NEXUSGUARDIAN
Architecte de sécurité de la supply chain
Profil professionnel
Expert dans la protection des chaînes d’approvisionnement logicielle distribuées. Fort de nombreuses années d’expérience dans les environnements SaaS et DevSecOps, NexusGuardian conçoit des architectures qui empêchent la compromission des dépôts, de CI/CD et des dépendances open source.
Compétences clés
Modélisation des menaces de supply chain; audit des pipelines CI/CD; analyse des dépendances open source; signature de code et intégrité des artefacts; protection des dépôts Git/Subversion
Réalisations majeures
Réduction des risques de supply chain de 95 % dans un écosystème de 4 000 microservices.; découverte d’une backdoor dans un module Python téléchargé 12 M de fois.
Articles de NEXUSGUARDIAN
A 12 KB Windows Ghost Hid in Plain Sight
A tiny x64 backdoor dressed itself as Realtek software, used WMI for persistence, and tucked its command channel into a nearly empty desktop.ini file - a reminder that ordinary Windows features can become stealth infrastructure.
When a Trusted Release Path Becomes the Payload
A high-reach npm supply-chain campaign shows how compromised publishing identities and clean-looking provenance can turn release automation into a delivery channel for poisoned packages.
Windows at Kernel Depth: The Stealth Trick That Can Hide a Backdoor’s Breath
A reported CoolClient update moves concealment into the Windows kernel, where a rootkit can make C2-related network activity harder to trust from the host itself.
Evooo1Bot Turns Exposed Routers Into Quiet SOCKS5 Relays
A newly reported Mirai-based Linux botnet is being linked to internet-facing gateway devices, with infected routers repurposed as traffic relay nodes rather than simple spam or flood engines.
Dysphoria’s Quiet Power Grab: 296,000 Infected Devices Become a Crimeware Utility
A botnet built from routers, gateways, and IP cameras is doing more than flooding targets - it is also being used as proxy and relay infrastructure.
The Hidden Windows Trick Behind a DCRat Phishing Run
A legal-themed email, an SVG file, and two classic Windows trust-abuse techniques show how commodity malware can disappear into ordinary process activity.
Telecom Branding, Hidden Installers, and a Quiet Remote-Control Layer
A sector-themed ZIP, a Windows installer, and a SuperShell control layer show how trusted packaging can be bent into an intrusion path without relying on a flashy exploit.
Google Docs as a Dead Drop: The Quiet Trick Behind Jewelbug’s Malware Channel
A reported Jewelbug operation uses public Google Docs to stage malware content, showing how trusted cloud services can be repurposed into low-noise command infrastructure.
A Microphone, a Messenger, and a Rust Payload: The Quiet Anatomy of a Windows Spyware Run
A newly documented espionage campaign points to a simple but unsettling formula: compromise a Windows endpoint, then turn its microphone and logged-in chat sessions into surveillance tools.
Phantom Stealer Bets on Ordinary Trust to Break Windows Defenses
A .NET infostealer is being pushed through phishing, cracked installers, and chat links, showing how credential theft often begins with a familiar click rather than an exotic exploit.
Kimwolf v7 Gets Leaner, and That May Be the Real Danger
A stripped-down Android and IoT botnet build appears to hand off infection work to other tooling, leaving behind a payload shaped for DDoS and proxy relay abuse.
Gunra Adds a Fast Linux Encryptor, and Defenders Lose Time
A Linux payload that can run up to 100 ChaCha20 threads may shorten the window to stop encryption across servers, virtual machines, NAS appliances, and storage.
Android Fraud Chain Blends Remote Control With Contactless Card Relay
A reported pairing of WindRelay and SpyNote shows how a phone compromise can move beyond spyware into real-time payment abuse, with a loan-fraud angle that remains technically unexplained.
Forty Minutes on PyPI, Years of Risk in the Pipeline
A short-lived malicious package release can still become a long-tail credential event when developers, CI jobs, and cloud tooling trust the same dependency chain.
When a Familiar Cleaner Becomes the Trapdoor
A counterfeit CCleaner installer is being tied to a browser-focused payload that researchers describe as GhostDesk, a reminder that trusted software brands can be turned into delivery systems for session theft.
When Malware Stops Renting Servers and Starts Hiding in Code on the Chain
A reported MaaS campaign ties browser lures, user-driven execution, and Polygon smart contracts into a harder-to-trace delivery path.
Paste Once, Pay Later: How Blockchain Staging Is Reviving Old Malware Tricks
A recent ACN CSIRT Italia advisory points to a campaign that mixes ClickFix-style social engineering with EtherHiding on BNB Smart Chain, turning a simple copy-paste prompt into a delivery path for malicious code.
Fake PsExec Signals How Ransomware Hides Inside Routine Windows Work
Play ransomware is linked to a custom Windows service binary named PSexesvc.exe, a disguise designed to look like familiar administrative tooling.
The Trusted Plugin Trap: How a Solidity-Branded VS Code Add-on Became a Secret-Clearing Risk
A malicious extension family tied to Solidity Pro put a familiar developer workflow under suspicion, showing how an editor plugin can become a high-value path to wallets, API keys, and credentials.
When a Conference Server Starts Handing Out Malware
A reported compromise of TrueConf infrastructure shows how a trusted download path can become the delivery point for backdoors if server-side integrity slips.