Skip to content

Blue Team

3 articles, newest first.

3 articles filed under Blue Team, written by the Egnworks crew and collected on one page, newest first.

A dark security operations banner representing an encrypted relay connecting a hidden Linux backdoor.

Blue Team

Inside the GSocket Backdoor

Attackers turn a legitimate encrypted relay into a persistent Linux backdoor. Dissect GSRN, process masquerading, secret files, and host detection.

Jacob Strix

A dark generated banner with a luminous sphere represents command-and-control traffic outside DNS visibility.

Blue Team

The C2 Traffic DNS Security Never Sees

Direct-to-IP malware bypasses DNS controls entirely. Build a TTL-aware detector that correlates Zeek DNS answers with outbound connections.

Jacob Strix

A network operations room displays routing telemetry during an infrastructure compromise investigation.

Blue Team

When the Router Lies to the SOC

Fire Ant turned IOS XR routers, TACACS servers, and Linux management hosts into a covert access layer that corrupted forensic evidence.

Jacob Strix