Featured · Research
AI-agent assisted ransomware: what actually changes in the kill chain
Affiliates are starting to orchestrate intrusion stages with agents. How to prioritize detection and response without hype.
ReadResearch and disclosure
Clear findings. No noise.
We publish analysis, responsible disclosures, and guides for teams that need to understand real risk and decide what to fix first.
PromptLock and the real risk of locally generated malicious scripts
Local models via API can fabricate Lua and other scripts in real time. What that means for endpoint detection and internal AI policy.
How to evaluate whether an LLM can help reproduce a CVE (without fooling yourself)
Benchmarks show partial PoCs from public data. A sober method for internal labs and patch validation.
From CVE to verifiable PoC: what multi-agent frameworks reveal to defenders
Pipelines that rebuild environments and exploit CVEs at scale change patching tempo. Concrete priorities for AppSec and ops.
RDP without MFA is still ransomware’s front door
Recent families still bet on weak RDP accounts. A hardening checklist that actually moves risk.
Residential proxies: from TV-box botnets to corporate network risk
Consumer devices turned into proxies fuel fraud and anonymization. What to watch in DNS, DHCP, and BYOD.
When the ransomware negotiator is too close to the attacker
Recent cases reopen due diligence debates for negotiation firms. Minimum criteria before hiring.
Absurd-scale Patch Tuesday: how to prioritize when hundreds of fixes arrive
Record patch volumes force an exposure-based risk model. A simple framework to avoid drowning.
Installer supply chain and update hijacking: a forgotten surface
Update mechanisms without proper signing remain offensive shortcuts. Controls for engineering and procurement.
SpamGPT and generative phishing: redesign awareness and detection
Perfect prose is no longer a legitimacy signal. What changes in training and filters.
Modern bootkits: why a “clean” endpoint can still lie
Pre-OS persistence makes partial reimage playbooks insufficient. What to validate after a serious incident.
Hypervisors under attack: a quick checklist for virtualized estates
Hyper-V oriented malware and VM escapes demand real management-plane segmentation.
Record DDoS and the pivot to proxies: economics behind Aisuru-like botnets
When DDoS stops being the main business, residential proxies sustain revenue. Implications for ISPs and enterprises.
Critical PHP flaws and the cost of delaying runtime updates
Public exploits against web runtimes still take whole sites down. An update plan with safe rollback.
Crypto laundering and sanctions screening for security teams
Crimeware-friendly payment platforms force teams to look beyond malware. Controls for finops and threat intel.
AI accelerating vulnerability discovery: an asymmetric patch race
More bugs found faster means operational pressure. How to shorten deploy without breaking change.
Hardening high-risk messaging accounts (practical lockdown mode)
Executives and sensitive staff need stricter profiles. Controls you can apply today on WhatsApp-like apps.
Abusive hosting and bulletproof-adjacent networks: reading adversary infrastructure
Providers that concentrate toxic networks remain pivots for malware and disinfo. Signals for threat intel.
Playbook: responding to a mass corporate identity leak
When employee credentials or data appear on forums, the first 48 hours matter more than a perfect press note.
Social engineering with LLM-enriched context
The model is not magic: it scales personalization. Human and technical controls that actually cut the chain.
Segmentation that survives an AI-assisted operator
If the attacker enumerates faster, blast radius matters more. Identity- and data-oriented segment design.
Internal policy for offensive use of language models
Red teams need guardrails too. Legal, data, and publication limits before experimenting.
Malicious AI bots and platform-abuse automation
Bots that generate content and actions at scale stress fraud and trust & safety. Cross-signals for corporate security.
Design detections for accelerated TTPs (not for the “AI” logo)
Your SIEM does not need a “ChatGPT attack” rule. It needs better signals for the same techniques, denser in time.
Data extortion without encryption: when ransomware no longer needs a lock
Steal-and-leak remains profitable. Exfiltration and classification controls that matter.
From finding to useful advisory
What we include in a report so engineering can reproduce, prioritize, and close without ambiguity.
How we report vulnerabilities with real impact
A walkthrough of our responsible disclosure process: evidence, remediation windows, coordination with the affected team, and publication when it creates public value.
Prepare a pentest without surprises
Scope, access, contacts, and success criteria so the assessment starts with clarity.
Early signals in web applications
Recurring patterns that appear before an incident, and how to catch them in periodic reviews.
Prioritize fixes when everything looks critical
A simple framework to order findings by exposure, exploitability, and business impact.
Map attack surface without losing focus
How inventory, exposure, and ownership combine to decide what to look at first.
No articles in this category right now. Try another filter or go back to All.