The Threat of Physical Compromise A business trip can expose sensitive data to compromise before a laptop ever connects to the corporate network. For instance, the OVERCAST PANDA threat group infe…

Exploiting AI Infrastructure An attacker dispatched nearly 200,000 requests to a language model in just two minutes. Specifically, they leveraged a stolen access key to execute this massive flood.…

The previous post covered what Crystal Palace is and why it exists. This one is hands-on. We’re building two PICOs from scratch, a…

A technical walkthrough of deobfuscating JavaScript, dumping EVM bytecode, and resolving blockchain command and control infrastructure.

At a Glance Malware family API-driven XSS supply chain implant (Biggopti banner abuse) Threat actor Suspected; linked to the ARVE and OptinMonster campaigns Targets WordPress sites running seven B…

At a Glance Attribute Detail Malware family FDMTP implant (.NET, TouchSocket-based) Threat actor Suspected Twill Typhoon (not confirmed) Target / victims Windows users of QuickFox, mainly Chinese …

At a Glance Attribute Detail Malware family Interlock ransomware (double extortion) Threat actor Interlock, tracked by Sophos as GOLD EMBRACE (confirmed) Target / victims Critical infrastructure, …

Hey, My name is Omri Baso I am a 28 years old Security Researcher from Israel — I like researching about Windows, Active Directory, Malware…

At a glance Malware family MaaS infostealer delivered via SmartLoader (NodeJS strain among final payloads) Threat actor Operators behind TroyDen’s “lure factory” (suspected, not …

At a Glance Attribute Detail Malware family DOUBLECUP (Loader-as-a-Service); payloads CountLoader 4.5p and DeviceManager RAT Threat actor Rognar, a Russian operator (confirmed by SOCRadar) Target …