Mohammad A'mir
SC-200, AZ-500, SC-300
Mohammad specialises in cyber threat intelligence, incident response, malware analysis and threat actor profiling. He supports intelligence-led investigations by correlating threat intelligence with security incidents to improve detection and response.
5 articles
Rogue Certificates For Real Brands: What The ccTLD Registry Hijacks Mean For Your Domains
Attackers hijacked the .gh, .sl and .as registries and got trusted certificates for big brands. CAA, CT monitoring and the DNS risk behind it.
Threat ResearchNetScaler Zero-Days: Why Patching Isn't Enough After Config Theft
Three NetScaler zero-days, exploited before disclosure. The upgrade closes the hole but rotates no secrets. What to rotate and how to hunt downstream.
Threat ResearchToolShell Exploits: Inside CVE-2025-53770 And CVE-2025-53771's Critical Threat To SharePoint
Two chained SharePoint flaws giving unauthenticated remote code execution — and both are patch bypasses. Affected versions, attacker tradecraft, IOCs and what to do now.
Threat ResearchFrom ClickFix To FileFix: A New Frontier In Social Engineering Attacks
ClickFix persuaded users to run commands themselves. FileFix does the same through File Explorer — no download, no Mark-of-the-Web, and almost nothing to distinguish it from normal work.
Threat ResearchMassive Password Leak: Investigating The Alleged 16 Billion Credential Breach
Headlines claimed the largest credential compilation in history. Our threat intelligence team investigated, and the reality is less dramatic and more persistent than the number suggests.
Talk to the people
who do the work.
A demo against your own estate rather than a canned one, run by an analyst rather than a salesperson.