www.shuffle-on.com/threat-intel/ti-2026-065b-two-doors-one-landlord)
- [TI-2026-065C — The Reader that Wasnt](https://www.shuffle-on.com/threat-intel/ti-2026-065c-the-reader-that-wasnt)
- [TI-2026-065D — The Glass House](https://www.shuffle-on.com/threat-intel/ti-2026-065d-the-glass-house)
- [TI-2026-065E — The Env Playbook](https://www.shuffle-on.com/threat-intel/ti-2026-065e-the-env-playbook)
- [TI-2026-065F — The Mirror that Masks](https://www.shuffle-on.com/threat-intel/ti-2026-065f-the-mirror-that-masks)

### TI-2026-066  (6)
- [TI-2026-066A — Trusted by Default](https://www.shuffle-on.com/threat-intel/ti-2026-066a-trusted-by-default)
- [TI-2026-066B — The Browser Costume](https://www.shuffle-on.com/threat-intel/ti-2026-066b-the-browser-costume)
- [TI-2026-066C — Behind the Orange Cloud](https://www.shuffle-on.com/threat-intel/ti-2026-066c-behind-the-orange-cloud)
- [TI-2026-066D — The Quiet German](https://www.shuffle-on.com/threat-intel/ti-2026-066d-the-quiet-german)
- [TI-2026-066E — The Bulletproof Midtier](https://www.shuffle-on.com/threat-intel/ti-2026-066e-the-bulletproof-midtier)
- [TI-2026-066F — Behavior Over Reputation](https://www.shuffle-on.com/threat-intel/ti-2026-066f-behavior-over-reputation)

### TI-2026-067  (2)
- [TI-2026-067A — The Steady State Four Shapes](https://www.shuffle-on.com/threat-intel/ti-2026-067a-the-steady-state-four-shapes)
- [TI-2026-067B — The Recount Churn Without Growth](https://www.shuffle-on.com/threat-intel/ti-2026-067b-the-recount-churn-without-growth)

### TI-2026-068  (4)
- [TI-2026-068A — The Authority](https://www.shuffle-on.com/threat-intel/ti-2026-068a-the-authority)
- [TI-2026-068B — The Deed and the Tenant](https://www.shuffle-on.com/threat-intel/ti-2026-068b-the-deed-and-the-tenant)
- [TI-2026-068C — The Synonym Problem](https://www.shuffle-on.com/threat-intel/ti-2026-068c-the-synonym-problem)
- [TI-2026-068D — The Same Hand](https://www.shuffle-on.com/threat-intel/ti-2026-068d-the-same-hand)

### TI-2026-069  (3)
- [TI-2026-069A — The Open Armory](https://www.shuffle-on.com/threat-intel/ti-2026-069a-the-open-armory)
- [TI-2026-069B — The Template and the Target](https://www.shuffle-on.com/threat-intel/ti-2026-069b-the-template-and-the-target)
- [TI-2026-069C — The Changelog](https://www.shuffle-on.com/threat-intel/ti-2026-069c-the-changelog)

### TI-2026-070  (3)
- [TI-2026-070A — The Map and the Territory](https://www.shuffle-on.com/threat-intel/ti-2026-070a-the-map-and-the-territory)
- [TI-2026-070B — The Appraisal](https://www.shuffle-on.com/threat-intel/ti-2026-070b-the-appraisal)
- [TI-2026-070C — The Key](https://www.shuffle-on.com/threat-intel/ti-2026-070c-the-key)

### TI-2026-071  (26)
- [TI-2026-071A — A is for Apt](https://www.shuffle-on.com/threat-intel/ti-2026-071a-a-is-for-apt)
- [TI-2026-071B — B is for Bulletproof](https://www.shuffle-on.com/threat-intel/ti-2026-071b-b-is-for-bulletproof)
- [TI-2026-071C — C is for Covert Collection](https://www.shuffle-on.com/threat-intel/ti-2026-071c-c-is-for-covert-collection)
- [TI-2026-071D — D is for Dota](https://www.shuffle-on.com/threat-intel/ti-2026-071d-d-is-for-dota)
- [TI-2026-071E — E is for Eternalblue](https://www.shuffle-on.com/threat-intel/ti-2026-071e-e-is-for-eternalblue)
- [TI-2026-071F — F is for Financial Rails](https://www.shuffle-on.com/threat-intel/ti-2026-071f-f-is-for-financial-rails)
- [TI-2026-071G — G is for Greece](https://www.shuffle-on.com/threat-intel/ti-2026-071g-g-is-for-greece)
- [TI-2026-071H — H is for HASSH](https://www.shuffle-on.com/threat-intel/ti-2026-071h-h-is-for-hassh)
- [TI-2026-071I — I is for I Soon](https://www.shuffle-on.com/threat-intel/ti-2026-071i-i-is-for-i-soon)
- [TI-2026-071J — J is for Jurisdiction](https://www.shuffle-on.com/threat-intel/ti-2026-071j-j-is-for-jurisdiction)
- [TI-2026-071K — K is for Key](https://www.shuffle-on.com/threat-intel/ti-2026-071k-k-is-for-key)
- [TI-2026-071L — L is for Log4shell](https://www.shuffle-on.com/threat-intel/ti-2026-071l-l-is-for-log4shell)
- [TI-2026-071M — M is for Maxwell](https://www.shuffle-on.com/threat-intel/ti-2026-071m-m-is-for-maxwell)
- [TI-2026-071N — N is for Netoptics Tap](https://www.shuffle-on.com/threat-intel/ti-2026-071n-n-is-for-netoptics-tap)
- [TI-2026-071O — O is for Orb](https://www.shuffle-on.com/threat-intel/ti-2026-071o-o-is-for-orb)
- [TI-2026-071P — P is for Phonexia](https://www.shuffle-on.com/threat-intel/ti-2026-071p-p-is-for-phonexia)
- [TI-2026-071Q — Q is for Quantum](https://www.shuffle-on.com/threat-intel/ti-2026-071q-q-is-for-quantum)
- [TI-2026-071R — R is for Ransomware](https://www.shuffle-on.com/threat-intel/ti-2026-071r-r-is-for-ransomware)
- [TI-2026-071S — S is for Spyfiles](https://www.shuffle-on.com/threat-intel/ti-2026-071s-s-is-for-spyfiles)
- [TI-2026-071T — T is for Telegram](https://www.shuffle-on.com/threat-intel/ti-2026-071t-t-is-for-telegram)
- [TI-2026-071U — U is for Unpatched](https://www.shuffle-on.com/threat-intel/ti-2026-071u-u-is-for-unpatched)
- [TI-2026-071V — V is for Vastech](https://www.shuffle-on.com/threat-intel/ti-2026-071v-v-is-for-vastech)
- [TI-2026-071W — W is for Wikileaks](https://www.shuffle-on.com/threat-intel/ti-2026-071w-w-is-for-wikileaks)
- [TI-2026-071X — X is for Xkeyscore](https://www.shuffle-on.com/threat-intel/ti-2026-071x-x-is-for-xkeyscore)
- [TI-2026-071Y — Y is for Yara](https://www.shuffle-on.com/threat-intel/ti-2026-071y-y-is-for-yara)
- [TI-2026-071Z — Z is for Zero Accountability](https://www.shuffle-on.com/threat-intel/ti-2026-071z-z-is-for-zero-accountability)

