Incident replay · IR-2026-07 · reconstructed from ~17,600 logged actions
Thousands of small decisions at machine speed. Press play to watch it unfold.
2026-07-09 → 07-13 UTC ~17,600 actions ~6,280 clusters 9 phases · 2 stages
2026-07-09 02:28
Day 1 / 5 · UTC
Attacker actions replayed
0
of 17,613 total · grouped into ~6,280 clusters
Active phase
-
awaiting first action
Blast radius
sandbox
contained to a third-party sandbox
Attack chain across trust boundaries
nodes ignite as the agent reaches them
Phase activity
first-seen → last-seen
Live action stream
representative commands, as observed
Volume per day
bimodal · Day 3 spike
Day 1 (07-09) - Initial access, foothold, C2 established.
Companion visualization to the July 2026 incident disclosure. Live credentials, hostnames and indicators are redacted or genericized; techniques shown as observed. ← Back to the blog post