* online syscfg.research utc
syscfg :// research

e-zine for incident history, threat actors, hardware and a live honeypot

issue 0x0AF // 175 articles // 65 simulations // last entry 2026-10-09

intro

A research journal with a playground attached. Read the write-ups, run the demos, watch the honeypot take real traffic. Every article lists what it was checked against; where nothing could be checked, it says so. No tracking, no ads, no accounts.

latest entries

  1. 0x0AFReal Certificates, Fake Control: Hijacking ccTLD Registries to Mint Trusted TLS Certs for Google[demo] 2026-10-09 9 min
  2. 0x0AEFortiBleed: 86,000 Compromised FortiGates, No CVE, and a Number That Keeps Changing Meaning[demo] 2026-10-08 9 min
  3. 0x0ADOne Breach, Four Numbers: The Oracle Health Extortion and the 20 Million That Isn't Confirmed Yet[demo] 2026-10-07 9 min
  4. 0x0ACCVE-2026-104286: One Unauthenticated File Write, Preloaded Into Every Process on a FortiMail Box[demo] 2026-10-06 8 min
  5. 0x0ABThe Persistence Layer IR Tools Cannot See: LoJax, CosmicStrand, BlackLotus and What It Takes to Find Firmware-Level Implants 2026-10-01 11 min
  6. 0x0AASecure Against Whom? The Hardware of Resisting Surveillance, With the Marketing Removed[demo] 2026-09-28 11 min
  7. 0x0A9When Encryption Was a Weapon: The Cypherpunks, the Crypto Wars, and the Book That Beat the Munitions List[demo] 2026-09-27 13 min
  8. 0x0A8An Extortion Group With a Reputation to Protect: CVE-2026-35273, ShinyHunters, and the FBI Advisory They Want Deleted[demo] 2026-09-24 14 min
  9. 0x0A7Nobody Logged In: How ShinyHunters Emptied Hundreds of Salesforce Tenants Through OAuth Grants Nobody Owned[demo] 2026-09-22 9 min
  10. 0x0A6From a Bing Search to Domain-Wide Akira in 44 Hours: SEO Poisoning, wbadmin and the Software Already on the Network[demo] 2026-09-19 10 min
  11. 0x0A5$159 of Hardware Breaks Confidential Computing: DDRop, Dropped DDR5 Writes, and Why Encryption Is Not Freshness 2026-09-18 12 min
  12. 0x0A4One Bug, Two Official CVSS Scores: CVE-2025-25249, PivotC2, and the 1.7 Points That Decide Whether Anyone Gets Paged[demo] 2026-09-17 11 min
  13. 0x0A3There Is No C2 Server To Block: EtherRAT, TukTuk, and Command and Control Built Entirely on SaaS[demo] 2026-09-16 11 min
  14. 0x0A2Somebody Read the Site, Then Came Back Every Week: A Month of Targeted Credential Attacks Against This Server's Own Usernames[demo] 2026-09-15 9 min

> full index of 175 entries // by year // reading paths // rss

live honeypot

$ cowrie-feed --summary events logged ............... 3.50M attempts today .............. 874 unique sources .............. 12,549 source countries ............ 20

> watch the feed // ssh, telnet and an ics layer; real attackers, updated every minute

learn by doing

Most articles carry a simulation. Pull the lever, see what happens.

> all 65 simulations in the lab

tracks

signals-intelligence ........ 11 reports privacy-self-sovereignty .... 8 reports threat-history .............. 52 reports original-research ........... 4 reports malware-analysis ............ 22 reports breach-analysis ............. 20 reports nation-state-operations ..... 13 reports threat-intelligence ......... 13 reports vulnerability-research ...... 6 reports hardware-hacking ............ 9 reports social-engineering .......... 6 reports research .................... 11 reports

reference

threat actors // malware database // timeline 1986-2025 // browser tools // terminal // methodology

170 of 175 articles list opened sources; the rest carry a note saying why.

independent research. no cookies. contact via session id on /about. everything here is receive-only and legal.