grep -rl "detection" ./articles
ANSSI's incident report on the DGFiP, published on 29 September, describes several dozen agent passwords stolen from machines the agency does not manage, sensitive portals with no multi-factor authentication, and a messaging tool scraped on three days in June and July. Nobody noticed until the attacker posted about it on a forum on 12 August.
Rapid7 found a Linux implant built into the HAProxy binaries of two South Korean organisations, intercepting traffic and erasing its own requests from the proxy's own logs. Every headline calls it an HAProxy backdoor. Installing it requires already owning the host, which makes patching HAProxy the one response that changes nothing.
Advisory AA26-237A describes simultaneous red team assessments using similar tradecraft against a government services body and a water utility. Both were compromised at the domain level. One detected each phishing payload as it executed and isolated the machines within 2 to 20 minutes. The other saw nothing, and the red team read its security team's email to check.
Sleepwalker is a Windows backdoor with a 23-instruction custom bytecode language, AES-256-CCM, and no outbound connections at all. It sits dormant until a specially crafted packet arrives. It loads by side-loading through a security vendor's own management agent while pretending to be Microsoft's dpapi.dll — and the researcher who found it says plainly that he cannot name a single victim.
WMIC is not vulnerable. It is a signed Microsoft binary that does exactly what it says, which is why ransomware uses it to delete shadow copies, uninstall antivirus and add Defender exclusions. Deprecated in 2016, finally gone from Windows 11 24H2 and 25H2 — a decade, because you cannot patch a tool that works.
Microsoft Defender Experts has tied 30-plus domains to MacSync, a macOS stealer delivered by getting people to paste a command into Terminal. It takes the Keychain, SSH keys, AWS credentials and Kubernetes configs. The build token changes every deployment; the API key does not, which is the whole detection.
The technique needs SYSTEM on the ADFS host and touches neither LSASS nor the running service. It works because manual certificate rotation leaves the database pointing at a ghost while the real key sits in the machine DPAPI store.
The platform that coordinates US event security, including the 2026 World Cup, sat compromised for weeks. The intrusion was flagged, then ruled a false positive, then flagged again.