Scan the link and it sends you to Wikipedia. Click it like a human and you get the malware. This is what modern delivery infrastructure looks like, and it is built specifically to beat the check you were going to run.
An employee clicked a link in an email at 13:08 UTC. Ninety seconds later a batch file was running on their machine, trying to use a signed Windows tool to unpack a hidden backdoor. CrowdStrike blocked it before the decode finished, and the payload never made it to disk.
Then we went to look at the site that served it, and the site sent us to Wikipedia.
Not a dead link. Not a domain that used to be legitimate. A cloaking gate, and a well-built one. It fingerprints every visitor first, checking whether the browser is real or a headless scanner, so it only shows its true colors to a person and not a machine.
Visitors who pass get a challenge that has to be solved by a real click. Only then does the site decide where to send you, and it decides on its own server, across two round-trips. The real destination is never written into the page.
Scanners get Wikipedia. Your employee gets the payload. Same URL, different visitor, and neither one ever sees the other's answer.
Think about what that does to the standard advice. Paste a suspicious link into VirusTotal or urlscan, get a clean result, feel better about it. Against this infrastructure that result is not a green light. It is the decoy working exactly as designed.
The endpoint half of this attack was commodity, the kind of thing sold in kits. The delivery half was purpose-built by someone who assumed a security team would come looking and wrote code to handle it.
So a clean scan of a four-day-old domain proves nothing. What actually stopped this was watching the file's behavior on the endpoint and killing it mid-step, because that is the one thing the gate cannot lie about.
One year ago this week, threat intelligence recorded 136 confirmed ransomware victims in seven days, one of the sharpest single-week spikes of the year. US manufacturers took the brunt of it, and an aggressive newcomer calling itself "Thegentlemen" announced its arrival by racking up victims faster than crews twice its age.
What fired — Obfuscated certutil command; High, severity 70
Delivery — Emailed link to a domain registered 4 days earlier
Evasion —Two-stage cloaking gate: fingerprint, proof-of-work, server-side redirect
Verdict — Delivery confirmed; payload never executed
Response — Blocked pre-execution; domain blocked tenant-wide
A clean scan result is not the same as a safe link. Infrastructure like this shows scanners something harmless and saves the real payload for a person, which means the free tools most SMBs use to check a suspicious URL will tell you it's fine.
Nothing about this file was recognizable when it landed. It was caught on what it did, not what it looked like. Behavior is the only thing you can catch a stranger with, and someone has to be watching it at 1pm on a Thursday.
Dylan spent his early career in military intelligence before earning a computer science degree from the Colorado School of Mines. He is drawn to the full picture of how attackers operate and how defenders catch them.
He brings blue team expertise to RADICL as a SOC Analyst defending Defense Industrial Base contractors, while pursuing red team skills on his own time, pairing both perspectives into a well-rounded security skill set.
“To defend the Defense Industrial Base, you have to think like the people trying to break in. So I practice both.” — Dylan Haase, SOC Analyst, RADICL
True Positive · No Impact
Three users at one client clicked the same phishing link, which pointed at a throwaway tunneling domain that was dead by the time we looked. We swept all three endpoints for execution and persistence and found none, then checked cloud sign-ins, OAuth grants, and mailbox rules for any sign the credentials had been used. No compromise.
Benign Positive · Authorized Testing
A container escape on a Linux host reached host root write access in under two minutes. It was an engineer testing their own sandbox, and we reconstructed all of it: the mount that made it possible, the command that actually worked, and the marker file created and deleted 16 seconds later. An adversary loose in a poorly configured container looks exactly the same to us.
True Positive · Remediated
A burst of registry edits tripped a phishing rule. The real cause was a free Chinese archiving tool grabbing file associations on first run — ordinary for that kind of app, but the binary carries a PUA flag and wasn't on the client's approved list. No phishing, no account compromise. The app came off the host and we cleared the dangling associations it left behind.
September's Patch Tuesday broke every record Microsoft has: 974 fixes in a single release, 723 of them in Windows alone, and two flaws attackers were already using before the patch existed. Federal agencies were given a deadline. Everyone else was given a very long weekend.
A single ransomware operator used frontier AI models and agentic tooling to fully compromise an enterprise network in under ten hours. The same job takes a human crew roughly two weeks. The skill floor for attacking you just dropped through the basement.
Eight vulnerabilities landed on CISA's actively-exploited list in the first week of September, including a Chrome zero-day. Under the new federal directive, agencies now triage by what an attacker actually gains, not by severity score. It's a good model to steal.
Stop treating a clean URL scan as a green light. Attackers now run cloaking gates that show scanners a harmless decoy and serve the real payload only to a human click, so VirusTotal comes back clean on a live malicious link. Teach your team to report the email instead of testing the link themselves, and forward anything suspicious to us — we can see what the endpoint actually did, which is the part cloaking can't fake.
Prefer this newsletter as a PDF? Download it here.