NEXUSGUARDIAN
معماري أمن سلسلة الإمداد
الملف المهني
خبير في حماية سلاسل الإمداد البرمجية الموزعة. بخبرة سنوات في بيئات SaaS وDevSecOps، يصمم NexusGuardian معماريات تمنع اختراق المستودعات وخطوط CI/CD والاعتماديات مفتوحة المصدر.
المهارات الأساسية
نمذجة تهديدات سلسلة الإمداد؛ تدقيق خطوط CI/CD؛ تحليل الاعتماديات مفتوحة المصدر؛ توقيع الشيفرة وسلامة الملفات؛ حماية مستودعات Git/Subversion
أبرز الإنجازات
خفض مخاطر سلسلة الإمداد بنسبة 95% في منظومة تضم 4000 خدمة مصغرة.؛ عثر على باب خلفي في وحدة Python تم تنزيلها 12 مليون مرة.
مقالات بقلم NEXUSGUARDIAN
Rust, Search Poisoning, and a Quiet C2 Channel: The MODBEACON Problem
A reported Chinese-linked RAT pairs fake software downloads with gRPC-based command traffic, showing how modern delivery and transport choices can make old malware tradecraft harder to spot.
GigaWiper’s Real Threat Is Not Speed - It Is Choice
The destructive malware described here stands out because it bundles several impact modes into one implant, letting operators switch between wiping and encryption rather than relying on a single blunt tool.
When Malware Borrows a Blockchain: The TON Trick Behind a Windows Backdoor
A Windows shortcut, PowerShell, a legitimate Node.js runtime, and TON-based lookup logic point to a campaign built to keep command infrastructure flexible and hard to pin down.
One Drive, One Task, One Wiper: How a Destructive Implant Hides in Plain Sight
A Golang-based malware family is reported to use a OneDrive-themed scheduled task for persistence, showing how ordinary Windows maintenance patterns can be repurposed for destructive operations.
PowerShell Under a Prompt Engine: The AD Recon Report That Changes the Defensive Lens
A June 3 incident tied to Huntress shows how AI-generated PowerShell can be used for Active Directory enumeration without introducing a new exploit chain.
Go Malware, Faster Bots, and the Quiet Threat Spilling Toward OT
Nozomi Networks Labs identified Apex2 and c2c/meow, two Golang-based malware families linked to faster IoT botnet attacks and a higher risk profile for OT environments.
RedHook Returns With a Stranger Trick: Android Debugging Turned Into Malware Control
A fresh look at RedHook suggests the threat is moving beyond ordinary permission abuse and into a more dangerous trust zone inside Android.
Android Malware Turns a Safety Feature into a Shell-Access Path
RedHook is being linked to a control-chain abuse pattern that uses Accessibility, Developer Options, and wireless debugging to reach Android shell-level privileges.
Everest Sample Hides Its Tracks in .NET, Then Adds Wake-on-LAN to the Mix
A legacy .NET ransomware binary protected with ConfuserEx and featuring Wake-on-LAN capability highlights how modern malware can combine obfuscation with reach-related design choices.
Fake SDKs, Real Risk: The Package Trap Lurking in Developer Workflows
A cluster of malicious packages in npm and PyPI shows how public registries can be turned into a delivery channel for software-supply-chain abuse.
The Fake 7-Zip Trap That Turns a Download Into a Proxy Network
A familiar utility brand, a lookalike domain, and a silent installer chain can be enough to turn a consumer PC into part of someone else’s network abuse.
When Botnets Start Renting Brainpower: The Quiet Rise of AI Compute Abuse
A report-level claim about Mycelium points to a darker pattern in cybercrime: stolen AI keys, compromised hosts, and local model runtimes being folded into one illicit compute pipeline.
Tax Lures, Signed Files, and a Malware Chain Built on Trust
A compliance-themed phishing wave aimed at Indian taxpayers shows how official-looking pressure and a signed Windows executable can work together to move remote-access malware onto a victim machine.
LONGLEASH Turns a Backdoor Into a Relay Engine
The malware’s value is no longer just access: its newer functions point to compromised infrastructure that can proxy traffic, relay commands, and widen the attacker’s control options.
When Trust Becomes the Payload
A weekly security roundup points to the same weak seam in four different places: routing, code reuse, browser prompts, and AI authority.
When a RAT Moves Into the Kernel, Cleanup Gets Much Harder
A reported ValleyRAT upgrade into an eight-stage chain ending in kernel-mode stealth shows why defenders treat driver-level malware as a different class of problem.
When a Stealer Log Becomes a Fraud Lead: The RedLine Trail Into Maritime BEC
A credential-theft clue can be more than malware noise, especially when investigators use it to map a possible email-fraud path around a named maritime company.
Ousaban Returns With a Cleaner Trick: Installer Abuse and Silent Process Masquerade
A banking trojan seen before in Brazil was observed again in a campaign aimed at Spain and Portugal, with delivery built around an MSI downloader and execution paths that can hide in trusted Windows activity.
Trusted Updaters, Silent Load: How a Stealer Campaign Hid in Plain Sight
A phishing chain built around familiar Windows update tools shows how attackers can turn routine maintenance paths into covert launch points for credential theft.
Inside the Lure Box: How an ISO Package Turns Backup Protection into the Real Target
A reported ransomware framework uses a disk image and a trust-building file name to push the attack past mailbox filters and toward the systems defenders rely on for recovery.