A computed digest, not an editorial pick — deterministic counts and deltas over the Radar corpus, refreshed each ETL run. Nothing here is a new finding: every line links to the surface that owns the underlying record so you can verify it in place.
Aggregates the Emerging, Exploited-in-MENA, Ransomware, Signals, Campaigns and KEV surfaces over a rolling time window (first_seen / published_at / claimed_at / date_added / to_at). Deterministic spine: every count and ranking is a fixed function of the corpus — no model in the data path. A deterministic digest of what ENTERED or CHANGED in the MENA corpus in the window — counts, windowed deltas, and top-N by each surface’s own fixed rank. No item is a model-chosen "top threat." First-seen ≠ globally new; claims ≠ breaches; KEV/OSINT ≠ confirmed in-region exploitation; correlation ≠ attribution.
Correlated OSINT activity, not confirmed attribution. State-change history is not stored — "new" (first seen) and "fresh activity" (latest report) are the windowed proxies.
No Activity Group first-seen or fresh-report activity in the last 24h out of 30 tracked. See /campaigns for the full correlated-activity board.
Signals of MENA relevance — KEV listing, MENA OSINT mentions, ransomware leak-site activity, and tracked-actor linkage are NOT confirmed in-region exploitation. Prioritize, then verify against your own telemetry.
No freshly-mentioned or freshly-listed CVE in the last 24h out of 17 tracked. See /signals for the full board.
Leak-site claims, not confirmed breaches — metadata only.
First appearance in our MENA collection — new to Radar, not necessarily new to the world.
Newly KEV-listed and cross-referenced to a MENA actor/case. KEV listing is not confirmed in-region exploitation.
No new MENA-relevant CISA KEV entries in the last 24h out of 12 tracked. See /kev for the full catalog; this section repopulates on the next ETL run if a new entry picks up a MENA signal.
12-week technique momentum (z-score), not a 72h delta — a spike in reporting volume, not confirmed targeting.
This brief covers the surfaces shipped to date. It is a routing layer, not a source — cite the underlying page (Campaigns, Exploited-in-MENA, Ransomware, Emerging, KEV, Signals) when reporting on any item above.