Real-time global intelligence

© 2026 OpenWatch. All rights reserved.

For informational and entertainment purposes only. Not investment advice.

Platform

Brief
Signals
Cascade
Trajectories
Wagers
Track Record
Countries
Companies
Industries
Themes
Rankings

Tools

Globe
Analytics
Crises
Clusters
Supply Chain
Alliances
Screener
Watchlist
Portfolio

Developer

Status

Sources

View all sources →

1,000+ tracked sources

Signals updated every 15 minutes

Not investment advice. OpenWatch is provided for informational and entertainment purposes only. While we strive for accuracy, precision, and source attribution in all intelligence assessments, geopolitical analysis involves inherent uncertainty and our conclusions may be incomplete, delayed, or incorrect. Nothing on this platform constitutes financial, investment, legal, or professional advice of any kind. Forward-looking scenarios and probability estimates are analytical hypotheses — not independently validated forecasts. Any actions taken based on information found here are solely your responsibility. Always consult a qualified financial advisor before making investment decisions. Past signal patterns do not guarantee future outcomes.

Methodology
Privacy Policy
Terms of Use

openwatch.io

v·b5fbd6e

Search

Congressional trades, bills, prediction markets, hearings, and intelligence signals. Signal search supports: AND OR "exact phrase" -exclude

Keywords

Threat Layer

Military Cyber Economic Disaster Political Criminal Health Supply Chain

Signal Type

Any Crisis Update Resolution

Region

Country

Min. Severity

Any ≥ 3 ≥ 5 ≥ 7 ≥ 9

Date Range

Clear all filters

Sort by

Severity Newest

↓Export CSV (requires API key)

Themes:🧠AI Chip Bottleneck 🛡US Defense Surge ⚓Shipping Lane Fragmentation 🔌Taiwan Semiconductor Risk

227 signals for Cyber+Military · Mali

Page 4 of 10

MilitaryUpdate🇲🇱Mali41d ago

Mali issued threats in Markala [3 sources]

6.5/10

·

GDELT Events Historical

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇲🇱Mali45d ago

CISA has issued an alert after attackers compromised two versions of the widely-used Axios npm package on March 31, 2026, injecting a malicious dependency that downloads a remote access trojan — urging developers and organizations to downgrade, rotate credentials, and audit any pipelines that ran the affected versions.

6.5/10·CISA Current Activity·Mali

Primary Source ↗Details →

MilitaryUpdate🇲🇱Mali34d ago

Mali assaulted Rebel in Bamako [10 sources]

6.3/10·GDELT Events Historical·Bamako

Primary Source ↗Details →

MilitaryCrisis🇺🇸United States 🇮🇷Iran 🇲🇱Mali8d ago

U.S. military strikes on an Iranian military site have escalated U.S.-Iran tensions and driven oil prices up roughly 2%. Analysts caution that even if a diplomatic deal is reached, restoring normal shipping through the Strait of Hormuz could take months, creating sustained pressure on global energy markets.

6.2/10·Economic Times·Strait Of Hormuz

Primary Source ↗Details →

CyberCrisis🇧🇷Brazil 🇲🇱Mali35d ago

KrebsOnSecurity reported that a Brazilian cybersecurity firm specializing in DDoS protection has been compromised and used to launch botnet-powered distributed denial-of-service attacks against rival network operators in Brazil. The company's CEO attributed the malicious activity to a security breach, claiming a competitor may have infiltrated their systems to damage their reputation.

6.2/10·Krebs on Security·Mali

Primary Source ↗Details →

MilitaryCrisis🇮🇷Iran 🇮🇱Israel 🇲🇱Maliyesterday

Iran’s Supreme Leader Ayatollah Mojtaba Khamenei said on Thursday that his country’s adversaries had turned to “hybrid warfare”, aimed at creating divisions among Iranians, after receiving a “decisive blow”. Mojtaba, who has not appeared publicly since being named as the supreme leader on March 8, made these remarks in his message on the death anniversary of Iran’s founder, Ayatollah Ruhollah Khomeini. The message shared on his official X account and reported by the Iranian media .

6.1/10·Dawn (Pakistan)

Primary Source ↗Details →

MilitaryCrisis🇲🇱Mali 🇺🇦Ukraine 🇷🇺Russia7d ago

# Two Russian Officers Killed in Mali Two Russian officers were killed in Mali on April 25 when a Mi-8 helicopter was shot down in Gao province, according to the KIU ✪ Russian Officers killed in Ukraine project, which tracks deaths of Russian officers. The deceased are Major Andrey Vasilyevich Kondratyev and Captain Dmitry Alexandrovich Lobanov. OSINT researcher Necro Mancer discovered a message about Lobanov's funeral on his sister's VKontakte page.

