Dark Security and Total Chaos
Dr. Chaos is a blog dedicated to adversarial AI, cyber counter intelligence, and offensive security. Articles are written by security professionals and researchers to bring an in-depth, real-world look at emerging threats, techniques, and defenses.
“a blogger, InfoSec specialist, super hero… and all around good guy.”
~/start-here
Three hands-on labs, in order — easiest first. Each one builds on the last.
Step 1 · Warm-up
A beginner-friendly, step-by-step guide to DNS tunneling: how it works, how to build a safe isolated lab with iodine, what it looks like on the wire, and — most importantly — how to detect and defend against it.
Build a tiny lab and watch data hide inside DNS. No prior tooling needed.
Step 2 · Map the terrain
Build a lab Active Directory domain, collect it with SharpHound, and use BloodHound CE to find the permission chains that lead to Domain Admin — plus how red teams, blue teams, and real attackers each use it, and how to detect and dismantle the paths.
See how attackers chain Active Directory permissions into domain admin.
Step 3 · Run the attacks
A hands-on Impacket tutorial for beginners: build a lab, then walk Kerberoasting, AS-REP roasting, secretsdump/DCSync, and remote execution end to end — with the red team, blue team, and attacker view of each, plus the exact Windows event IDs that detect them and the controls that stop them.
Kerberoasting, DCSync and lateral movement — in a lab you control.
~/featured
Deep dives our editors keep coming back to.
The serious attack surface is no longer the chatbot. It is the agent's toolbelt: retrieval, memory, skills, CI pipelines, credentials, and every renderer or proxy trusted to move data. A field analysis of EchoLeak, malicious agent skills, coding-agent compromise, state-scale campaigns, and data poisoning, separating confirmed incidents from research demonstrations, with the containment architecture that actually holds up.
A balanced cybersecurity review of Moonshot's Kimi K3 and the multi-agent K3 Swarm. Not "is it smart" but the question a red team actually asks: does an open, self-hostable, agentic model make you more effective on an engagement, and what does it give you that Claude and GPT cannot? Data that stays in the room, no vendor holding your engagement hostage, cost at scale, and a swarm that fits the work, weighed honestly against where the closed frontier models still win.
The webshell is the cockroach of offensive security: one line of code, arbitrary command execution, and still everywhere. A deep dive into what webshells are, how attackers plant and use them, how red and blue teams both put them to work, plus a hands-on Docker lab where you build a vulnerable app, drop a shell, use it, and then detect and defend against it three different ways.
AI automation quietly became critical infrastructure that security never signed off on. A deep look at where automation actually is in 2026, the real differences between Zapier, Make, and n8n, when to reach for each, and why every one of them is a beautiful new attack surface: standing credentials, unauthenticated webhooks, shadow automation, and prompt injection into agents that hold tools.
~/latest
Fresh drops from the lab — news, exploits, and analysis.
Muse, Amazon Quick, Hermes Agent and OpenClaw all promise to do more than chat. That is roughly where the similarities end. A practical comparison of four very different bets (hosted convenience, governed workplace AI, a self-improving runtime, and a local-first gateway), plus a security lens on each: where the lethal trifecta lives, and how to harden the two you run yourself.
Black Hat and DEF CON land in the same week in Las Vegas every year, and every year one story ends up getting told in the hallways more than the others. Usually it takes a couple of days to sort out which story won. This year, it took about a morning.
The blog returns with a decade of archives intact and a new focus: adversarial and offensive AI. Here's what to expect.
From the PolinRider DPRK supply chain drama to the JadePuffer agentic ransomware debate, the security community is having big conversations this week. Here's the pulse from r/netsec, r/cybersecurity,
AI agents are being weaponized in the wild — from crypto-stealing prompt injections to fully autonomous ransomware. Here's what the AI attack surface looks like in July 2026, and why your security tea
~/lab
Three ways in, depending on how deep you want to go.
Breach post-mortems, emerging adversarial AI threats, and what the headlines actually mean for defenders on the ground.
Hands-on labs, tooling walkthroughs, and reproducible attack demos — learn offensive techniques by running them yourself.
Unfiltered takes on where security is heading — machine-speed offense, AI-built malware, and the defenses that might keep up.
~/podcast
Interviews, war stories, and threat deep dives with security practitioners — straight from the people breaking and defending real systems.
~/subscribe
New research, tutorials, and podcast episodes in your inbox. No spam, no tracking pixels — just the good stuff.