Blog
How breached credentials and leaked personal data put executives at risk, how stolen data is traded on the dark web and Telegram, and how to reduce the exposure.
Stolen-data ecosystem and actors
php2shell is the name for two critical flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. They can allow unauthenticated r...
Stolen-data ecosystem and actors
The Global Government Credential Leaks Study found 642,639 government credential leaks across 192 countries, collected from 83 dark web and Telegram sources. Br...
Attacks that use leadership data
Ransomware-as-a-Service lets developers lease ransomware to affiliates for a share of the profits, so attackers no longer need elite skills. Small and medium-si...
Methodology and data
In our tests, DeepSeek R1 did not display full generated scripts itself. Its “Full Updated Script” link pointed to a GitHub Gist URL, so code can end up on thir...
Stolen-data ecosystem and actors
After the January 2025 seizure of the forums Nulled.to and Cracked.io, cybercriminals are shifting stolen-data trading to Telegram “clouds”. The article explain...
Attacks that use leadership data
In a red team exercise, we trained an AI model on an executive’s public writing, built a target list with open-source intelligence and sent a two-stage phishing...
EU regulation and governance
A three-part investigation into GDPR exposures. “Fake” placeholder emails in public documents turned out to be real addresses. We compared how Microsoft and Vod...
Leaked credentials and breach data
Credentials taken by infostealers and command and control servers often keep the full login URL. The path shows which supplier portals, APIs and third-party sys...
Stolen-data ecosystem and actors
Telegram channels are used to list and sell exfiltrated data and access to compromised machines. The article describes the sales workflow from C2 server to list...
Stolen-data ecosystem and actors
Our investigation of the phishing domain coinbase-mywallet.com, registered on 16 January 2025, traced three IP addresses to malware samples and a command-and-co...
Methodology and data
NS Record Exploiter is a free, open-source Python script. It reads a list of domains, resolves their NS records with dnspython and checks each nameserver domain...
Methodology and data
A single mistyped nameserver, such as a22-65.akam.ne instead of akam.net, can let an attacker who registers that domain intercept traffic for a subdomain. A Mas...