6.1/10·The Insider Russia

Primary Source ↗Details →

CyberCrisis🇯🇵Japan 🇲🇱Mali10d ago

Written by: Takahiro Sugiyama, Peter Revelant, Mathew Potaczek Introduction In late 2025, Mandiant responded to a security incident involving a compromised web server running KnowledgeDeliver . KnowledgeDeliver is a Learning Management System (LMS) developed by Digital Knowledge commonly used in Japan. Mandiant identified a critical vulnerability that allowed unauthenticated Remote Code Execution (RCE).

6.1/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberCrisis🇲🇱Mali17d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info acl--ACL Analytics ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers to execute arbitrary commands by leveraging the EXECUTE function. Attackers can use bitsadmin to download malicious PowerShell scripts and execute them with system privileges to establish reverse shells and gain complete system control. 2026-05-17 9.8 CVE-2018-25320 ExploitDB-44281 Official Product Homepage Product Reference VulnCheck Advisory: ACL Analytics 11.x - 13.0.0.579 Arbitrary Code Execution   gitbucket--GitBucket GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality.

6.1/10·US-CERT Bulletins·Mali

Primary Source ↗Details →

MilitaryCrisis🇮🇷Iran 🇦🇪United Arab Emirates 🇲🇱Mali20d ago

Abu Dhabi says Iran launched 3,000 missiles and drones at UAE The Ministry of Foreign Affairs of the United Arab Emirates reaffirmed the United Arab Emirates’s “firm approach based on supporting the security and stability of the region” while condemning “in the strongest terms the Iranian attacks and threats that targeted the state and the countries of the region”. In a statement, the ministry accused Iran of launching “approximately 3,000 ballistic missiles, cruise missiles, and drones toward the United Arab Emirates”, saying the strikes “resulted in deaths and injuries among civilians in addition to damage caused to civil infrastructure”. The UAE described the attacks as a “clear violation of the sovereignty of states and a direct threat to the security and stability of the region”, adding that all defensive measures were “aimed at protecting its sovereignty, civilians, and critical infrastructure”.

6.1/10·Middle East Eye·Mali

Primary Source ↗Details →

MilitaryCrisis🇲🇱Mali 🇷🇺Russia20d ago

Army supported by Russian mercenaries launches airstrikes after offensive by coalition of Islamist extremists and Tuareg separatists Mali’s armed forces, supported by Russian mercenaries, have launched airstrikes targeting a rebel alliance of Islamist extremists and Tuareg separatists as the ruling junta struggles to maintain its hold on power in the unstable west African country. Earlier this week warplanes targeted the key northern town of Kidal, which was lost when the rebels launched a surprise offensive across much of Mali in late April. Continue reading...

6.1/10·The Guardian·Mali

Primary Source ↗Details →

CyberCrisis🇦🇺Australia 🇲🇱Mali20d ago

Written by: Austin Larsen, Tyler McLellan, Genevieve Stark, Dan Ebreo Introduction Google Threat Intelligence Group (GTIG) has continued to track an expansive extortion campaign by UNC6671, a threat actor operating under the "BlackFile" brand, that targets organizations via sophisticated voice phishing (vishing) and single sign-on (SSO) compromise. By leveraging adversary-in-the-middle (AiTM) techniques to bypass traditional perimeter defenses and multi-factor authentication (MFA), UNC6671 gains deep access to cloud environments. The group primarily targets Microsoft 365 and Okta infrastructure, leveraging Python and PowerShell scripts to programmatically exfiltrate sensitive corporate data for subsequent extortion attempts.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇲🇱Mali42d ago

Written by: JP Glab, Tufail Ahmed, Josh Kelley, Muhammad Umair Introduction Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group, UNC6692, that leveraged persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to achieve deep network penetration. As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT helpdesk employees, convincing their victim to accept a Microsoft Teams chat invitation from an account outside their organization. The UNC6692 campaign demonstrates an interesting evolution in tactics, particularly the use of social engineering, custom malware, and a malicious browser extension, playing on the victim’s inherent trust in several different enterprise software providers.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇫🇷France 🇲🇱Mali45d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info Grafana--Pyroscope Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API.

6.1/10·US-CERT Bulletins·Mali

Primary Source ↗Details →

CyberCrisis🇲🇱Mali 🇵🇪Peru63d ago

Written by: Stuart Carrera Introduction Building on recent BRICKSTORM research from Google Threat Intelligence Group (GTIG), this post explores the evolving threats facing virtualized environments. These operations directly target the VMware vSphere ecosystem, specifically the vCenter Server Appliance (VCSA) and ESXi hypervisors. To help organizations stay ahead of these risks, we will focus on the essential hardening strategies and mitigating controls necessary to secure these critical assets.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇰🇵North Korea 🇲🇱Mali73d ago

Every year, the cyber threat landscape forces defenders to adapt to evolving adversary tactics, techniques, and procedures (TTPs). In 2025, Mandiant observed a clear divergence in adversary pacing that closely aligns with the trends we have been documenting for defenders over the past year. On one end of the spectrum, cyber criminal groups optimized for immediate impact and deliberate recovery denial.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇸🇦Saudi Arabia 🇹🇷Turkey 🇲🇾Malaysia+378d ago

Introduction Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword. Since at least November 2025, GTIG has observed multiple commercial surveillance vendors and suspected state-sponsored actors utilizing DarkSword in distinct campaigns.

