What We Do
The Process
Latest Posts
[Advisory]TIBER-EU and DORA: What Financial Institutions Need to Understand Before the Notification Arrives
[Advisory]NIS2 Compliance in Portugal: Evidence Over Documentation
[Technical Research]Killing EDR visibility at the kernel: BYOVD
[Technical Research]ACL Abuse Havoc, a BOF toolkit for AD ACL exploitation via Havoc C2
From the operators
Research, walkthroughs, and opinions from our operators. The same work that goes into our engagements, shared publicly.

Decree-Law 125/2025 is in force. We break down what Article 27 requires, what CNCS auditors actually check, and where organisations in Portugal are failing.
Read More →
Most EDRs rely on kernel callbacks to see what happens on an endpoint. We show how BYOVD attacks zero those callbacks, why ML detection does not save you, and what defenders should actually do about it.
Read More →
We're releasing acl-abuse-havoc, an open-source BOF toolkit for abusing Active Directory ACL misconfigurations through Havoc C2. The centrepiece is acl-shadow, a full Shadow Credentials attack chain that runs entirely in-memory.
Read More →