Search the archive

STIFLE

Stifle is a post-exploitation tool for abusing explicit certificate mappings in ADCS for account takeover.

PPHACK

Pphack is an advanced client-side prototype pollution scanner. It utilizes chromedp, a headless Chrome browser, to identify prototype pollution vulnerabilities, a type of JavaScript vulnerability that enables attackers to add arbitrary properties to global object prototypes which may then be inherited by user-defined objects.

BLOODHOUNDVIEWER

BloodHoundViewer is a Chrome Extension that enhances the BloodHound Community Edition with features like improved layout controls, query history navigation, and support for Neo4j.

AGENTIC AI THREAT MODELING FRAMEWORK: MAESTRO

MAESTRO is a threat modeling framework that was built to address gaps in traditional threat modeling frameworks like STRIDE and PASTA related to the unique challenges that are inherent in AI systems. It is designed for multi-agent environments and is based on a seven-layer reference architecture that spans from the agent ecosystem at the top to foundational models at the bottom. The model also provides threat modeling examples of agentic architecture patterns such as single agent, multi agent, unconstrained conversational autonomy, human in the loop, and task-oriented agents.

THREATSTATS: AI VULNERABILITIES SURGE 1,025%, 99% CONNECTED TO APIS

Wallarm's researchers cataloged 439 AI-related CVEs in 2024 and released the 2025 API ThreatStats report. 99% of the vulnerabilities traced back to insecure APIs. Attackers exploit internet-exposed APIs that do not include strong authentication mechanisms to exploit injection flaws, misconfigurations, and memory corruption vulnerabilities in high-performance binary APIs.

SPANISH SPYWARE STARTUP MOLLITIAM INDUSTRIES SHUTS DOWN

A Spanish spyware company, Mollitiam Industries, is shutting down after filing for bankruptcy in January. The secretive firm developed surveillance tools called "Invisible Man" and "Night Crawler" that could hack devices and was linked to military intelligence surveillance of journalists in Colombia.

GOOGLE ADDS QUANTUM-RESISTANT DIGITAL SIGNATURES TO CLOUD KMS (2 MINUTE READS)

Google has released quantum-safe digital signatures (FIPS 204/FIPS 205) in Google Cloud Key Management Service (Cloud KMS) for software-based keys, available in preview.

BLACK BASTA RANSOMWARE GANG'S INTERNAL CHAT LOGS LEAK ONLINE

Internal chat logs from the Black Basta ransomware gang were leaked online, revealing tactics and member information.

300% INCREASE IN ENDPOINT MALWARE DETECTIONS

A new WatchGuard report found a 300% increase in endpoint malware detections in the third quarter of 2024, with threat actors using social engineering tactics to execute attacks.

of mind.

AN UPDATE ON FAKE UPDATES: TWO NEW ACTORS, AND NEW MAC MALWARE

Proofpoint identified two new cybercriminal actors operating web injection campaigns, alongside a new macOS malware called FrigidStealer. The campaigns serve as a traffic distribution service for FrigidStealer.

HUNDREDS OF DUTCH MEDICAL RECORDS BOUGHT FOR POCKET CHANGE AT FLEA MARKET

A Dutch man bought five HDDs for €5 each at a flea market and discovered 15GB of unencrypted medical records from 2011 to 2019. He then purchased ten more drives containing healthcare data from a defunct IT company called Nortade ICT Solutions, which violated Dutch law requiring the certified erasure of medical data storage devices.

PALO ALTO NETWORKS TAGS NEW FIREWALL BUG AS EXPLOITED IN ATTACKS

Palo Alto Networks is reporting that a new file read vulnerability is being chained with two previously disclosed vulnerabilities to breach PAN-OS firewalls in active attacks. AssetNote released a proof-of-concept exploit the same day as the vulnerabilities were disclosed and GreyNoise has reported seeing active exploitation of the attack chain.

BREAKING AMSI: HOW MALWARE AVOIDS WINDOWS SCRIPT SCANNING

AMSI is a Windows component that serves as a middleman to pass consumer content to a security solution such as Crowstrike or Microsoft Defender. The first method that is discussed in the post is to patch the prologue of the security provider's DLL to disrupt AMSI initialization. The second method is to intercept the AMSCI scan process by looping through the list of scan functions provided by the providers in CAmsiAntimalware and patching their scan functions to return immediately.

THE ART OF LINUX KERNEL ROOTKITS

This comprehensive guide to Loadable Kernel Module (LKM) rootkits begins by introducing how modern rootkits work and the different hooking techniques used. The guide then explains detection techniques utilizing the filesystem, proofs, logs, and eBPF Tracepoints. Finally, the guide concludes with some advanced techniques for defenders to expose or render rootkits useless as well as some advanced techniques for attackers to establish persistence or defend against LKM rootkits hunters.

