Blog:

  1. Home
  2. Insights
  3. Blog
On 2026-07-30
by Kynan Jones, Incident Responder @ Airbus Protect
Cybersecurity

What the Shell? Accelerating Incident Response: Letting the Malware do the work for you

What the Shell? Accelerating Incident Response: Letting the Malware do the work for you
Intrusion Context Last month, Airbus Protect’s CSIRT responded to an intrusion targeting a vulnerable, internet-facing Windows Server. What began as typical automated scanning quickly transitioned into a targeted attack utilising tools such as SQLMap and vulnerability scanners. By leveraging a flurry of SQL injection attacks, the threat actor successfully enabled xp_cmdshell which facilitated remote code [...]
  • Share

Discover all the latest releases

Cybersecurity

The 120-Hour Threat: the timeline of a Devman 2.0 intrusion from VPN to Domain Admin

Key points Initial Access via Vulnerable Perimeter: The intrusion began with a compromised VPN appliance. While logging deficiencies obscured the exact entry mechanism, strong evidence suggests the Devman 2.0 operators leveraged a Remote Code Execution (RCE) exploit to hijack a valid account.  Living Off the Land & Open-Source Tooling: The attackers maintained a low profile [...]

Read more
Table mythos or mirage Cybersecurity

Mythos or mirage: The hidden burden of agentic security

The recent arrival of Claude Mythos Preview has been met with the usual industry fanfare, promising a new era of agentic security where AI finally moves from being a passive observer to an active defender. However, as we have seen with every previous iteration of machine learning in this space, unbridled enthusiasm usually precedes a [...]

Read more
product security Cybersecurity

What is Product Security?

Product Security: The invisible Shield.  In the era of modern and interconnected world, Product Security acts as an unseen defense whose tangible effects are clearly observed and felt in our daily lives. While Product Security and Cybersecurity are intrinsically linked, however, they diverge in their priorities especially within the Operational Technology and Critical infrastructure. Cybersecurity, [...]

Read more
embed resilience into the DNA of all critical operations and functions Cybersecurity

It’s time to embed resilience into the DNA of all critical operations and functions

We have begun to live in a world where unpredictability is a part of daily life; where geopolitical tensions are more frequent, recovery timeframes are shorter, keeping economic balance is harder, and trajectories are switchbacked. In a competitive environment overwhelmed by transformation and restructuring, the defining requirement for organisations is no longer speed, quality, or […]

Read more
Netwars and Cyber Interview Cybersecurity

Airbus Protect shines in international cybersecurity competition

Once a year, just before the Christmas break, cybersecurity experts from around the world gather together and compete in the SANS NetWars Tournament of Champions, an invite-only cybersecurity competition featuring the top-scoring 200 players from their regional equivalents. This competition tests cybersecurity professionals across hands-on challenges in penetration testing, forensics, and threat detection. Competitors solve [...]

Read more
Safety

From QMS to SMS: The Evolution of Safety Management Systems

For any modern enterprise, particularly those operating in safety-critical domains, the ability to manage risk is not merely a box-ticking exercise; it is the bedrock of operational longevity and ethical responsibility. In the complex world of industrial and technological operations, a haphazard, reactive approach to safety is no longer sufficient. What is required is a comprehensive,[...]

Read more