https://lab539.com/blogOriginal adversary infrastructure research and technical investigations from Lab539.https://lab539.com/blog/anydesk-tag-anydesk-and-screenconnect-in-a-campaign-targeting-banking-customershttps://lab539.com/blog/anydesk-tag-anydesk-and-screenconnect-in-a-campaign-targeting-banking-customersAn investigation into bank-themed fraud sites, signed malware, AnyDesk and unattended ScreenConnect access.Mon, 19 Oct 2026 12:00:00 GMThttps://lab539.com/blog/pre-attack-indicatorshttps://lab539.com/blog/pre-attack-indicatorsWhy intelligence discovered during adversary preparation deserves to be recognised and acted on.Wed, 23 Sep 2026 12:00:00 GMThttps://lab539.com/blog/fulcrumsec-a-look-at-their-tradecrafthttps://lab539.com/blog/fulcrumsec-a-look-at-their-tradecraftThe tradecraft behind FulcrumSec’s campaigns, exposed credentials and cloud access.Wed, 09 Sep 2026 12:00:00 GMThttps://lab539.com/blog/from-ethereum-to-dns-c2-reverse-engineering-the-clickfix-payloadhttps://lab539.com/blog/from-ethereum-to-dns-c2-reverse-engineering-the-clickfix-payloadDissecting a ClickFix payload that uses Ethereum for discovery and DNS for command and control.Wed, 12 Aug 2026 09:00:00 GMThttps://lab539.com/blog/from-compromised-wordpress-sites-to-blockchain-backed-malwarehttps://lab539.com/blog/from-compromised-wordpress-sites-to-blockchain-backed-malwareFollowing ClickFix from compromised WordPress sites through blockchain-backed staging to malware.Wed, 12 Aug 2026 01:00:00 GMThttps://lab539.com/blog/ipv6-trends-in-user-account-compromiseshttps://lab539.com/blog/ipv6-trends-in-user-account-compromisesThe IPv6 address space is changing the economics of account takeover and IP-based blocking.Fri, 07 Aug 2026 12:00:00 GMThttps://lab539.com/blog/what-i-learned-from-sitting-in-on-a-scattered-spider-sentencinghttps://lab539.com/blog/what-i-learned-from-sitting-in-on-a-scattered-spider-sentencingTechnical observations from the sentencing of two prominent Scattered Spider members.Fri, 24 Jul 2026 12:00:00 GMThttps://lab539.com/blog/when-dmca-comes-knocking-part-2-the-sign-in-window-that-isn-thttps://lab539.com/blog/when-dmca-comes-knocking-part-2-the-sign-in-window-that-isn-tA close look at the browser-in-the-browser component of a DMCA-themed phishing kit.Mon, 08 Jun 2026 12:00:00 GMThttps://lab539.com/blog/when-dmca-comes-knocking-a-youtube-creator-phishing-kit-part-1https://lab539.com/blog/when-dmca-comes-knocking-a-youtube-creator-phishing-kit-part-1An investigation into the lures and infrastructure targeting YouTube creators.Tue, 19 May 2026 12:00:00 GMThttps://lab539.com/blog/blob-urls-the-phishing-disguise-hiding-in-your-browserhttps://lab539.com/blog/blob-urls-the-phishing-disguise-hiding-in-your-browserHow malicious sites hide phishing content using browser Blob URLs.Wed, 18 Mar 2026 12:00:00 GMThttps://lab539.com/blog/tycoon2fa-is-down-what-happens-nexthttps://lab539.com/blog/tycoon2fa-is-down-what-happens-nextThe Tycoon2FA takedown and the operational questions it raises for defenders.Sun, 08 Mar 2026 12:00:00 GMThttps://lab539.com/blog/starkiller-residential-proxy-aitmhttps://lab539.com/blog/starkiller-residential-proxy-aitmMapping the infrastructure behind Starkiller and the role of residential proxy addresses.Fri, 23 Jan 2026 12:00:00 GMThttps://lab539.com/blog/aitm-detectionhttps://lab539.com/blog/aitm-detectionLooking beyond reactive alerts to detect adversary-in-the-middle infrastructure.Wed, 15 Oct 2025 12:00:00 GMThttps://lab539.com/blog/tracking-clickfix-infrastructurehttps://lab539.com/blog/tracking-clickfix-infrastructureAn investigation into ClickFix delivery infrastructure and its overlap with other adversary operations.Mon, 13 Oct 2025 12:00:00 GMThttps://lab539.com/blog/azure-front-door-aitm-phishinghttps://lab539.com/blog/azure-front-door-aitm-phishingAn AiTM investigation involving infrastructure placed behind Microsoft Azure Front Door.Thu, 24 Jul 2025 12:00:00 GMThttps://lab539.com/blog/where-conditional-access-risk-policies-failhttps://lab539.com/blog/where-conditional-access-risk-policies-failWhy certain Microsoft risk-policy configurations can mask successful AiTM attacks.Mon, 21 Jul 2025 12:00:00 GMThttps://lab539.com/blog/aitm-non-incident-reporthttps://lab539.com/blog/aitm-non-incident-reportA real attempted AiTM compromise stopped by preventative Conditional Access controls.Thu, 10 Jul 2025 12:00:00 GMThttps://lab539.com/blog/2024s-aitm-activity-in-numbershttps://lab539.com/blog/2024s-aitm-activity-in-numbersAnalysis of the AiTM infrastructure Lab539 tracked throughout 2024, including deployment timing, hosting choices and changing patterns.Wed, 12 Feb 2025 12:00:00 GMThttps://lab539.com/blog/file-hosting-services-used-for-identity-phishinghttps://lab539.com/blog/file-hosting-services-used-for-identity-phishingA look at which legitimate file-hosting providers are most often impersonated in identity phishing campaigns.Wed, 16 Oct 2024 12:00:00 GMThttps://lab539.com/blog/conditional-access-policy-to-block-tor-ipshttps://lab539.com/blog/conditional-access-policy-to-block-tor-ipsUsing Microsoft Entra Conditional Access to deny authentication from Tor exit nodes.Fri, 24 May 2024 12:00:00 GMThttps://lab539.com/blog/6-months-tracking-aitm-campaignshttps://lab539.com/blog/6-months-tracking-aitm-campaignsEarly observations from Lab539’s original research identifying AiTM backend infrastructure before operational use.Wed, 01 May 2024 12:00:00 GMThttps://lab539.com/blog/the-cyber-defenders-kill-chain-tcdo-part2https://lab539.com/blog/the-cyber-defenders-kill-chain-tcdo-part2A defender-oriented view of the attack lifecycle and how it informs tailored cyber defence.Fri, 26 Jan 2024 12:00:00 GMThttps://lab539.com/blog/applying-context-to-control-adversaries-part1https://lab539.com/blog/applying-context-to-control-adversaries-part1Why defensive context matters more than following adversary tradecraft in isolation.Tue, 21 Nov 2023 12:00:00 GMThttps://lab539.com/blog/cyber-security-fuel-terminals-operational-networkshttps://lab539.com/blog/cyber-security-fuel-terminals-operational-networksThe cyber threat to downstream oil and fuel terminals, and principles for protecting operational networks.Fri, 22 Sep 2023 12:00:00 GMThttps://lab539.com/blog/inside-akira-ransomware-negotiationshttps://lab539.com/blog/inside-akira-ransomware-negotiationsObservations from Akira ransomware negotiations and what they reveal about adversary behaviour.Sun, 06 Aug 2023 12:00:00 GMT