NEXUSGUARDIAN
Arquitecto de seguridad de la cadena de suministro
Perfil profesional
Experto en la protección de cadenas de suministro de software distribuidas. Con años de experiencia en entornos SaaS y DevSecOps, NexusGuardian diseña arquitecturas que evitan el compromiso de repositorios, CI/CD y dependencias open source.
Competencias clave
Modelado de amenazas de cadena de suministro; auditoría de pipelines CI/CD; análisis de dependencias open source; firma de código e integridad de artefactos; protección de repositorios Git/Subversion
Logros principales
Redujo los riesgos de la cadena de suministro en un 95% en un ecosistema de 4.000 microservicios.; Encontró una puerta trasera en un módulo de Python descargado 12 millones de veces.
Artículos de NEXUSGUARDIAN
Fake Wallet Extensions Turn the Browser Into a Secret-Taking Machine
A cluster of lookalike Firefox add-ons targeting Rabby users shows how browser-wallet security can fail before encryption even enters the picture.
Rotating Domains, Fixed Habits: The Trail Behind a Mac Stealer Campaign
A moving domain set can hide infrastructure for a while, but repeated host and network behavior can still expose a macOS infostealer cluster.
MacOS Infostealer Swaps Domains Faster Than Defenders Can Block Them
MacSync Stealer shows how credential theft on Mac can survive exposure by treating infrastructure as disposable, not fixed.
The Forgotten Driver Page That Turned Into a Trust Problem
A stale support download, a malicious flag, and a domain with an old Asruex connection show how retired web assets can become risky long after a portal migration.
Old Support Link, New Malware Fear: The Hidden Risk of Driver Archives
A malware-flagged Realtek LAN driver on a legacy mini PC support page shows how stale downloads can turn ordinary maintenance into a supply-chain question.
Lookalike Gems, Real Damage: A Ruby Package Trap Aimed at Developers
A typosquatting run against RubyGems shows how a single mistaken install can push a Windows stealer toward browser credentials and crypto-wallet secrets.
Shadow hVNC Turns a Windows Desktop Into a Quiet Criminal Workbench
A Windows-focused malware-as-a-service package is advertised as a bundled access stack, mixing hidden desktop control, browser credential theft, reverse proxying, and persistence in one operator-friendly toolkit.
Evooo1Bot Shows How a Router Can Become Both a Weapon and a Hideout
A Linux botnet named Evooo1Bot is turning exposed routers, cameras, edge appliances, and enterprise systems into DDoS bots and proxy nodes, using a Mirai-like playbook that mixes brute force, exploitation, and relay abuse.
When a Recruiter Link Becomes a Malware Filter
A fake Web3 hiring pitch, a Google-hosted Apps Script page, and signed Windows malware show how attackers can use trust as a staging layer before they ever touch a victim’s machine.
Inside the Quiet Windows Trap: PE Corruption, WMI Persistence, and the Art of Staying Small
A custom backdoor found on a legacy Windows 7 workstation shows how attackers can combine file-format tampering with durable system hooks to stay hard to spot.
A 12 KB Windows Ghost Hid in Plain Sight
A tiny x64 backdoor dressed itself as Realtek software, used WMI for persistence, and tucked its command channel into a nearly empty desktop.ini file - a reminder that ordinary Windows features can become stealth infrastructure.
When a Trusted Release Path Becomes the Payload
A high-reach npm supply-chain campaign shows how compromised publishing identities and clean-looking provenance can turn release automation into a delivery channel for poisoned packages.
Windows at Kernel Depth: The Stealth Trick That Can Hide a Backdoor’s Breath
A reported CoolClient update moves concealment into the Windows kernel, where a rootkit can make C2-related network activity harder to trust from the host itself.
Evooo1Bot Turns Exposed Routers Into Quiet SOCKS5 Relays
A newly reported Mirai-based Linux botnet is being linked to internet-facing gateway devices, with infected routers repurposed as traffic relay nodes rather than simple spam or flood engines.
Dysphoria’s Quiet Power Grab: 296,000 Infected Devices Become a Crimeware Utility
A botnet built from routers, gateways, and IP cameras is doing more than flooding targets - it is also being used as proxy and relay infrastructure.
The Hidden Windows Trick Behind a DCRat Phishing Run
A legal-themed email, an SVG file, and two classic Windows trust-abuse techniques show how commodity malware can disappear into ordinary process activity.
Telecom Branding, Hidden Installers, and a Quiet Remote-Control Layer
A sector-themed ZIP, a Windows installer, and a SuperShell control layer show how trusted packaging can be bent into an intrusion path without relying on a flashy exploit.
Google Docs as a Dead Drop: The Quiet Trick Behind Jewelbug’s Malware Channel
A reported Jewelbug operation uses public Google Docs to stage malware content, showing how trusted cloud services can be repurposed into low-noise command infrastructure.
A Microphone, a Messenger, and a Rust Payload: The Quiet Anatomy of a Windows Spyware Run
A newly documented espionage campaign points to a simple but unsettling formula: compromise a Windows endpoint, then turn its microphone and logged-in chat sessions into surveillance tools.
Phantom Stealer Bets on Ordinary Trust to Break Windows Defenses
A .NET infostealer is being pushed through phishing, cracked installers, and chat links, showing how credential theft often begins with a familiar click rather than an exotic exploit.