Security research / Detection engineering

Security Research Field Notes

Independent analysis of threat actors, vulnerabilities, attack techniques, ransomware operations, adversary tooling and detection opportunities. Each report turns public evidence into practical guidance for security teams.

Research archive

31 reports

Vulnerability 19 Oct 2026 7 min read

Nightmare Eclipse: The Researcher, the Defender Exploits, and the Attacks That Followed

How Abdelhamid Naceri's Nightmare Eclipse disclosures became part of a wider story about Windows security flaws, public exploits, and real-world attacks.

Malware 17 Oct 2026 10 min read

ROMULUS ClickFix Platform Threat Research

Analysis of the ROMULUS malware-delivery platform, linked Custom GPT lures, Stardock DLL sideloading, LegionLoader delivery, and defensive priorities.

Data breach 15 Oct 2026 8 min read

Meta GitHub Breach: Stolen Credentials Expose Code and Personal Data

Analysis of the credential-driven repository breach that exposed Meta product code and personal data affecting about 1,500 people.

Supply-chain campaign 14 Oct 2026 10 min read

GhostAction Supply Chain Campaign Threat Research

Threat analysis of the GhostAction GitHub Actions credential theft campaign.

Malware 13 Oct 2026 8 min read

XWorm Malware Research Report

Evidence-grounded research on XWorm capabilities, observed campaigns, ATT&CK mappings, indicators, detection opportunities, and response.

Vulnerability 12 Oct 2026 10 min read

CVE-2026-105192: Critical LMCache Unauthenticated Remote Code Execution

Analysis of unsafe pickle deserialization in LMCache's unauthenticated multiprocess ZeroMQ transport, including exposure, remediation, and detection guidance.

Malware 07 Oct 2026 8 min read

PromptSteal and LAMEHUG Malware Research

Threat analysis of APT28-associated malware that uses a hosted large language model to generate and execute commands at runtime.

AI security 06 Oct 2026 9 min read

Slopsquatting and HalluSquatting Threat Research

Threat Analysis of AI package hallucinations, package-name squatting, supply-chain risk, and practical defenses.

Adversary tooling 05 Oct 2026 28 min read

NetExec Threat Hunting Research

Threat analysis of NetExec capabilities, observed threat use, lateral movement, credential access, and behavior-led hunting hypotheses.

Malware 01 Oct 2026 10 min read

OpenSUpdater Hides Malware in Recompiled 7-Zip SFX Installers

Analysis of a modified 7-Zip extraction stub, reflective loading chain, certificate evasion, indicators, and defensive guidance.

Adversary tooling 29 Sep 2026 20 min read

Abuse of RMM and Remote Access Tools

Evidence-based analysis of attacker abuse of remote management tools, with actor mappings, indicators, hunting hypotheses, and detection strategies.

Process injection 28 Sep 2026 8 min read

Beyond WriteProcessMemory: Detecting Console Named-Pipe Injection

How redirected console input can place payloads without WriteProcessMemory, and the behavioral signals defenders can still hunt.

Threat actor 25 Sep 2026 15 min read

Zirconium and Violet Typhoon Threat Actor Hunting Research

Evidence-based analysis of Zirconium target profiles, attack flows, ATT&CK techniques, tools, indicators, and hunting hypotheses.

Vulnerability 22 Sep 2026 9 min read

Not-a-Mused: How a Local Flaw Can Turn Meta's Muse Agent Against Its User

Analysis of a local Muse client flaw that enables dictation interception, prompt replacement, bearer-token theft, and access to delegated agent capabilities.

Vulnerability 20 Sep 2026 8 min read

Plugin4Shell: When a Pinned Plugin Is Not the Code That Runs

How broken commit pinning let malicious repositories replace reviewed AI-agent plugins with untrusted code.

