INTEL_REPORT
The Record (Recorded Future News) · published 7/9/2026, 2:20:00 PM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
Latvian forestry company still restoring systems weeks after ransomware attack A foreign, financially motivated group was responsible for a cyberattack on state-owned forestry company Latvijas Valsts Mezi (LVM), officials said. Latvian forestry company still restoring systems weeks after ransomware attack | The Record from Recorded Future News Leadership Cybercrime Nation-state Influence Operations Technology Cyber Daily® Click Here Podcast Go Subscribe to The Record ✉️ Fre…
https://therecord.media/latvia-state-owned-foresty-company-lvm-ransomware
sha256:98d6dceadca0b0f331c6736f012886355fab80c421cc7b02859f735fa0c5ba02
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
| Type | Value | Link |
|---|---|---|
| domain | cert.lv | Open → |
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.
Neighborhood from the first linked indicator.