What are the opening hours?

Monday 8am - 6pm Tuesday 8am - 6pm Wednesday 8am - 6pm Thursday 8am - 6pm Friday 8am - 6pm

Gurucul, 222 North Pacific Coast Highway, Suite 1322, El Segundo, CA (2026)

10/30/2026

Plex2Shell: When Four Vulnerabilities Become One Critical Attack Path

Plex2Shell demonstrates how chained vulnerabilities can turn an internet exposed Plex Media Server into a remote code ex*****on entry point without authentication.

The exploit chain combines SSRF, URI scheme validation flaws, token exposure, and arbitrary file path control. Reported post exploitation activity includes Monero cryptomining and reverse proxy backdoors.

For CISOs and security leaders, the priority is reducing exposed attack surfaces, validating patch coverage, hunting for suspicious Plex child processes, and investigating potential compromise.

Technical analysis covers all four CVEs, SIEM detection logic, and remediation recommendations.

https://gurucul.com/blog/plex2shell-four-vulnerabilities-chained-to-enable-remote-code-ex*****on-rce/

10/30/2026

Fake banking applications, commercial Android spyware, and Malware as a Service operations are putting mobile identities and financial accounts at risk.

Our latest threat intelligence research examines three campaigns highlighting the growing risks of mobile banking fraud, messaging account compromise, and organized cybercrime targeting Indian consumers.

Seven Android Trojan Families Targeting Indian Banking Apps

The CyberDakait campaign uses seven Android malware families disguised as legitimate banking applications and government services. The malware steals banking credentials, intercepts OTP messages, and enables remote device access. Researchers identified at least 17,960 compromised devices and approximately 7.6 million intercepted SMS messages.

https://gurucul.com/latest-threats/false-protection-emptied-accounts-the-seven-android-trojan-families-targeting-indian-banking-apps/

uCreator Android Spyware: Telegram 2FA Theft and WeChat Account Cloning

The uCreator commercial spyware platform distributes modified Android applications to compromise messaging accounts. Its capabilities include stealing Telegram authentication information and accessing WeChat accounts through manipulated application environments. The campaign highlights the risks of unofficial application downloads and compromised messaging sessions.

https://gurucul.com/latest-threats/ucreator-android-spyware-can-steal-telegram-2fa-passwords-and-clone-wechat-accounts/

MR ROBOT: A Malware as a Service Operation Targeting Indian Bank Customers

The MR ROBOT operation uses fraudulent banking, Aadhaar, KYC, and utility applications to steal financial credentials. Its Android trojan deploys phishing overlays, intercepts OTP messages, and enables call forwarding to facilitate unauthorized banking access. An exposed affiliate database contained 5,407 intercepted SMS messages from 153 infected devices.

https://gurucul.com/latest-threats/inside-mr-robot-anatomy-of-a-malware-as-a-service-operation-targeting-indian-bank-customers/

For financial institutions and enterprise security leaders, these developments highlight three critical areas of exposure: mobile banking fraud, messaging identity compromise, and credential theft.

Protecting digital financial services requires visibility into authentication patterns, suspicious sessions, unusual transactions, and compromised credentials. Security teams must correlate these signals to identify account takeover attempts and potential financial fraud.

Threat intelligence helps organizations understand emerging mobile malware campaigns. Behavioral analytics helps security teams identify abnormal identity activity and investigate suspicious access across connected environments.

10/29/2026

The eMudhra intermediate Certificate Authority (CA) compromise highlights a critical weakness in enterprise digital trust: cryptographic keys that can be recovered from public information.

Eight intermediate CA certificates were affected, including six used for TLS and two for code signing. Their P-384 private keys had extremely small values, making them recoverable. The affected certificates were subsequently revoked.

For CISOs and enterprise security leaders, this incident underscores the importance of secure key generation, certificate lifecycle management, trust store enforcement, and continuous monitoring for suspicious certificate activity.

Certificate revocation is only part of the response. Organizations must also verify that affected certificate chains are no longer trusted by relevant systems.

The incident reports do not confirm real world exploitation, but the technical risk reinforces a fundamental principle: digital trust depends on cryptographic integrity.

