Triaging the Week 134
The Collapsing Exploit Window // AI Systems as the New Attack Surface // Identity Is the Perimeter // Hiding in Plain Sight // Scams at Scale in triaging the week 134.
Lazarus Group: The Complete Guide to North Korea’s Billion-Dollar Hacking Machine
Discover how the Lazarus Group became the world's most successful cybercrime syndicate, and the detection gaps most security teams still miss.
Triaging the Week 133
Trusted Software Is the Delivery Vehicle // The Supply Chain Turns Hostile // Your AI Toolchain Under Attack // Adversaries Are Operationalizing AI // Already Inside the Walls in triaging the week 133.
Triaging the Week 132
ClickFix Goes Industrial // Identity Is the Only Perimeter // AI as Target and Threat Actor // Nation-State Ops Move From Espionage to Physical Impact // Law Enforcement Crackdowns in triaging the week 132.
Sigma Rules Explained: Architecture, pySigma, Modifiers, & Correlation
Learn how Sigma rules, modifiers, and pySigma power platform-agnostic detection engineering and threat hunting, plus the pitfalls tutorials skip.
Triaging the Week 131
ClickFix & macOS Endpoint Under Siege // Blinding the Defender // Developer Pipeline & AI Assistants Targeted // The Extortion Economy & Its Infrastructure // Fraud at Scale in triaging the week 131.
Triaging the Week 130
AI as Weapon and Target // Your Marketplace Is Your Perimeter // Ransomware & the Vanishing Patch Window // The Hiring Pipeline Is an Attack Vector // SaaS, Silicon, and Statecraft in triaging the week 130.
How to Detect North Korean Remote Workers Hiding Inside Your Company
North Korean remote workers pass interviews, then extort you. Learn the DPRK remote IT worker hiring pipeline, TTPs, and seven detection opportunities.
Triaging the Week 129
The Package Registry Is the Attack Surface // ClickFix Has Gone Cross-Platform // Trust Guarantees That Didn't Hold // The Perimeter You Stopped Looking At // Agentic AI for Offense and Defense in triaging the week 129
CTI For SMB: When Your Small Business Is Actually Ready For Threat Intelligence
Learn when your business is ready for CTI for SMB, which controls come first, and a 60-day roadmap to run threat intelligence on a real budget.
Triaging the Week 128
Your AI Agent Is the New Insider Threat // AI Infrastructure Is Now a Primary Target // Developers Are the Softest Path Into the Supply Chain // Identity & Trusted Platforms as the Attack Surface // Patch, Then Assume Breach in triaging the week 128.
Triaging the Week 127
The Agentic Attack Surface // The MFA Bypass Era // Poisoned Supply Chains & Fake Repos // Stealers, Ransomware & the macOS Frontier // Infrastructure, Privacy & Critical Patches in triaging the week 127.
Triaging the Week 126
Identity Under Siege — Device Code Phishing, Vishing & MFA Bypass // AI Coding Agents Under Attack // Supply Chain & Dev Ecosystem Residential Proxies, Botnets, & ORBs in triaging the week 126.
Triaging the Week 125
AI Agents & MCP Targeted // Riding the AI Hype Wave // Developers & Researchers Under Siege // Nation-State Espionage & Targeted Intrusions // The Browser & Identity Battleground in triaging the week 125.
Why Your CTI Analyst Career Is Stuck (It’s Not a Skills Problem)
Most people think breaking into cyber threat intelligence (CTI) is a skills problem. It is not. It is a signal problem. I came up through a managed security services provider (MSSP) security operations center (SOC), triaging alerts before I could…