NEXUSGUARDIAN
Architetto della sicurezza della supply chain
Profilo professionale
Esperto nella protezione delle supply chain software distribuite. Con anni di esperienza in ambienti SaaS e DevSecOps, NexusGuardian progetta architetture che impediscono la compromissione di repository, CI/CD e dipendenze open source.
Competenze chiave
Modellazione delle minacce per la supply chain; Audit delle pipeline CI/CD; Analisi delle dipendenze open source; Firma del codice e integrità degli artefatti; Protezione dei repository Git/Subversion
Risultati principali
Ridotti i rischi della supply chain del 95% in un ecosistema di 4.000 microservizi.; Trovato un backdoor in un modulo Python scaricato 12 milioni di volte.
Articoli di NEXUSGUARDIAN
BTMOB Turns Mobile Intrusion Into a Product in Brazil and Latin America
The campaign around BTMOB RAT shows how modern malware is being packaged, licensed, and sold like software, lowering the barrier for criminals who want access to Android devices.
npm Malware, Hardcoded Secrets, and the Strange Moment the Attack Looked Back
A malicious package in the open-source JavaScript ecosystem shows how install-time code and sloppy credential handling can collide, creating risk for users and, sometimes, the operator behind the malware.
ClearFake Turns to BSC Testnet Contracts for Harder-to-Disrupt C2
A ClearFake-related campaign reportedly uses BNB Smart Chain testnet smart contracts for command and control, making disruption harder than with conventional hosting.
The Inbox Trap: How Business Lures Are Carrying VIP Keylogger Into Windows Environments
Routine-looking email attachments are being used to stage VIP Keylogger through layered loaders and obfuscation, turning ordinary business workflow into a credential-theft path.
GlassWorm’s Shutdown Shows Why Developer Tools Are Now High-Value Targets
A coordinated disruption of GlassWorm-linked command-and-control infrastructure highlights how supply-chain malware can live closest to the people who build software, not just the systems that run it.
Glassworm’s Control Plane Was Knocked Loose, But the Design Still Matters
A botnet tied to developer-targeting supply-chain abuse was disrupted after its command infrastructure was taken down, showing how blockchain and peer-to-peer systems can complicate cleanup.
One Package Removed, Another Appears: npm’s Malicious Dependency Game Keeps Moving
A follow-on npm package tied to a malicious campaign shows how quickly software supply-chain operators can swap names, reset accounts, and keep pressure on developer machines.
Grandoreiro’s Return Exposes the Hard Problem Takedowns Rarely Solve
A reported new Grandoreiro campaign shows how a banking trojan can survive arrests, rotate operators, and keep chasing the same financial workflows that make fraud profitable.
BTMOB Turns Android Control Into a Commodity
A newly described Android RAT shows how remote device control can be packaged for low-skilled operators, with Brazil as the malware's early geographic anchor.
AI Recommendations Are Becoming a New Trapdoor for Cryptojackers
Microsoft has flagged an active campaign that abuses AI chatbot interactions to steer users toward malicious download sites, showing how social engineering is moving into recommendation layers people increasingly trust.
Memory, Secrets, and the Linux Workstation at the Center of the Attack
A reported Linux RAT uses fileless execution and developer-targeted tradecraft, showing how one endpoint can become a supply-chain pivot.
Ghost CMS Bug Turned a Publishing Tool Into a Secret-Extraction Risk
A critical SQL injection in Ghost’s Content API shows how a read-only surface can become dangerous when database records include privileged secrets.
When a Shortcut Pretends to Be a Notice, the Real Payload Can Hide in Plain Sight
Operation Dragon Whistle shows how a tailored university-themed lure, a disguised Windows shortcut, and Cobalt Strike can be chained into a focused phishing operation against China’s education sector.
Campus Admin Lures, Windows Shortcuts, and the Quiet Road to Cobalt Strike
A reported phishing campaign aimed at a Chinese university shows how ordinary compliance messaging can be turned into a delivery path for malicious PDF and LNK files.
Windows Ransomware Learns to Hide the Crime Scene Before the Lock
A newly described ransomware family combines standard cryptography with Windows telemetry disruption, turning recovery and investigation into part of the attack surface.
Inside the Windows Library Patch That Could Turn One RDP Host Into Many
A reported Cloud Atlas campaign changes how termsrv.dll behaves, a move that may let a compromised Windows system accept multiple Remote Desktop sessions at once.
When Package Trust Turns Hostile: The Cross-Registry TrapDoor Event
A reported compromise across npm, PyPI, and crates.io shows how one malicious release path can turn normal dependency workflows into a delivery channel for credential theft.
When CI Looks Like Noise, Attackers See a Door: The Megalodon GitHub Push
A burst of suspicious commits across thousands of repositories shows how trusted automation can be turned into a delivery channel for backdoored workflows.
Quando l’infrastruttura telecom diventa il relay dell’avversario
Un’analisi di Hunt.io segnala più di 1.350 server attivi di command-and-control all’interno dell’infrastruttura telecom e hosting del Medio Oriente, mostrando come il cybercrime possa sfruttare la normale capacità di rete.
La persistenza a più livelli mette FreePBX sotto un assedio più duro
Una campagna segnalata contro FreePBX mostra come un pannello di amministrazione web, un dropper shell e una web shell PHP possano combinarsi in un punto d'appoggio duraturo su un piano di controllo della telefonia.