ZERO|TOLERANCEZERO|TOLERANCE

THREAT INTELLIGENCE & DATA EXPOSURE ADVISORY

"The gap between what you defend and what's actually exposed is where every breach begins."

— K. Ellabban

// CYBER_THREATS

Breach Intelligence

170 ARTICLES

Independent OSINT research and published threat analyses across critical infrastructure, healthcare, cloud, and software supply chains. These are recent breach analyses.

NATION-STATE

CyberAv3ngers Successors Exploit U.S. Water, Energy, and Government PLCs in Escalating Iranian Campaign

IRGC-CEC-linked actors exploiting internet-facing Rockwell PLCs across U.S. critical infrastructure. Operational disruption and financial loss confirmed.

04/10/2026
NATION-STATE

FBI: China-Linked Hackers Breach Wiretap Surveillance System in 'Major Incident'

FBI's DCS-3000 pen register system compromised via ISP vendor supply chain. Surveillance target phone numbers and PII exposed.

04/05/2026
SURVEILLANCE

LinkedIn: Covert Browser Extension Scanning Program Targets 6,236 Extensions and Fingerprints Visitors' Devices

LinkedIn deployed hidden JavaScript scanning visitors for 6,236 browser extensions - including 200+ competitors - while harvesting device telemetry.

04/03/2026
DATA BREACH

Cisco Systems: ShinyHunters Claim 3M Salesforce Records, 300+ GitHub Repos, and AWS Data in Triple-Vector Extortion

ShinyHunters claims 3M Salesforce records, 300+ GitHub repos, and AWS data from three breach vectors in a triple-vector extortion against Cisco.

03/31/2026
SUPPLY CHAIN

Axios npm Hijack: North Korea's UNC1069 Weaponized 100M Weekly Downloads via Social Engineering and WAVESHAPER.V2 RAT

North Korea's UNC1069 social-engineered the lead Axios maintainer, hijacking npm and GitHub accounts to deploy the WAVESHAPER.V2 RAT via 100M weekly downloads.

03/31/2026
SUPPLY CHAIN

GlassWorm: 433 Compromised Components Across VSCode, GitHub, and npm - Self-Propagating Worm Spans Four Developer Ecosystems

A Russian-speaking actor deployed GlassWorm across 433 components in four developer ecosystems using invisible Unicode payloads and Solana blockchain C2.

03/31/2026
// SERVICES

What We Do

Security research operating under zero-trust principles. Never trust, always verify.

Data Exposure Advisory

Passive external reconnaissance to identify exposed assets, leaked credentials, and misconfigured services before adversaries do.

Security Posture Assessment

External attack surface analysis from an adversary's perspective.

Supply Chain Risk Assessment

Vendor inventory mapping, third-party risk scoring, and supply chain exposure analysis for organizations relying on external data and infrastructure access.

Responsible Disclosure

Coordinated vulnerability disclosure with verified remediation. We document, we notify, we follow through.

Incident Analysis

Post-breach forensic analysis and timeline reconstruction. Understanding the kill chain to prevent recurrence.

OSINT Research & Publishing

Independent open-source intelligence research on cyber threats. We investigate, analyze, and publish breach reports on our Cyber Threats page.

WHO WE WORK WITH

PROFESSIONAL SERVICES

One breach exposes every client. We assess the attack surface your partners create.

HOLDING COMPANIES

A subsidiary's exposure is yours. We map risk across your portfolio.

GOVERNMENT

Critical infrastructure under persistent threat. We verify what internal programs miss.

HEALTHCARE & EDUCATION

The costliest breach sector for 14 consecutive years. We quantify the exposure.

FINANCIAL SERVICES

Banks, insurers, and payment platforms across three continents. We find what compliance audits miss.

RETAIL & E-COMMERCE

Millions of records, hundreds of vendors. We test the boundaries.

zt_recon.sh
$ whoami
zero | tolerance
$ cat mission.txt
Security research firm operating
under zero-trust principles.
Never trust. Always verify.
$ ls ./coverage
MENA/ EU/ US/
$ wc -l ./published
168 breach analyses
$
// ABOUT

Holding Organizations Accountable

Zero Tolerance is a security research firm built on one principle: Breaches are inevitable, but negligence isn't.

We conduct passive external reconnaissance - no intrusion, no exploitation. We observe what's already exposed and document what organizations fail to protect.

Every disclosure is responsible. Every remediation is confirmed. Every analysis is published to raise the standard of accountability in cybersecurity.

// CONTACT

Contact

Responsible disclosure, advisory engagement, or media inquiries.

We do not use web forms. Your message is sent directly from your own email client - no data passes through or is stored on our servers. For sensitive disclosures, encrypt with our PGP key.

security@zerotolerance.me
REACH OUT

RESPONSE WITHIN 48 HOURS