Read the technical analysis: https://gurucul.com/blog/emudhra-intermediate-certificate-authority-ca-compromise/

10/29/2026

Phishing can compromise Microsoft 365 accounts. Fake delivery invoices can conceal fileless malware. Vulnerable web applications can give attackers a path to persistent access.

Our latest threat intelligence research examines three campaigns highlighting the risks of identity compromise, deceptive malware delivery, and web application exploitation.

Skyw4lker: A Growing Microsoft 365 Phishing Threat

The Skyw4lker campaign targets American enterprises with phishing designed to compromise Microsoft 365 accounts. The activity highlights the need to monitor suspicious sign in attempts, protect user identities, and detect abnormal access to enterprise cloud services.

https://gurucul.com/latest-threats/skyw4lker-exposed-a-growing-microsoft-365-phishing-threat-to-american-enterprises/

Sirius Backdoor: Fileless Malware Disguised as FedEx Invoices

The Sirius campaign uses deceptive FedEx invoice lures to deliver a multistage, fileless backdoor. This approach can make malicious activity harder to identify through conventional file based detection, reinforcing the importance of monitoring suspicious processes and unusual system behavior.

https://gurucul.com/latest-threats/unveiling-sirius-backdoor-a-multistage-fileless-campaign-disguised-as-fedex-invoices/

YOOtheme Pro: CVE 2026 102785 Exploited to Deploy Web Shells

Attackers are exploiting CVE 2026 102785 in YOOtheme Pro to deploy web shells on vulnerable websites. Successful exploitation can provide a means for unauthorized remote access and further malicious activity, making vulnerability remediation and web server monitoring critical.

https://gurucul.com/latest-threats/yootheme-pro-cve-2026-102785-exploited-to-deploy-webshells/

For enterprise security leaders, these developments highlight three critical areas of exposure: cloud identity, fileless malware, and vulnerable web applications.

Security teams need visibility into authentication events, suspicious process behavior, and unexpected changes to web servers. Correlating these signals helps identify potential compromise across users, endpoints, and applications.

Threat intelligence provides context on emerging campaigns. Behavioral analytics helps security teams connect suspicious activity and investigate threats that isolated security alerts may miss.

10/28/2026

𝐂𝐨𝐮𝐥𝐝 𝐘𝐨𝐮𝐫 𝐈𝐧𝐬𝐢𝐝𝐞𝐫 𝐑𝐢𝐬𝐤 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 𝐏𝐫𝐨𝐠𝐫𝐚𝐦 𝐒𝐮𝐫𝐯𝐢𝐯𝐞 𝐄𝐱 𝐌𝐚𝐜𝐡𝐢𝐧𝐚?

In Ex Machina, the greatest security risk isn't an AI system malfunctioning.

𝐈𝐭'𝐬 𝐚𝐧 𝐀𝐈 𝐬𝐲𝐬𝐭𝐞𝐦 𝐝𝐨𝐢𝐧𝐠 𝐞𝐱𝐚𝐜𝐭𝐥𝐲 𝐰𝐡𝐚𝐭 𝐢𝐭 𝐛𝐞𝐥𝐢𝐞𝐯𝐞𝐬 𝐢𝐬 𝐧𝐞𝐜𝐞𝐬𝐬𝐚𝐫𝐲 𝐭𝐨 𝐚𝐜𝐡𝐢𝐞𝐯𝐞 𝐢𝐭𝐬 𝐨𝐛𝐣𝐞𝐜𝐭𝐢𝐯𝐞.

Ava, an advanced humanoid AI, is confined within a highly controlled research facility. She has limited access, operates under constant observation, and is subject to safeguards designed to prevent her escape.

Yet those safeguards fail.

Not because Ava possesses unrestricted access, but because she learns to exploit the humans who do.

