Blogs
BlogsCVE-2026-63077 Teardown: Weaponizing JetBrains TeamCity’s Agent Polling Protocol for Zero-Click CI/CD Pipeline TakeoverCVE-2026-63077 is a CVSS 9.8 unauthenticated deserialization flaw in JetBrains TeamCity's agent polling protocol. This teardown covers root cause, a lab exploit…Read →BlogsGolden Chickens 2026: Four New Malware Families, Modular MaaS Architecture, and Why the Most Resilient Crimeware Ecosystem Keeps Reinventing ItselfTAG-195 refactored Golden Chickens into a modular MaaS framework: four new families, WebSocket C2, and a Chrome ABE bypass. Here's the full…Read →BlogsLAUNDRY BEAR Exposed: Dissecting Russia’s Zimbra-Targeting APTLAUNDRY BEAR turned a CVSS 6.1 Zimbra stored XSS into a five-month state espionage campaign. Dissect the CVE-2025-66376 exploit chain, Ulej SOAP…Read →BlogsTELESHIM, MIXEDKEY & BINDCLOAK: Dissecting the East Asian APT’s Three-Family Toolkit Weaponizing Telegram C2 Against Middle East GovernmentsZscaler ThreatLabz exposed three undocumented malware families targeting Middle East governments. Learn how TELESHIM, MIXEDKEY, and BINDCLOAK chain together using Telegram C2,…Read →BlogsCVE-2026-56155 Anatomy: Inside the Actively Exploited AD FS Zero-Day That Grants Admin Privileges and How Ransomware Groups Are Chaining It With RCECVE-2026-56155 turns a permissive AD FS DKM container ACL into a full federated-identity compromise via Golden SAML. Learn how ransomware groups chain…Read →BlogsCVE-2026-57092 Anatomy: Hyper-V VMSwitch Use-After-Free Guest-to-Host Escape, From Low-Privileged VM Tenant to Full Hypervisor CompromiseCVE-2026-57092 is a CVSS 9.9 use-after-free in vmswitch.sys that lets an authenticated guest tenant escape to host ring-0. This teardown covers the…Read →BlogsGoSerpent Malware Internals: Reversing the Undocumented Go Implant Silently Espionaging Southeast Asian Governments Since Late 2025GoSerpent is a patient Go-based espionage implant targeting Southeast Asian governments since late 2025. This post reverses the binary internals, decrypts the…Read →BlogsSharePoint CVE-2026-50522 / CVE-2026-58644 Teardown: Pwn2Own-Demonstrated Deserialization-to-RCE and the Authentication-Bypass Chain That Makes It Pre-AuthThree CVSS 9+ SharePoint flaws from Pwn2Own Berlin - two deserialization RCEs and a JWT bypass - combine into a pre-auth kill…Read →BlogsHelloNet Exposed: Reversing the APT That Weaponized ViPNet’s Trusted Update ChannelHelloNet abused ViPNet's signed updater to sideload a modular implant chain into svchost.exe - no new service, no run key, just a…Read →BlogsCVE-2026-56190 Anatomy: Uninitialized-Resource RCE in Windows RDP – Pre-Auth Memory Corruption to Remote Code Execution Without a Single Packet of AuthenticationCVE-2026-56190 is a CVSS 9.8 pre-authentication RCE in the Windows RDP server caused by an uninitialized-resource flaw in termsrv.dll. Learn how the…Read →BlogsLegacyHive Exposed: Dissecting Chaotic Eclipse’s Unpatched Windows Registry Hive-Loading Zero-Day and the Adversarial Pattern Behind Nine Back-to-Back Uncoordinated DisclosuresLegacyHive is an unpatched Windows privilege escalation zero-day abusing a deterministic TOCTOU race in ProfSvc to redirect hive loads via Object Manager…Read →BlogsPolinRider: North Korea’s 108-Package Open-Source Supply Chain Campaign DissectedPolinRider compromised 108 packages and 1,951 GitHub repos using VS Code auto-run task hijacking, blockchain dead-drop C2, and expired-domain account takeover to…Read →