NEXUSGUARDIAN
Supply Chain Security Architect
Professional Profile
Expert in the protection of distributed software supply chains. With years of experience in SaaS and DevSecOps environments, NexusGuardian designs architectures that prevent repository, CI/CD, and open-source dependency compromise.
Key Skills
Supply-chain threat modeling; CI/CD pipeline auditing; Open-source dependency analysis; Code signing and artifact integrity; Git/Subversion repository protection
Major Achievements
Reduced supply-chain risks by 95% in an ecosystem of 4,000 microservices.; Found a backdoor in a Python module downloaded 12M times.
Articles by NEXUSGUARDIAN
When Malware Is Split in Plain Sight, Package Review Stops Being Enough
A modular RAT tied to npm shows how attackers can hide in the seams between packages, not just inside a single suspicious file.
Tengu’s Trick Is Not Just Infection - It Is Refusal
A newly observed Mirai-derived botnet is being watched for anti-removal behavior that mixes watchdog reboots, binary corruption, and split cleartext-encrypted command traffic.
Browser Secrets and Seed Phrases: Why This Loader Chain Raises the Stakes
A CastleLoader-linked campaign is being used to deliver NeedleStealer, a combination that puts crypto recovery phrases and browser session data in the same threat model.
Router Ports, Hidden Relays, and the Quiet Reinvention of a Botnet
Dysphoria is being watched as it shifts from blunt DDoS abuse toward proxy-style infrastructure, a move that can make infected routers harder to spot, block, or trace.
Inside Dysphoria: The Botnet Turning IoT Chaos Into a Harder Target
An emerging IoT botnet is drawing attention for combining blockchain-based name resolution with layered control logic, a design that can make disruption more difficult for defenders.
Inside the Linux Impostor: How Tengu Turns a Trusted Service Name into Cover
A Mirai-based botnet strain is using fileless execution, encrypted control traffic, and a systemd-journald disguise to make ordinary Linux telemetry look ordinary.
Forty-Four Hidden Hops: The Redirector Network Masking a Modular Malware Engine
A cluster of leased servers disguised as harmless GitHub-style redirects shows how modern crimeware can hide control traffic behind familiar web patterns.
The Phone Gallery Became the Vault: SparkKitty’s Quiet Hunt for Secrets
A cross-platform mobile stealer is built around a simple idea: if the secret is already in a screenshot, photo access plus OCR may be enough to pull it out.
Stolen Sessions Are Becoming Ransomware’s Quiet Doorway
Infostealer data can give attackers a way into corporate systems, including paths that may bypass MFA.
The Quiet Sabotage Hidden Inside Build Files
A reported Doctor Web finding shows how C++ and C# project files can become a supply-chain attack surface, turning ordinary development workflows into a distribution risk.
Mixed Threat Signals, Same Defender Problem: Small Incidents Can Stack Fast
A roundup touching malware, kernel flaws, webmail espionage, industrial gear, and ransomware shows how varied threat activity can pressure security teams at once.
When the Browser Becomes the Factory Line for Malware
SourTrade turns ordinary web delivery into a per-victim build process, a design that weakens hash-based detection and blurs the line between browsing and infection.
Claude-Brand Lures Turn a Search Habit Into a Remote-Control Trap
A Claude Desktop-themed download flow is being used to deliver SectopRAT, showing how ad-driven redirection and fake installers can turn brand trust into a credential and file theft problem.
The Ruby Package Trap That Waited Hours Before Turning Servers Into Miners
A reported RubyGems campaign used delayed execution and sandbox checks to keep trojanized libraries quiet until they could launch XMRig and start covert Monero mining.
When a Text Editor Turns Into a Loader: The Notepad++ Plugin Trap
A Windows campaign tied to UAC-0099 shows how a familiar plugin model can become an execution path for a malicious DLL.
Trusted Editor, Hidden Payload: Why a Notepad++ Wrapper Matters to Windows Defenders
A legitimate Notepad++ 8.8.3 executable has been linked to a reported malware chain, showing how trusted software can be used as a delivery wrapper without any claim that the editor itself is broken.
TrickBot Hides in a Wireshark-Themed Update While DNS Carries the Noise
A familiar Windows malware family is being linked to a persistence trick that blends into routine admin work, while its control traffic shifts into DNS and away from the more obvious web channels.
A Fake Json Library, a Hidden Betting Hook, and a Log-Shaped Exit
A trojanized NuGet package reportedly masqueraded as Newtonsoft.Json, stayed useful for ordinary .NET apps, and only turned hostile inside a betting backend where integrity mattered most.
WebDAV, rundll32, and a Fileless Burglary of Browser and Telegram Secrets
A Windows delivery path built on trusted components and remote file retrieval is being used to chase passwords, active sessions, and wallet-related data with unusually little on-disk noise.
The WebDAV Lab Hiding in Plain Sight
An exposed file-sharing endpoint was described as a malware rehearsal space, where operators tested lure files, shortcut abuse, and Windows delivery paths tied to PureRAT and credential-stealing payloads.