Series

Newsletters-eng

How was the defense system disabled? Inside the campaign of Qilin & Warlock
Summary of the campaign Two notorious Ransomware-as-a-Service (RaaS) groups, Qilin and Warlock (also known as Water Manual), are independently deploying the "Bring Your Own Vulnerable Driver" (BYOVD)
Apr 9, 20268 min read1
Invisible malware in the Linux kernel: Are you sure your system is clean?
Overview In the modern world of cybersecurity, most defense mechanisms are built on a familiar assumption: every threat will leave a trace — a suspicious connection, an open port, or at least an unusu
Apr 9, 20268 min read
TeamPCP Supply Chain Campaign: When the Security Scanner Became a Weapon Against AI Infrastructure
Executive Summary On March 24, 2026, threat group TeamPCP successfully pushed two backdoored versions of the Python library LiteLLM (v1.82.7 and v1.82.8) to PyPI — a package registry serving over 95 m
Apr 8, 202615 min read
WhatsApp Malware Campaign Delivering VBS Payloads and MSI Backdoors
Executive Summary In late February 2026, Microsoft Defender Experts detected a sophisticated attack campaign leveraging WhatsApp to distribute malicious Visual Basic Script (VBS) files to Windows user
Apr 5, 20267 min read4
You are the "security vulnerability": ClickFix is causing users to install malware themselves.
Overview Amid increasingly sophisticated cyberattacks, a worrying trend is emerging: attackers no longer need to exploit system vulnerabilities—they exploit the users themselves. The ClickFix campaign
Apr 4, 20268 min read2
Trivy supply chain attack spreads: Docker Hub, GitHub, and Kubernetes all affected
Overview Cybersecurity researchers have discovered more malicious artifacts on Docker Hub related to a supply chain attack targeting the vulnerability scanner Trivy. This incident not only involves ma
Mar 31, 20264 min read2

Command Palette