Skip to content

Obsession

The topics we keep coming back to.

6 categories, 91 tags, 48 articles, because nobody ever agreed on what to call anything. A category opens its own page, a tag filters in place.

Frontend Architecture21Security11AI Development08AI SecOps03Blue Team03Red Team02
A dark security operations banner representing an encrypted relay connecting a hidden Linux backdoor.

Blue Team

Inside the GSocket Backdoor

Attackers turn a legitimate encrypted relay into a persistent Linux backdoor. Dissect GSRN, process masquerading, secret files, and host detection.

Jacob Strix

A dark generated banner with a luminous sphere represents command-and-control traffic outside DNS visibility.

Blue Team

The C2 Traffic DNS Security Never Sees

Direct-to-IP malware bypasses DNS controls entirely. Build a TTL-aware detector that correlates Zeek DNS answers with outbound connections.

Jacob Strix

A network operations room displays routing telemetry during an infrastructure compromise investigation.

Blue Team

When the Router Lies to the SOC

Fire Ant turned IOS XR routers, TACACS servers, and Linux management hosts into a covert access layer that corrupted forensic evidence.

Jacob Strix

A dark computer terminal shows code during analysis of a Windows kernel driver.

Red Team

BTR Reforged Turns Defender Against Itself

BTR Reforged repurposes Defender's signed remediation driver as a controlled Ring 0 file and registry operation primitive.

Jacob Strix

A close-up technology photograph used for an embedded red-team firmware banner.

Red Team

Flipper Firmware on the T-Embed CC1101 Plus

A technical assessment of Sor3nt's Flipper Zero ESP32 port running from main on the LilyGo T-Embed CC1101 Plus.

Jacob Strix

A laptop displays source code during an investigation into compromised npm packages.

Security

ChainDrop Poisoned the npm Supply Chain

ChainDrop turned trusted npm releases into a self-propagating credential stealer across Keyv, Cacheable, and hundreds of downstream packages.

Jacob Strix