ls -la ./research/
Research
175 articles - malware analysis, major incidents, hardware hacking, threat intelligence, underground history
reference: category hubs / threat groups / malware families / timeline / archive / learning paths
175 results
- 0x0AFReal Certificates, Fake Control: Hijacking ccTLD Registries to Mint Trusted TLS Certs for GoogleIn late September 2026 attackers obtained genuine, browser-trusted TLS certificates for Google domains without touching Google or any certif…
- 0x0AEFortiBleed: 86,000 Compromised FortiGates, No CVE, and a Number That Keeps Changing MeaningThe FBI and US Secret Service issued a joint advisory on 6 October 2026 about a campaign against internet-facing FortiGate firewalls. There …
- 0x0ADOne Breach, Four Numbers: The Oracle Health Extortion and the 20 Million That Isn't Confirmed YetThe Oracle Health breach got a headline in October 2026: nearly 20 million people, patient records taken from a legacy Cerner migration serv…
- 0x0ACCVE-2026-104286: One Unauthenticated File Write, Preloaded Into Every Process on a FortiMail BoxCVE-2026-104286 is an unauthenticated arbitrary file write in FortiMail's GUI, published as FG-IR-26-175 on 1 October 2026, already exploite…
- 0x0ABThe Persistence Layer IR Tools Cannot See: LoJax, CosmicStrand, BlackLotus and What It Takes to Find Firmware-Level ImplantsLoJax in 2018, CosmicStrand in 2022, BlackLotus in 2023. Each one survives an OS reinstall, a disk wipe, and a complete CrowdStrike scan - b…
- 0x0AASecure Against Whom? The Hardware of Resisting Surveillance, With the Marketing RemovedThe companion to the Crypto Wars piece: given that the cypherpunks won strong encryption, what does using it in hardware actually look like …
- 0x0A9When Encryption Was a Weapon: The Cypherpunks, the Crypto Wars, and the Book That Beat the Munitions ListFor most of the 1990s a strong encryption program was legally a munition, and exporting it was arms trafficking. The people who broke that f…
- 0x0A8An Extortion Group With a Reputation to Protect: CVE-2026-35273, ShinyHunters, and the FBI Advisory They Want DeletedShinyHunters exploited an unauthenticated RCE in Oracle PeopleSoft against 100-plus organisations, two thirds of them universities, and publ…
- 0x0A7Nobody Logged In: How ShinyHunters Emptied Hundreds of Salesforce Tenants Through OAuth Grants Nobody OwnedThree times in ten months, ShinyHunters and associated actors took data out of hundreds of Salesforce tenants without signing in to any of t…
- 0x0A6From a Bing Search to Domain-Wide Akira in 44 Hours: SEO Poisoning, wbadmin and the Software Already on the NetworkAn IT administrator searched Bing for ManageEngine OpManager and installed a trojanized MSI that also installed the real software. Forty-fou…
- 0x0A5$159 of Hardware Breaks Confidential Computing: DDRop, Dropped DDR5 Writes, and Why Encryption Is Not FreshnessA $159 board sits between a server's CPU and its DDR5 memory, passes every boot integrity check, then starts silently discarding writes by i…
- 0x0A4One Bug, Two Official CVSS Scores: CVE-2025-25249, PivotC2, and the 1.7 Points That Decide Whether Anyone Gets PagedNVD scored CVE-2025-25249 at 9.8. Fortinet, the CNA that assigned it, scored it 8.1. The whole gap is one metric - attack complexity - and i…
- 0x0A3There Is No C2 Server To Block: EtherRAT, TukTuk, and Command and Control Built Entirely on SaaSAn intrusion ending in domain-wide Gentlemen ransomware, where the command and control ran over ClickHouse, Supabase, Ably, Dropbox, GitHub …
- 0x0A2Somebody Read the Site, Then Came Back Every Week: A Month of Targeted Credential Attacks Against This Server's Own UsernamesTwo usernames exist in this honeypot's logs that appear in no credential wordlist: syscfg and feed, the site's handle and its API subdomain.…
- 0x0A1One Key, 511 Hosts: How a Shared SSH Public Key Fingerprints a Botnet That IP Blocklists Cannot SeeA single RSA public key was implanted 632 times from 511 distinct source IPs across 30 days of honeypot logs. The delivery command was byte-…
- 0x0A0Two Ways Into the Build: ChainDrop's npm Worm, XCSSET v40, and Why Valid Provenance Is Not a DefenceAn npm worm in 400+ packages and a macOS infostealer hiding in Xcode projects, four months apart, sharing no code and probably no operator. …
- 0x09FTesting a Four-Year-Old Botnet Fingerprint: The mdrfckr Campaign's Published HASSH Is Dead and Its Payload Never ChangedA HASSH fingerprint published in 2022 for the mdrfckr SSH botnet matched zero of 632 implants in a 2026 honeypot corpus. The campaign now ru…
- 0x09E31 Days Inside a Public SSH Honeypot: 1.25 Million Events, Multi-Architecture Malware, and What Automated Attackers Actually DoA Cowrie SSH honeypot on a Helsinki VPS logged 1,251,496 events across 134,060 sessions in 31 days. Analysis of the raw JSON logs reveals fi…
- 0x09DEchoLeak: Four Defences, Four Bypasses, and What Zero-Click Prompt Injection Says About Filtering an Unconstrained CapabilityCVE-2025-32711 let an attacker email a target once, never interact again, and have Microsoft 365 Copilot exfiltrate that person's confidenti…
- 0x09CWannaCry and EternalBlue: How the NSA's Hoarded Exploit Infected 200,000 Machines in 72 HoursIn May 2017, a ransomware worm called WannaCry spread to 200,000 machines across 150 countries in three days. It used EternalBlue - a cyberw…