Callum Draycott

Callum Draycott covers the threat‑actor beat for Breach Signal, tracking espionage groups, criminal crews and the ransomware operations that rely on them. The work matters because understanding who is behind a campaign reveals its goals, the infrastructure it leans on and the policy responses it provokes. For security practitioners, the beat offers a window into the tactics that precede breaches; for policymakers, it shows where defensive gaps appear; for general readers, it clarifies how obscure technical details translate into real‑world risk.

Each story starts with the latest vendor threat reports, government advisories and public indictments, then checks for overlapping infrastructure, shared tools and naming conventions. The byline always asks which group is credited, what confidence the source assigns and whether the attribution rests on technical evidence or circumstantial clues. It also traces the timeline of activity, notes any changes in aliases or hosting providers, and looks for connections to broader campaigns or geopolitical events that might explain shifts in behavior.

The voice is measured and analytical, preferring long, precise sentences that lay out the chain of reasoning without sensationalism. Readers will find pieces that explain a group's aliases, map botnet bulletproof hosting, trace ransomware affiliates to their sponsors and situate those activities within evolving cyber‑policy debates. The byline also highlights when confidence levels shift, notes gaps in public attribution, and points readers to the primary sources so they can verify the claims themselves.