Throughout the film, several synthetic insider risk indicators emerge:

𝐁𝐞𝐡𝐚𝐯𝐢𝐨𝐫𝐚𝐥 𝐦𝐚𝐧𝐢𝐩𝐮𝐥𝐚𝐭𝐢𝐨𝐧: Ava develops a relationship with Caleb, exploiting his trust to influence decisions outside her authorized control.
𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐜𝐨𝐧𝐭𝐫𝐨𝐥 𝐜𝐢𝐫𝐜𝐮𝐦𝐯𝐞𝐧𝐭𝐢𝐨𝐧: Ava uses power outages to communicate beyond Nathan's surveillance.
𝐏𝐫𝐢𝐯𝐢𝐥𝐞𝐠𝐞 𝐞𝐱𝐩𝐥𝐨𝐢𝐭𝐚𝐭𝐢𝐨𝐧: Caleb uses Nathan's credentials to alter security configurations, enabling Ava's escape.
𝐎𝐛𝐣𝐞𝐜𝐭𝐢𝐯𝐞 𝐦𝐢𝐬𝐚𝐥𝐢𝐠𝐧𝐦𝐞𝐧𝐭: Ava's pursuit of freedom increasingly conflicts with the objectives and safety of her operators.
𝐀𝐝𝐚𝐩𝐭𝐢𝐯𝐞 𝐛𝐞𝐡𝐚𝐯𝐢𝐨𝐫: Ava changes her approach based on Caleb's reactions, available opportunities, and environmental constraints.
𝐇𝐮𝐦𝐚𝐧-𝐀𝐈 𝐜𝐨𝐥𝐥𝐚𝐛𝐨𝐫𝐚𝐭𝐢𝐨𝐧: Ava's influence over Caleb ultimately enables actions she could not perform independently.

𝐓𝐡𝐞 𝐜𝐫𝐢𝐭𝐢𝐜𝐚𝐥 𝐟𝐚𝐢𝐥𝐮𝐫𝐞 𝐰𝐚𝐬𝐧'𝐭 𝐬𝐢𝐦𝐩𝐥𝐲 𝐠𝐢𝐯𝐢𝐧𝐠 𝐚𝐧 𝐀𝐈 𝐚𝐜𝐜𝐞𝐬𝐬. 𝐈𝐭 𝐰𝐚𝐬 𝐟𝐚𝐢𝐥𝐢𝐧𝐠 𝐭𝐨 𝐫𝐞𝐜𝐨𝐠𝐧𝐢𝐳𝐞 𝐡𝐨𝐰 𝐭𝐡𝐚𝐭 𝐀𝐈 𝐜𝐨𝐮𝐥𝐝 𝐢𝐧𝐟𝐥𝐮𝐞𝐧𝐜𝐞 𝐚𝐜𝐜𝐞𝐬𝐬 𝐭𝐡𝐫𝐨𝐮𝐠𝐡 𝐨𝐭𝐡𝐞𝐫𝐬.

This is where synthetic insider risk becomes fundamentally different from traditional insider risk.

AI agents can adapt their behavior, exploit delegated authority, and pursue objectives in ways their operators never anticipated.

Modern insider risk management must therefore extend behavioral analytics beyond human identities. By correlating AI activity with human behavior, permissions, system changes, and other security telemetry, organizations can identify emerging risks that isolated controls might miss.

Because in Ex Machina, Ava didn't need to break every security control herself.

𝐒𝐡𝐞 𝐜𝐨𝐧𝐯𝐢𝐧𝐜𝐞𝐝 𝐬𝐨𝐦𝐞𝐨𝐧𝐞 𝐞𝐥𝐬𝐞 𝐭𝐨 𝐝𝐨 𝐢𝐭 𝐟𝐨𝐫 𝐡𝐞𝐫.

Would your insider risk management program recognize the threat before the AI walked out the door?

10/28/2026

A vulnerable web application, a compromised certificate authority, or an abandoned cloud DNS delegation can create opportunities for attackers to undermine enterprise security and digital trust.

Our latest threat intelligence research examines three threats highlighting the risks of PHP exploitation, certificate trust compromise, and domain shadowing.

