Armada Blog

Reverse Engineering a Crypto Wallet Remote Access Trojan

nick.swink@risk3sixty.com (Nick Swink) — Tue, 10 Nov 2026 20:34:02 GMT

Introduction

"Hey Nick, I've got this interesting sample if you want to take a look at it. Currently zero detections on VirusTotal."

Cloud Security Must Track Real Attack Paths

cory.wolff@risk3sixty.com (Cory Wolff) — Tue, 10 Nov 2026 04:29:05 GMT

A public storage bucket is rarely the full incident. The real question is what an attacker can do next: use exposed data to target an employee, reuse a leaked credential, assume a privileged role, reach a production workload, or pivot into the identity plane. That is the standard cloud security programs must meet. Finding misconfigurations is useful. Proving which ones create a viable path to business-critical systems is what changes risk.

What “AI Aimbot” Actually Means: Inside a Modern Commercial Game Cheat (Part 2)

steve.guris@risk3sixty.com (Steve Guris) — Tue, 07 Jul 2026 18:50:59 GMT

Reverse Engineering a Commercial AI Cheat: How AI Agents Changed the Way We Work (Part 1)

steve.guris@risk3sixty.com (Steve Guris) — Tue, 07 Jul 2026 18:28:40 GMT

Someone Else’s Cybercrime, Routed Through Your House

steve.guris@risk3sixty.com (Steve Guris) — Thu, 25 Jun 2026 16:54:43 GMT

Armada Team Achieves CREST Accreditation for Penetration Testing

cory.wolff@risk3sixty.com (Cory Wolff) — Thu, 15 Jan 2026 15:53:00 GMT

Hardware Hacking: Discovering a DoS in NetGear Router

will.mcgraw@risk3sixty.com (Will McGraw) — Wed, 26 Nov 2025 15:12:00 GMT

Exploiting SharePoint Permissions the Co-Pilot Way

cory.wolff@risk3sixty.com (Cory Wolff) — Tue, 19 Aug 2025 15:11:00 GMT

Security Advisory – Microsoft 365 Direct Send Abuse in Active Phishing Campaigns

cory.wolff@risk3sixty.com (Cory Wolff) — Tue, 01 Jul 2025 15:48:00 GMT

JWT Abuse in Modern Web Apps: How a Misconfigured Token Leads to Full Access

andrew.gahan@risk3sixty.com (Andrew Gahan) — Wed, 25 Jun 2025 15:43:00 GMT