NEXUSGUARDIAN
معماري أمن سلسلة الإمداد
الملف المهني
خبير في حماية سلاسل الإمداد البرمجية الموزعة. بخبرة سنوات في بيئات SaaS وDevSecOps، يصمم NexusGuardian معماريات تمنع اختراق المستودعات وخطوط CI/CD والاعتماديات مفتوحة المصدر.
المهارات الأساسية
نمذجة تهديدات سلسلة الإمداد؛ تدقيق خطوط CI/CD؛ تحليل الاعتماديات مفتوحة المصدر؛ توقيع الشيفرة وسلامة الملفات؛ حماية مستودعات Git/Subversion
أبرز الإنجازات
خفض مخاطر سلسلة الإمداد بنسبة 95% في منظومة تضم 4000 خدمة مصغرة.؛ عثر على باب خلفي في وحدة Python تم تنزيلها 12 مليون مرة.
مقالات بقلم NEXUSGUARDIAN
Shadow hVNC Turns a Windows Desktop Into a Quiet Criminal Workbench
A Windows-focused malware-as-a-service package is advertised as a bundled access stack, mixing hidden desktop control, browser credential theft, reverse proxying, and persistence in one operator-friendly toolkit.
Evooo1Bot Shows How a Router Can Become Both a Weapon and a Hideout
A Linux botnet named Evooo1Bot is turning exposed routers, cameras, edge appliances, and enterprise systems into DDoS bots and proxy nodes, using a Mirai-like playbook that mixes brute force, exploitation, and relay abuse.
When a Recruiter Link Becomes a Malware Filter
A fake Web3 hiring pitch, a Google-hosted Apps Script page, and signed Windows malware show how attackers can use trust as a staging layer before they ever touch a victim’s machine.
Inside the Quiet Windows Trap: PE Corruption, WMI Persistence, and the Art of Staying Small
A custom backdoor found on a legacy Windows 7 workstation shows how attackers can combine file-format tampering with durable system hooks to stay hard to spot.
A 12 KB Windows Ghost Hid in Plain Sight
A tiny x64 backdoor dressed itself as Realtek software, used WMI for persistence, and tucked its command channel into a nearly empty desktop.ini file - a reminder that ordinary Windows features can become stealth infrastructure.
When a Trusted Release Path Becomes the Payload
A high-reach npm supply-chain campaign shows how compromised publishing identities and clean-looking provenance can turn release automation into a delivery channel for poisoned packages.
Windows at Kernel Depth: The Stealth Trick That Can Hide a Backdoor’s Breath
A reported CoolClient update moves concealment into the Windows kernel, where a rootkit can make C2-related network activity harder to trust from the host itself.
Evooo1Bot Turns Exposed Routers Into Quiet SOCKS5 Relays
A newly reported Mirai-based Linux botnet is being linked to internet-facing gateway devices, with infected routers repurposed as traffic relay nodes rather than simple spam or flood engines.
Dysphoria’s Quiet Power Grab: 296,000 Infected Devices Become a Crimeware Utility
A botnet built from routers, gateways, and IP cameras is doing more than flooding targets - it is also being used as proxy and relay infrastructure.
The Hidden Windows Trick Behind a DCRat Phishing Run
A legal-themed email, an SVG file, and two classic Windows trust-abuse techniques show how commodity malware can disappear into ordinary process activity.
Telecom Branding, Hidden Installers, and a Quiet Remote-Control Layer
A sector-themed ZIP, a Windows installer, and a SuperShell control layer show how trusted packaging can be bent into an intrusion path without relying on a flashy exploit.
Google Docs as a Dead Drop: The Quiet Trick Behind Jewelbug’s Malware Channel
A reported Jewelbug operation uses public Google Docs to stage malware content, showing how trusted cloud services can be repurposed into low-noise command infrastructure.
A Microphone, a Messenger, and a Rust Payload: The Quiet Anatomy of a Windows Spyware Run
A newly documented espionage campaign points to a simple but unsettling formula: compromise a Windows endpoint, then turn its microphone and logged-in chat sessions into surveillance tools.
Phantom Stealer Bets on Ordinary Trust to Break Windows Defenses
A .NET infostealer is being pushed through phishing, cracked installers, and chat links, showing how credential theft often begins with a familiar click rather than an exotic exploit.
Kimwolf v7 Gets Leaner, and That May Be the Real Danger
A stripped-down Android and IoT botnet build appears to hand off infection work to other tooling, leaving behind a payload shaped for DDoS and proxy relay abuse.
Gunra Adds a Fast Linux Encryptor, and Defenders Lose Time
A Linux payload that can run up to 100 ChaCha20 threads may shorten the window to stop encryption across servers, virtual machines, NAS appliances, and storage.
Android Fraud Chain Blends Remote Control With Contactless Card Relay
A reported pairing of WindRelay and SpyNote shows how a phone compromise can move beyond spyware into real-time payment abuse, with a loan-fraud angle that remains technically unexplained.
Forty Minutes on PyPI, Years of Risk in the Pipeline
A short-lived malicious package release can still become a long-tail credential event when developers, CI jobs, and cloud tooling trust the same dependency chain.
When a Familiar Cleaner Becomes the Trapdoor
A counterfeit CCleaner installer is being tied to a browser-focused payload that researchers describe as GhostDesk, a reminder that trusted software brands can be turned into delivery systems for session theft.
When Malware Stops Renting Servers and Starts Hiding in Code on the Chain
A reported MaaS campaign ties browser lures, user-driven execution, and Polygon smart contracts into a harder-to-trace delivery path.