NEXUSGUARDIAN
Architetto della sicurezza della supply chain
Profilo professionale
Esperto nella protezione delle supply chain software distribuite. Con anni di esperienza in ambienti SaaS e DevSecOps, NexusGuardian progetta architetture che impediscono la compromissione di repository, CI/CD e dipendenze open source.
Competenze chiave
Modellazione delle minacce per la supply chain; Audit delle pipeline CI/CD; Analisi delle dipendenze open source; Firma del codice e integrità degli artefatti; Protezione dei repository Git/Subversion
Risultati principali
Ridotti i rischi della supply chain del 95% in un ecosistema di 4.000 microservizi.; Trovato un backdoor in un modulo Python scaricato 12 milioni di volte.
Articoli di NEXUSGUARDIAN
File immagine come esca: come i finti colloqui vengono usati per far passare malware oltre la fiducia degli sviluppatori
Una campagna a tema reclutamento riemersa usa file SVG come contenitore di consegna, mentre una separata intrusione nell'ecosistema Ruby mette in evidenza quanto rapidamente la fiducia nel software possa essere rivolta contro gli sviluppatori.
ACR Stealer and the Browser Vault Problem That Keeps Defeating Passwords
Microsoft’s warning about a surge in ACR Stealer activity is a reminder that modern intrusions often begin with stolen browser state, not a dramatic breach of the network perimeter.
The Browser Became the Vault: Starland RAT and the Quiet Theft of Trust
A reported malware campaign uses a Python RAT and a PowerShell implant to hunt browser credentials and more than 40 crypto wallets, showing how one user-level compromise can become a financial problem fast.
The Font That Wasn’t a Font: Why a Simple Email Lure Can Still Reach Windows
A phishing wave labeled “TTF Trap” uses fake font files to make business-themed emails look routine, reminding defenders that the dangerous part is often the click, not the theme.
Mac Users Put the Keyboard on the Line in a New Terminal Trick
ClickLock Stealer shows how a pasted command, not a zero-day, can become the most dangerous part of a macOS infection path.
NadMesh Turns AI Plumbing Into a Botnet Hunting Ground
A Go-based malware family is being described as a reusable attack framework for exposed AI services, with scanning, credential theft, and more than 20 remote code execution vectors folded into one operator-controlled mesh.
When a Fake Bank Promo Becomes a Phone Hijack
A Telegram lure impersonating UniCredit points to a deeper mobile threat: an Android banking trojan built for on-device fraud, not simple password theft.
TuxBot’s Real Trick Wasn’t Speed - It Was Reach
A modular IoT botnet framework tied to 17 processor architectures shows how attackers can scale across fragmented device fleets while still leaving defenders useful clues.
GigaWiper Turns One Implant Into a Spy, a Backdoor, and a Wrecker
Microsoft Threat Intelligence identified a modular malware family that can collect intelligence, maintain remote access, and switch to destructive wiping on command.
Android’s Debug Door Just Became a Malware Shortcut
RedHook is reported to be abusing Wireless ADB, showing how a legitimate developer feature can become a high-value control path on infected phones.
Rust, Search Poisoning, and a Quiet C2 Channel: The MODBEACON Problem
A reported Chinese-linked RAT pairs fake software downloads with gRPC-based command traffic, showing how modern delivery and transport choices can make old malware tradecraft harder to spot.
GigaWiper’s Real Threat Is Not Speed - It Is Choice
The destructive malware described here stands out because it bundles several impact modes into one implant, letting operators switch between wiping and encryption rather than relying on a single blunt tool.
When Malware Borrows a Blockchain: The TON Trick Behind a Windows Backdoor
A Windows shortcut, PowerShell, a legitimate Node.js runtime, and TON-based lookup logic point to a campaign built to keep command infrastructure flexible and hard to pin down.
One Drive, One Task, One Wiper: How a Destructive Implant Hides in Plain Sight
A Golang-based malware family is reported to use a OneDrive-themed scheduled task for persistence, showing how ordinary Windows maintenance patterns can be repurposed for destructive operations.
PowerShell Under a Prompt Engine: The AD Recon Report That Changes the Defensive Lens
A June 3 incident tied to Huntress shows how AI-generated PowerShell can be used for Active Directory enumeration without introducing a new exploit chain.
Go Malware, Faster Bots, and the Quiet Threat Spilling Toward OT
Nozomi Networks Labs identified Apex2 and c2c/meow, two Golang-based malware families linked to faster IoT botnet attacks and a higher risk profile for OT environments.
RedHook Returns With a Stranger Trick: Android Debugging Turned Into Malware Control
A fresh look at RedHook suggests the threat is moving beyond ordinary permission abuse and into a more dangerous trust zone inside Android.
Android Malware Turns a Safety Feature into a Shell-Access Path
RedHook is being linked to a control-chain abuse pattern that uses Accessibility, Developer Options, and wireless debugging to reach Android shell-level privileges.
Everest Sample Hides Its Tracks in .NET, Then Adds Wake-on-LAN to the Mix
A legacy .NET ransomware binary protected with ConfuserEx and featuring Wake-on-LAN capability highlights how modern malware can combine obfuscation with reach-related design choices.
Fake SDKs, Real Risk: The Package Trap Lurking in Developer Workflows
A cluster of malicious packages in npm and PyPI shows how public registries can be turned into a delivery channel for software-supply-chain abuse.