We correct errors of fact, attribution, dating and sourcing. Each correction is listed here with the article it affects, what was wrong, what we changed and the date of the change. The corrected article carries a note at the point of the change.
Clarifications that do not change a fact, and routine updates to living actor profiles, are recorded in the article or profile's own version history rather than here.
Reporting an error
Write to legal @ threatintelreport.com with the article's address, the statement you believe is wrong and, where you can, a source that shows the correct position. Please do not send personal data about third parties or material that is not public.
Corrections log
29 October 2026 — UEFI coverage scope
Our initial EDK II PXE article addressed a vulnerability when the intended subject was UEFI rootkits. We have retained that vulnerability article as supplementary coverage and published a separate rootkit investigation. The new investigation distinguishes firmware implants from disk-resident bootkits and separates the source-specific actor assessments; it does not attribute the recent BlackX activity to APT28. The original page carries a clarification and a link to the investigation.