Blog and Research

The eMudhra CA Compromise, just another cautionary tale

Our take on the October 2026 eMudhra incident. Eight browser-trusted intermediate CA certificates signed with weak ECDSA P-384 keys whose private keys were small numbers.

HTML Smuggling 101

A technical deep dive into HTML Smuggling (T1027.006): browser-side payload reconstruction, Base64 and other encoding techniques, container-based delivery, Mark of the Web bypass, and detection approaches, with a practical Sliver C2 PoC.

Gunra Ransomware - FortiGate exploit to data encryption

Gunra first appeared in April 2025 on a Conti-derived codebase and has since grown into a ransomware-as-a-service operation. A technical deep dive into its Fortinet exploitation, Operation Double Barrel, and the full attack chain mapped to MITRE ATT&CK.

Emulating The Gentlemen Ransomware: Go Encryptor, BYOVD Framework, and Attack Chain

The Gentlemen are a ransomware-as-a-service operation (tracked by Microsoft as Storm-2697) that emerged around July-August 2025. They run the standard double extortion model, encrypt and threaten to leak, but move faster than most.

Security Drift: What happens when you let different AI agents build your APIs

The use of APIs has been increased with the introduction of AI agents and MCP servers. The problem is that during this fast development process using the agents, security controls are often overlooked or not implemented unless they are clearly stated.

Defense Evasion is dead! What MITRE ATT&CK v19 changed and how to work with it

MITRE released ATT&CK v19 on 28 April 2026, and the biggest change in this release is structural. Defense Evasion, which was the most heavily used tactic in the MITRE ATT&CK framework, it is gone.

What we know about the Axios npm supply chain compromise, and what to do about it.

I first read about this on March 31, sitting at Changi Airport on my way back from RSAC. Two malicious versions of Axios had been live on the npm registry overnight.

The Notepad++ supply-chain attack: what happened and how it worked

On February 2, 2026, the Notepad++ team disclosed a supply-chain compromise affecting their update infrastructure, confirming that attackers had gained persistent access to hosting systems for several months in 2025.

Tusker has a new friend. Upgrading CBAS training with Cobalt Strike.

Upgrading 'Mastering breach and adversarial attack simulation engagements' training at DEF CON Training Singapore with Cobalt Strike C2.

Nimbus Manticore: How an Iran-aligned APT weaponizes fake job portals and DLL side-loading

Nimbus Manticore is a highly sophisticated threat actor group, assumed to be aligned with Iranian state interests.

Scattered Spider: Inside the operations of a modern threat group

Scattered Spider is one of the most dangerous and active cyber criminal groups operating today.

Hello World!

Hello world from BreachSimRange! From Mammoth to the Tusker, the hunter becomes the hunted.