CloudSEK TRIAD

CloudSEK Threat Research and Information Analytics Division

Blogs & Articles

Read all Blogs from this Author

RedSun: Windows 0day when Defender becomes the attacker

RedSun exposes a critical logic flaw in Windows Defender that allows a standard user to escalate privileges to SYSTEM without admin rights or kernel exploits. By exploiting a missing reparse point validation during file restoration, attackers can redirect Defender’s write operation into System32 and execute arbitrary code. The attack is reliable, unpatched, and affects modern Windows systems with Defender enabled, making it a serious security concern.

The Rise and Fall of RAMP: Inside the Forum Where Ransomware Was Always Welcome

CloudSEK’s latest report traces the lifecycle of RAMP, a ransomware-friendly underground forum that operated from 2021 until its FBI seizure in January 2026. Built as a safe haven for cybercriminals, it connected ransomware groups, affiliates, and access brokers at scale. Its takedown has fragmented the ecosystem, pushing actors into smaller, harder-to-track communities—raising new challenges for global cyber defense. Read the full report for a deeper look into how ransomware networks evolve and adapt.

Whitepapers and Reports

Read all Whitepapers and reports from this Author

Threat Landscape Report for Middle East 2024

Beyond the Storefront: E-commerce and Retail Threat Insights

The report "Beyond the Storefront: E-commerce and Retail Threat Insights" highlights the growing cyber threats to the e-commerce and retail sectors, including a surge in ransomware attacks, hacktivist activities, and data breaches. It emphasizes the need for enhanced security measures as these industries face increasing risks from financially motivated attacks and politically driven hacktivism.

MichaMichaBot: Unveiling the Exploitation of Missing "X-Frame-Options" HTTP Headers in Phishing Attacks

The report "MichaMichaBot: Unmasking the Threats Exploiting Missing 'X-Frame-Options' Headers" reveals how cybercriminals exploit this vulnerability to launch phishing attacks by embedding legitimate websites in iframes with fake login panels. It provides insights into these attack methods and practical strategies to secure digital assets against such threats.

Unveiling Maorrisbot: The Inner Workings of an Android Trojan Malware

Our whitepaper, "Unveiling Maorrisbot: The Inner Workings of an Android Trojan Malware," explores the sophisticated methods and impacts of Maorrisbot malware, offering insights and strategies to protect your devices. Download it to learn how to safeguard against this significant Android threat.

Knowledge Base

Read all knowledge base articles from this Author

No Knowledge base articles found.