SIGNALS OF TROUBLE: MULTIPLE RUSSIA-ALIGNED THREAT ACTORS ACTIVELY TARGETING SIGNAL MESSENGER

Google's Threat Intelligence Group (GTIG) has discovered that Russian-aligned threat actors are targeting Signal Messenger through phishing campaigns exploiting the app's "linked devices" feature. These actors use malicious QR codes and altered group invites to trick victims into linking their Signal accounts to actor-controlled devices. Multiple threat actors, including UNC5792 and UNC4221, are actively involved in these operations, along with efforts to steal Signal database files from Android and Windows devices.

controls, and overcome tough technical hurdles. Register now

HARPOON

Harpoon is a precision tool for Seccomp profiling and function-level tracing by leveraging the power of eBPF. It captures syscalls made by defined functions, providing detailed visibility compared to traditional tracing tools. Installation options include downloading the latest release or building manually with specific steps.

AWESOMEUSERFINDER

AWeSomeUserFinder is an AWS IAM username enumeration and password spraying tool. It can use IAM, S3, or SMS for username enumeration.

TUXTAPE

TuxTape is an ecosystem for generating, compiling, deploying, and installing Linux kernel live patches. It is a toolchain to simplify the workflow around kpatch.

CAN AI ACTUALLY FIND REAL SECURITY BUGS? TESTING THE NEW WAVE OF AI MODELS

The author of ai-security-analyzer decided to test the new generation of reasoning LLMs for their ability to detect vulnerabilities in a test project. A comparison of OpenAI o1, o3-mini-high, Gemini 2.0 Flash Thinking and Pro, and Deepseek R1 is presented, with the reasoning models all successfully identifying some issues while Gemini 2.0 Pro mostly identified false positives. The author concluded that the AI models are promising tools but still imperfect and also compared the test against Semgrep and found that they both identified different vulnerabilities

US ARMY SOLDIER PLEADS GUILTY TO AT&T AND VERIZON HACKS

US Army soldier Cameron Wagenius pled guilty to hacking AT&T and Verizon for phone records and faces up to 20 years imprisonment and $500,000 in fines. His case connects to the major 2024 Snowflake hacks that affected over 160 companies including Santander Bank and Ticketmaster.

HOW PHISHED DATA TURNS INTO APPLE & GOOGLE WALLETS

Brian Krebs dives into how Chinese cybercrime groups are turning phished card data into mobile wallets for Apple and Google Pay. These stolen wallets are loaded onto phones controlled by scammers and sold for profit. The phishing kits used by these groups exploit vulnerabilities to convert stolen card details into digital images for easy enrollment into mobile wallets.

SANS AI CYBERSECURITY HACKATHON

Global virtual AI Cybersecurity Hackathon from February 15 to March 15 with the goal to secure systems, protect data, and tackle emerging cyber threats.

CRACKED GARRY'S MOD, BEAMNG.DRIVE GAMES INFECT GAMERS WITH MINERS

A malware campaign named "StaryDobry" targeted gamers with infected versions of popular games like Garry's Mod and BeamNG.drive, spreading through torrent sites and impacting users in several countries.

HARD DRIVE SCAM: FRAUDSTERS PEDDLE OLD DRIVES AS NEW ONES

Fraudsters in Germany are selling used hard drives as new, deceiving buyers with fake packaging and warranty information, as well as reset SMART values.

FRESSH BUGS UNDISCOVERED FOR YEARS THREATEN OPENSSH SECURITY

OpenSSH has released patches for two new vulnerabilities: a machine-in-the-middle attack (CVE-2025-26465) and a denial-of-service bug (CVE-2025-26466), discovered by Qualys. While not critically severe, they affect this widely used secure connection tool.

VENTURE CAPITAL GIANT INSIGHT PARTNERS HIT BY CYBERATTACK

Insight Partners revealed that they were breached in January following a social engineering attack. Insight has stated that they shut down the attacker's presence in their network immediately after detecting their intrusion and has no evidence that any portfolio companies, funds, or other stakeholders were impacted by this breach.

JUNIPER NETWORKS FIXED A CRITICAL FLAW IN SESSION SMART ROUTERS

Juniper Networks fixed a critical authentication bypass vulnerability, tracked as CVE-2025-21589 (CVSS score of 9.8), in its Session Smart Router. The flaw could allow attackers to take control of the device without proper authentication. Users are advised to upgrade to the fixed versions listed on the site to protect against potential attacks.

MAGENTO CREDIT CARD STEALER DISGUISED IN AN `IMG` TAG

Magecart is a credit card skimming malware that is sophisticated and hard to detect as it hides in `img` tags using Base64 encoding. It can seamlessly inject fake payment forms to steal card details, requiring vigilant security measures and monitoring.

