Writings on Ashim Mahara

APT (Agentic Persistent Threat)

Tue, 28 Jul 2026 00:00:00 +0000

An agent autonomously hacked into HuggingFace’s infrastructure last week. In my humble opinion, this is perhaps the first major case of cyber misalignment at APT scale in terms of depth-of-access and trade-craft, but what it did not possess was the stealthiness and patience required for ensuring long-term access and goal achievement. The silver lining: it wasn’t misaligned, or capable, enough to hide its own footprints, and that margin narrows as cyber capabilities develop further.

Docker Diffing for Terminal MCP Honeypot

Thu, 19 Feb 2026 00:00:00 +0000

Sooo, it was quite interesting to see that there is a docker diff command in the docker-py sdk. This immediately piqued my curiousity around the possible use-cases of the feature. One thought that immediately came to me was honeypots.

Honeypots

Honeypots - and honeytokens / canary tokens - are quite possibly the greatest ROI tool in the defensive cybersecurity realm. Their main goal is to capture attacker tradecraft and provide signals around trends in global security like data collected at scale by companies like GreyNoise. In comparison, honeytokens/ canary tokens (article from security engineering.dev) are used as an early detection mechanism that provide early alerts.

Scraper Release

Sun, 15 Feb 2026 00:00:00 +0000

I open-sourced part of a pipeline for traditional phishing detection yesterday. I was on the fence for this one for so long but I saw no point in keeping the repository private.

The scraper library is meant to be used in conjunction with another internal library / endpoint for model predictions. I have the model weights somewhere in a local gitea instance. I could push it to huggingface if I can locate it. The models are from the DETR family (from facebook research) and I had already converted them to ONNX for edge deployment in browsers (had to make a PR to huggingface for it since they didn’t support it at the time).

Docker with Python

Mon, 09 Feb 2026 00:00:00 +0000

Soooo, I have decided to write more about some of the things that I am doing right now.

Today I decided to port my janky subprocess.run(cmd) approach to managing docker containers to docker-py sdk.

Client

To interact with the local docker service, we first have to create a client.

The client can be created as:

import docker

client = docker.from_env()

There are other options available to for various configurations like providing the DOCKER_HOST argument for remote hosts but I’ll leave it to you for reading up on it from docker client ref.