https://kh4lifa0x.github.io/blogs/Ahmed KhalifaThreat research, malware analysis, and adversary infrastructure hunting. 2026-08-02T23:43:29+03:00 Ahmed Khalifa https://kh4lifa0x.github.io/blogs/ Jekyll © 2026 Ahmed Khalifa /blogs/assets/img/favicons/favicon.ico /blogs/assets/img/favicons/favicon-96x96.png From Windows Telemetry to Arrest: How Microsoft’s GDID Helped Connect the Dots2026-07-08T15:38:36+03:00 2026-08-02T22:57:27+03:00 https://kh4lifa0x.github.io/blogs/posts/from-windows-telemetry-to-arrest-how-microsofts-gdid-helped-connect-the-dots/ Ahmed Khalifa Executive Summary The arrest and extradition of an alleged Scattered Spider member drew attention for more than the charges themselves. The most revealing detail appeared inside the court documents: Microsoft telemetry associated with a Global Device Identifier, or GDID, helped investigators connect online activity to a specific Windows installation. According to the complaint, Microsoft reco... Inside Modern Supply Chain Intrusions: From CI/CD Abuse to Ecosystem-Wide Compromise2026-06-02T12:42:53+03:00 2026-08-02T23:14:26+03:00 https://kh4lifa0x.github.io/blogs/posts/inside-modern-supply-chain-intrusions-from-ci-cd-abuse-to-ecosystem-wide-compromise/ Ahmed Khalifa Modern supply chain intrusions are attacks that compromise trusted software development systems, including CI/CD pipelines, package registries, GitHub repositories, developer tools, and cloud environments. Instead of attacking one organization directly, threat actors abuse trusted dependencies, automation workflows, and stolen developer credentials to spread across entire software ecosystems. ... Crypto Money Laundering2026-02-25T10:59:36+02:00 2026-02-25T10:59:36+02:00 https://kh4lifa0x.github.io/blogs/posts/crypto-money-laundering/ Ahmed Khalifa Crypto Money Laundering: Definition, Stages, and Common Techniques Money laundering is the process of concealing illegally obtained funds to make them appear legitimate. In crypto, laundering has evolved because digital assets can move quickly across borders and between platforms, often with limited identity context unless strong compliance controls are in place. Crypto doesn’t make launderin... The Ransomware Ecosystem: Roles, Tools, and How Modern RaaS Attacks Work2026-02-09T08:45:05+02:00 2026-08-02T22:57:27+03:00 https://kh4lifa0x.github.io/blogs/posts/the-ransomware-ecosystem-roles-tools-and-how-modern-raas-attacks-work/ Ahmed Khalifa Ransomware is no longer just a malicious program deployed by a single attacker — it has evolved into a complex, profit-driven ecosystem operating much like a legitimate business model. Today’s ransomware operations involve multiple specialized actors, automated platforms, and underground services working together to maximize impact and financial gain. From Initial Access Brokers selling compro... Smishing Triad Targets Egypt’s Financial Sector and Postal Services2025-11-24T14:50:17+02:00 2026-08-02T23:14:26+03:00 https://kh4lifa0x.github.io/blogs/posts/smishing-triad-targets-egypts-financial-sector-and-postal-services/ Ahmed Khalifa Recently, during one of our threat hunting operations, our squad identified multiple malicious domains impersonating major Egyptian service providers, including Fawry, the Egypt Post, and Careem. These domains were likely established to support fraud, phishing campaigns, and other malicious activities targeting users and organizations. Before we begin our analysis, we will provide an overview ...