Writing

Engineering·November 7, 2026·2 min read

I traced Stuxnet as a boundary-crossing problem: from Windows software into industrial control commands. Calling it sophisticated Windows malware misses the physical-system risk. The attack path targeted software used to supervise and program indust

Engineering·November 7, 2026·2 min read

Raspberry Robin showed why incident timelines need separate columns for initial access and what attackers do later. Microsoft's October 2022 research described a USB-propagating worm that was connected to a bro

Engineering·November 7, 2026·2 min read

Melissa demonstrates why I include document and user-interaction boundaries in propagation analysis, not only remotely exploitable network services. In March 1999, a Microsoft Word document with a malicious macro relied on someone o

Engineering·November 7, 2026·2 min read

In my analysis of Mirai, the failure starts with a simple hardware assumption: devices that ship with weak or default remote-management credentials will eventually be found by automated scanners. In 2016, many cameras, recorders and routers were ex

Engineering·November 7, 2026·2 min read

The starting point I emphasized in my NotPetya review is a trusted enterprise distribution path: the update path for Ukrainian accounting software M.E.Doc. It then moved laterally and disrupted organizations well beyond its initial target geography.

Engineering·November 7, 2026·2 min read

In my review of WannaCry's propagation path, the network boundary matters as much as the payload. The May 2017 outbreak combined ransomware with self-propagation across vulnerable Windows SMB services.

Engineering·November 7, 2026·2 min read

The trust failure I examined in Android toll-fraud reporting is the confirmation step: an OTP does not protect a purchase if malicious software on the same device can intercept or submit it. Microsoft documented Android toll-fraud workflows in which malware tried to subscribe victim

Engineering·November 7, 2026·2 min read

In reviewing the Joker/Bread campaigns, I focused on the separation between an app doing its advertised job and subscription activity the owner never authorized. Google's 2020 report on Bread—often called Joker—documented that exact billing-fraud problem. The family kept adapting as defenses a

Engineering·November 7, 2026·2 min read

Triada challenges an app-centric mobile threat model in an important way. Google's Android security team described a malware family that moved from rooting attempts into compromised system images. The malicious cod

Engineering·November 7, 2026·2 min read

The entry point I focused on in FluBot was the delivery-text lure, because the later banking and contact-abuse behavior depended on the permissions granted after that initial deception. But FluBot used exactly that: convince someone to follow a delivery or voicemail lure, install a malicious Android application, and grant it un