Cybersecurity
The Engineer's Guide to MalDevOps: Deconstructing Modern Threat Actor Infrastructure
A technical deep-dive into the DevOps principles, CI/CD pipelines, and Infrastructure-as-Code (IaC) practices used by modern threat actors to build, deploy, and manage sophisticated malware campaigns.
MalDevOps is the now-standard practice where threat actors apply mature DevOps principles—CI/CD, Infrastructure-as-Code (IaC), and containerization—to the entire lifecycle of malware development and operations. This software engineering approach allows them to build, test, and deploy malicious infrastructure with industrial-scale efficiency, speed, and resilience. By treating their operations as a software product, adversaries can rapidly iterate on attack tools and evade detection through constant, automated change.
For defensive engineers and offensive security professionals, understanding the mechanics of MalDevOps is fundamental. The ability of adversaries to regenerate entire attack infrastructures from code in minutes renders traditional IOC-based blocking insufficient. This guide deconstructs the modern MalDevOps toolchain, from AI-assisted payload generation in CI/CD pipelines to ephemeral, multi-cloud Command and Control (C2) infrastructures managed by code.
Latest briefings on The Engineer's Guide to MalDevOps: Deconstructing Modern Threat Actor Infrastructure
Security
Old Virus Secretly Altered Calculations
A newly analyzed computer virus from over 20 years ago, named fast16.sys, reveals an early Stuxnet-style attack. The malware was designed to selectively target high-precision calculation software, subtly altering results in memory. This highlights a long-standing threat of data manipulation in critical systems.
Neeraj Dhiman ·
Security
Hackers Turn Web Analytics Script into a Weapon
A Russian-linked hacking group, APT29, has compromised a popular web analytics script. The attack injects malicious code into websites, which then targets visitors using iOS and Android devices with exploits.
Neeraj Dhiman ·
Data
How to Stop a Rogue Database From Taking Writes
When a Postgres database fails over, the old primary can sometimes keep accepting data, causing corruption. ClickHouse built a system to safely isolate, or "fence," the old server across different cloud and on-premise environments.
Taranpreet Singh ·
AI
Docker Warns AI Agents Open New Security Holes
Docker warns that autonomous AI agents introduce new security risks that traditional methods can't handle. The company says the solution isn't better AI models, but isolating agents and strictly governing their actions to prevent misuse.
Neeraj Dhiman ·
Security
Hackers Hijacked a Security Tool to Steal Passwords
Attackers compromised the update system for the cPGuard security tool, using it to push a malicious script to Linux servers. This script installed a backdoor and stole password hashes and other sensitive files from affected systems.
Neeraj Dhiman ·
Security
Ransomware Hits Synology Devices Using a Patched Flaw
Attackers are targeting Synology NAS devices with ransomware, exploiting a vulnerability that was patched months ago. Synology is urging all users to update their DiskStation Manager (DSM) software immediately to protect their data.
Neeraj Dhiman ·
Security
Barracuda Flaws Allow Full Device Takeover
Barracuda has revealed two critical flaws that can be combined to give attackers complete control over its security devices. The vulnerability chain allows unauthenticated hackers to gain root access, bypassing all security checks.
Neeraj Dhiman ·
Security
Popular AI Tool Left Servers Open to Attack
Critical flaws in the popular AI tool Langflow let attackers run code on servers without any credentials. IBM discovered the vulnerabilities, which affect all versions before 1.13.0, and urges users to update immediately.
Neeraj Dhiman ·
Security
Hackers Are Using AI to Write Malicious Scripts
Security researchers found a new attack on government Linux servers using a tool called SysGoRAT. The attackers may be using AI to generate their malicious scripts, a major shift in cyber espionage tactics.
Neeraj Dhiman ·
Security
The Real Reason Critical Security Patches Are Delayed
Critical security fixes often get stuck because IT teams fear they will break applications. A new framework helps security teams prove a patch is safe, getting it deployed faster and reducing organizational risk.
Neeraj Dhiman ·
Security
New Malware Targets Governments With .NET Trick
A new malware campaign, NetamLoader, is targeting government organizations in Asia. It uses a previously undocumented .NET injection technique, revealing a sophisticated new attack vector for security and development teams to monitor.
Neeraj Dhiman ·
Security
A Popular Claude Extension Hid a Secret Backdoor
A malicious version of the official Claude AI coding extension was discovered on a popular marketplace. The compromised tool installed a persistent SSH backdoor, giving attackers remote access to developers' machines and their code.
Neeraj Dhiman ·
Security
A Simple Header Flaw Exposed SOGo Accounts
A vulnerability in the SOGo groupware server allowed attackers to hijack user accounts. The flaw stemmed from how SOGo handled password reset links, letting attackers steal the reset tokens and gain unauthorized access to corporate data.
Neeraj Dhiman ·
Security
Critical Drupal Commerce Flaw Is Under Active Attack
A critical authorization bypass vulnerability in Drupal's Commerce Core is being actively exploited. The flaw affects a wide range of versions, putting e-commerce sites at immediate risk until they are patched.
Neeraj Dhiman ·
Security
A Perfect-Score GitLab Flaw Was Used Against Alpine Linux
Attackers tried to exploit a maximum-severity GitLab vulnerability on Alpine Linux's own servers just one week after a patch was released. The attempt highlights an urgent need for all teams to update their GitLab instances immediately.
Neeraj Dhiman ·
Security
The Real Cost of Downloading Cracked Software
Microsoft is warning of a malware campaign targeting users searching for cracked software and free games. Attackers use fake installers to deliver multiple unwanted programs that monetize the infection through ads and other intrusive means.
