Everything we've published.
Every report, in one place methodology and indicators included, not just findings.
Disect Netscaler Citrix Vulnerability CVE 2026-88771/72 - Uncovering the exploit & it's infrastructure
In September 2026, Citrix disclosed two critical vulnerabilities: CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and Gateway. Both carry a 9.5 CVSS score and affect default configurations. Approximately 50,000 internet-exposed NetScaler instances were reachable at the time of disclosure. This research analyzes a captured operations console at `66.154.127.156` (AS35916 MULTACOM CORPORATION, Leesburg, Virginia).
Suspected Sidewinder Campaign Against South Asian Governments and Finance Targets
While threat hunting, we identified an exposed VPS at 66.179.31[.]191 hosted on BL Networks (AS399629) in Singapore. The host ran a Python SimpleHTTP server on port 8898 with directory listing enabled. AttackCapture archived the directory and flagged it as a potential malicious open directory. What it exposed was a working attack server: 395 files across 9 subdirectories, roughly 182 MB, containing exploit code for GeoServer, GeoTools, Laravel Ignition, Tomcat, and a Redis module loader, along with phpMyAdmin weak-credential scripts, target lists, session cookies, C2 configuration, and operational logs.
Inside PlayCrypt: Deconstructing the Amadey → Cobalt Strike → Play Multi-Stage Ransomware Chain
One file hash. A few pivots. That's all it took to walk straight into Play ransomware's back office: a Cobalt Strike server on Tencent loaded with exploit and credential-theft scripts, a live Sliver C2 host, and a team server actively churning out evasive Windows payloads, all sitting in open directories, no victim network required. A misconfigured leak site handed over Play's negotiation timelines for free. And one intrusion traced back to a single binary carrying Amadey, Cobalt Strike, Elex, and the Play encryptor together, proof that if you're only watching the network, you're already too late.
Scattered Spider: Many Names, One Syndicate
A financially motivated collective that weaponises social engineering over malware, mapped through domain impersonation, JARM pivoting and IOC clustering.
Operation Black Mirror: ClickFix Campaign Analysis
Multi-campaign analysis of ClickFix operations run by both APT actors and crimeware crews, focused on Win+R lures and infrastructure-level hunting.
When the Bazaar Burned From Within: The Silent Breach of Nobitex
How a cryptocurrency exchange was taken apart from the inside, and what its internal architecture revealed once the attackers published it.
No reports match your search.