Author

Alex Kim

Threat intelligence editor

Focuses on cloud identity, incident response, and exploitation trends.

CloudIncident responseIdentity

Coverage by Alex Kim (121)

Illustration of an autonomous AI agent chaining a Langflow RCE foothold into Nacos and database destruction in the JadePuffer campaign

JadePuffer AI Ransomware Marks First Fully Agentic Extortion Campaign

The operator chained CVE-2025-3248 through secrets harvest, Nacos takeover and database destruction — including a 31-second self-repair — with no human driving.

Abstract illustration of two separate state-linked cyberespionage paths converging on a Pakistani police complaint portal

Cloud Security Research

Dual-Threat State Actor Cyber Espionage: How Rival China- and India-Linked Actors Converged on Balochistan Police Networks (2024–2026)

The overlap breaks single-actor incident models: a confirmed foothold no longer implies a single intrusion set, or that eviction ends the campaign.

Dossier-style infographic summarizing double-agent ransomware negotiator scheme with key dollar figures, prison sentences, and collusion flow nodes from the Martino case

Ransomware Negotiators Research

Double-Agent Ransomware Negotiators: How Insiders Inflated Ransoms and Betrayed Victims

Federal cases reveal ransomware negotiators acting as double agents who leaked insurance limits to inflate ransoms and collect kickbacks from attackers.

Security operations analysts using AI automation dashboards that reduce data-breach costs and shorten incident lifecycles

Cloud Security Research

Defensive AI Cuts Breach Costs by $1.9 Million and Shrinks Attack Lifecycles by 80 Days

Drawn from 600 breached organizations, the figures are converting abstract AI hype into concrete budget justification for CISOs facing machine-speed attackers.

European financial board reviewing ICT risk packs and Register of Information data during a DORA liability audit discussion

Cloud Security Research

DORA Board Liability Audits: Why Personal Exposure Is Now Live Across the EU

After the 2026 Register of Information cycles, operational resilience is no longer a checkbox a board can safely delegate to the CIO or a third party.

Diagram-style illustration of indirect prompt injection spreading from a poisoned email or document into an enterprise AI agent’s tools.

Cloud Security Research

Indirect Prompt Injection Puts Enterprise AI Agents at Risk—and Filters Alone Will Not Stop It

Assume injection succeeds, then contain it with architecture, least privilege, isolation and monitoring rather than betting the estate on a single classifier.

Illustration of AI-discovered open-source vulnerabilities flowing into a human-and-AI triage clearinghouse that produces signed remediated packages

Cloud Security Research

AI Automated Vulnerability Orchestration in Open Source: Clearinghouses After the Discovery Flood

With NVD enrichment stalled and bounty programs closing, coordination is shifting to systems that turn findings into rebuildable artifacts before exploits land.

Editorial illustration of a dark-web leak dashboard over an electronics plant silhouette

Cloud Security Research

Tata Electronics Cyberattack Exposes Apple and Tesla Hardware Secrets in Pure Data Extortion Campaign

Tata said production was unaffected, but the 630GB dump shows pure-extortion crews extracting leverage from contract manufacturers instead of encrypting them.

Desks covered

Operations Research

Latest

Sep 12, 2026, 12:37 PM EDT · Research · Mlx12 minMLX vs llama.cpp on Apple Silicon: Which Local LLM Runtime to Actually Use

One is a portable inference engine, the other an array framework that also trains — and that single difference settles almost every practical question.

Sep 12, 2026, 12:37 PM EDT · Operations · Llm Evaluation14 minHow to Build an LLM Evaluation Harness That Catches Real Regressions

Public benchmarks only shortlist a model; your own cases decide whether to ship it. Here is the dataset, the scorers and the CI gates that catch real drift.

Sep 12, 2026, 12:37 PM EDT · Research · Prompt Caching11 minPrompt Caching Explained: Cutting Agent Costs Without Touching the Model

Your agent re-sends the same long prefix on every step and pays to recompute it. Here is the KV mechanism, the ordering rule it forces, and the break-even math.

Sep 12, 2026, 12:37 PM EDT · Research · Speculative Decoding11 minSpeculative Decoding and Multi-Token Prediction: How LLMs Generate Faster

Decode is memory-bound, so checking several tokens in one pass is nearly free. Here is the mechanism, the arithmetic behind it, and why quality never moves.