An immutable selection snapshot: original publication dates remain attached to each source record.
Materially reviewed · Curated reference
A record of the selected publication state, not a complete history of events on this day. Multiple snapshots on one date reflect material selection or annotation changes.
Microsoft Defender Security Research Team · Original publication: (timestamp supplied by publisher) Publisher update: 2026-05-18T22:42:53+00:00 First collected: 2026-10-22T19:50:55+00:00 · Last successful check: 2026-10-22T19:50:55+00:00 Record: ms-storm-2949-cloud-breach-2026 · Editorial review: 2026-10-22
Microsoft reports cleanup of local forensic artifacts in a cloud-to-endpoint intrusion. Preserve the distinction between endpoint history and cloud audit coverage, and trace credential context through the available identity records before naming a person.
Evidence reference: clearing Windows event logs. Reviewed original report; locate the quoted phrase in context.
Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.
Mandiant / Google Cloud · Original publication: (day precision; time and zone unknown) Publisher update: No full update timestamp supplied First collected: 2026-10-22T19:50:55+00:00 · Last successful check: 2026-10-22T19:50:55+00:00 Record: mandiant-unc3886-esxi-logging-2023 · Editorial review: 2026-10-22
Mandiant explicitly describes investigative challenges from disabled or altered logging and guest operations without default guest logs. Treat hypervisor, guest, and central logging as separate coverage questions and preserve surviving sources with their collection limits.
Evidence reference: tamper with and disable logging services. Reviewed original report; locate the quoted phrase in context.
Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.
ESET Research / WeLiveSecurity · Original publication: (day precision; time and zone unknown) Publisher update: No full update timestamp supplied First collected: 2026-10-22T19:51:52+00:00 · Last successful check: 2026-10-22T19:51:52+00:00 Record: eset-industroyer2-caddywiper-2022 · Editorial review: 2026-10-22
ESET and CERT-UA investigated an energy-sector attack involving Industroyer2 and destructive malware. ESET distinguishes observed deployment from assessed purpose; examine surviving remote records and source collections without assuming every affected system or copy had the same outcome.
Evidence reference: erase Industroyer2 traces. Reviewed original report; locate the quoted phrase in context.
Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.
Microsoft Security · Original publication: (timestamp supplied by publisher) Publisher update: 2026-08-19T15:57:04+00:00 First collected: 2026-10-22T18:57:47+00:00 · Last successful check: 2026-10-22T18:57:47+00:00 Record: ms-destructive · Editorial review: 2026-10-22
Microsoft reports destructive effects on boot records and file content behind a ransom message. Evidence availability can be affected before collection; corroborate the reported behavior against preserved originals and independent records. This is a historical source, not a new incident alert.
Evidence reference: designed to be destructive. Opening assessment and Observed actor activity
Historical primary incident report; not a new incident. Page displays January 15, 2022; publisher machine-readable publication time is January 16, 2022 in UTC. Updated time is publisher metadata, not a new incident date.
Mandiant / Google Cloud · Original publication: (day precision; time and zone unknown) Publisher update: No full update timestamp supplied First collected: 2026-10-22T19:50:55+00:00 · Last successful check: 2026-10-22T19:50:55+00:00 Record: mandiant-russian-targeting-log-gaps-2021 · Editorial review: 2026-10-22
Mandiant reports stopped Sysmon and Splunk logging alongside cleared Windows events. The combination illustrates why source generation, forwarding health, retained central copies, and cloud identity records must be reviewed as separate evidence paths.
Evidence reference: cleared Windows Event Logs. Reviewed original report; locate the quoted phrase in context.
Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.
Microsoft Security · Original publication: (timestamp supplied by publisher) Publisher update: 2025-06-27T06:58:35+00:00 First collected: 2026-10-22T19:50:55+00:00 · Last successful check: 2026-10-22T19:50:55+00:00 Record: ms-human-operated-ransomware-2020 · Editorial review: 2026-10-22
Microsoft describes event-log clearing within observed human-operated ransomware activity. The investigative implication is to compare native endpoint channels with retained central copies and collection status; a gap by itself does not attribute an actor.
Evidence reference: the group clears event logs. Reviewed original report; locate the quoted phrase in context.
Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.
Original reports remain attributed to their publishers. Selection, classification and editorial annotations are by Anti-Forensics.com. Limited coverage and exclusion do not imply safety. Third-party articles are not mirrored.
