Your Logs Are Not Evidence If The Infrastructure That Produces Them Can Rewrite The Record
The evidence layer is not a byproduct of your infrastructure — it is infrastructure, and on August 30, Sygnia documented what happens when the evidence layer is captured along with everything else. Fire Ant, a China-nexus threat actor Sygnia has tracked since 2025, spent this year moving past the VMware hypervisors it was previously known…