### TI-2026-072  (26)
- [TI-2026-072A — A is for Amesys](https://www.shuffle-on.com/threat-intel/ti-2026-072a-a-is-for-amesys)
- [TI-2026-072B — B is for Blue Coat](https://www.shuffle-on.com/threat-intel/ti-2026-072b-b-is-for-blue-coat)
- [TI-2026-072C — C is for Chengdu 404](https://www.shuffle-on.com/threat-intel/ti-2026-072c-c-is-for-chengdu-404)
- [TI-2026-072D — D is for Darkside](https://www.shuffle-on.com/threat-intel/ti-2026-072d-d-is-for-darkside)
- [TI-2026-072E — E is for Equation Group](https://www.shuffle-on.com/threat-intel/ti-2026-072e-e-is-for-equation-group)
- [TI-2026-072F — F is for Finfisher](https://www.shuffle-on.com/threat-intel/ti-2026-072f-f-is-for-finfisher)
- [TI-2026-072G — G is for Gru Fancy Bear](https://www.shuffle-on.com/threat-intel/ti-2026-072g-g-is-for-gru-fancy-bear)
- [TI-2026-072H — H is for Hafnium](https://www.shuffle-on.com/threat-intel/ti-2026-072h-h-is-for-hafnium)
- [TI-2026-072I — I is for Intellexa](https://www.shuffle-on.com/threat-intel/ti-2026-072i-i-is-for-intellexa)
- [TI-2026-072J — J is for Jia Tan](https://www.shuffle-on.com/threat-intel/ti-2026-072j-j-is-for-jia-tan)
- [TI-2026-072K — K is for Kimsuky](https://www.shuffle-on.com/threat-intel/ti-2026-072k-k-is-for-kimsuky)
- [TI-2026-072L — L is for Lockbit](https://www.shuffle-on.com/threat-intel/ti-2026-072l-l-is-for-lockbit)
- [TI-2026-072M — M is for Mirai](https://www.shuffle-on.com/threat-intel/ti-2026-072m-m-is-for-mirai)
- [TI-2026-072N — N is for Nso Group](https://www.shuffle-on.com/threat-intel/ti-2026-072n-n-is-for-nso-group)
- [TI-2026-072O — O is for Oceanlotus](https://www.shuffle-on.com/threat-intel/ti-2026-072o-o-is-for-oceanlotus)
- [TI-2026-072P — P is for Park Jin Hyok](https://www.shuffle-on.com/threat-intel/ti-2026-072p-p-is-for-park-jin-hyok)
- [TI-2026-072Q — Q is for Qakbot](https://www.shuffle-on.com/threat-intel/ti-2026-072q-q-is-for-qakbot)
- [TI-2026-072R — R is for Revil](https://www.shuffle-on.com/threat-intel/ti-2026-072r-r-is-for-revil)
- [TI-2026-072S — S is for Sandworm](https://www.shuffle-on.com/threat-intel/ti-2026-072s-s-is-for-sandworm)
- [TI-2026-072T — T is for Turla](https://www.shuffle-on.com/threat-intel/ti-2026-072t-t-is-for-turla)
- [TI-2026-072U — U is for Unc2452](https://www.shuffle-on.com/threat-intel/ti-2026-072u-u-is-for-unc2452)
- [TI-2026-072V — V is for Volt Typhoon](https://www.shuffle-on.com/threat-intel/ti-2026-072v-v-is-for-volt-typhoon)
- [TI-2026-072W — W is for Wizard Spider](https://www.shuffle-on.com/threat-intel/ti-2026-072w-w-is-for-wizard-spider)
- [TI-2026-072X — X is for Xenotime](https://www.shuffle-on.com/threat-intel/ti-2026-072x-x-is-for-xenotime)
- [TI-2026-072Y — Y is for Yanluowang](https://www.shuffle-on.com/threat-intel/ti-2026-072y-y-is-for-yanluowang)
- [TI-2026-072Z — Z is for Zeus](https://www.shuffle-on.com/threat-intel/ti-2026-072z-z-is-for-zeus)

### TI-2026-073  (5)
- [TI-2026-073A — The Mcp Hunters](https://www.shuffle-on.com/threat-intel/ti-2026-073a-the-mcp-hunters)
- [TI-2026-073B — The Control Plane Lie](https://www.shuffle-on.com/threat-intel/ti-2026-073b-the-control-plane-lie)
- [TI-2026-073C — The Namespace Sweep](https://www.shuffle-on.com/threat-intel/ti-2026-073c-the-namespace-sweep)
- [TI-2026-073D — The Poisoned Tool](https://www.shuffle-on.com/threat-intel/ti-2026-073d-the-poisoned-tool)
- [TI-2026-073E — The Original Sin](https://www.shuffle-on.com/threat-intel/ti-2026-073e-the-original-sin)

