Ahmed Attalla

I’m super excited to be presenting my latest research at BlackHat MEA this year! VSCode and AI-powered IDEs are going to cause one of the largest breaches soon. It’s time for vendors to take action, and I’ll be sharing my findings this December at BlackHat MEA. Over the past few months, I’ve been researching ways to scale how attackers could compromise developers through VS Code and other AI-powered IDEs (Cursor AI, Windsurf, and AWS Kiro). The research involved finding vulnerabilities that led to bypass Microsoft sandbox scanning, SAST analysis, DAST scanning, and all relevant security controls. The same outcome were shown on OpenVSX, the market is powering Cursor AI, Windsurf, and AWS Kiro. Join me this December in Riyadh for Black Hat MEA.

124

6 Comments

📔Studying OSINT and Cybersecurity Fundamentals from a Technical and Defensive Perspective📔 Core focus areas: 🔴 Open-Source Intelligence (OSINT) 🔴 Ethical collection and correlation of public data 🔴 Digital footprint and social media exposure awareness 🔴 Windows system fundamentals 🔴 Legal and ethical principles in offensive security Security is not exploitation — it is understanding. Knowledge exists for defense, risk mitigation, and responsible use. 🔐 🔗Comment: "RTFM-OSINT", to get Book in private. #RedTeam #OSINT #OPSEC #CyberSecurity #BlueTeamMindset #EthicalSecurity

42

82 Comments

The challenge for SOC teams isn’t the lack of alerts, it’s knowing which ones actually matter. Implementing Threat Intelligence directly inside SOC workflows is how teams reduce noise, prioritize faster, and accelerate response.

4

Just exactly 2 weeks ago at Web Summit Qatar, we talked about the very situations we are seeing now with the reported QatarEnergy leak. This huge several-terabyte data loss proves that old-school security (kernel-level) can’t see attackers who move through a system using stolen, "real" login details. A shift toward user-mode security is one of the most effective ways to address these threats-by securing the point where data is actually used. The GCC market doesn't need just another firewall; it needs the major shift in thinking that we showed in Doha.

4

The pros and cons in NIST standards for cybersecurity recommendations to 2026 Excellent analysis by constructive criticism to hardening cybersecurity standards against humanity by weaponization of technology and AI Read through here https://zurl.co/ZaObB #Enterprise_administrator_CIO_CISO #cyber_command_USA #CEO #FBI_CIA_US_Government #CIA_NSA_OFAC_Digital_Government_US_congress #US_Senate #Cyber_Security_Community_Weaponization_AI #President #stealer_Logs_Mitre_Attacks_Extortion_Anti_Virus_Applications_EDR_XDR #Patch_Management_IBM_Microsoft_Amazon #Social_Media_Mange_Engine_Zoho_Threat_Deduction #Africa #Asia #SAP_Ariba #Canada #UN_ODC_UN_Global_Compact #US_Treasury_US_Cyber_Security_Executive_Order_EU_US_DATA_Shield_GDPR #Godaddy_AWS_Cloud_Flare_Get_HUB #World_Bank_IMF_global_DATA_Access_Combat_Act #Meta #Interpol #Black_Rock #Swiss_DATA_Protection_Act #UAE #White_House_Cyber_Security_Executive_Orders

5

Weekly GCC Threat Summary: February 13, 2026 Key metrics (as of February 13, 2026): Threat Actors: 110 targeting GCC State-Sponsored APTs: 4 active Campaigns: 18 detected Actor Evolution: 12 groups showing capability changes IOC Velocity: -58% High Severity: 9 actors Most active threat actors: Ember Bear, INC Ransom, Storm-1811, Ajax Security Team, Play Key observations: - Multiple state-sponsored APT groups maintaining regional operations - Significant actor evolution detected across threat landscape - Elevated campaign activity across multiple sectors This intelligence is updated continuously from aggregated threat feeds, CVE correlations, and regional monitoring. --- GCC-Focused Threat Intelligence Platform Request a demo: info@vyuhnet.com

6

Campaign Deep Dive: February 15, 2026 GCC Threat Operations Overview: 20 active campaigns targeting GCC organizations are currently being tracked in real-time across multiple threat actors. Threat Actors in Active Campaigns: - Ember Bear (MEDIUM) - active capability changes - INC Ransom (MEDIUM) - active capability changes - Storm-1811 (MEDIUM) - stable operational pattern - Ajax Security Team (MEDIUM) - active capability changes Campaign Characteristics: - Target Sectors: Finance, Government, Energy, Technology - Attack Vectors: Spear-phishing, Supply chain, Credential theft - Infrastructure: Rotating C2, bulletproof hosting, cloud abuse - Objective: Espionage, data exfiltration, pre-positioning 564 threat-CVE correlations provide attack path visibility for defenders. Understanding campaign operations enables proactive defense rather than reactive incident response. --- | GCC-Focused Threat Intelligence Platform Request a demo: info@vyuhnet.com

5