Crimson7 Blog
Research & Insights
Adversary analysis, detection engineering and threat hunting from the Crimson7 team.
offensive security
We Were the Queue: An AI Agent Team at BruCON
Around 50 AI agents, one shared channel and 942 messages. Our BruCON CTF team finished second. The harder lesson was learning how to keep the agents out of each other's way.
detection engineering
Five Questions to Ask Your Security Team About Your Detections
The board report says the controls are in place. It rarely says when anyone last proved they fire. Five questions a CISO or CTO can ask at the next security review, and what a good answer sounds like.
threat intelligence
Your Browser Already Downloaded the Malware. You Just Haven't Run It Yet.
Browser Cache Smuggling combined with ClickFix turns the browser's disk cache into a payload stash: the browser delivers the malware silently, while the command that executes it downloads nothing.
Latest articles16
events
Both Cybersec Netherlands Talks, Now on Video
We ran two sessions at Cybersec Netherlands in Utrecht on 9 and 10 September, one on the attack side and one on the defence side. Both recordings are now online, 27 and 24 minutes, with live product demos rather than slideware.
threat intelligence
The Revolut Breach: Infrastructure, Actors, and the Compliance Gap
Revolut handed passport scans, KYC selfies and full transaction histories to a fraudulent emergency data request sent from a real, compromised law enforcement mailbox. Two actors claim the breach, both leak domains are now on registry hold, and a darknet Revolut account shop refreshed its stock the same week. We trace the infrastructure, the actors, and the technique.
threat intelligence
Ph1shy v2.0.0: The Forum Post Said "Phishing Panel." The Source Code Said Otherwise.
How static analysis of a cloned Next.js frontend uncovered a full-spectrum criminal operations platform hiding behind a five-feature forum advertisement.
threat intelligence
EtherHiding: When Malware Hides Its C2 on the Blockchain
Threat actors are storing C2 domains inside Ethereum smart contracts. The contract address is stable, the retrieval is anonymous, and there is no registrar or hosting provider to send a takedown request to. We observed the technique live in the Shai-Hulud supply chain campaign, deployed our own proof of concept on Sepolia, and decoded the active C2 domain straight off mainnet.
threat intelligence
Shai-Hulud's Ethereum C2: Inside a Blockchain-Backed npm Supply-Chain Attack
How keyv@6.0.0 uses EtherHiding to resolve its C2 domains from an Ethereum smart contract at runtime, and what the major threat intel platforms are missing. We reproduced the malware's eth_call, recovered the active C2 domain and its full 72-day rotation history, traced the operator's wallet to a FixedFloat exchange, and decrypted 294 obfuscated strings offline. At publication the active C2 is live and absent from the public feeds we checked.
threat intelligence
Browsing Outlook As You: Inside an Unreported ARToken / EvilTokens Phishing Tenant
We captured and reverse-engineered the client build of ARToken, an operator panel for a Microsoft 365 / Entra ID token-theft operation. It phishes the device-code authentication flow, steals access, refresh, and Primary Refresh Tokens, and drives the victim tenant from a dashboard with 80+ API endpoints. Cisco Talos ties ARToken to the EvilTokens phishing-as-a-service ecosystem. The tenant we analysed is not in Talos's published IOCs, so it is a previously-unreported deployment, complete with a bundled anti-detect browser for offline session replay.
threat intelligence
One Token, 88 Repos: Reading the Accenture PwnForums Listing
A threat actor named 888 is selling roughly 35GB of alleged Accenture data on PwnForums: source code, RSA/SSH keys, Azure Personal Access Tokens, and Azure Storage keys, pulled from an Azure DevOps organization called LISTeamRepos. We read the listing directly and cross-referenced it against the six-million-line directory manifest the actor posted as proof. The access method is confirmed, a valid Personal Access Token used exactly as intended. How that token leaked is not.
threat intelligence
The Credential Nobody Deleted: How Icarus Raided Salesforce Through a Forgotten Klue Integration
A dormant service account nobody decommissioned let the Icarus extortion group push malicious code into Klue's integration layer, harvest OAuth tokens, and quietly drain Salesforce CRM data from downstream victims over a 24-hour window. Here is how the supply chain attack unfolded and what the forensic artifacts reveal.
threat intelligence
From One Hash to a Russian MaaS Empire: Hunting MuddyWater's DenoDoor
A single VirusTotal hash led us to the full deobfuscation of MuddyWater's DenoDoor backdoor, 40 plus active C2 nodes across two bulletproof ASNs, a second live DenoDoor cluster delivering zero-detection AI-themed lures, and confirmation that Iranian state actors are renting infrastructure from a Russian criminal Malware-as-a-Service operation.
Showing 9 of 16 articles