Anatomy of a 21-day Red Team operation against a Brazilian fintech
How we mapped the external attack surface, compromised an employee through a targeted phishing campaign and reached the production environment without triggering a single SIEM alert.
Insights
Field perspectives on attacks, defense and real-world adversaries
Strategic and technical content on penetration testing, Red Team, adversary simulation and modern cybersecurity.
Connecting to NVD…
—Critical · 30d
—Exploited · KEV
—High · 14d
Severity distribution
CriticalHighMedium
7-day disclosure activity
Critical CVEs
Highest severity · last 30 days · NVDActively Exploited
CISA Known Exploited VulnerabilitiesEmerging Threats
Recently disclosed high-severity issuesFrom the team
Research · write-ups · red teamPoorly defined scope: the $200K mistake we see in 7 out of 10 engagements
Modern SSRF: exploiting metadata in serverless and edge environments
AWS IAM is your biggest risk — and no single tool solves it on its own
EDR bypass in 2026: why in-memory payloads still work
Who is attacking Brazilian companies right now — Q1 2026 report
Secrets in CI/CD pipelines: hunting credentials before the attacker does
GraphQL is not secure by default: 6 vectors that slip past scanners
Container escape in Kubernetes: three paths from pod to node
Active Directory: the 4 flaws that still get us Domain Admin in 2026
Technical analysis of the Akira ransomware: the full infection chain
What your pentest report should contain (and almost never does)
Threat modeling in a sprint: running STRIDE in 60 minutes with agile squads
WAF bypass: techniques that still work against Cloudflare and AWS WAF
Phishing infrastructure with Evilginx: from domain to captured 2FA
Mobile pentest: OWASP MASVS applied to real Android and iOS apps
Azure AD attacks: enumeration, consent and persistence without alerts
Commercial stealers: how Redline and Lumma became the entry point of 2026
SBOM beyond the hype: putting it to real use in supply chain security
C2 frameworks in 2026: Sliver, Mythic and what we see used in the field
API hacking: BOLA, BUA and the OWASP API Top 10 that still dominate
External recon: how we map a company's attack surface in 4 hours
Insecure Terraform: 8 misconfigurations we see in every public module
Insider threat: the program that caught 3 cases before any material damage
Shift-left that works: SAST, SCA and secret scanning in the PR without burning out the team
Newsletter
Technical content, no noise.
One email a month with our findings, write-ups and analyses. Curated by the team, no sponsorships.
