Browse Labs
Case Studies

Incident reconstructions.
Honest writeups.

Reconstructions of documented attack patterns - attack chain, findings, and detection gaps.

Supply ChainAvailable

Supply Chain Compromise via Dependency Confusion in CI/CD

Reconstruction of an internal npm package substitution: the build resolved to a malicious public version and executed attacker-controlled code during CI.

Attack vector
Dependency Confusion (npm)
  • Package manager resolved public registry over private registry for the same package name
  • Attacker-controlled version executed preinstall scripts with network access during build
RansomwareAvailable

Ransomware via Active Directory Lateral Movement

Initial phishing access escalated to domain compromise in under 4 hours via Kerberoasting and GPO-based deployment.

Attack vector
Kerberoasting → GPO Deployment
  • Service account passwords unrotated for 18+ months
  • Kerberoasted hash cracked in under 2 minutes on a modest GPU rig
AIAvailable

Indirect Prompt Injection Enabling Data Exfiltration

An LLM-powered document assistant manipulated via malicious content embedded in uploaded documents to exfiltrate conversation history.

Attack vector
Indirect Prompt Injection
  • Malicious instructions embedded in a PDF were processed as trusted system context
  • No input sanitization applied to document text before injection into the model context window