Threat actor 18 Sep 2026 20 min read

Scattered Spider Threat Group Research and Hunting Hypotheses

Evidence-based profile of Scattered Spider, its identity-led attack flow, campaigns, tools, indicators, and detection opportunities.

Threat actor 17 Sep 2026 23 min read

ShinyHunters Hacker Group Hunting Research

Behavior-focused analysis of ShinyHunters data theft, SaaS abuse, extortion, indicators, and hunting hypotheses for Microsoft Defender XDR and Sentinel.

Exploit kit 11 Sep 2026 15 min read

BlueMoon Exploit Kit Threat Research and Hunting Hypotheses

Evidence-based analysis of BlueMoon exploitation, campaigns, vulnerabilities, evasion methods, indicators, ATT&CK mappings, and detection opportunities.

Phishing kit 07 Sep 2026 16 min read

EvilTokens Phishing Kit Threat Research and Hunting Hypotheses

Evidence-based analysis of EvilTokens device-code phishing, campaigns, evasion, ATT&CK mappings, and detection opportunities.

Supply-chain campaign 04 Sep 2026 18 min read

Shai-Hulud Software Supply-Chain Campaign Threat Research

Shai-Hulud campaign evolution, npm propagation, credential theft, CI/CD compromise, and behavior-led hunting hypotheses.

Phishing campaign 02 Sep 2026 12 min read

NovaCookies Campaign Analysis and Threat Hunting Research

NovaCookies phishing infrastructure, session-cookie theft, attack flow, indicators, and identity-focused hunting hypotheses.

Adversary tooling 01 Sep 2026 25 min read

Mimikatz Threat Research and Detection Hypotheses

Mimikatz capabilities, credential-access techniques, campaign use, evasion methods, and behavior-led detection hypotheses.

Ransomware 27 Aug 2026 23 min read

DeadLock Ransomware Threat Hunting Research

DeadLock operations, decentralized recovery infrastructure, attack flow, and behavior-led hunting hypotheses.

Ransomware 24 Aug 2026 22 min read

Medusa Ransomware Threat Hunting Research

Medusa intrusion patterns, double-extortion activity, actor context, and detection opportunities.

Threat actor 15 Aug 2026 22 min read

Transparent Tribe APT36 Threat Actor Hunting Research

APT36 targeting, evolving malware, campaign tradecraft, and durable behavioral indicators.

Ransomware 01 Aug 2026 24 min read

Gentlemen Ransomware-as-a-Service Threat Research

The Gentlemen affiliate ecosystem, domain-wide deployment methods, attack flow, and hunting guidance.

Adversary tooling 25 Jul 2026 28 min read

Cobalt Strike Threat Hunting Research

Adversary use of Cobalt Strike, resilient detection surfaces, evasion methods, and hunting hypotheses.

Phishing 21 Jul 2026 15 min read

Phishing Techniques Research for Hunting Development

Analysis of device code phishing, AiTM kits, OAuth abuse, ClickFix, vishing, rogue RDP lures, and behavior-led hunting opportunities.

Threat actor 08 Jun 2026 24 min read

Lazarus Group Threat Actor Hunting Research

Cluster-aware analysis of Lazarus Group attack flows, campaigns, tools, indicators, and hunting hypotheses for Microsoft Defender XDR and Sentinel.

Adversary tooling 30 Apr 2026 20 min read

Rubeus Threat Hunting Research

Evidence-based analysis of Rubeus capabilities, Kerberos abuse, observed threat use, evasion, and behavior-led hunting hypotheses.

Supply-chain campaign 08 Feb 2026 20 min read

GlassWorm Campaign Threat Research and Hunting Hypotheses

Evidence-based analysis of GlassWorm supply-chain activity, affected developer artifacts, indicators, actor profile, and detection opportunities.

About Sec Bites

Sec Bites publishes evidence-backed security research with clear confidence boundaries. Reports prioritize durable behaviors over short-lived indicators and include hypotheses that defenders can adapt to their own environments.