R3KONX analysis, published as developments warrant.
Signal collection, spectrum awareness and emitter analysis across the electromagnetic spectrum.
South Africa's air navigation provider found ransomware-stage malware in the operational technology supporting weather services to air traffic control. Containment was declared before forensics began, and ICAO Annex…
6 min read 11 sources
Three European airports suspended operations this year on sightings nobody could confirm or attribute. The EU's own action plan treats detection as a pillar but mandates no performance…
5 min read 10 sources
The Philippine Coast Guard says a Chinese survey vessel broadcast false positions while holding station near a submarine cable corridor. The falsified track is the firm part of…
6 min read 10 sources
Adversarial testing, red teaming and exploit research: finding the gaps before adversaries do.
Sucuri has documented a WordPress infection replicated across eight locations that rebuild one another, plus a copy held in shared memory. The durable lesson is about the platform's…
6 min read 10 sources
CERT/CC published a signature-verification bypass in Authlib on 28 September and recorded the vendor as unreachable with no patch available. A week later there is still no fix,…
5 min read 10 sources
Cisco disclosed a fourth exploited authentication or privilege flaw in the Catalyst SD-WAN control plane on 30 September. The pattern matters more than the CVE: what began as…
5 min read 11 sources
Detection, response and mission delivery in contested networks, and how operations are actually run.
Microsoft counts at least thirteen large-scale phishing campaigns and more than one hundred affected organisations since January. The change that matters is not the new malware but that…
6 min read 11 sources
Glow Labs found more than 13,000 internal screenshots in public GitHub repositories, put there by AI coding agents that could not attach an image to a private pull…
5 min read 10 sources
Microsoft documented NeedyMantis on 28 September: a modular post-compromise framework found while following indicators from the DAEMON Tools supply chain compromise. Its design choice - load a capability,…
5 min read 10 sources
