Channel
@APTANALYSIS
On this record: Topic · Growth · Engagement · Posts · Cite this entry
1,695subscribers
+43 since we began measuring on 7 August 2026
Risers and fallers across the register · movement among entries of 1,000–3,162.
| Telegram ID | -1001479632251 |
|---|---|
| Type | Channel |
| Username | @APTANALYSIS |
| Created | Between 1 April 2019 and 30 September 2021 — estimated from Telegram’s id allocation, not measured. How this range is calculated. |
| First recorded | 7 August 2026 |
| Last confirmed live | 11 October 2026 |
| Measurements held | 16 |
| Confirmed unchanged | 1 time, most recently 11 October 2026 |
| On Telegram | t.me/APTANALYSIS |
Hacking & security — a classification, not a measurement. An on-box language model (Qwen3.6-35B-A3B-FP8, prompt version 1) read this channel’s own recent posts on 17 September 2026 and assigned it the closest of 31 fixed categories, at 98% confidence. This is a model’s judgement about what the channel is likely to be about, not a fact this register measured the way a subscriber count or a view count is measured — it can be revised on a later pass, and it carries no weight anywhere else on this page. How this classification works, and why it has no browse page of its own yet.
| Measured (UTC) | Subscribers | Change |
|---|---|---|
| 11 Oct 2026, 09:19 | 1,695 | +4 |
| 4 Oct 2026, 20:36 | 1,691 | +10 |
| 25 Sept 2026, 10:17 | 1,681 | +9 |
| 15 Sept 2026, 11:41 | 1,672 | -1 |
| 11 Sept 2026, 12:17 | 1,673 | -1 |
| 6 Sept 2026, 14:01 | 1,674 | +1 |
| 1 Sept 2026, 19:25 | 1,673 | +3 |
| 29 Aug 2026, 22:27 | 1,670 | +1 |
| 27 Aug 2026, 07:46 | 1,669 | +3 |
| 24 Aug 2026, 14:47 | 1,666 | +4 |
| 20 Aug 2026, 22:12 | 1,662 | -1 |
| 18 Aug 2026, 04:12 | 1,663 | +1 |
| 11 Aug 2026, 01:36 | 1,662 | +12 |
| 8 Aug 2026, 04:25 | 1,650 | -2 |
| 7 Aug 2026, 16:18 | 1,652 | no change |
| 7 Aug 2026, 12:39 | 1,652 | first reading |
19 posts held, back to 16 September 2025 — the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 1 page of Telegram’s post history, 20 posts per page.
Nothing published in the last 30 days. ERR and ER are rolling 30-day measures, so there is nothing to compute — we hold 19 posts for this entry, the most recent from 26 June 2026. An engagement rate over an empty window would be a number about nothing.
♣️Behind Khmer Shadow: Targeted espionage against Cambodian government entities 👁Blog : https://www.acronis.com/en/tru/posts/behind-khmer-shadow-targeted-espionage-against-cambodian-government-entities ♣️Velvet Ant’s Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected 👁Blog : https://www.sygnia.co/blog/operation-highland-velvet-ant ♣️ShinyHunters Targets Education Sector with Oracle…
🌕APTANALYSIS : Threat Review June 10 to June 25 ⭐️@APTANALYSIS
♣️Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware 😈Blog : https://www.trendmicro.com/en_us/research/26/e/analyzing-void-dokkaebi-invisibleferret-malware.html ♣️Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns 😈Blog : https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens ♣️Behind .payload: In-Depth Technical Analysis of Payload Ransomware 💀Blog : https://darkatlas.io…
🌕APTANALYSIS : Threat Review May 24 to June 10 ⭐️@APTANALYSIS
💀Monthly collection ♣️Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud 💀Blog : https://www.trendmicro.com/en_us/research/26/e/banana-rat.html ♣️Microsoft’s MSHTA Legacy Tool Still Powers Malware Campaigns on Windows 💀Blog : https://www.bitdefender.com/en-us/blog/labs/microsofts-mshta-legacy-malware-windows ♣️Coruna Respawned: Compromised art-template npm Package Leads to iOS Browser Exploit Ki…
🌟Stealer & Ransom Analysis Collection ♣️Phantom Stealer Analysis: Inside the Two-Layer Attack Chain Hidden Behind a Windows DLL ⚫Blog : https://darkatlas.io/blog/phantom-stealer-analysis-inside-the-two-layer-attack-chain-hidden-behind-a-windows-dll ♣️Amatera Stealer 4.0.2 Beta: What's New in This Variant ⚫Blog : https://www.esentire.com/blog/amatera-stealer-4-0-2-beta-whats-new-in-this-variant ♣️crpx0 Ransomware Oper…
♣️INJ3CTOR3’s Self-Healing FreePBX Toll Fraud Campaign 👶Blog : https://cyble.com/blog/jomangy-inj3ctor3s-self-healing-freepbx-toll-fraud-campaign ⭐️@APTANALYSIS
♣️UAC-0244 / UAC-0247: Malware Targeting FPV drone operators 🖤Blog : https://blog.synapticsystems.de/uac-0247-malware-targeting-fpv-operators ♣️UAC-0184: From HTA to a Signed Network Stack 🖤Blog : https://blog.synapticsystems.de/uac-0184-from-hta-to-a-signed-network-stack ⭐️@APTANALYSIS
💀Hot headlines over the past week ♣️How ClickFix Opens the Door to Stealthy StealC Information Stealer 💿Blog : https://www.levelblue.com/blogs/spiderlabs-blog/how-clickfix-opens-the-door-to-stealthy-stealc-information-stealer ♣️Odyssey Stealer: Inside a macOS Crypto-Stealing Operation ⏳Blog : https://censys.com/blog/odyssey-stealer-macos-crypto-stealing-operation ♣️Lotus Blossom (G0030) and the Notepad++ Supply-Chain…
♣️Tenant from Hell: Prometei's Unauthorized Stay in Your Windows Server 🖥Blog : https://www.esentire.com/blog/tenant-from-hell-prometeis-unauthorized-stay-in-your-windows-server ⭐️@APTANALYSIS
♣️Inside Gunra RaaS: From Affiliate Recruitment on the Dark Web to Full Technical Dissection of their Locker 🍎Blog : https://www.cloudsek.com/blog/inside-gunra-raas-from-affiliate-recruitment-on-the-dark-web-to-full-technical-dissection-of-their-locker ⭐️@APTANALYSIS
♣️Detecting Russian Threats to Critical Energy Infrastructure 🔬Blog : https://www.truesec.com/hub/blog/detecting-russian-threats-to-critical-energy-infrastructure ⭐️@APTANALYSIS
Showing the 12 most recent of 19 posts we hold for @APTANALYSIS. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.
A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 11 October 2026 — this entry's latest reading, not the date you are reading this.
“APT ANALYSIS” (@APTANALYSIS), 1,695 subscribers as measured 11 October 2026. Telegram Register, tgregister.com/channel/APTANALYSIS.
Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.