Pulling the Thread: APT should not usurp the identity of Leroy Merlin or there will be consequences
An APT group thought it was a good idea to use Leroy Merlin for its C2 domain. They should think again.
Recent Posts
Pulling the Thread: Two Unreported Infrastructure Clusters Linked to Chinese Espionage Tooling
Two unreported infrastructure clusters linked to Chinese espionage tooling uncovered through infrastructure pivoting.
Pulling the Thread: Pivoting on DPRK IT Worker Infrastructure
A simple naming pattern search on DPRK-linked infrastructure — and one domain that kept giving.
Pulling the Thread: Invite Only
How a suspicious filename led to 88 phishing domains, a shared hosting cluster, and an operator who probably should have used a different email address.
Fragmentation and Blackout: How War Is Reshaping Iran’s Cyber Operations
War is reshaping Iran’s cyber operations. IRGC fragmentation, a near-total internet shutdown, and the loss of senior commanders are creating compounded uncer...