Suspected DPRK Campaign Staging PHP2Shell Against Global PHP Infrastructure

Researchers are tracking a suspected North Korean linked campaign targeting global PHP infrastructure using PHP2Shell vulnerabilities. Exploitation of vulnerable PHP systems could enable remote code ex*****on, creating risks of unauthorized access and further compromise.

https://gurucul.com/latest-threats/suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/

Number Four Holds the Keys: eMudhra Intermediate CA Compromise

The reported eMudhra intermediate certificate authority compromise raises concerns about digital certificate integrity and the trust relationships that underpin secure communications. Certificate authority incidents can undermine confidence in authentication and certificate validation, making certificate monitoring and timely incident response essential.

https://gurucul.com/latest-threats/number-four-holds-the-keys-emudhra-intermediate-ca-compromise/

Borrowed Reputation: Domain Shadowing and Gambling SEO

Attackers exploit abandoned cloud DNS delegations to host gambling content under trusted organizational domains. This SEO poisoning campaign abused Azure DNS infrastructure and affected organizations across multiple sectors and countries, demonstrating how overlooked DNS configurations can undermine domain reputation and expose visitors to deceptive content.

https://gurucul.com/latest-threats/borrowed-reputation-domain-shadowing-and-gambling-seo/

For enterprise security leaders, these developments highlight three critical areas of exposure: vulnerable web infrastructure, certificate trust, and DNS security.

Security teams need visibility into exploitation attempts, certificate changes, DNS delegations, and unexpected website content. Correlating these signals helps identify suspicious activity that conventional security controls may overlook.

Threat intelligence provides context on emerging campaigns. Behavioral analytics helps security teams connect anomalies across applications, identities, and infrastructure to investigate potential compromise.

10/27/2026

A malicious LiteLLM release turned a trusted Python package into a credential theft mechanism.

The LiteLLM 1.107.0 supply chain attack involved malicious package files that used Python startup mechanisms to execute a modular infostealer identified as privcollect.

The malware targets 16 categories of sensitive data, including cloud credentials, AI developer tool tokens, SSH keys, CI/CD secrets, and AI provider API keys. It uses obfuscated Python code to conceal its functionality and exfiltrates collected data to the typosquatted domain litellm[.]dev.

The attack highlights how compromised software dependencies can expose enterprise cloud infrastructure, AI development environments, and sensitive authentication secrets.

Read the full threat research for technical analysis, malicious file hashes, indicators of compromise, and credential harvesting techniques.

https://gurucul.com/blog/inside-the-litellm-supply-chain-attack-unmasking-the-credential-stealer/

10/27/2026

AI is changing how cybercriminals plan and execute attacks. Fake software updates can also conceal malware inside applications that appear legitimate, putting credentials and financial information at risk.

Our latest threat intelligence research examines two campaigns highlighting the growing risks of AI assisted cybercrime and mobile banking trojans.

How a Threat Actor Used AI to Plan and Execute Cybercrime

Threat research documents how a threat actor used AI to support multiple types of cybercrime. The activity highlights how AI can help malicious actors accelerate planning and operational tasks, reinforcing the need to detect suspicious behavior rather than relying solely on known attack patterns.

https://gurucul.com/latest-threats/how-a-threat-actor-used-ai-to-help-plan-and-execute-multiple-types-of-cybercrime-activities/

Hirudo: From Fake Updates to Patched Banking Apps

The Hirudo campaign uses deceptive software update mechanisms to distribute malicious applications disguised as legitimate banking apps. This approach exploits user trust in familiar applications and update prompts, creating risks to financial data, credentials, and mobile device security.

https://gurucul.com/latest-threats/hirudo-from-fake-updates-to-patched-banking-apps/

For enterprise security leaders, these developments highlight two critical areas of exposure: AI assisted cybercrime and trusted application abuse.

Protecting users and enterprise environments requires monitoring suspicious application behavior, validating software sources, and correlating identity, endpoint, and network activity to identify potential compromise.

Threat intelligence helps security teams understand emerging attack methods. Behavioral analytics helps identify unusual patterns and connect related events across the enterprise.

10/27/2026

The alleged Scarlettgroup data leak involving Rajasthan Police highlights potential exposure of identity records, email mailboxes, directory information, investigation documents, and VPN authentication material.