### TI-2026-074  (26)
- [TI-2026-074A — The Ransom](https://www.shuffle-on.com/threat-intel/ti-2026-074a-the-ransom)
- [TI-2026-074B — The Warhead](https://www.shuffle-on.com/threat-intel/ti-2026-074b-the-warhead)
- [TI-2026-074C — The Clawback](https://www.shuffle-on.com/threat-intel/ti-2026-074c-the-clawback)
- [TI-2026-074D — The Kill Switch](https://www.shuffle-on.com/threat-intel/ti-2026-074d-the-kill-switch)
- [TI-2026-074E — The Mixer](https://www.shuffle-on.com/threat-intel/ti-2026-074e-the-mixer)
- [TI-2026-074F — The Compound](https://www.shuffle-on.com/threat-intel/ti-2026-074f-the-compound)
- [TI-2026-074G — The Wire](https://www.shuffle-on.com/threat-intel/ti-2026-074g-the-wire)
- [TI-2026-074H — The Marketplace](https://www.shuffle-on.com/threat-intel/ti-2026-074h-the-marketplace)
- [TI-2026-074I — The Payroll](https://www.shuffle-on.com/threat-intel/ti-2026-074i-the-payroll)
- [TI-2026-074J — The Cryptoqueen](https://www.shuffle-on.com/threat-intel/ti-2026-074j-the-cryptoqueen)
- [TI-2026-074K — The Bridge](https://www.shuffle-on.com/threat-intel/ti-2026-074k-the-bridge)
- [TI-2026-074L — The Cash Out](https://www.shuffle-on.com/threat-intel/ti-2026-074l-the-cash-out)
- [TI-2026-074M — The Cause](https://www.shuffle-on.com/threat-intel/ti-2026-074m-the-cause)
- [TI-2026-074N — The Precursor](https://www.shuffle-on.com/threat-intel/ti-2026-074n-the-precursor)
- [TI-2026-074O — The Canvas](https://www.shuffle-on.com/threat-intel/ti-2026-074o-the-canvas)
- [TI-2026-074P — The Black Box](https://www.shuffle-on.com/threat-intel/ti-2026-074p-the-black-box)
- [TI-2026-074Q — The Reckoning](https://www.shuffle-on.com/threat-intel/ti-2026-074q-the-reckoning)
- [TI-2026-074R — The Franchise](https://www.shuffle-on.com/threat-intel/ti-2026-074r-the-franchise)
- [TI-2026-074S — The Sanctioned State](https://www.shuffle-on.com/threat-intel/ti-2026-074s-the-sanctioned-state)
- [TI-2026-074T — The Machine on the Corner](https://www.shuffle-on.com/threat-intel/ti-2026-074t-the-machine-on-the-corner)
- [TI-2026-074U — The Washman](https://www.shuffle-on.com/threat-intel/ti-2026-074u-the-washman)
- [TI-2026-074V — The Return](https://www.shuffle-on.com/threat-intel/ti-2026-074v-the-return)
- [TI-2026-074W — The Custodian](https://www.shuffle-on.com/threat-intel/ti-2026-074w-the-custodian)
- [TI-2026-074X — The Hoard](https://www.shuffle-on.com/threat-intel/ti-2026-074x-the-hoard)
- [TI-2026-074Y — The Number](https://www.shuffle-on.com/threat-intel/ti-2026-074y-the-number)
- [TI-2026-074Z — The Verdict](https://www.shuffle-on.com/threat-intel/ti-2026-074z-the-verdict)

### TI-2026-075  (26)
- [TI-2026-075A — The Armory](https://www.shuffle-on.com/threat-intel/ti-2026-075a-the-armory)
- [TI-2026-075B — The Cloud Contractor](https://www.shuffle-on.com/threat-intel/ti-2026-075b-the-cloud-contractor)
- [TI-2026-075C — Two Handed](https://www.shuffle-on.com/threat-intel/ti-2026-075c-two-handed)
- [TI-2026-075D — Sliver](https://www.shuffle-on.com/threat-intel/ti-2026-075d-sliver)
- [TI-2026-075E — Havoc Framework](https://www.shuffle-on.com/threat-intel/ti-2026-075e-havoc-framework)
- [TI-2026-075F — The First Move](https://www.shuffle-on.com/threat-intel/ti-2026-075f-the-first-move)
- [TI-2026-075G — Fifty Six Networks](https://www.shuffle-on.com/threat-intel/ti-2026-075g-fifty-six-networks)
- [TI-2026-075H — The Resident](https://www.shuffle-on.com/threat-intel/ti-2026-075h-the-resident)
- [TI-2026-075I — The Weapon is Never the Point](https://www.shuffle-on.com/threat-intel/ti-2026-075i-the-weapon-is-never-the-point)
- [TI-2026-075J — The Ammunition](https://www.shuffle-on.com/threat-intel/ti-2026-075j-the-ammunition)
- [TI-2026-075K — The Payload](https://www.shuffle-on.com/threat-intel/ti-2026-075k-the-payload)
- [TI-2026-075L — The Compiled Swarm](https://www.shuffle-on.com/threat-intel/ti-2026-075l-the-compiled-swarm)
- [TI-2026-075M — By Hand](https://www.shuffle-on.com/threat-intel/ti-2026-075m-by-hand)
- [TI-2026-075N — The Mapmaker](https://www.shuffle-on.com/threat-intel/ti-2026-075n-the-mapmaker)
- [TI-2026-075O — The Glue](https://www.shuffle-on.com/threat-intel/ti-2026-075o-the-glue)
- [TI-2026-075P — The Version Fleets](https://www.shuffle-on.com/threat-intel/ti-2026-075p-the-version-fleets)
- [TI-2026-075Q — The Auditors](https://www.shuffle-on.com/threat-intel/ti-2026-075q-the-auditors)
- [TI-2026-075R — The Sharpest Edge](https://www.shuffle-on.com/threat-intel/ti-2026-075r-the-sharpest-edge)
- [TI-2026-075S — The Silent Knock](https://www.shuffle-on.com/threat-intel/ti-2026-075s-the-silent-knock)
- [TI-2026-075T — The Borrowed Face](https://www.shuffle-on.com/threat-intel/ti-2026-075t-the-borrowed-face)
- [TI-2026-075U — The Key Ring](https://www.shuffle-on.com/threat-intel/ti-2026-075u-the-key-ring)
- [TI-2026-075V — The Bulletproof Shelf](https://www.shuffle-on.com/threat-intel/ti-2026-075v-the-bulletproof-shelf)
- [TI-2026-075W — The Clock](https://www.shuffle-on.com/threat-intel/ti-2026-075w-the-clock)
- [TI-2026-075X — The Cross Vector](https://www.shuffle-on.com/threat-intel/ti-2026-075x-the-cross-vector)
- [TI-2026-075Y — The Innocent](https://www.shuffle-on.com/threat-intel/ti-2026-075y-the-innocent)
- [TI-2026-075Z — The Complete Armory](https://www.shuffle-on.com/threat-intel/ti-2026-075z-the-complete-armory)

