Writing

Engineering·November 7, 2026·2 min read

Raspberry Robin showed why incident timelines need separate columns for initial access and what attackers do later. Microsoft's October 2022 research described a USB-propagating worm that was connected to a bro

Engineering·November 7, 2026·2 min read

Melissa demonstrates why I include document and user-interaction boundaries in propagation analysis, not only remotely exploitable network services. In March 1999, a Microsoft Word document with a malicious macro relied on someone o

Engineering·November 7, 2026·2 min read

In my review of WannaCry's propagation path, the network boundary matters as much as the payload. The May 2017 outbreak combined ransomware with self-propagation across vulnerable Windows SMB services.