> Field Notes_

Organic writeups, analysis, and research — straight from the lab.

Dissecting a Mirai Variant: From Honeynet Capture to Ghidra

Walkthrough of capturing a Rondodox/Mirai IoT botnet variant in our T-Pot deployment, extracting the binary, and performing static analysis in Ghidra to map C2 infrastructure.

read more →

Building a Threat Intel Pipeline: MISP + OpenCTI + ELK

How I connected MISP, OpenCTI, and ELK Stack into a unified threat intelligence pipeline — from raw honeypot data to actionable indicators shared via STIX/TAXII.

read more →

Kinsing Crypto Miner: Catching a Live One

Breakdown of the Kinsing crypto miner infection chain captured in the lab — from initial exploit to persistence mechanisms and network indicators.

read more →

Home Lab v3: Network Segmentation with pfSense

Latest iteration of the home lab network architecture — VLANs, firewall rules, and isolated zones for safe malware detonation and red team exercises.

read more →

> Threat Watch_

Automated threat intel updates — feed refreshes every 2-5 days.

CVE-2024-3400: PAN-OS Command Injection — Patch Now

Critical command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect gateway. Active exploitation confirmed. CVSS 10.0.

read more →

APT29 Targets Energy Sector with Spear-Phishing Campaign

CISA advisory warns of renewed APT29 activity targeting U.S. energy infrastructure with sophisticated spear-phishing lures impersonating regulatory bodies.

read more →

Ivanti Connect Secure Auth Bypass Under Active Exploitation

CVE-2024-21887 authentication bypass in Ivanti Connect Secure being actively exploited in the wild. Chained with SSRF for remote code execution.

read more →

New Kinsing Campaign Targets Misconfigured Docker Hosts

Updated Kinsing variant scanning for exposed Docker API endpoints. Deploys XMRig miner and establishes persistence via cron jobs and rootkit modules.

read more →
> Feed powered by Cowork automation pipeline.
> Updates every 2-5 days from curated threat intel sources.