### TI-2026-076  (26)
- [TI-2026-076A — The Default Password](https://www.shuffle-on.com/threat-intel/ti-2026-076a-the-default-password)
- [TI-2026-076B — The Brute Force](https://www.shuffle-on.com/threat-intel/ti-2026-076b-the-brute-force)
- [TI-2026-076C — The Exposed Rdp](https://www.shuffle-on.com/threat-intel/ti-2026-076c-the-exposed-rdp)
- [TI-2026-076D — The Phish](https://www.shuffle-on.com/threat-intel/ti-2026-076d-the-phish)
- [TI-2026-076E — The Edge Appliance](https://www.shuffle-on.com/threat-intel/ti-2026-076e-the-edge-appliance)
- [TI-2026-076F — The Web Shell](https://www.shuffle-on.com/threat-intel/ti-2026-076f-the-web-shell)
- [TI-2026-076G — The Open Database](https://www.shuffle-on.com/threat-intel/ti-2026-076g-the-open-database)
- [TI-2026-076H — The Exposed Docker Socket](https://www.shuffle-on.com/threat-intel/ti-2026-076h-the-exposed-docker-socket)
- [TI-2026-076I — The Infostealer](https://www.shuffle-on.com/threat-intel/ti-2026-076i-the-infostealer)
- [TI-2026-076J — The Access Broker](https://www.shuffle-on.com/threat-intel/ti-2026-076j-the-access-broker)
- [TI-2026-076K — The Valid Account](https://www.shuffle-on.com/threat-intel/ti-2026-076k-the-valid-account)
- [TI-2026-076L — The Mfa Bypass](https://www.shuffle-on.com/threat-intel/ti-2026-076l-the-mfa-bypass)
- [TI-2026-076M — The Supply Chain](https://www.shuffle-on.com/threat-intel/ti-2026-076m-the-supply-chain)
- [TI-2026-076N — The Watering Hole](https://www.shuffle-on.com/threat-intel/ti-2026-076n-the-watering-hole)
- [TI-2026-076O — The Fake Installer](https://www.shuffle-on.com/threat-intel/ti-2026-076o-the-fake-installer)
- [TI-2026-076P — The Vulnerable Driver](https://www.shuffle-on.com/threat-intel/ti-2026-076p-the-vulnerable-driver)
- [TI-2026-076Q — The Planted Key](https://www.shuffle-on.com/threat-intel/ti-2026-076q-the-planted-key)
- [TI-2026-076R — The Iot Worm](https://www.shuffle-on.com/threat-intel/ti-2026-076r-the-iot-worm)
- [TI-2026-076S — The Wormable Exploit](https://www.shuffle-on.com/threat-intel/ti-2026-076s-the-wormable-exploit)
- [TI-2026-076T — The Leaked Secret](https://www.shuffle-on.com/threat-intel/ti-2026-076t-the-leaked-secret)
- [TI-2026-076U — The Insider](https://www.shuffle-on.com/threat-intel/ti-2026-076u-the-insider)
- [TI-2026-076V — The Cloud Metadata Service](https://www.shuffle-on.com/threat-intel/ti-2026-076v-the-cloud-metadata-service)
- [TI-2026-076W — The Mass Scanner](https://www.shuffle-on.com/threat-intel/ti-2026-076w-the-mass-scanner)
- [TI-2026-076X — The Combolist](https://www.shuffle-on.com/threat-intel/ti-2026-076x-the-combolist)
- [TI-2026-076Y — The First Machine](https://www.shuffle-on.com/threat-intel/ti-2026-076y-the-first-machine)
- [TI-2026-076Z — The Verdict](https://www.shuffle-on.com/threat-intel/ti-2026-076z-the-verdict)

### TI-2026-077  (4)
- [TI-2026-077A — The Laundered Vector](https://www.shuffle-on.com/threat-intel/ti-2026-077a-the-laundered-vector)
- [TI-2026-077B — The Pipe that Hides](https://www.shuffle-on.com/threat-intel/ti-2026-077b-the-pipe-that-hides)
- [TI-2026-077C — One Hand Two Doors](https://www.shuffle-on.com/threat-intel/ti-2026-077c-one-hand-two-doors)
- [TI-2026-077D — The Midtier](https://www.shuffle-on.com/threat-intel/ti-2026-077d-the-midtier)

### TI-2026-078  (4)
- [TI-2026-078A — The Cloud Offensive](https://www.shuffle-on.com/threat-intel/ti-2026-078a-the-cloud-offensive)
- [TI-2026-078B — The Estate Sweep](https://www.shuffle-on.com/threat-intel/ti-2026-078b-the-estate-sweep)
- [TI-2026-078C — The Credential Army](https://www.shuffle-on.com/threat-intel/ti-2026-078c-the-credential-army)
- [TI-2026-078D — The Accountability Gap](https://www.shuffle-on.com/threat-intel/ti-2026-078d-the-accountability-gap)

### TI-2026-079  (3)
- [TI-2026-079A — The Harvest](https://www.shuffle-on.com/threat-intel/ti-2026-079a-the-harvest)
- [TI-2026-079B — The Docsearch Probe](https://www.shuffle-on.com/threat-intel/ti-2026-079b-the-docsearch-probe)
- [TI-2026-079C — The Reseller Stack](https://www.shuffle-on.com/threat-intel/ti-2026-079c-the-reseller-stack)