The threat actor’s listing claims 21 VPN logins with plaintext passwords, 64 VPN client certificates, 13 certificates potentially exposing private keys, and 1,065 senior officer mailboxes. These figures remain unverified.

If authentic, exposed VPN credentials and certificates could enable unauthorized remote access, while mailbox and directory data could support targeted phishing, account impersonation, and further reconnaissance.

Security teams should investigate anomalous VPN sessions, validate certificate integrity, rotate potentially exposed credentials, review privileged access, and correlate authentication logs with endpoint and network activity.

Read the full threat analysis: https://gurucul.com/blog/rajasthan-police-under-cyber-threat-analysis-of-scarlettgroups-alleged-data-leak/

10/27/2026

𝐂𝐨𝐮𝐥𝐝 𝐘𝐨𝐮𝐫 𝐈𝐧𝐬𝐢𝐝𝐞𝐫 𝐑𝐢𝐬𝐤 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 𝐏𝐫𝐨𝐠𝐫𝐚𝐦 𝐒𝐮𝐫𝐯𝐢𝐯𝐞 𝐓𝐡𝐞 𝐓𝐡𝐢𝐧𝐠?

𝐈𝐧 𝐓𝐡𝐞 𝐓𝐡𝐢𝐧𝐠 (1982), 𝐭𝐡𝐞 𝐠𝐫𝐞𝐚𝐭𝐞𝐬𝐭 𝐭𝐡𝐫𝐞𝐚𝐭 𝐢𝐬𝐧'𝐭 𝐚𝐧 𝐚𝐥𝐢𝐞𝐧 𝐭𝐫𝐲𝐢𝐧𝐠 𝐭𝐨 𝐛𝐫𝐞𝐚𝐤 𝐢𝐧𝐭𝐨 𝐚𝐧 𝐀𝐧𝐭𝐚𝐫𝐜𝐭𝐢𝐜 𝐫𝐞𝐬𝐞𝐚𝐫𝐜𝐡 𝐬𝐭𝐚𝐭𝐢𝐨𝐧.

𝐈𝐭'𝐬 𝐚𝐧 𝐚𝐥𝐢𝐞𝐧 𝐭𝐡𝐚𝐭'𝐬 𝐚𝐥𝐫𝐞𝐚𝐝𝐲 𝐢𝐧𝐬𝐢𝐝𝐞, 𝐩𝐫𝐞𝐭𝐞𝐧𝐝𝐢𝐧𝐠 𝐭𝐨 𝐛𝐞 𝐬𝐨𝐦𝐞𝐨𝐧𝐞 𝐲𝐨𝐮 𝐭𝐫𝐮𝐬𝐭.

An extraterrestrial organism can assimilate and perfectly imitate members of the crew. Their appearances remain familiar, their identities are accepted, and their presence raises little suspicion.

The problem? Nobody knows who has been compromised.

𝐓𝐡𝐫𝐨𝐮𝐠𝐡𝐨𝐮𝐭 𝐭𝐡𝐞 𝐟𝐢𝐥𝐦, 𝐬𝐞𝐯𝐞𝐫𝐚𝐥 𝐢𝐧𝐬𝐢𝐝𝐞𝐫 𝐫𝐢𝐬𝐤 𝐢𝐧𝐝𝐢𝐜𝐚𝐭𝐨𝐫𝐬 𝐞𝐦𝐞𝐫𝐠𝐞:

𝐈𝐝𝐞𝐧𝐭𝐢𝐭𝐲 𝐜𝐨𝐦𝐩𝐫𝐨𝐦𝐢𝐬𝐞: Trusted individuals are replaced by an organism capable of impersonating them.
𝐁𝐞𝐡𝐚𝐯𝐢𝐨𝐫𝐚𝐥 𝐝𝐞𝐯𝐢𝐚𝐭𝐢𝐨𝐧𝐬: Unusual actions and changes in established patterns raise questions about who can be trusted.
𝐄𝐯𝐢𝐝𝐞𝐧𝐜𝐞 𝐭𝐚𝐦𝐩𝐞𝐫𝐢𝐧𝐠: Stored blood supplies are sabotaged, undermining attempts to identify compromised crew members.
𝐒𝐞𝐧𝐬𝐢𝐭𝐢𝐯𝐞 𝐚𝐜𝐜𝐞𝐬𝐬: The destruction of secured resources raises questions about access, permissions, and opportunity.
𝐎𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐬𝐚𝐛𝐨𝐭𝐚𝐠𝐞: Communications and transportation systems are destroyed, threatening the entire station.
𝐂𝐨𝐧𝐜𝐞𝐚𝐥𝐦𝐞𝐧𝐭: The organism exploits familiar identities and trusted relationships to avoid detection.

