Security research, technical perspectives, and company announcements from the team building practical Zero Trust Connectivity.
A construction quote lure led to device code phishing, three rogue Entra devices named iAuthFlow-Device, and seven weeks of mail access before a thread hijack.
Deep dives
Original technical analysis of active threats, vulnerable systems, and defensive architecture.
Tax-themed ISOs sideload ValleyRAT through a signed Visual Studio tool. Five months of builds share one transport key and a text file that hands out new servers.
Two ClickFix kits fought over the same screen on hacked WordPress sites. One wrote the fight into its code, in Russian, down to the moment the browser broke.
Brevo served KongTuke ClickFix from its own infrastructure. Altered tracker scripts, forms, and unsubscribe pages delivered the attack to customer sites.
A compromised HBO Max Reddit account led to PasteSwitch, a cross-platform ClickFix operation spanning macOS stealers, Windows loaders, deceptive TLS, and contract-controlled clippers.
A 99 KB Mirai-derived sample scanned 238,756 hosts in 149 seconds. RondoDox shows how Zero Trust Connectivity can contain compromised IoT devices.
Perspectives
Technical perspectives on DNS, Zero Trust Connectivity, and modern network defense.
At GITEX 2025, Spire Connect’s Pankaj Sharma asked Francois Driessen what to do when security systems fail. Why even real-time detection is too slow, and how Zero Trust Connectivity denies connections first.
Encrypted DNS hides queries from protective DNS policy. A lab walk-through of Do53, direct-to-IP and allowed DoH URL bypass attempts, and how a local Zero Trust Resolver keeps encryption and enforcement together.
In a default-deny network, legacy apps, VoIP and peer-to-peer tools and time-bound connections can fail DTTS checks. The three categories of violation, how traffic logs show them, and how Enablers grant exceptions.
OT environments face organized crime, nation-state attacks and IT/OT convergence that the Purdue Model and IEC 62443 alone cannot stop. How Zero Trust Connectivity controls egress at every level, with four test cases.
DNS TXT records carry SPF, DKIM and verification data, and now malware and C2 traffic too. Passive DNS analysis of who needs TXT answers, and how adam:ONE blocks them for risky endpoints while allowing the rest.
A hands-on test of how far Windows, Android and iOS have adopted encrypted DNS through DDR and DNR, with the adam:ONE lab setup, the queries each platform sends, and what administrators can enable today.
Company news
Product launches, industry recognition, and important updates from ADAMnetworks.
We released ClickNix, a free browser extension that blocks ClickFix content before it is shown, warns the visitor, and reports the compromised site to a shared defense network.
Our technology partnership with VyOS Networks layers adam:ONE, our Zero Trust resolver, onto the VyOS networking platform to secure cloud infrastructure, on-premises operations and remote access traffic.
Philippe Johnston, a former CIO and CTO across Canadian federal departments and past President of the CIO Association of Canada, has joined us as Field CIO and Strategic Advisor.
We uncovered Underminr, a vulnerability in how large hosting providers handle internet-bound connections. Attackers use it to evade protective DNS when reaching C2 or exfiltrating data, and it is under active exploit.
We have formed a distribution partnership with Spire Solutions, a value-added distributor in the Middle East and Africa, to bring adam:ONE and Zero Trust Connectivity (ZTc) to enterprises, governments and critical sectors in more than 10 countries.
ONE9 released a featurette on ADAMnetworks, From Reactive to Proactive: A New Cybersecurity Philosophy, covering adam:ONE and Zero Trust Connectivity. The video and full transcript are on our site.