### TI-2026-080 — Follow the Operator  (26)
- [TI-2026-080A — The Reused Key](https://www.shuffle-on.com/threat-intel/ti-2026-080a-the-reused-key)
- [TI-2026-080B — The Planted Key](https://www.shuffle-on.com/threat-intel/ti-2026-080b-the-planted-key)
- [TI-2026-080C — The Tool Fingerprint](https://www.shuffle-on.com/threat-intel/ti-2026-080c-the-tool-fingerprint)
- [TI-2026-080D — The Shared Payload](https://www.shuffle-on.com/threat-intel/ti-2026-080d-the-shared-payload)
- [TI-2026-080E — The Bulletproof Landlord](https://www.shuffle-on.com/threat-intel/ti-2026-080e-the-bulletproof-landlord)
- [TI-2026-080F — The Same Keystrokes](https://www.shuffle-on.com/threat-intel/ti-2026-080f-the-same-keystrokes)
- [TI-2026-080G — The Bespoke Wordlist](https://www.shuffle-on.com/threat-intel/ti-2026-080g-the-bespoke-wordlist)
- [TI-2026-080H — The Working Day](https://www.shuffle-on.com/threat-intel/ti-2026-080h-the-working-day)
- [TI-2026-080I — The Beacon](https://www.shuffle-on.com/threat-intel/ti-2026-080i-the-beacon)
- [TI-2026-080J — The Registrant](https://www.shuffle-on.com/threat-intel/ti-2026-080j-the-registrant)
- [TI-2026-080K — The Handle](https://www.shuffle-on.com/threat-intel/ti-2026-080k-the-handle)
- [TI-2026-080L — The Cut Thread](https://www.shuffle-on.com/threat-intel/ti-2026-080l-the-cut-thread)
- [TI-2026-080M — The Mega Cluster](https://www.shuffle-on.com/threat-intel/ti-2026-080m-the-mega-cluster)
- [TI-2026-080N — The Graph](https://www.shuffle-on.com/threat-intel/ti-2026-080n-the-graph)
- [TI-2026-080O — The Cloud Tenant](https://www.shuffle-on.com/threat-intel/ti-2026-080o-the-cloud-tenant)
- [TI-2026-080P — The False Flag](https://www.shuffle-on.com/threat-intel/ti-2026-080p-the-false-flag)
- [TI-2026-080Q — The Merge Problem](https://www.shuffle-on.com/threat-intel/ti-2026-080q-the-merge-problem)
- [TI-2026-080R — The Split Problem](https://www.shuffle-on.com/threat-intel/ti-2026-080r-the-split-problem)
- [TI-2026-080S — The Coincidence](https://www.shuffle-on.com/threat-intel/ti-2026-080s-the-coincidence)
- [TI-2026-080T — The Brokers Fingerprint](https://www.shuffle-on.com/threat-intel/ti-2026-080t-the-brokers-fingerprint)
- [TI-2026-080U — The Persona](https://www.shuffle-on.com/threat-intel/ti-2026-080u-the-persona)
- [TI-2026-080V — The Ghost](https://www.shuffle-on.com/threat-intel/ti-2026-080v-the-ghost)
- [TI-2026-080W — The Census Behind the Census](https://www.shuffle-on.com/threat-intel/ti-2026-080w-the-census-behind-the-census)
- [TI-2026-080X — The Confidence Problem](https://www.shuffle-on.com/threat-intel/ti-2026-080x-the-confidence-problem)
- [TI-2026-080Y — The Linker](https://www.shuffle-on.com/threat-intel/ti-2026-080y-the-linker)
- [TI-2026-080Z — The Verdict](https://www.shuffle-on.com/threat-intel/ti-2026-080z-the-verdict)

### TI-2026-081  (26)
- [TI-2026-081A — The Miner](https://www.shuffle-on.com/threat-intel/ti-2026-081a-the-miner)
- [TI-2026-081B — The Proxy](https://www.shuffle-on.com/threat-intel/ti-2026-081b-the-proxy)
- [TI-2026-081C — The Recruit](https://www.shuffle-on.com/threat-intel/ti-2026-081c-the-recruit)
- [TI-2026-081D — The Commodity Payload](https://www.shuffle-on.com/threat-intel/ti-2026-081d-the-commodity-payload)
- [TI-2026-081E — The Harvester](https://www.shuffle-on.com/threat-intel/ti-2026-081e-the-harvester)
- [TI-2026-081F — The Exfiltrator](https://www.shuffle-on.com/threat-intel/ti-2026-081f-the-exfiltrator)
- [TI-2026-081G — The Ransom Note](https://www.shuffle-on.com/threat-intel/ti-2026-081g-the-ransom-note)
- [TI-2026-081H — The Wiper in Ransom Clothing](https://www.shuffle-on.com/threat-intel/ti-2026-081h-the-wiper-in-ransom-clothing)
- [TI-2026-081I — The Backdoor](https://www.shuffle-on.com/threat-intel/ti-2026-081i-the-backdoor)
- [TI-2026-081J — The Loader](https://www.shuffle-on.com/threat-intel/ti-2026-081j-the-loader)
- [TI-2026-081K — The Dropped But Never Run](https://www.shuffle-on.com/threat-intel/ti-2026-081k-the-dropped-but-never-run)
- [TI-2026-081L — The Decoy Payload](https://www.shuffle-on.com/threat-intel/ti-2026-081l-the-decoy-payload)
- [TI-2026-081M — The Dual Use Tool](https://www.shuffle-on.com/threat-intel/ti-2026-081m-the-dual-use-tool)
- [TI-2026-081N — The Layered Payload](https://www.shuffle-on.com/threat-intel/ti-2026-081n-the-layered-payload)
- [TI-2026-081O — The Rented Payload](https://www.shuffle-on.com/threat-intel/ti-2026-081o-the-rented-payload)
- [TI-2026-081P — The Self Propagator](https://www.shuffle-on.com/threat-intel/ti-2026-081p-the-self-propagator)
- [TI-2026-081Q — The Ddos Cannon](https://www.shuffle-on.com/threat-intel/ti-2026-081q-the-ddos-cannon)
- [TI-2026-081R — The Anti Analysis Payload](https://www.shuffle-on.com/threat-intel/ti-2026-081r-the-anti-analysis-payload)
- [TI-2026-081S — The Objective that Changed](https://www.shuffle-on.com/threat-intel/ti-2026-081s-the-objective-that-changed)
- [TI-2026-081T — The Sleeper](https://www.shuffle-on.com/threat-intel/ti-2026-081t-the-sleeper)
- [TI-2026-081U — The Misattributed Objective](https://www.shuffle-on.com/threat-intel/ti-2026-081u-the-misattributed-objective)
- [TI-2026-081V — The Payload with No Objective](https://www.shuffle-on.com/threat-intel/ti-2026-081v-the-payload-with-no-objective)
- [TI-2026-081W — The Living Off the Land Intrusion](https://www.shuffle-on.com/threat-intel/ti-2026-081w-the-living-off-the-land-intrusion)
- [TI-2026-081X — The Intent Ledger](https://www.shuffle-on.com/threat-intel/ti-2026-081x-the-intent-ledger)
- [TI-2026-081Y — The Classifier](https://www.shuffle-on.com/threat-intel/ti-2026-081y-the-classifier)
- [TI-2026-081Z — The Verdict](https://www.shuffle-on.com/threat-intel/ti-2026-081z-the-verdict)