REVOLUTIONIZING SOFTWARE TESTING: INTRODUCING LLM-POWERED BUG CATCHERS

Mutation testing is the process by which automatic test cases are programmatically created based on existing test cases to increase code coverage. Meta created the Automated Compliance Hardening (ACH) system to use LLMs to generate mutants to model realistic inputs. A developer uses ACH by describing the types of bugs that they're concerned about, ACH then generates a series of bugs and converts them into tests to run.

HOW ADVERSARIES EXPLOIT UNMONITORED CLOUD REGIONS TO EVADE DETECTION

Attackers commonly exploit unused regions in cloud providers to launch crypto miners, exfiltrate data, or deploy other payloads. This post explores the various methods and permissions that attackers can utilize in AWS, GCP, and Azure to enumerate or enable unused regions. This post also provides recommended mitigations such as restricting region usage, setting budget alerts, and conducting regular audits.

frontline. Read the full findings here

MIRRORTAB (PRODUCT LAUNCH)

MirrorTab intercepts and sanitizes a browser session before it ever reaches the customer's device eliminating the traditional client-side attack surface by preventing raw code or sensitive data from being exposed in the user's environment.

PASSKEY RAIDER

Passkey Raider is a Burp Suite extension designed to facilitate comprehensive testing of Passkey systems.

TAILPIPE

Tailpipe is an open source SIEM powered by DuckDB that allows for querying data with SQL directly from the terminal.

COMMON OAUTH VULNERABILITIES

This blog provides an overview of how OAuth 2 works with a focus on outlining the different parties involved in a request. It outlines the common flows that are used in OAuth applications such as Implicit Flows, Authorization Code Flows, Client Credentials, Device Authorization Flows, and Resource Owner Password Credentials Flows. The post then provides common attacks and mitigations against these flows.

UNDERSTANDING SAFETENSORS: A SECURE ALTERNATIVE TO PICKLE FOR ML MODELS

Python Pickles are a binary format that is commonly used to distribute ML models but is inherently insecure because arbitrary code can be executed during deserialization. SafeTensors is a format that was created to solve this issue by only storing metadata and numerical tensors. SafeTensors binaries should always be preferred over Pickles when available as in addition to the security benefits, they can also be more performant.

$10 INFOSTEALERS ARE BREACHING CRITICAL US SECURITY: MILITARY AND EVEN THE FBI HIT

The article talks about how relatively inexpensive infostealer malware, like boobytrapped PDFs, game mods, and pirated software, are leading to compromises across the board, even in critical US organizations like the Pentagon and the FBI. According to Hudson Rock's report, over 30 million computers worldwide have been hit, with one in five holding corporate credentials. The article includes a case study on Honeywell and the US Navy and discusses the importance of vigilance and training staff.

MICROSOFT THREAT INTELLIGENCE - NEW XCSSET VARIANT

The first known variant since 2022, this latest XCSSET malware features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies.

CHINA-LINKED APT GROUP WINNTI TARGETS JAPANESE ORGANIZATIONS SINCE MARCH 2024

Researchers from cybersecurity firm LAC have uncovered that a China-linked APT group called Winnti carried out a cyberespionage campaign that targeted Japanese companies in the manufacturing, materials, and energy sectors in March 2024.

X NOW BLOCKS SIGNAL CONTACT LINKS, FLAGS THEM AS MALICIOUS

Social media platform X is now blocking Signal.me links, used by the Signal encrypted messaging app to share account info, citing spam or malware risks.

NEW FINALDRAFT MALWARE ABUSES OUTLOOK MAIL SERVICE FOR STEALTHY COMMUNICATIONS

Elastic Security is reporting on a new malware campaign that utilizes Outlook drafts for C2 communication. The campaign uses PathLoader, which contains static analysis defenses, to load the FinalDraft malware, which requests OAuth tokens from Microsoft to hide C2 communication in drafts. The malware accepts 37 unique commands that include data exfiltration, process injection, pass-the-hash attacks, network proxying, file operations, and Powershell execution.

TELEGRAM ABUSED AS C2 CHANNEL FOR NEW GOLANG BACKDOOR

Researchers at Netskope have discovered a Golang-based malware, likely Russian in origin, that uses Telegram API as a Command and Control Mechanism. It uses the "C:\Windows\Temp\svchost.exe" location to save the binary and listens to commands in a Telegram Channel. This blog post includes the IOCs in a GitHub repository as well as screenshots of decompiled code of the malware.

FINASTRA ANNOUNCES DATA BREACH FOLLOWING DISCOVERY OF NOVEMBER 2024 CYBERATTACK

Finastra reported a data breach after discovering unauthorized access in November 2024 to consumer information, including names and financial details. They are sending out notification letters to those affected by the security incident. The article suggests seeking legal guidance to protect anyone receiving notification letters and for anyone impacted to understand options following the breach.