Threat Level: ELEVATED
Current Status: ELEVATED
As of January 30, 2026, 10:48 AM CST, DugganUSA is reporting the global threat level as ELEVATED.
This is not normal. Here's why.
What "Elevated" Means
We track threat levels on a three-tier scale:
| Level | Definition | What You Should Do |
| NORMAL | Background noise. Commodity scanners, opportunistic phishing, script kiddies. | Standard monitoring |
| ELEVATED | Nation-state activity above baseline. Active zero-days. Coordinated campaigns. | Increased vigilance, IOC blocking, patch prioritization |
| CRITICAL | Active mass exploitation. Wormable vulnerabilities. Infrastructure-level attacks. | All hands on deck |
ELEVATED means the professionals are working. Not the amateurs.
The Data (As of This Morning)
Active C2 Infrastructure
| Framework | Instances | Primary Geos |
| Empire/PowerShell | 224 | US, CN |
| Covenant | 108 | MX, CN, HK, SG, JP |
| Mythic | 14 | US, JP |
| Cobalt Strike | 12 | FI, CA, PL, DE, US, FR |
358 active command-and-control instances across four major frameworks. This is coordinated infrastructure, not random noise.
Malware Families in the Wild
| Family | Active IOCs | Geography |
| Emotet | 240 | US, DE, CA |
| Mythic C2 | 108 | Multi-region |
| AsyncRAT | 12 | FI, CA, PL, DE, US, FR |
Emotet—the malware that "died" in 2021—has 240 active indicators. It never left.
Nation-State Activity
| Group | IOCs | Confidence | Origin |
| APT41 (Double Dragon) | 21 | 94% | China |
APT41 is active. This is a Chinese state-sponsored group that conducts both espionage and financially-motivated attacks. When APT41 is working, the threat level is not normal.
Today's BDE Scores
Our automated Oz system published 14 threat intelligence pulses today. Average BDE (Big Data Energy) score: 80-85.
- BDE 70-79: Normal activity
- BDE 80-89: Elevated activity
- BDE 90+: Critical activity
We're running hot.
Why This Matters to You
1. Zero-Days Are Being Exploited
- CVSS: 10.0
- Patch: None available
- Status: Actively exploited by UAT-9686 (China-nexus)
If you run Cisco Secure Email Gateway, you are currently unpatched against a maximum-severity vulnerability that nation-state actors are actively exploiting.
2. Cloud Infrastructure Is the New Battleground
Today's fresh phishing uses your trusted platforms:
| Platform | Being Abused For |
| GitHub Pages | Amazon clone phishing |
| Gitbook | DeFi wallet theft |
| AWS S3 | Credential harvesting |
| Backblaze B2 | Brazilian banking fraud |
| Cloudflare R2 | Generic phishing |
Attackers aren't hosting on sketchy servers anymore. They're hosting on the same platforms you trust.
3. The Typhoon Family Is Pre-Positioning
Chinese APT groups (Volt Typhoon, Salt Typhoon, Flax Typhoon, Brass Typhoon) are actively pre-positioning in critical infrastructure:
- Volt Typhoon: US utilities, communications, transportation
- Salt Typhoon: Telecom interception (T-Mobile, AT&T, Verizon compromised)
- Flax Typhoon: IoT botnet operations
- Brass Typhoon: Southeast Asia espionage
Pre-positioning means: compromise now, activate later. The access is the objective.
4. Novel TTPs Are Emerging
DPRK actors are now using blockchain-based C2 (EtherRAT):
- C2 addresses stored in Ethereum smart contracts
- Cannot be seized or taken down
- Updates on-chain, no infrastructure to block
- Consensus voting prevents researcher poisoning
This is the first widespread use of blockchain C2 in the wild. The tradecraft is evolving.
What You Should Do
Immediate Actions
- Block our IOCs
- Patch Cisco AsyncOS (when available)
- Hunt for Living-off-the-Land
- Review cloud trust
Ongoing Vigilance
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
- Subscribe to threat feeds (ours is free)
- Monitor for unusual Ethereum RPC traffic from servers
- Watch CISA KEV catalog for new additions
- Assume nation-state actors are already in networks you trust
The Comparison
Normal Day
- Commodity scanners probing ports
- Opportunistic phishing with obvious tells
- Script kiddies running Shodan queries
- BDE scores: 70-75
Today (Elevated)
- 358 active C2 instances across 4 frameworks
- APT41 at 94% confidence
- Unpatched CVSS 10.0 being actively exploited
- Novel blockchain C2 in production
- Cloud platforms weaponized at scale
- BDE scores: 80-85
The difference isn't volume. It's sophistication.
How We Determine Threat Level
Our assessment combines:
- Automated analysis (Butterbot Jr)
- Manual correlation (Butterbot Sr)
- Infrastructure telemetry
When both automated and manual analysis agree, we publish.
Today, they agree: ELEVATED.
The Feed
All IOCs backing this assessment are available free:
STIX 2.1 Feed
``
https://analytics.dugganusa.com/api/v1/stix-feed
``
OTX Profile
``
https://otx.alienvault.com/user/pduggusa
``
- 52,482 IOCs indexed
- 40 countries consuming
- 78 OTX subscribers
- Updated continuously
Summary
| Indicator | Status |
| Threat Level | ELEVATED |
| Nation-State Activity | Above baseline (APT41, Typhoon family) |
| Active Zero-Days | CVE-2025-20393 (CVSS 10.0, no patch) |
| Novel TTPs | Blockchain C2 (EtherRAT) |
| Cloud Abuse | GitHub Pages, S3, R2, Backblaze weaponized |
| Recommended Posture | Increased vigilance, active IOC blocking |
The professionals are working. Your defenses should be too.
Patrick Duggan is founder of DugganUSA LLC, a Minnesota-based threat intelligence operation. He publishes threat levels because defenders deserve to know when to pay closer attention.
Questions? [email protected]
Get the IOCs
- STIX Feed: https://analytics.dugganusa.com/api/v1/stix-feed
- OTX: https://otx.alienvault.com/user/pduggusa
- Blog: https://www.dugganusa.com
TLP:WHITE - Share freely.
Her name was Renee Nicole Good.
His name was Alex Jeffery Pretti.
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Look up an IOC → · Audit your brand on AIPM → · See pricing →
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=threat-level-elevated