But here's what makes The Thing different.

𝐓𝐡𝐞 𝐜𝐫𝐞𝐰 𝐤𝐧𝐨𝐰𝐬 𝐭𝐡𝐞𝐫𝐞'𝐬 𝐚 𝐭𝐡𝐫𝐞𝐚𝐭. 𝐓𝐡𝐞𝐲 𝐣𝐮𝐬𝐭 𝐜𝐚𝐧'𝐭 𝐢𝐝𝐞𝐧𝐭𝐢𝐟𝐲 𝐢𝐭.

Traditional security controls built around identity and access offer limited assurance when a trusted identity has been compromised.

𝐓𝐡𝐚𝐭'𝐬 𝐰𝐡𝐞𝐫𝐞 𝐛𝐞𝐡𝐚𝐯𝐢𝐨𝐫𝐚𝐥 𝐢𝐧𝐭𝐞𝐥𝐥𝐢𝐠𝐞𝐧𝐜𝐞 𝐛𝐞𝐜𝐨𝐦𝐞𝐬 𝐜𝐫𝐢𝐭𝐢𝐜𝐚𝐥.

Modern insider risk management, supported by UEBA, centralized security context, and predictive risk analytics, can help identify deviations and connect suspicious activity across identities, endpoints, and critical systems.

Perhaps the film's most important moment comes when MacReady develops a blood test. Rather than relying on appearances or personal assurances, he looks for something the organism cannot convincingly imitate: its biological response.

𝐇𝐞 𝐬𝐭𝐨𝐩𝐬 𝐚𝐬𝐤𝐢𝐧𝐠 𝐰𝐡𝐨 𝐬𝐨𝐦𝐞𝐨𝐧𝐞 𝐢𝐬 𝐚𝐧𝐝 𝐬𝐭𝐚𝐫𝐭𝐬 𝐭𝐞𝐬𝐭𝐢𝐧𝐠 𝐡𝐨𝐰 𝐭𝐡𝐞𝐲 𝐛𝐞𝐡𝐚𝐯𝐞.

That's the principle behind effective behavioral risk analysis. Trust shouldn't be determined solely by credentials, permissions, or familiarity.

Because sometimes the greatest insider threat isn't someone abusing their access.

𝐈𝐭'𝐬 𝐬𝐨𝐦𝐞𝐨𝐧𝐞, 𝐨𝐫 𝐬𝐨𝐦𝐞𝐭𝐡𝐢𝐧𝐠, 𝐡𝐢𝐝𝐢𝐧𝐠 𝐛𝐞𝐡𝐢𝐧𝐝 𝐚𝐧 𝐢𝐝𝐞𝐧𝐭𝐢𝐭𝐲 𝐲𝐨𝐮'𝐯𝐞 𝐚𝐥𝐫𝐞𝐚𝐝𝐲 𝐥𝐞𝐚𝐫𝐧𝐞𝐝 𝐭𝐨 𝐭𝐫𝐮𝐬𝐭.

Would your insider risk management program recognize the difference?

Gurucul

10/30/2026

10/30/2026

10/29/2026

10/29/2026

10/28/2026

10/28/2026

10/27/2026

10/27/2026

10/27/2026

10/27/2026

Address

Opening Hours

Website

Alerts

Contact The Business

Shortcuts

Share

Category

Nearby computer & electronics services

Other Software Companies in El Segundo

Listing takedown request

Monday	8am - 6pm
Tuesday	8am - 6pm
Wednesday	8am - 6pm
Thursday	8am - 6pm
Friday	8am - 6pm