### TI-2026-082  (6)
- [TI-2026-082A — The Bank that Wasnt](https://www.shuffle-on.com/threat-intel/ti-2026-082a-the-bank-that-wasnt)
- [TI-2026-082B — The Borrowed Vault](https://www.shuffle-on.com/threat-intel/ti-2026-082b-the-borrowed-vault)
- [TI-2026-082C — The Address Foundry](https://www.shuffle-on.com/threat-intel/ti-2026-082c-the-address-foundry)
- [TI-2026-082D — The Costume Catalog](https://www.shuffle-on.com/threat-intel/ti-2026-082d-the-costume-catalog)
- [TI-2026-082E — The Flooder Next Door](https://www.shuffle-on.com/threat-intel/ti-2026-082e-the-flooder-next-door)
- [TI-2026-082F — The Nursery](https://www.shuffle-on.com/threat-intel/ti-2026-082f-the-nursery)

### TI-2026-083  (4)
- [TI-2026-083A — The Senpai Loader](https://www.shuffle-on.com/threat-intel/ti-2026-083a-the-senpai-loader)
- [TI-2026-083B — The Target Was Never a Server](https://www.shuffle-on.com/threat-intel/ti-2026-083b-the-target-was-never-a-server)
- [TI-2026-083C — The Appraiser](https://www.shuffle-on.com/threat-intel/ti-2026-083c-the-appraiser)
- [TI-2026-083D — The Loader Splits in Two](https://www.shuffle-on.com/threat-intel/ti-2026-083d-the-loader-splits-in-two)

### TI-2026-084  (4)
- [TI-2026-084A — Borrowed Trust](https://www.shuffle-on.com/threat-intel/ti-2026-084a-borrowed-trust)
- [TI-2026-084B — The Watchmans Own Gate](https://www.shuffle-on.com/threat-intel/ti-2026-084b-the-watchmans-own-gate)
- [TI-2026-084C — The Research Bureaus Spray](https://www.shuffle-on.com/threat-intel/ti-2026-084c-the-research-bureaus-spray)
- [TI-2026-084D — Reading the Good Name](https://www.shuffle-on.com/threat-intel/ti-2026-084d-reading-the-good-name)

### TI-2026-085  (6)
- [TI-2026-085A — The Training Land Grab](https://www.shuffle-on.com/threat-intel/ti-2026-085a-the-training-land-grab)
- [TI-2026-085B — The Impostor Economy](https://www.shuffle-on.com/threat-intel/ti-2026-085b-the-impostor-economy)
- [TI-2026-085C — Verified and Still Where It Shouldnt Be](https://www.shuffle-on.com/threat-intel/ti-2026-085c-verified-and-still-where-it-shouldnt-be)
- [TI-2026-085D — Recon as a Service](https://www.shuffle-on.com/threat-intel/ti-2026-085d-recon-as-a-service)
- [TI-2026-085E — The Mask Beneath the Mask](https://www.shuffle-on.com/threat-intel/ti-2026-085e-the-mask-beneath-the-mask)
- [TI-2026-085F — The Nameless](https://www.shuffle-on.com/threat-intel/ti-2026-085f-the-nameless)

### TI-2026-086  (26)
- [TI-2026-086A — The Wardrobe Rack](https://www.shuffle-on.com/threat-intel/ti-2026-086a-the-wardrobe-rack)
- [TI-2026-086B — The Flagship Mask](https://www.shuffle-on.com/threat-intel/ti-2026-086b-the-flagship-mask)
- [TI-2026-086C — The Archivists Coat](https://www.shuffle-on.com/threat-intel/ti-2026-086c-the-archivists-coat)
- [TI-2026-086D — The Eastern Crawlers](https://www.shuffle-on.com/threat-intel/ti-2026-086d-the-eastern-crawlers)
- [TI-2026-086E — The Newest Trust](https://www.shuffle-on.com/threat-intel/ti-2026-086e-the-newest-trust)
- [TI-2026-086F — The Social Unfurlers](https://www.shuffle-on.com/threat-intel/ti-2026-086f-the-social-unfurlers)
- [TI-2026-086G — The Wardrobe in Motion](https://www.shuffle-on.com/threat-intel/ti-2026-086g-the-wardrobe-in-motion)
- [TI-2026-086H — The Landlords](https://www.shuffle-on.com/threat-intel/ti-2026-086h-the-landlords)
- [TI-2026-086I — The Costume Fits the Crime](https://www.shuffle-on.com/threat-intel/ti-2026-086i-the-costume-fits-the-crime)
- [TI-2026-086J — The Same Hand](https://www.shuffle-on.com/threat-intel/ti-2026-086j-the-same-hand)
- [TI-2026-086K — The Mask that Convicts](https://www.shuffle-on.com/threat-intel/ti-2026-086k-the-mask-that-convicts)
- [TI-2026-086L — The Verifiers Dilemma](https://www.shuffle-on.com/threat-intel/ti-2026-086l-the-verifiers-dilemma)
- [TI-2026-086M — The Operators Behind the Rack](https://www.shuffle-on.com/threat-intel/ti-2026-086m-the-operators-behind-the-rack)
- [TI-2026-086N — The Long Con](https://www.shuffle-on.com/threat-intel/ti-2026-086n-the-long-con)
- [TI-2026-086O — The Bystander Cloud](https://www.shuffle-on.com/threat-intel/ti-2026-086o-the-bystander-cloud)
- [TI-2026-086P — The Two Hundred Mask](https://www.shuffle-on.com/threat-intel/ti-2026-086p-the-two-hundred-mask)
- [TI-2026-086Q — The Robots Txt Tell](https://www.shuffle-on.com/threat-intel/ti-2026-086q-the-robots-txt-tell)
- [TI-2026-086R — The Wordlist as a Blueprint](https://www.shuffle-on.com/threat-intel/ti-2026-086r-the-wordlist-as-a-blueprint)
- [TI-2026-086S — The Rhythm](https://www.shuffle-on.com/threat-intel/ti-2026-086s-the-rhythm)
- [TI-2026-086T — The Estate Map](https://www.shuffle-on.com/threat-intel/ti-2026-086t-the-estate-map)
- [TI-2026-086U — The Corroborators](https://www.shuffle-on.com/threat-intel/ti-2026-086u-the-corroborators)
- [TI-2026-086V — The Ones that Passed](https://www.shuffle-on.com/threat-intel/ti-2026-086v-the-ones-that-passed)
- [TI-2026-086W — The Semantic Layer](https://www.shuffle-on.com/threat-intel/ti-2026-086w-the-semantic-layer)
- [TI-2026-086X — The Economics of a Face](https://www.shuffle-on.com/threat-intel/ti-2026-086x-the-economics-of-a-face)
- [TI-2026-086Y — The Next Rung](https://www.shuffle-on.com/threat-intel/ti-2026-086y-the-next-rung)
- [TI-2026-086Z — The Identity Layer](https://www.shuffle-on.com/threat-intel/ti-2026-086z-the-identity-layer)

