Rhys Downing

Ontinue researchers uncover the Lunex malware platform, revealing a sophisticated attack chain, BYOVD techniques, and previously unreported capabilities.

A new malware framework is hiding its entire command-and-control operation inside Microsoft 365 and Azure.

Rhys Downing outlines an ongoing campaign targeting developers through fake installation pages that mimic popular developer tools.

Ontinue's ATO team published research on VoidLink revealing how LLM-generated malware is lowering the barrier to sophisticated Linux C2 implants with cloud…

Ontinue's ATO team examined the new Chat with Anyone feature in Microsoft Teams and offers best practices to protect against phishing attacks

Research from Ontinue reveals how Nezha, a legitimate open-source monitoring tool, is being abused by attackers as a stealthy post-exploitation RAT.

Ontinue's Advanced Threat Operations team published reverse engineering analysis of Vidar Stealer 2.0 through systematic analysis.

Learn about the Salty2FA phishing method: multi-stage credential theft using MFA bypass and evasion tactics—and how to defend.

Dive into how the threat actor LockBit operates—attack methods, monetization models, and defenses every organization should apply.

Ontinue Cyber Defenders have observed an uptick in activities related to the LummaC2 infostealer being used as a Malware-as-a-Service.