vivek@kali:~/blog$ grep -r "threat-intel" ./posts/

Security Research & Threat Intelligence

Field notes from active engagements - ethical hacking tutorials, cybercrime case studies, zero-day analysis, and blue team detection strategies.

Three Developer Supply Chain Attacks in One Week: NPM AMOS Stealer, Rogue VS Code Extension and GhostCommit AI Prompt Injection (July 2026) CVE-2026-5196
Featured - 10 min read
Three Developer Supply Chain Attacks in One Week: NPM AMOS Stealer, Rogue VS Code Extension and GhostCommit AI Prompt Injection (July 2026)
Three developer supply chain attacks confirmed in seven days: NPM AMOS stealer via @copilot-mcp/apex postinstall dropper, fake VS Code Markdown extension beaconing credentials, and GhostCommit PNG-embedded prompt injection…
Jul 30, 2026 DevSecOps
Read Full Post →
Microsoft July 2026 Patch Tuesday: 622 CVEs, Two Active Zero-Days and How SOC Teams Should Triage This Cycle CVE-2026-5194
Patch Management
Microsoft July 2026 Patch Tuesday: 622 CVEs, Two Active Zero-Days and How SOC Teams Should Triage This Cycle
Comprehensive analysis of Microsoft July 2026 Patch Tuesday covering record 622 CVEs including two actively exploited zero-days: CVE-2026-56164…
8 min
CVE-2026-58608: Windows Print Spooler TOCTOU Race Condition RCE, Exploitation Chain Analysis and Detection Queries CVE-2026-5192
Vulnerability Research
CVE-2026-58608: Windows Print Spooler TOCTOU Race Condition RCE, Exploitation Chain Analysis and Detection Queries
Deep dive into CVE-2026-58608 Windows Print Spooler TOCTOU race condition RCE with CVSS 8.8. Covers the use-after-free exploitation…
9 min
Salt Typhoon APT Analysis 2025: GhostSpider Malware, US Telecom Breach, and Threat Hunting Queries for SOC Teams CVE-2026-5190
APT Analysis
Salt Typhoon APT Analysis 2025: GhostSpider Malware, US Telecom Breach, and Threat Hunting Queries for SOC Teams
Deep technical analysis of the Salt Typhoon APT campaign that breached nine US telecom carriers and accessed CALEA…
Jul 29, 2026 11 min
CALEA Chinese APT Cisco IOS XE
Volt Typhoon Threat Hunting in 2025: KQL, Splunk, and Sigma Detection Guide for Living-Off-the-Land APT CVE-2026-5188
APT Analysis
Volt Typhoon Threat Hunting in 2025: KQL, Splunk, and Sigma Detection Guide for Living-Off-the-Land APT
A complete threat hunting guide for detecting Volt Typhoon living-off-the-land techniques. Includes verified KQL queries for Microsoft Sentinel,…
14 min
Chinese APT CISA advisory critical infrastructure
Krybit Ransomware Hits Indian Pharma and IT: LAXAI Life Sciences and Vibonum Technologies Attacked in 72 Hours CVE-2026-5186
Cyber Awareness
Krybit Ransomware Hits Indian Pharma and IT: LAXAI Life Sciences and Vibonum Technologies Attacked in 72 Hours
Emerging ransomware group Krybit has attacked two Indian companies in 72 hours: LAXAI Life Sciences (pharma CRDMO) on…
Jul 28, 2026 8 min
India IT security 2026 India ransomware 2026 Krybit ransomware
Hinduja Tech Ransomware Attack 2026: Global Secret Group Claims 515 GB of BMW and Skoda Auto Supply Chain Data CVE-2026-5184
Cyber Awareness
Hinduja Tech Ransomware Attack 2026: Global Secret Group Claims 515 GB of BMW and Skoda Auto Supply Chain Data
Ransomware group Global Secret Group claimed a major attack on Hinduja Tech on July 26, 2026, exfiltrating 515…
7 min
automotive cybersecurity BMW supply chain hack engineering services cyber attack
Kudankulam Nuclear Plant Breach: World Leaks Ransomware Exposes 19,000 Files Including Reactor Blueprints CVE-2026-5182
Cyber Awareness
Kudankulam Nuclear Plant Breach: World Leaks Ransomware Exposes 19,000 Files Including Reactor Blueprints
The ransomware group World Leaks has dumped 19,000 files (14.3 GB) from Kudankulam Nuclear Power Plant including blueprints…
7 min
India critical infrastructure Kudankulam nuclear breach NPCIL breach
DRDO Data Breach 2026: 31 GB of Classified Missile Guidance Data Being Sold on Dark Web for $8,000 CVE-2026-5180
Cyber Awareness
DRDO Data Breach 2026: 31 GB of Classified Missile Guidance Data Being Sold on Dark Web for $8,000
A threat actor is selling 31 GB of allegedly stolen DRDO data including advanced missile guidance sensor electronics…
8 min
Babuk2 dark web data sale defence cybersecurity India
CVE-2025-0282: Ivanti Connect Secure Zero-Day Exploited by Nation-State Hackers Before Anyone Knew It Existed CVE-2026-5178
Exploits
CVE-2025-0282: Ivanti Connect Secure Zero-Day Exploited by Nation-State Hackers Before Anyone Knew It Existed
CVE-2025-0282 is a critical pre-authentication stack buffer overflow in Ivanti Connect Secure VPN (CVSS 9.0). Exploited by China-nexus…
Jul 22, 2026 7 min
China APT CISA emergency CVE-2025-0282