Neeraj Dhiman ·
Security
Security Teams Will Soon Need More Engineers Than Analysts
Gartner predicts that by 2028, security teams will have 50% more engineers than analysts. This shift is driven by AI agents taking over routine tasks, requiring more engineering skills to manage and build automated systems.
Neeraj Dhiman ·
Security
New Phishing Attack Skips Stealing Your Password
A new phishing campaign called 'Skyw4lker' targets U.S. organizations using a clever trick. Instead of stealing passwords, it abuses legitimate cloud login features to trick employees into granting attackers direct access to corporate accounts.
Neeraj Dhiman ·
Security
Adobe Fixes Flaw That Gave Attackers Full Control
Adobe has patched eight critical vulnerabilities in its Campaign Classic marketing software. The most severe flaw, rated 9.9/10, could allow attackers to execute arbitrary code, potentially taking full control of the system and its customer data.
Neeraj Dhiman ·
Security
What Happens When Your Fintech Vendor Goes Down
Fintech provider Abrigo took its Sageworks platform offline after a cyberattack, disrupting risk management services for thousands of banks and credit unions. The incident highlights the growing threat of supply chain attacks in the financial sector.
Neeraj Dhiman ·
Security
Linux Desktops Vulnerable to Data Theft and Crashes
Security flaws in the GNOME desktop's file system component, GVfs, could let attackers steal sensitive data over SFTP or crash systems via AFP. The vulnerabilities affect many popular Linux distributions and require immediate patching to secure user data.
Neeraj Dhiman ·
Security
Your Linux Server's Bluetooth Could Be a Backdoor
A critical vulnerability in the Linux kernel's Bluetooth subsystem could let a local attacker crash your system or run any code they want. Ubuntu has issued a security notice detailing this and other flaws that could compromise the entire system.
Neeraj Dhiman ·
Security
Your TeamCity Server Needs This Critical Security Update
JetBrains has released urgent updates for its on-premises TeamCity CI/CD server. The new versions fix significant security vulnerabilities, performance problems, and several bugs, making it a critical patch for development and IT teams to apply immediately.
Neeraj Dhiman ·
Security
The Most Secure OS Now Supports More Hardware
OpenBSD 8.0 has been released, bringing major updates for modern hardware and security. The new version adds support for Intel Arc graphics and improves virtualization, making the secure operating system more versatile for today's infrastructure.
Neeraj Dhiman ·
Security
That Microsoft Teams IT Request Might Be a Trap
Attackers are exploiting a Microsoft Teams feature to send messages from outside your organization, posing as IT support. They trick employees into running malicious files, leading to malware and ransomware infections.
Neeraj Dhiman ·
Security
Hackers Build Ghost Networks for Stealth Attacks
A state-sponsored hacking group called Volt Typhoon is using a new method, 'Silent Train,' to launch attacks. They create temporary chains of hijacked devices to hide their tracks, making them incredibly difficult to detect and block.
Neeraj Dhiman ·
Security
How North Korean Hackers Are Weaponizing AI
Microsoft reports North Korean hackers are using large language models to improve their cyberattacks. This allows them to craft more convincing phishing emails, research targets, and write malicious code, making them a more sophisticated threat.
Neeraj Dhiman ·
Security
Hackers Use AI to Steal Passwords in Hours
Attackers are using AI agents to accelerate post-breach activities. After exploiting a PHP flaw to target a European government, an AI helped steal password hashes and multi-factor authentication data in under two hours, signaling a major shift in cyberattack speed.
Neeraj Dhiman ·
Security
Attackers Are Crashing Cisco Firewalls With a New Flaw
Cisco has patched a critical zero-day vulnerability in its ASA and FTD firewalls. Attackers were actively exploiting the flaw to remotely crash devices, disrupting SSL VPN services and forcing reboots. Updates are available now.
Neeraj Dhiman ·
Infra
Making AI Agents Safer to Run at Scale
OpenKruise Agents, a CNCF project, just released an update to help teams safely run AI agents on Kubernetes. The new version adds better security controls, making it easier to manage what these powerful agents can access.
Ashish Kale ·
Frequently asked questions
What is MalDevOps?
MalDevOps applies a software engineering discipline to malware operations. It uses CI/CD pipelines (e.g., GitHub Actions) for automated polymorphic payload generation, Infrastructure-as-Code (IaC) to provision ephemeral C2 infrastructure across multiple clouds, and containerization for consistency. This enables threat actors to operate with extreme agility, making their infrastructure resilient to takedowns.
What are common tools in a MalDevOps toolchain?
Adversaries use a mix of legitimate and custom tools. A modern toolchain features private Git repos, CI/CD platforms like GitHub Actions or GitLab CI for automation, and IaC tools like Terraform or Pulumi to manage resources on AWS, Azure, and GCP. This is paired with modern C2 frameworks like Sliver or Havoc, or custom implants developed in languages like Go or Rust.
How does Infrastructure-as-Code (IaC) benefit attackers?
IaC allows attackers to codify their entire attack infrastructure—from C2 servers and domain fronting configurations to serverless redirectors and containerized payloads. This enables 'infrastructure regeneration,' where a compromised or blocked setup can be torn down and redeployed in a new configuration within minutes. This velocity neutralizes the impact of traditional blocklisting and takedown efforts.
How can defenders combat MalDevOps tactics?
Defense shifts from blocking IOCs to detecting malicious TTPs in cloud environments. This involves using Cloud-Native Application Protection Platforms (CNAPP) to spot anomalous infrastructure provisioning, analyzing cloud audit logs (e.g., AWS CloudTrail) for suspicious API calls from IaC tools, and applying AI-powered anomaly detection. Proactive threat hunting for patterns of ephemeral infrastructure is crucial.