Threat Groups Share Suppliers. Scenario Models Assume They Do Not.
A takedown of shared offensive tooling shows that capability sits in the supply chain behind named groups, and that scenario models which simulate each group line independently understate the tail of the loss distribution.
The Register Copies the Catalogue’s Unit
MITRE ATT&CK organizes adversary knowledge around the named group. That is a defensible choice for a catalogue: analysts need a place to file what has been observed, and the group is the label under which observations accumulate. The problem starts when a threat model inherits that unit without noticing that it has done so.
A typical scenario model takes named groups or threat communities as separate lines. Each line gets its own threat event frequency range, its own threat capability rating, its own resistance strength assumption. Each is simulated on its own, and the simulated losses are summed to produce an annualized loss exposure. The structure looks diversified. Many lines, many draws, each a chance for a quiet year on one to offset a bad year on another. The arithmetic is clean and the independence assumption is never written down.
The takedown of 8 October 2026 makes the assumption visible. According to BleepingComputer, the FBI seized seven domains used to operate two hacking tools, MicroScan and FishHub, in activity tracked as Flax Typhoon. The infrastructure was allegedly run by a China-based cybersecurity company which US authorities say has contracts with the Chinese government. The FBI, CISA, the NSA and international partners issued a joint warning alongside the seizures. The Record reports that the document runs to 58 pages and covers tools used over the last six years, with agencies from Australia, Japan, the United Kingdom, Spain, New Zealand and Canada contributing. The FBI’s Cyber Division assistant director said the company “provided China-linked threat actors with capabilities”. The Record describes the company as “acquiring, selling or hosting tools used by several groups”. Investigators also found a custom web application that let third parties browse stolen email without direct access to the compromised accounts.
This is a supply relationship. One company, two tools, seven domains, several consuming groups, and a productized interface for the output. MITRE ATT&CK already has a place for it: the Resource Development tactic covers how adversaries obtain capabilities and infrastructure, and the sub-technique for obtaining tools is recorded for 81 of the 174 groups in the Enterprise dataset. Almost nobody reads that tactic when building a threat model. The model reads the group page instead.
The Dependence Is Already in the Data
The framework’s own records show the sharing. MITRE ATT&CK Enterprise, version 19.1, released 12 May 2026, contains 174 groups, 697 techniques and 821 software entries, of which 95 are classed as tools and 726 as malware. Of the 174 groups, 127 are recorded using at least one software entry also recorded for another group. 104 software entries are recorded for two or more groups, and 18 for ten or more. Mimikatz is recorded for 51 groups, PsExec for 38, Cobalt Strike for 30. These are records of public reporting, so they are a floor on shared tooling, not a measurement of it. Even as a floor, the picture is not one of independent actors building independent arsenals.
The modelling consequence is straightforward. When scenario lines share a capability supplier, an improvement at the supplier, a new exploit script added to the scanner for instance, raises contact frequency and effective capability for every consumer in the same period. Independent draws let a bad year on one line be offset by a quiet year on another. A shared driver removes that offset. The mean of the annualized loss exposure may move little. The upper percentiles rise, and a model that leaves the shared driver out understates the value at risk figure used for capital, insurance limits and risk appetite.
The fix is modest and does not require rebuilding the register. Sample a shared-capability factor once per Monte Carlo iteration and apply it to every scenario line that depends on the same supply chain, rather than sampling each line alone. The lines stay separate for narrative purposes. The simulation stops pretending their drivers are separate.
The criminal side shows the same structure. BleepingComputer reported on 7 October 2026 that the FBI warned attacks following the FortiBleed credential leak are still ongoing against internet-exposed firewalls and VPN gateways, and that “the FortiBleed attack chain has been observed as an initial entry point for ransomware affiliates”. An accidentally exposed backend server revealed scripts that validate credentials, filter honeypots, identify organizations and rank targets by revenue. SOCRadar, which linked the campaign to two ransomware operations, puts its latest count at 86,644 compromised devices. One operator’s credential pipeline, ranked target lists, and an entry point feeding more than one ransomware operation: the same supply logic, without a state anywhere in the description.
“Very High Capability” Is the Wrong Label for the Front Door
The scanner at the centre of the takedown is broad, not deep. BleepingComputer, citing the joint warning, describes MicroScan as a Python-based scanner with more than 1,300 penetration-testing scripts. The eight flaws it commonly targeted carry CVE identifiers from 2014 to 2023, and four of the eight are from 2016 or earlier. In model terms, vulnerability is the probability that threat capability exceeds resistance strength. For the contact and initial access stage, the capability being applied is wide and shallow: industrialized breadth against old, well-known flaws.
The resistance strength that matters at that stage is unglamorous. Patch state on old internet-facing software. Exposed services. Multi-factor authentication. These are also what the agencies recommended in the joint warning: patching, disabling unnecessary exposed services, enforcing multi-factor authentication. Against the flaws this scanner most commonly targeted, nothing exotic is required to raise resistance strength above the capability actually being applied at the door.
A single “very high” capability rating for the whole scenario line produces one of two failures. It produces fatalism, the sense that nothing can resist a state actor and therefore the front door is not worth spending on. Or it steers budget toward exotic controls that address a depth of capability which does not arrive until after a foothold exists. The better practice is to rate capability per stage of the scenario: industrialized breadth at the front door, real depth only after initial access. The takedown itself shows the split: MicroScan works the door, while FishHub was used for spear-phishing and also for delivering further malware to networks already compromised. Rating the whole line by its worst stage misprices every stage before it.
A Takedown Is Not a Step Change in Frequency
As BleepingComputer notes, the same supplier’s botnet was disrupted in September 2024 by the US Department of Justice. The United Kingdom sanctioned the company in 2025, the European Union in 2026. The Record reports that MicroScan has been in use since 2017. A domain used to access it was online as of September 2026, according to law enforcement. That is the shape of the thing: disruption, sanction, continued availability.
A register that lowers threat event frequency on the news of a seizure is recording an announcement, not a measurement. Treat a disruption as a temporary reduction with a recovery, and size it from the organization’s own evidence: scan and probe volumes against its perimeter before and after, and the persistence of old flaws in the patch backlog. Threat intelligence can say which group names draw on the same tooling. Only the people who own the perimeter telemetry and the patch backlog can say how often contact occurs and how long old flaws stay exposed. The dependence structure can be drawn from outside. The estimates cannot.
The group name is a label on the consumer of capability. The unit that carries the capability is the supply chain behind it. A model that cannot express a shared supplier will keep reporting diversified risk that is not diversified.