Blog
Security operations write-ups, threat research and incident response.
-
PaperCut CVE-2026-82078 and CVE-2026-81578 Analysis and Case Study
A technical case study of a real-world PaperCut compromise involving CVE-2026-81578 and CVE-2026-82078, covering exploitation, malicious Java payloads, privilege escalation attempts, C2 activity, and containment from a Huntress SOC investigation.
-
From Intrusion Analysis to HijackLibs: DLL Sideloading Research
This write-up covers my DLL sideloading research and recent contributions to HijackLibs, including an investigation where a legitimate, signed VMware binary, vmware-vmx.exe, was renamed and used to load a malicious libcrypto-3-x64.dll from the same directory.