The Strand Blog

Insights & Analysis

Expert perspectives on digital forensics, incident response, and the evolving threat landscape. Stay informed with analysis from the Strand team.

13 articles

Threat Intelligence

PHPanic: Two Critical Flaws Put Web Servers at Risk of Remote Code Execution

Two critical PHP flaws expose web servers to remote code execution. Jordan Newman examines exploitation conditions, forensic limitations, and a Sigma detection rule.

Jordan Newman

Oct 21, 202619 min readRead

Threat Intelligence

Zammad 0-day chain and AI-assisted post-exploitation in the wild

We examine the Zammad exploit chain used against DIVD, reproduce initial access in our lab, and show how Strand reconstructs the attack from forensic evidence.

Jordan Newman

Oct 16, 202613 min readRead

Threat Intelligence

Threat Actor Tradecraft – The Residential Proxy Problem

Threat actors are moving from VPNs to residential proxies, routing attacks through ordinary home connections. How they work, and how Strand now detects them.

Will Poole and Jordan Newman

Oct 6, 20266 min read

Threat Intelligence

Vibe-Coded Malware: How Working Apps Become Infostealers

Threat actors ship working, often AI-built apps that turn malicious through an update. We cover TamperedChef, CHOSEN BRICK and NightScreenShot, with IOCs.

Jordan Newman

Oct 1, 202613 min readRead

Project Glasswing: and what does it mean for DFIR?

On 7 April 2026, Anthropic announced Project Glasswing, a coordinated industry initiative built around a single, sobering finding: AI models can now...

Oli

Apr 13, 20266 min readRead

Threat Intelligence

Trivy / TeamPCP - How to check if you're exposed

Strand Intelligence has released a free, open-source scanner to detect exposure to the TeamPCP supply chain attack (CVE-2026-33634) — one of the most significant software supply chain compromises of 2026. If your organisation uses Trivy, GitHub Actions, LiteLLM, or any of 66+ compromised npm packages, run this tool to find out in minutes whether your credentials, infrastructure, or developer machines were affected.

Will Poole

Mar 25, 20265 min readRead

Europol, TycoonMFA and a quiet month for phishing attacks

Phishing attack volume dropped significantly in February 2026 following the disruption of Phishing-as-a-service platform Tycoon MFA.

Will Poole

Mar 5, 202614 min readRead

Threat Intelligence

Threat Actors using Mimecast to Evade M365 Forensics

In several recent Business Email Compromise (BEC) investigations, we have observed a subtle but important shift in attacker tradecraft: threat actors are leveraging Mimecast portals to further payment diversion fraud while avoiding traditional Microsoft 365 forensic review.

Will Poole

Mar 2, 20264 min readRead

Threat IntelligenceCase Studies

The VM Next Door: When Threat Actors Build Their Own Blind Spots

Recent DFIR cases have shown that the use to VMs for persistence is a concerning, hard to detect, effective persistence mechanism for threat actors.

Will Poole

Jan 13, 202614 min readRead

Threat IntelligenceRansomware

Know Your Adversary: Qilin

Summary Qilin is a double-extortion Ransomware-as-a-Service (RaaS) that steals data first, then encrypts at scale across Windows, Linux and VMware ESXi. Recent...

Oli

Jan 5, 20263 min readRead

Stay ahead of threats

Get the latest insights on digital forensics and incident response delivered to your inbox.

Get in Touch