One new document, several recycled ones, and a set of election numbers nobody has read
The 26–29 October window produced exactly one piece of genuinely new primary cyber research. The rest is older vendor material resurfacing — including Israeli pre-election threat figures circulating without a single verified number attached.
Inside the ESET report sits a correction to the prevailing consensus. APT groups are using large language models, the firm says, “However, ESET has not noticed AI substantially reshaping the APT landscape over the past six months.” That is a vendor saying, on the record, that the technology everyone is selling against has not yet changed the threat it is sold against — and it is worth noting that ESET released a commercial AI product on the same day it published that line. The incentive runs the unusual direction here, which is part of why the statement is credible. Separately, a full quote attributed to ESET’s Jean-Ian Boutin in the accompanying press release could not be retrieved intact in this sweep and is therefore not reproduced; partial quotes get reconstructed into things people did not say.
Three items moving through trade coverage this week are not new. Check Point, an Israeli vendor, has published threat figures concerning Israel during an Israeli election campaign; three outlets have picked them up, but The Files has verified no number from the report itself — no attacks-per-week, no percentage, no baseline — and will publish none until the document is read. A Semperis finding on Iranian command-and-control infrastructure hosted in the United States dates to 23 October; the ITWire item carrying it inside this window is filed as guest research, meaning vendor-placed. A Citizen Lab report on Pegasus in Serbia dates to 19–20 October and is resurfacing because its research page carries a refreshed timestamp. A TechRadar interview with an NSO Group founder on sovereign AI exists as a headline and a URL; the body text, the speaker’s name and his title were not obtained.
Assessment: The recirculation mechanics matter more than any individual item. A refreshed CMS timestamp, a guest-research byline and an election-season vendor release are three different ways for old or interested material to enter the news cycle wearing the clothes of new reporting, and all three operated this week. The NSO thread is the one to chase once there is text: a spyware founder repositioning as a sovereign-AI vendor has an obvious customer base in the Gulf, and that migration — from selling interception to selling national capability — is the commercially serious story. Not yet, though. A headline is not an interview.