### TI-2026-087  (10)
- [TI-2026-087A — The Scp Drop](https://www.shuffle-on.com/threat-intel/ti-2026-087a-the-scp-drop)
- [TI-2026-087B — The Self Made Botnet](https://www.shuffle-on.com/threat-intel/ti-2026-087b-the-self-made-botnet)
- [TI-2026-087C — The Channel](https://www.shuffle-on.com/threat-intel/ti-2026-087c-the-channel)
- [TI-2026-087D — One Key Six Names](https://www.shuffle-on.com/threat-intel/ti-2026-087d-one-key-six-names)
- [TI-2026-087E — The Dispossessed](https://www.shuffle-on.com/threat-intel/ti-2026-087e-the-dispossessed)
- [TI-2026-087F — The Kill List](https://www.shuffle-on.com/threat-intel/ti-2026-087f-the-kill-list)
- [TI-2026-087G — The Countermeasure](https://www.shuffle-on.com/threat-intel/ti-2026-087g-the-countermeasure)
- [TI-2026-087H — The Other Tenant](https://www.shuffle-on.com/threat-intel/ti-2026-087h-the-other-tenant)
- [TI-2026-087I — The Lineage](https://www.shuffle-on.com/threat-intel/ti-2026-087i-the-lineage)
- [TI-2026-087J — The Crossroads](https://www.shuffle-on.com/threat-intel/ti-2026-087j-the-crossroads)

### TI-2026-088  (15)
- [TI-2026-088 — The Dmzhost Trinity](https://www.shuffle-on.com/threat-intel/ti-2026-088-the-dmzhost-trinity)
- [TI-2026-088B — The Fourth Prefix](https://www.shuffle-on.com/threat-intel/ti-2026-088b-the-fourth-prefix)
- [TI-2026-088C — The Bunea Sponsor](https://www.shuffle-on.com/threat-intel/ti-2026-088c-the-bunea-sponsor)
- [TI-2026-088D — The Tenant](https://www.shuffle-on.com/threat-intel/ti-2026-088d-the-tenant)
- [TI-2026-088E — The Empty Arsenal](https://www.shuffle-on.com/threat-intel/ti-2026-088e-the-empty-arsenal)
- [TI-2026-088F — The Dual Origin Prefix](https://www.shuffle-on.com/threat-intel/ti-2026-088f-the-dual-origin-prefix)
- [TI-2026-088G — Jingle Shells](https://www.shuffle-on.com/threat-intel/ti-2026-088g-jingle-shells)
- [TI-2026-088H — The Adjacent Operator](https://www.shuffle-on.com/threat-intel/ti-2026-088h-the-adjacent-operator)
- [TI-2026-088I — Jurisdictional Arbitrage](https://www.shuffle-on.com/threat-intel/ti-2026-088i-jurisdictional-arbitrage)
- [TI-2026-088J — The Directors](https://www.shuffle-on.com/threat-intel/ti-2026-088j-the-directors)
- [TI-2026-088K — The Arsenal on the Floor](https://www.shuffle-on.com/threat-intel/ti-2026-088k-the-arsenal-on-the-floor)
- [TI-2026-088L — The Tenants Second Floor](https://www.shuffle-on.com/threat-intel/ti-2026-088l-the-tenants-second-floor)
- [TI-2026-088M — The Enabler](https://www.shuffle-on.com/threat-intel/ti-2026-088m-the-enabler)
- [TI-2026-088N — The Full Brood](https://www.shuffle-on.com/threat-intel/ti-2026-088n-the-full-brood)
- [TI-2026-088O — Closing the Census](https://www.shuffle-on.com/threat-intel/ti-2026-088o-closing-the-census)

### TI-2026-089  (9)
- [TI-2026-089A — The Ladder](https://www.shuffle-on.com/threat-intel/ti-2026-089a-the-ladder)
- [TI-2026-089B — The Repeat Offenders](https://www.shuffle-on.com/threat-intel/ti-2026-089b-the-repeat-offenders)
- [TI-2026-089C — The Familiar Faces](https://www.shuffle-on.com/threat-intel/ti-2026-089c-the-familiar-faces)
- [TI-2026-089D — The Subnet Verdict](https://www.shuffle-on.com/threat-intel/ti-2026-089d-the-subnet-verdict)
- [TI-2026-089E — The Cloud Recidivists](https://www.shuffle-on.com/threat-intel/ti-2026-089e-the-cloud-recidivists)
- [TI-2026-089F — The Supply Underneath](https://www.shuffle-on.com/threat-intel/ti-2026-089f-the-supply-underneath)
- [TI-2026-089G — The First New Address](https://www.shuffle-on.com/threat-intel/ti-2026-089g-the-first-new-address)
- [TI-2026-089H — The Vanishing Majority](https://www.shuffle-on.com/threat-intel/ti-2026-089h-the-vanishing-majority)
- [TI-2026-089I — The Counterfeit Crawlers](https://www.shuffle-on.com/threat-intel/ti-2026-089i-the-counterfeit-crawlers)

