Mohammad A'mir
SC-200, AZ-500, SC-300
Mohammad specialises in cyber threat intelligence, incident response, malware analysis and threat actor profiling. He supports intelligence-led investigations by correlating threat intelligence with security incidents to improve detection and response.
14 articles
What Is The Vulnerability Management Lifecycle? The Six Stages, And Where Most Programmes Stall
The vulnerability management lifecycle: discover, assess, prioritise, remediate, verify, report. What each stage involves, and where programmes stall.
FundamentalsWhat Is An Advanced Persistent Threat (APT)? How Nation-State Groups Operate, And How To Spot One In Microsoft 365
An APT is a skilled, well-resourced attacker that stays hidden in a network for months. How they operate, how they're named and the signs to look for.
Threat ResearchOpt-In, Still Exposed: Finding The Brotli Flaw (CVE-2026-111497) Across Your .NET And Node.js Estate
Microsoft shipped emergency .NET fixes for the Brotli flaw. Self-contained apps, containers and bundled copies need more. How to find them with Defender KQL.
Threat ResearchFully Patched, Still Bootkitted: BlackX And The Secure Boot Revocation Most Estates Skipped
BlackX loaded on fully patched Windows PCs because the Secure Boot revocation is a manual step. How to check your estate, hunt and apply it safely.
FundamentalsWhat Is Double Extortion Ransomware? How It Works, And Why Backups Alone Won't Save You
Double extortion ransomware steals data before encrypting it, so restoring from backup is only half the answer. How it works and how to reduce the damage.
FundamentalsWhat Is A Zero-Day Attack? How Zero-Days Work, And What You Can Do Before The Patch Exists
A zero-day attack exploits a flaw before a fix exists. How zero-days differ from n-days, why they matter, and what to do in the first 72 hours.
Threat ResearchEight Stolen CA Keys: Checking Your Estate After The Intermediate Certificate Compromise
Browsers and Windows now block eight compromised intermediate CAs. Apps with their own trust stores may not. How to find them with Defender KQL.
Threat ResearchThe Box That Holds Every Key: Hunting Downstream From A Compromised Remote Support Appliance
A remote support zero-day was exploited from August. Patching won't undo it. What to rotate, in what order, and how to hunt downstream in Defender.
Threat ResearchThe Firewall's Admin Page Is The Target: Hunting PAN-OS CVE-2026-0322
A PAN-OS zero-day gives root via the management interface to anyone with an admin login. Fixed versions, what to rotate and KQL to hunt it.
Threat ResearchRogue Certificates For Real Brands: What The ccTLD Registry Hijacks Mean For Your Domains
Attackers hijacked the .gh, .sl and .as registries and got trusted certificates for big brands. CAA, CT monitoring and the DNS risk behind it.
Threat ResearchNetScaler Zero-Days: Why Patching Isn't Enough After Config Theft
Three NetScaler zero-days, exploited before disclosure. The upgrade closes the hole but rotates no secrets. What to rotate and how to hunt downstream.
Threat ResearchToolShell Exploits: Inside CVE-2025-53770 And CVE-2025-53771's Critical Threat To SharePoint
Two chained SharePoint flaws giving unauthenticated remote code execution — and both are patch bypasses. Affected versions, attacker tradecraft, IOCs and what to do now.
Threat ResearchFrom ClickFix To FileFix: A New Frontier In Social Engineering Attacks
ClickFix persuaded users to run commands themselves. FileFix does the same through File Explorer — no download, no Mark-of-the-Web, and almost nothing to distinguish it from normal work.
Threat ResearchMassive Password Leak: Investigating The Alleged 16 Billion Credential Breach
Headlines claimed the largest credential compilation in history. Our threat intelligence team investigated, and the reality is less dramatic and more persistent than the number suggests.
Talk to the people
who do the work.
A demo against your own estate rather than a canned one, run by an analyst rather than a salesperson.