Analysis · Retrospective 2025
Shai-Hulud made publishing credentials part of the infection
The first Shai-Hulud wave linked dependency installation to secret theft and further package publication.
Topic
Malware
How malicious software spreads, what it does once inside, and who is behind the campaigns that distribute it.
Technical Advisory · Retrospective 2024
ClickFix asks the user to cross the execution boundary
A repair prompt can be a malware-delivery step. Investigate the requested action and whether it actually ran.
Analysis · Retrospective 2024
The xz backdoor: why reviewing the repository was not enough
The 2024 disclosure put release archives, generated build files and distribution-specific build conditions inside the trust boundary.
Analysis · Retrospective 2023
One compromised supplier led into 3CX’s build systems
The 3CX investigation traced a compromised software input into another vendor’s release environment.
Analysis · Retrospective 2017
NotPetya spread through credentials as well as exploits
The NotPetya record connects a poisoned update, stolen credentials and remote administration across recovery boundaries.
Analysis · Retrospective 2017
WannaCry exposed a gap in patch verification
WannaCry, MS17-010 and the gap between a patch notice, installed software and a service that can recover.