// Research & Insights

Security Blog

Deep dives into offensive security, penetration testing, vulnerability research, and red team operations.

FortiBleed: A Global Intrusion Campaign Targeting Fortinet Edge Infrastructure

FortiBleed Exposed: Inside the Credential Harvesting Campaign Targeting Fortinet Edge Infrastructure explores the large-scale cyber intrusion campaign targeting internet-facing Fortinet firewalls and VPN gateways worldwide. This in-depth analysis examines how threat actors leveraged credential harvesting, automated reconnaissance, and compromised authentication mechanisms to gain unauthorized access to enterprise networks. The article provides a detailed breakdown of the attack methodology, potential impact, detection strategies, and key security lessons organizations can apply to protect their critical infrastructure from similar advanced cyber threats.

fortinetfortibleed

June 22, 2026

Read article

cybersecurity

Offensive Threat Hunting - Tracing The Cyber Criminals Behind a Phishing Campaign

The associated user profile indicates a long-standing online presence, with an account creation date dating back to 2010 and a more recent update within the past year. While this demonstrates sustained use of the identity over time, it does not in itself provide conclusive evidence of involvement in phishing activity. Such temporal OSINT indicators may be useful for contextual enrichment, but they must be correlated with stronger technical and behavioral evidence before drawing attribution-related conclusions.

threatintelransomwareAPT

June 16, 2026

Read article

Malware Analysis

Analysing a Cobalt-Strike Beacon

This article explores the dynamic analysis of a Cobalt Strike Beacon, focusing on reverse engineering techniques used to uncover its runtime behavior and malicious functionality. Using x64dbg, the beacon’s execution flow was traced to extract embedded shellcode, which was then emulated in a controlled environment using Speakeasy. The analysis highlights how memory inspection, breakpoint strategy, and shellcode emulation can reveal command-and-control communication patterns and produce actionable indicators of compromise (IOCs) for effective threat hunting and incident response.

Research&DevelopmentReverse-Engineering

June 16, 2026

Read article

cybersecurity

Kernel Trust Abuse: Leveraging Vulnerable Drivers to Disable Security Controls

This article explores how the `Bring Your Own Vulnerable Driver (BYOVD)` technique can be used to abuse legitimate but vulnerable kernel drivers to terminate the Windows Defender process (MsMpEng.exe). Through a proof of concept, we demonstrate how arbitrary process termination functionality exposed by a vulnerable driver can be leveraged to repeatedly disrupt endpoint protection mechanisms, highlighting the security risks posed by untrusted or inadequately secured drivers.

EDRevasionmalware-development

June 15, 2026

Read article