6.1/10·Mandiant Threat Intelligence·Coruna

Primary Source ↗Details →

CyberCrisis🇲🇱Mali80d ago

Written by: Bavi Sadayappan, Zach Riddle, Ioana Teaca, Kimberly Goody, Genevieve Stark Introduction Since 2018, when many financially motivated threat actors began shifting their monetization strategy to post-compromise ransomware deployments, ransomware has become one of the most pervasive threats to organizations across almost every industry vertical and region. In recent years ransomware operations have evolved, creating a robust ecosystem that has lowered the barrier to entry via the commoditization and specialization of the supporting underground communities, which is exemplified by the proliferation of the ransomware-as-a-service (RaaS) business model. While ransomware remains a dominant threat due to the volume of activity and the potential for serious operational disruptions, we have observed multiple indicators that suggest the overall profitability of ransomware operations is in decline.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇲🇱Mali90d ago

Written by: Matthew McWhirt, Bhavesh Dhake, Emilio Oropeza, Gautam Krishnan, Stuart Carrera, Greg Blaum, Michael Rudden UPDATE (March 13): Added guidance around abuse or misuse of endpoint / MDM platforms . Background Threat actors leverage destructive malware to destroy data, eliminate evidence of malicious activity, or manipulate systems in a way that renders them inoperable. Destructive cyberattacks can be a powerful means to achieve strategic or tactical objectives; however, the risk of reprisal is likely to limit the frequency of use to very select incidents.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇨🇳China 🇰🇵North Korea 🇲🇱Mali+191d ago

Written by: Casey Charrier, James Sadowski, Zander Work, Clement Lecigne, Benoît Sevens, Fred Plan Executive Summary Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities exploited in-the-wild in 2025. Although that volume of zero-days is lower than the record high observed in 2023 (100), it is higher than 2024’s count (78) and remained within the 60–100 range established over the previous four years, indicating a trend toward stabilization at these levels. In 2025, we continued to observe the structural shift, first identified in 2024, toward increased enterprise exploitation.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇨🇳China 🇲🇱Mali99d ago

Introduction Last week, Google Threat Intelligence Group (GTIG), Mandiant, and partners took action to disrupt a global espionage campaign targeting telecommunications and government organizations in dozens of nations across four continents. The threat actor, UNC2814, is a suspected People's Republic of China (PRC)-nexus cyber espionage group that GTIG has tracked since 2017. This prolific, elusive actor has a long history of targeting international governments and global telecommunications organizations across Africa, Asia, and the Americas and had confirmed intrusions in 42 countries when the disruption was executed.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇲🇱Mali 🇲🇽Mexico115d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info Insaat--Fikir Odalari AdminPando A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password parameters are vulnerable to SQL injection, allowing unauthenticated attackers to bypass authentication completely. Successful exploitation grants full administrative access to the application, including the ability to manipulate the public-facing website content (HTML/DOM manipulation).

6.1/10·US-CERT Bulletins·Mali

Primary Source ↗Details →

CyberCrisis🇲🇱Mali125d ago

Introduction Mandiant is tracking a significant expansion and escalation in the operations of threat clusters associated with ShinyHunters-branded extortion. As detailed in our companion report, 'Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft' , these campaigns leverage evolved voice phishing (vishing) and victim-branded credential harvesting to successfully compromise single sign-on (SSO) credentials and enroll unauthorized devices into victim multi-factor authentication (MFA) solutions. This activity is not the result of a security vulnerability in vendors' products or infrastructure.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇲🇱Mali 🇺🇸United States125d ago

Introduction Mandiant has identified an expansion in threat activity that uses tactics, techniques, and procedures (TTPs) consistent with prior ShinyHunters-branded extortion operations. These operations primarily leverage sophisticated voice phishing (vishing) and victim-branded credential harvesting sites to gain initial access to corporate environments by obtaining single sign-on (SSO) credentials and multi-factor authentication (MFA) codes. Once inside, the threat actors target cloud-based software-as-a-service (SaaS) applications to exfiltrate sensitive data and internal communications for use in subsequent extortion demands.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇦🇼AW 🇮🇹Italy 🇯🇵Japan+3135d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info 10-Strike--Strike Network Inventory Explorer Pro 10-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functionality that allows remote code execution. Attackers can craft a malicious text file with carefully constructed payload to trigger a reverse shell and execute arbitrary code on the target system. 2026-01-15 9.8 CVE-2021-47772 ExploitDB-50472 Vendor Homepage   10-Strike--Strike Network Inventory Explorer Pro 10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem privileges.

6.1/10·US-CERT Bulletins·Mali

Primary Source ↗Details →