Archives

Repurposing an old laptop into a Splunk lab sounded like a weekend project. It became a BIOS standoff, a USB ethernet graveyard, and one genuinely terrifying reboot.

Someone shared an interesting article. A colleague forwarded it. Three managed devices got wiped before the week was out.

762 sessions. Rotating AWS infrastructure. Dual C2 channels. Jittered intervals specifically designed to defeat statistical detection. On a cafeteria menu board.

I built an autonomous AI scambaiting persona and pointed her at a fake government grant scammer. Four days later he rage-quit and called her an Olofo.

Instructure reached an agreement with ShinyHunters hours before the May 12 deadline. The ransom debate is old but this case adds new wrinkles worth working through.

ShinyHunters breached Instructure and compromised data from thousands of institutions. The technical details matter less than what this breach pattern keeps telling us about third-party risk.

Shortly after midnight, an attacker exploited a known vulnerability in a web-facing server at one of our international campus locations. This is what happened next.

A phishing click led to fixed-size C2 check-ins arriving in two distinct bursts with a 142-minute gap between them. The pattern told the story before we had a verdict.

A user clicked through a phishing warning and ended up with what the evidence points to as a crypto drainer. Here's what the traffic looked like and how we assessed it.

An independent researcher found an open directory listing on one of our public-facing servers exposing archive files that had been sitting there since 2023. Here's how we handled it.

A phishing campaign captured two sets of credentials and resulted in one full account breach with MFA bypass. Here's how it unfolded and what contained it.

A single IDS alert turned into a six-host RAT cluster, all beaconing after hours on non-standard ports. The firewall didn't catch it. The IDS did.

Two C2 investigations on the same day with very different outcomes — one confirmed infection with active beaconing, one clean block. The key was knowing what the firewall logs were actually telling me.

A user device beaconing to a hardcoded Akamai IP every 17 minutes turned into a clean example of why defense-in-depth isn't just a buzzword.