Apac
Adjacent campaigns and a defender's playbook [3/3]
Adjacent SSH brute-force campaigns observed alongside Sorry-worm: Multiverze sshd backdoor, Diicot/Opera updated 2026 build, Mirai-derived sshscan kit. Indicators in three confidence tiers, YARA and Sigma rules, hunting queries, a reproducible activity timeline, and defensive recommendations.
YARASigmaIOC 19 min readInside Sorry-worm: anatomy of a Go ransomware-worm hybrid [2/3]
Binary-level analysis of Sorry-worm: hardcoded RSA-2048 attribution-stable indicator, AES-CBC encryption pipeline, 48-byte fixed prefix on encrypted files, UNIX-nanosecond victim ID, embedded SSH wordlist, and the layered SSH scan that runs concurrently with encryption. The single most important property: encryption and SSH propagation occur concurrently in the same process.
19 min readCatching Sorry-worm in the wild [1/3]
A previously undocumented Linux ransomware-worm hybrid, propagating from compromised SSH relays approximately 8 hours after the sample's first public sandbox submission. Two independent propagation events from unrelated IPs, separated by ~7 hours, more consistent with autonomous worm-style propagation than a single hands-on session.
IOC 15 min readDetecting and Countering AI-Enabled Intrusions with Deception
Findings from four controlled wargame labs running ~1,000 LLM-driven intrusions against a HIIH Surface Live Host. Persistence is universal. Attackers come in three shapes. Counter-forensics has arrived - and counter-intelligence works.
4 min read