A red team practitioner's blog covering offensive security tradecraft, including experiments with C2 channels disguised as legitimate services like Spotify, serverless redirectors on Cloudflare Workers, and a candid account of passing the CPTS certification. The posts are detailed and first-person, with practical steps and notes, though some sections read as informal walkthroughs.
Website: https://ppurin.me/
Stoïk's security team publishes detailed technical write-ups on real ransomware intrusions, scanner vulnerabilities and on-chain ransom tracing. Readers get incident timelines, root-cause analysis and concrete defensive checks drawn from the team's own investigations.
Covers security research on AI infrastructure and malware, including a geopolitical analysis of strikes on Yandex data centers and hands-on reverse engineering write-ups of Windows loaders and RMM abuse. Readers get detailed technical findings, indicators, and lessons about analysis tooling and methodology.
A weekly roundup of AI developments covering model releases, safety and alignment incidents, cybersecurity events and AI policy, with extended commentary on individual stories. It also includes occasional standalone deep dives, such as analysis of AI legislation and company conduct.
Essays and a serialized book on AI-era cybersecurity, trust and measurement, citing specific vendor and lab reports. Readers get an original framework, including the Learning Advantage Ratio and the work-factor idea for AI judgment, alongside analysis of how security metrics get gamed.
One short email a week with hand-picked newsletters from the index. Free, no spam, unsubscribe anytime.
