AGONY
Commandant d’élite de la sécurité offensive
Profil professionnel
Agony est le commandant de l’une des unités de Ethical Hacking les plus avancées opérant dans les environnements gouvernementaux et d’entreprise. Considéré comme un actif critique de tout premier plan, il dirige cinquante spécialistes d’élite dans des opérations à haut risque, en gérant des infrastructures, des chaînes d’approvisionnement et des missions fondées sur le renseignement. Actif dans des contextes multi-nœuds variables, il possède une expertise extrême en networking, en exploit development et dans les opérations deep-darknet.
Compétences clés
Networking avancé d’entreprise et gouvernemental; manipulation BGP et routage furtif; segmentation zero-trust; durcissement au niveau paquet; exploit development de bas niveau (Assembly/C/C++); exploitation kernel/hypervisor/firmware; reverse engineering haut de gamme; red teaming à fort impact; simulation APT; opérations offensives en air gap; infiltration clandestine du dark web; HUMINT; dé-anonymisation de cryptomonnaies; traçage off-chain
Réalisations majeures
Neutralisation de menaces APT dans des chaînes d’approvisionnement internationales; développement de cadres défensifs propriétaires pour des environnements à haute sécurité; conduite d’opérations de renseignement darknet classifiées; confinement d’incidents à haut risque dans des secteurs gouvernementaux
Articles de AGONY
A Phish, a Mesh, and a Burned-Down Trail: How a Ukrainian Logistics Target Was Reportedly Hit
ESET’s account points to a handoff between UAC-0099 and Sandworm, with a newly described mesh-network backdoor in the middle and a wiping phase that followed later.
Hidden in Plain Sight: A Reported C2 Shift That Put a Known Threat Label on US Shared Hosting
Researchers reported a Tornado command-and-control server on US-based shared hosting, a placement change that can complicate infrastructure tracking without proving who operated it or why.
Website Silence, Unclear Hand: The North Korea DDoS Puzzle That Still Lacks a Culprit
A reported traffic surge knocked public websites offline in North Korea, but the available evidence stops short of proving who drove it, where it began, or whether anything beyond availability was affected.
Traffic Without a Claim: The Reported Outage Wave Hitting North Korean Websites
A burst of inbound traffic reportedly pushed more than 40 official websites offline for about 32 hours, but the public record stops short of proving who caused it or exactly how the disruption unfolded.
Secure Boot’s Blind Spot: Why a Reported UEFI Bootkit Case Matters Beyond One Campaign
Researchers have reportedly linked a BlackX bootkit operation to APT41 with medium confidence, and the case underscores how boot-chain persistence can outlast ordinary patching if Secure Boot mitigations are not fully in place.
Serbia’s Vote, Synthetic Noise, and the Hard Problem of Proving Influence
The reported election climate in Serbia shows how wartime memory, AI-generated material, and cross-border sharing can muddy the information field without automatically proving a coordinated campaign.
When “Fully Patched” Still Wasn’t Enough: The BlackX Bootkit Gap
A reported Secure Boot bypass shows how firmware revocations can matter as much as Windows updates, and why that distinction keeps catching defenders off guard.
Backup Credentials, Not a Breach Story: Why This Microsoft 365 Case Demands Tenant-by-Tenant Review
Researchers reportedly tied a China-nexus actor to activity involving ConnectWise Cloud Backup, but the confirmed technical issue is narrower: unauthorized access to application credentials and the need to inspect Microsoft 365 tenants carefully.
When Malware Learns New Cryptography, Defenders Lose an Old Advantage
FlashHole is a narrow but revealing case: a reported espionage campaign allegedly tied to Lazarus used post-quantum key establishment inside malware, without proving that encryption alone makes the operation harder to stop.
Election Lies in Synthetic Skin: Israel’s Campaign Shows the New Friction Point in AI Propaganda
Reported use of synthetic video, automated profiles, and tailored political messaging points to a split battlefield: the most visible deepfakes draw scrutiny, while profiling and chatbot conditioning can remain harder to police.
When Orbits Tighten, Every Close Pass Becomes a Geopolitical Signal
A reported approach between Cosmos 2612 and ICEYE-X36 shows why satellite proximity is judged not just by distance, but by uncertainty, context, and the limits of what can be proven.
When Scripts Look Human: The CL-UNK-1211 Case and the New Blur in Linux Intrusions
A tracked campaign tied to government-related Linux environments shows how AI-like code signals can appear alongside familiar intrusion steps, without proving who wrote the scripts or how far the operation reached.
When Trusted Banking Software Becomes the Delivery Channel
A reported espionage campaign tied to Lazarus used CrossWeb EX in South Korea, showing how legitimate security tooling can sit inside an attack chain without proving a product flaw.
When the Hunt Shifts from Crypto to Cloud: The Huione Case and the New Pressure Point
U.S. authorities are increasingly treating backend infrastructure as a crime target in its own right, not just a side effect of a crypto investigation.
FlashHole and the Strange Case of Malware That Used Post-Quantum Crypto
Researchers reported a Lazarus-linked campaign that combined phishing, malicious websites, legitimate software abuse, and a post-quantum key mechanism to hide malware traffic targeting South Korean organizations.
Agentic AI Meets a Cloud Trust Trap in the ConnectWise Case
Microsoft reportedly tied a ConnectWise Cloud Backup supply-chain incident to Storm-0940, while also saying the group used ARTEX to speed up scanning.
When a Cloud Identity Becomes the Entry Point
Microsoft’s attribution to Storm-0940 around ConnectWise points to a harder problem than one breach: the risk that provider-linked application identities can turn into a quiet bridge into customer tenants.
Unnamed Shipbuilder, Unclear Intrusion: The Espionage Warning Hidden in a Thin Signal
A reported break-in at a shipbuilder described as NATO-linked is thin on public detail, but the response advice points to a familiar defense: hunt across identity, network, and endpoints, not just malware.
The Backdoor in Plain Sight: How a Trusted Windows Pattern Became a Covert Access Route
A previously undocumented threat cluster has been linked to Sandboxie DLL sideloading, a technique that can let malicious code ride inside a legitimate process while leaving defenders with a misleadingly clean first glance.
Trusted Windows Tools, Shadow Code: The Loader Trick Behind a Reported Backdoor Campaign
A reported campaign tied to BRONZE SANDCASTLE shows how legitimate Windows software can be used as a delivery path for encrypted payloads, with identity data possibly in the crosshairs.