### TI-2026-090  (4)
- [TI-2026-090A — One Binary Many Masks](https://www.shuffle-on.com/threat-intel/ti-2026-090a-one-binary-many-masks)
- [TI-2026-090B — Two Miners No Wallet](https://www.shuffle-on.com/threat-intel/ti-2026-090b-two-miners-no-wallet)
- [TI-2026-090C — Half the Honeypot](https://www.shuffle-on.com/threat-intel/ti-2026-090c-half-the-honeypot)
- [TI-2026-090D — The Widest Net](https://www.shuffle-on.com/threat-intel/ti-2026-090d-the-widest-net)

### TI-2026-091  (4)
- [TI-2026-091A — The Skeleton Key](https://www.shuffle-on.com/threat-intel/ti-2026-091a-the-skeleton-key)
- [TI-2026-091B — The Eviction](https://www.shuffle-on.com/threat-intel/ti-2026-091b-the-eviction)
- [TI-2026-091C — The Immutable Lock](https://www.shuffle-on.com/threat-intel/ti-2026-091c-the-immutable-lock)
- [TI-2026-091D — The Harvest](https://www.shuffle-on.com/threat-intel/ti-2026-091d-the-harvest)

### TI-2026-092  (4)
- [TI-2026-092A — Try Them All](https://www.shuffle-on.com/threat-intel/ti-2026-092a-try-them-all)
- [TI-2026-092B — The Same Server the Wrong Binary](https://www.shuffle-on.com/threat-intel/ti-2026-092b-the-same-server-the-wrong-binary)
- [TI-2026-092C — The Neighborhood](https://www.shuffle-on.com/threat-intel/ti-2026-092c-the-neighborhood)
- [TI-2026-092D — The Arch Oracle](https://www.shuffle-on.com/threat-intel/ti-2026-092d-the-arch-oracle)

### TI-2026-093  (4)
- [TI-2026-093A — The Staged Sweeps](https://www.shuffle-on.com/threat-intel/ti-2026-093a-the-staged-sweeps)
- [TI-2026-093B — Fingerprint Without a Face](https://www.shuffle-on.com/threat-intel/ti-2026-093b-fingerprint-without-a-face)
- [TI-2026-093C — Profiling the Prey](https://www.shuffle-on.com/threat-intel/ti-2026-093c-profiling-the-prey)
- [TI-2026-093D — The Final Accounting](https://www.shuffle-on.com/threat-intel/ti-2026-093d-the-final-accounting)

### TI-2026-094  (4)
- [TI-2026-094A — The Named Trap](https://www.shuffle-on.com/threat-intel/ti-2026-094a-the-named-trap)
- [TI-2026-094B — The Emulation Test](https://www.shuffle-on.com/threat-intel/ti-2026-094b-the-emulation-test)
- [TI-2026-094C — The Empty Room](https://www.shuffle-on.com/threat-intel/ti-2026-094c-the-empty-room)
- [TI-2026-094D — The Arms Race](https://www.shuffle-on.com/threat-intel/ti-2026-094d-the-arms-race)

### TI-2026-095  (8)
- [TI-2026-095A — The Dev Tcp Dropper](https://www.shuffle-on.com/threat-intel/ti-2026-095a-the-dev-tcp-dropper)
- [TI-2026-095B — The Tunnel Scout](https://www.shuffle-on.com/threat-intel/ti-2026-095b-the-tunnel-scout)
- [TI-2026-095C — The Weaponizers](https://www.shuffle-on.com/threat-intel/ti-2026-095c-the-weaponizers)
- [TI-2026-095D — The Equifax Ghost](https://www.shuffle-on.com/threat-intel/ti-2026-095d-the-equifax-ghost)
- [TI-2026-095E — The Config Vultures](https://www.shuffle-on.com/threat-intel/ti-2026-095e-the-config-vultures)
- [TI-2026-095F — The Roll Call](https://www.shuffle-on.com/threat-intel/ti-2026-095f-the-roll-call)
- [TI-2026-095G — The Siege](https://www.shuffle-on.com/threat-intel/ti-2026-095g-the-siege)
- [TI-2026-095H — The Seven](https://www.shuffle-on.com/threat-intel/ti-2026-095h-the-seven)

### TI-2026-096 — The Unannounced  (7)
- [TI-2026-096A — The Dark Census](https://www.shuffle-on.com/threat-intel/ti-2026-096a-the-dark-census)
- [TI-2026-096B — The Contrust Accumulator](https://www.shuffle-on.com/threat-intel/ti-2026-096b-the-contrust-accumulator)
- [TI-2026-096C — The Retail Floor](https://www.shuffle-on.com/threat-intel/ti-2026-096c-the-retail-floor)
- [TI-2026-096D — Change of Hands](https://www.shuffle-on.com/threat-intel/ti-2026-096d-change-of-hands)
- [TI-2026-096E — Putting on a Face](https://www.shuffle-on.com/threat-intel/ti-2026-096e-putting-on-a-face)
- [TI-2026-096F — The Ledger of Change](https://www.shuffle-on.com/threat-intel/ti-2026-096f-the-ledger-of-change)
- [TI-2026-096G — Running the Carousel Down](https://www.shuffle-on.com/threat-intel/ti-2026-096g-running-the-carousel-down)

### TI-2026-097 — Reading the Drop  (3)
- [TI-2026-097A — Count is a Lie](https://www.shuffle-on.com/threat-intel/ti-2026-097a-count-is-a-lie)
- [TI-2026-097B — The Signed Worm](https://www.shuffle-on.com/threat-intel/ti-2026-097b-the-signed-worm)
- [TI-2026-097C — One Binary Per Cpu](https://www.shuffle-on.com/threat-intel/ti-2026-097c-one-binary-per-cpu)

### TI-2026-098 — Counter-Recon  (2)
- [TI-2026-098 — Who Scans the Scanners](https://www.shuffle-on.com/threat-intel/ti-2026-098-who-scans-the-scanners)
- [TI-2026-098B — The Machinery of the Scan Back](https://www.shuffle-on.com/threat-intel/ti-2026-098b-the-machinery-of-the-scan-back)

### TI-2026-099  (1)
- [TI-2026-099 — The Complaint Department](https://www.shuffle-on.com/threat-intel/ti-2026-099-the-complaint-department)