Insights.
Field notes from running IT for other people’s businesses. Long-form posts on the boring layer done right. Honest, specific, written by the engineers who carry the pager.
// featured
// the one we’d hand a new client firstThe breach that wasn’t on the laptop
A creative firm reported an email account doing things no one recognised. We were brought in to answer two questions — what actually happened, and is anything still inside. The answer was entirely cloud-side, and proving the endpoint was clean meant imaging a Mac that can’t be imaged the usual way.
read the field note →// latest posts
// most recent first · published natively in SquarespaceThe breach that wasn’t on the laptop
An email account acting on its own — how we proved the laptop was clean and the breach lived entirely in the cloud account.
2023 CrowdStrike Global Threat Report — the AI-generated summary
I asked ChatGPT to summarise the 2023 CrowdStrike Global Threat Report — ransomware, state actors, and AI on both sides.
Old worms on new hooks — XSS as phishing’s hook, line, and sinker
Threat actors stopped scanning for XSS and started mailing you the malicious page as an HTML attachment. What that looks like.
Polymorphic code and ChatGPT (read label before use!)
Language models can detect polymorphic malware by its patterns — and, as one PoC showed, can also synthesise it on the fly.
Phishing kits as a service (attacks for sale!)
Phishing kits now ship as a $300–$1000 / month subscription, sending millions of malicious emails a day. How the model works.