Strand
HomeBuilt ForCase StudiesThreat IntelligenceAboutBlog
Sign inBook a demo
Strand

Automated digital forensics and incident response.

Contact the team

Platform

  • Platform Modules
  • Built For
  • ROI Calculator

Resources

  • Case Studies
  • Threat Intelligence
  • Blog

Company

  • About Strand
  • Trust Center
  • Contact

© 2026 Strand Intelligence. All rights reserved.

Privacy PolicyTerms of ServiceLinkedIn (opens in a new tab)X (opens in a new tab)
The Strand Blog

Insights & Analysis

Expert perspectives on digital forensics, incident response, and the evolving threat landscape. Stay informed with analysis from the Strand team.

8 articles

Threat Intelligence

Threat Actor Tradecraft – The Residential Proxy Problem

Threat actors are moving from VPNs to residential proxies, routing attacks through ordinary home connections. How they work, and how Strand now detects them.

Will Poole and Jordan Newman

Stay ahead of threats

Get the latest insights on digital forensics and incident response delivered to your inbox.

Get in Touch
Oct 6, 2026·6 min readRead
Threat Intelligence

Vibe-Coded Malware: How Working Apps Become Infostealers

Threat actors ship working, often AI-built apps that turn malicious through an update. We cover TamperedChef, CHOSEN BRICK and NightScreenShot, with IOCs.

Jordan Newman
Oct 1, 2026·13 min readRead
Threat Intelligence

Trivy / TeamPCP - How to check if you're exposed

Strand Intelligence has released a free, open-source scanner to detect exposure to the TeamPCP supply chain attack (CVE-2026-33634) — one of the most significant software supply chain compromises of 2026. If your organisation uses Trivy, GitHub Actions, LiteLLM, or any of 66+ compromised npm packages, run this tool to find out in minutes whether your credentials, infrastructure, or developer machines were affected.

Will Poole
Mar 25, 2026·5 min readRead
Threat Intelligence

Threat Actors using Mimecast to Evade M365 Forensics

In several recent Business Email Compromise (BEC) investigations, we have observed a subtle but important shift in attacker tradecraft: threat actors are leveraging Mimecast portals to further payment diversion fraud while avoiding traditional Microsoft 365 forensic review.

Will Poole
Mar 2, 2026·4 min readRead
Threat IntelligenceCase Studies

The VM Next Door: When Threat Actors Build Their Own Blind Spots

Recent DFIR cases have shown that the use to VMs for persistence is a concerning, hard to detect, effective persistence mechanism for threat actors.

Will Poole
Jan 13, 2026·14 min readRead
Threat IntelligenceRansomware

Know Your Adversary: Qilin

Summary Qilin is a double-extortion Ransomware-as-a-Service (RaaS) that steals data first, then encrypts at scale across Windows, Linux and VMware ESXi. Recent...

Oli
Jan 5, 2026·3 min readRead
Threat IntelligenceRansomware

Know Your Adversary: SafePay

Summary SafePay is a double-extortion ransomware that steals data before encrypting it, appending “.safepay” to files and dropping the note readme_safepay.txt....

Oli
Jun 14, 2025·3 min readRead
Threat IntelligenceRansomware

Know Your Adversary: Akira

Summary Akira is a double-extortion ransomware operation that steals data first, then encrypts it, pressuring victims with both operational outage and public...

Oli
May 26, 2025·4 min readRead