Field notes from the other side
Everything here comes out of our own pipeline: measured, anonymized and written for people who operate, not for people who forward PDFs.
Anatomy of a stealer log: from infection to sale in 31 hours
We followed a single log batch from the moment it hit a Telegram channel to the moment its credentials were tested against a corporate VPN. The window is smaller than you think.
READ THE PAPERFormat
Topic
5 of 5 pieces
Data analysis
Sherlog · 2 min
Anatomy of a stealer log: from infection to sale in 31 hours
We followed a single log batch from the moment it hit a Telegram channel to the moment its credentials were tested against a corporate VPN. The window is smaller than you think.
Data analysis
Sherlog · 1 min
Session cookies outlive password resets: measuring the window
Across a sample of stealer records, we measured how long stolen session cookies remained valid after the victim's password was changed. The median was not minutes.
Research report
Cvekit · 2 min
EPSS + KEV + exploit maturity: a prioritization formula that survives contact
CVSS tells you what could hurt. Exploitation probability, confirmed exploitation and exploit maturity together tell you what is hurting, and they shrink the patch queue by an order of magnitude.
Field note
Jabbernaut · 2 min
Why the underground's real marketplace speaks XMPP
Forum posts are advertisements. The price, the sample, the escrow and the handover all happen over Jabber, a layer almost no monitoring product indexes.
Research report
Dragnet · 2 min
Ransomware blogs as a data source: what leak-site behavior reveals
Victim announcements, countdown timers, proof packs and entries that quietly vanish. Leak-site behavior is a dataset, and it says more about the groups than their ransom notes do.
Follow the desk
Papers are published here first. The wire runs alongside them and carries what the pipeline turns up between them. For the papers alone, in a reader, there is feed.xml.
Your competitors will learn about the leak from the invoice.
Learn about it from the log batch.
NDA-friendly briefings · global coverage · no slideware