Writing & Research
Published articles and reports
Cybersecurity threat-actor research, internet measurement analysis, and essays on working with data, written for network operators, researchers, and practitioners. Earlier professional publications may appear under the name Meghal Donde.
-
Cyberattacks on France Are Rising—Here’s What the AIDE Data Shows
A threefold rise in attacks against French networks, a Mirai-linked outbound surge from French infrastructure, and where the traffic originates.
-
Salt Typhoon Across the Internet: What AIDE Honeypots Reveal About a Persistent State-Linked Campaign
Two years of telecom-decoy telemetry examined against the Salt Typhoon espionage campaign, with mitigation recommendations for network operators.
-
New Report: Salt Typhoon Across the Internet
The launch post introducing the report and its headline findings.
-
Dark Pink APT Campaigns Through the Lens of AIDE Telemetry
Attack sessions targeting government, defense, and education organizations across Southeast Asia and APAC, including command-and-control via webhook abuse.
-
AIDE Uncovers RedTail: Persistent Cryptomining with APT Tactics
A six-month, 25-country cryptomining campaign traced through honeypot data, and the tactical overlaps that made it look like something else.
-
Tracking Kimsuky: North Korean Espionage Operations in GCA’s AIDE
Two years of reconnaissance activity in AIDE telemetry, including a distinctive user-agent signature and linked login attempts.
-
AIDE Data on APT36: Regional Infrastructure Risks and Security Gaps
Detected incidents mapped across regional autonomous systems, paired with an analysis of routing-security gaps (RPKI, IRR, MANRS).
-
Catching Flax Typhoon in the Honeypot: Footprints in AIDE
VPN tunnelling, web shells, and living-off-the-land binaries surfacing in honeypot data, concentrated against Taiwan-based sensors.
-
Tracing Volt Typhoon: Insights from GCA’s AIDE Honey Farm
Measuring how much of the published indicator set actually appeared in sensor data, and what end-of-life router exploitation looked like up close.
-
Recurrence Is Not Persistence: Why Repeated Signals Can Mislead Data Teams
A repeated signal on a dashboard is not evidence that a problem is ongoing. Three questions worth asking about concentration, confounds, and corroboration before an engineering team acts on one.
To add: any further Medium essays, talks, panels, or conference appearances you want indexed here. Send the links and they slot straight into this list. Delete this box before publishing.