Hi, I'm Jacob Santos
Senior threat researcher who hunts for emerging threats, builds operational security tools, and shares findings through research and workshops.
Featured Research
Latest published threat analysis and intelligence
Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack
Deep-dive analysis of Warlock (Water Manaul) ransomware operations revealing new TTPs including persistent BYOVD techniques, TightVNC and Yuze remote access tools, and 15-day dwell time before LockBit-derived ransomware deployment.
Five New Rust-Based Ransomware Families Identified
Thread analyzing five distinct ransomware groups written in Rust identified in early December 2025, signaling an accelerated shift in how threat actors build and scale attacks.
Agenda Ransomware: Continued Linux-on-Windows Campaign
Thread on a new Agenda ransomware campaign continuing the group's use of Linux binaries on Windows systems, with new techniques and tooling building on earlier 2025 attacks.
PureRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading
Uncovered PureRAT targeting job seekers using renamed Foxit PDF Reader for DLL side-loading and Python-based shellcode loaders.
What I Do
Combining threat research with automation and intelligence dissemination.
Threat Research
Deep-dive analysis of ransomware families, APT campaigns, and adversary tooling. Published on the company research blog.
Security Tooling
Building production tools adopted team-wide — AI pipelines, threat intel platforms, MCP servers, desktop applications, and Confluence integrations.
Intelligence Dissemination
Delivering advanced threat defense workshops for multinational participants, government agencies, and enterprises across multiple countries.
From the Blog
Practical insights from the field
Infrastructure Hunting Beyond IOCs
2026-02-05Moving up the Pyramid of Pain — from hash-based detection to hunting adversary infrastructure through behavioral fingerprints and network patterns.
MCP Servers for Threat Intelligence
2026-01-15How I set up Model Context Protocol servers to bridge AI assistants with threat intelligence platforms — and what I learned about tool design along the way.
What Ransomware Hunting Actually Looks Like
2025-12-08The daily reality of proactive ransomware hunting — from YARA triggers and VirusTotal dashboards to naming new families and building attack chains from telemetry.
Let's connect
Open to research collaborations, interesting problems, and new opportunities.