Monthly Adversary Tradecraft Spotlight – June
OpenWith.exe Executes Specified Binary This technique leverages OpenWith.exe as a proxy execution mechanism to run arbitrary code while blending in with legitimate system activity. It is a trusted Windows binary that is typically used when a user selects “Open with…”...
The Extension Threat Vector: Protecting Browsers and Dev Environments?
If your organization doesn’t manage extensions and your users can freely install any browser and VSCode addons, you have an unmanaged code execution surface running with potentially elevated trust on your devices. The GitHub breach last month is just the latest proof...
Monthly Adversary Tradecraft Spotlight – May 2026
Windows Recovery Environment Disabled Via Reagentc WinRE exists specifically to help users repair boot problems, restore previous system states, and troubleshoot failures when Windows can no longer start normally. Disabling the Windows Recovery Environment (WinRE) is...
The Role of AI in Cybersecurity: Smarter Defense Against Evolving Threats
Artificial intelligence is transforming cybersecurity by helping organizations detect threats faster, reduce manual workload, and improve response capabilities. As cyberattacks become more sophisticated, AI enables security teams to move from reactive defense to...
“Black Cell chose me” – Viki’s Story
Why did you choose BlackCell? How did you decide you wanted to work here?Actually, I didn’t choose Black Cell at first – Black Cell chose me. A dear friend of mine – who is now also a colleague – who had been working at the company for a while, reached out to ask if...
Monthly Adversary Tradecraft Spotlight – April 2026
Powershell LocalAccount Manipulation The manipulation of local user accounts with PowerShell commands (related to account management operations) can occur during legitimate administrative tasks but become suspicious when they appear unexpectedly or in an unusual...
Flex routing in Copilot: steps to avert a potential privacy risk
Microsoft has recently introduced a feature in Microsoft 365 Copilot called flex routing that affects EU and EFTA customers. The feature allows large language model inferencing to occur outside the EU Data Boundary during periods of peak demand, with the aim of...
Rethinking Detection Engineering: Black Cell’s Detection-as-Code Framework
Detection-as-Code Tools is a repository designed to standardize the creation, validation, and deployment of detection rules across multiple security platforms. Itprovides a structured, automation-ready framework that enables security engineeringteams to manage...
Mobile Security Month: 6 Simple Ways to Reduce Mobile Risk
As smartphones and tablets continue to play a central role in modern work, mobile devices have become a critical part of the enterprise attack surface. From business email and MFA prompts to sensitive applications and cloud access, a compromised device can quickly...
