Triaging the Week 132
ClickFix Goes Industrial // Identity Is the Only Perimeter // AI as Target and Threat Actor // Nation-State Ops Move From Espionage to Physical Impact // Law Enforcement Crackdowns in triaging the week 132.
Sigma Rules Explained: Architecture, pySigma, Modifiers, & Correlation
Learn how Sigma rules, modifiers, and pySigma power platform-agnostic detection engineering and threat hunting, plus the pitfalls tutorials skip.
Triaging the Week 131
ClickFix & macOS Endpoint Under Siege // Blinding the Defender // Developer Pipeline & AI Assistants Targeted // The Extortion Economy & Its Infrastructure // Fraud at Scale in triaging the week 131.
Triaging the Week 130
AI as Weapon and Target // Your Marketplace Is Your Perimeter // Ransomware & the Vanishing Patch Window // The Hiring Pipeline Is an Attack Vector // SaaS, Silicon, and Statecraft in triaging the week 130.
How to Detect North Korean Remote Workers Hiding Inside Your Company
North Korean remote workers pass interviews, then extort you. Learn the DPRK remote IT worker hiring pipeline, TTPs, and seven detection opportunities.
Triaging the Week 129
The Package Registry Is the Attack Surface // ClickFix Has Gone Cross-Platform // Trust Guarantees That Didn't Hold // The Perimeter You Stopped Looking At // Agentic AI for Offense and Defense in triaging the week 129
CTI For SMB: When Your Small Business Is Actually Ready For Threat Intelligence
Learn when your business is ready for CTI for SMB, which controls come first, and a 60-day roadmap to run threat intelligence on a real budget.
Triaging the Week 128
Your AI Agent Is the New Insider Threat // AI Infrastructure Is Now a Primary Target // Developers Are the Softest Path Into the Supply Chain // Identity & Trusted Platforms as the Attack Surface // Patch, Then Assume Breach in triaging the week 128.
Triaging the Week 127
The Agentic Attack Surface // The MFA Bypass Era // Poisoned Supply Chains & Fake Repos // Stealers, Ransomware & the macOS Frontier // Infrastructure, Privacy & Critical Patches in triaging the week 127.
Triaging the Week 126
Identity Under Siege — Device Code Phishing, Vishing & MFA Bypass // AI Coding Agents Under Attack // Supply Chain & Dev Ecosystem Residential Proxies, Botnets, & ORBs in triaging the week 126.
Triaging the Week 125
AI Agents & MCP Targeted // Riding the AI Hype Wave // Developers & Researchers Under Siege // Nation-State Espionage & Targeted Intrusions // The Browser & Identity Battleground in triaging the week 125.
Why Your CTI Analyst Career Is Stuck (It’s Not a Skills Problem)
Most people think breaking into cyber threat intelligence (CTI) is a skills problem. It is not. It is a signal problem. I came up through a managed security services provider (MSSP) security operations center (SOC), triaging alerts before I could…
Triaging the Week 124
IABs & Backdoor Tradecraft // Vulnerabilities & Exploitable Infrastructure // Social Engineering & Trust Abuse // AI Supply Chain & Agentic Risks // Law Enforcement Wins & Phishing Evolution in triaging the week 124.
Volt Typhoon: Hunting the Ghost Already Living in Your Network
Volt Typhoon hides inside your own tools and waits. Learn how this Chinese APT pre-positions in critical infrastructure and how to hunt it in your network.
Triaging the Week 123
AI Both the Weapon and the Weak Link // Trusted Channels Weaponized // Covert Surveillance // Critical Exploits & Active Campaigns // The Future of Vulnerability Management in triaging the week 123.