Publications

Threat research at Securelist , academic publications, and policy contributions. Full scholar profile: Google Scholar .

2026

Non-Human Identity for AI Agents (research series), mahasbini.org and Zenodo (DOIs):

• Agents Are Not Service Accounts
• Authorization for AI Agents, Beyond RBAC
• Authorization Without Disclosure (with the AAC reference architecture)
• Delegation Without Escalation
• Auditing Agents Under NIS2, DORA, and the EU AI Act

PQC for AI Agents (research series), mahasbini.org and Zenodo (DOIs):

• The Channel Question: Post-Quantum Substrate for AI Agent Communication
• The Agility Question: A Post-Quantum Maturity Model for AI Agent Systems
• The Evidence Question: Regulated Agents Under DORA and NIS2

Running Regulated Agents (research series), mahasbini.org and Zenodo (DOIs):

• The Assessment: Scoring an Agent Estate Before Someone Else Does , with the Agent Governance Maturity Model v1.0 reference specification
• The Drill: What a Cryptographic Swap Actually Costs

Joint papers, mahasbini.org and Zenodo (DOIs):

• Accountability for AI agents: from code signing to evidence , with Alan Seow

Notes:

• Exercice du 29 septembre : les premières heures d’un déni de service qui touche des tiers (in French), note to the participants of a crisis exercise, state of the law at 1 October 2026

2024

• Machine learning in threat hunting , Securelist
• New Tropic Trooper Web Shell infection , Securelist
• BellaCpp: C++ version of BellaCiao , Securelist
• DuneQuixote , Securelist
• CVE-2024-30051 , Securelist
• CloudSorcerer: new APT cloud actor , Securelist
• How safe is Wi-Fi in Paris? , Kaspersky
• Darknet predictions for 2024 , Securelist
• KSB Dark Web predictions 2025 , Securelist

2023

• HrServ APT Web Shell , Securelist
• A hack in hand is worth two in the bush , Securelist
• DoubleFinger loader delivering GreetingGhoul cryptocurrency stealer , Securelist

2022

• DeftTorero: tactics, techniques and procedures , Securelist
• DeathStalker targets legal entities with new Janicab variant , Securelist
• Ransomware and wiper signed with stolen certificates , Securelist
• A bad luck BlackCat , Securelist
• Luna / Black Basta ransomware , Securelist
• Elections GoRansom and HermeticWiper attack , Securelist

2021

• WIRTE’s campaign in the Middle East: living off the land since at least 2019 , Securelist

2020

• 5G predictions 2020 , Securelist
• DeathStalker: mercenary triumvirate , Securelist

2019

• PhD thesis: Information security for smart cities , Brunel University London
• 5G security for smart cities , Securelist
• MuddyWater’s arsenal , Securelist
• Gaza Cybergang Group1 Operation SneakyPastes , Securelist

2018

• MuddyWater , Securelist
• Operation Parliament: who is doing what , Securelist
• Journal article: World Journal of Entrepreneurship, Management and Sustainable Development , Emerald
• Securing the Smart City Olympics , ResearchGate
• Securing the Smart City Olympics , Olympics Library

2017

• From Shamoon to StoneDrill , Securelist
• Gaza Cybergang updated 2017 activity , Securelist
• Securing Smart Cities consortium: 15 things · IAC · SCCCM · Municipal drones · Securing the Olympics

2016

• Operation Ghoul: targeted attacks on industrial and engineering organizations , Securelist
• Guidelines for safe smart cities , Securing Smart Cities
• The Smart City department: cyber security role and implications , ResearchGate
• Additional: Smart Cities cybersecurity worries · SCD guidelines · SSC 5G

2015

• The Syrian malware part 2: who is the Joe? , Securelist
• The Desert Falcons targeted attacks , Securelist
• Gaza Cybergang: where’s your IR team? , Securelist

2014

• The rise of cybercrime in Dubai and UAE , Securelist
• The Syrian malware house of cards , Securelist

← Track record