Confidence Is a Field, Not a Feeling
A short note on how HECAVEX will communicate analytical confidence and distinguish evidence from inference.
HECAVEX / EN
Research
Investigations, technical analysis and intelligence notes.
Introducing HECAVEX
Why HECAVEX exists and how this independent threat intelligence publication will approach evidence, uncertainty and digital investigations.
Information Factories on Lithuania's Border: How Russian and Belarusian Information Operations Target Lithuania, NATO, and Europe
How Russian and Belarusian information operations manufacture, localise, and distribute narratives targeting Lithuania, NATO, and Europe.
When Fake News, Scams, and Cloaking All Meet in One Place
An investigation into how fake news, investment fraud, and cloaking combine into a single victim-selection and monetisation infrastructure.
ClickFix: Why Modern Threat Actors No Longer Look for Vulnerabilities—they Look for People
The anatomy of ClickFix campaigns: how fake verification prompts turn users into the execution mechanism and what SOC and CTI teams should detect.
One Scam Domain Is Rarely Alone: Using Pivoting to Trace Fraud Infrastructure
A practical infrastructure-pivoting method for moving from one scam domain to related hosts, templates, and backend systems.
MFA Is Not a Panacea, and It's Time We Stopped Pretending It Is
Why MFA is essential but insufficient against session theft, AiTM, token replay, OAuth abuse, and modern account takeover.
The Centre of Registers Data Theft — Part 2
Part two of the Centre of Registers data-theft analysis, examining stolen identity, legitimate access, and gaps in behavioural detection.
The Centre of Registers Data Theft: When “It’s Just Data” Suddenly Becomes a National Security Issue
Why large-scale theft from Lithuania's Centre of Registers is not merely a privacy incident but a potential intelligence and national-security issue.
MISP for Cyber Threat Intelligence: Installation, Integration, and Automation. [Part 1]
A practical guide to installing MISP with Docker, understanding its threat-intelligence data model, integrations and automation options.
Unveiling Hidden Dangers on GitHub: Malicious Python Scripts Sending Your Data to Hackers
A technical investigation of malicious Python code hidden in a GitHub project, its obfuscation and the remote infrastructure receiving stolen data.
Unleashing the Dynamic Duo: OSINT and CTI for Proactive Defense against Cyber Threats.
How OSINT and cyber threat intelligence work together to reveal threat activity, improve context and support proactive security decisions.
Unleashing the Power of OSINT. Google Dorking: Unveiling Hidden Treasures of the Web.
Learn how advanced Google search operators support OSINT investigations, cybersecurity research and the discovery of hard-to-find public information.