Pen Test Partners<p>A critical vulnerability in old Telerik software gave an attacker remote code execution on an SFTP-only Windows server. That meant they didn’t need credentials, antivirus didn’t trigger, and default log sizes meant almost nothing useful was captured.</p><p>From there? PowerShell exclusions, admin account created, RDP tunnelled in via Ngrok, ransomware deployed. </p><p>They even opened Pornhub either to cover traffic or celebrate the moment. Who knows?</p><p>This attack wasn’t subtle. But it worked because basic controls were missing. </p><p>We’ve broken down the incident. Plus, recommendations you can act on now to prevent the same thing.</p><p>📌<a href="https://www.pentestpartners.com/security-blog/sil3ncer-deployed-rce-porn-diversion-and-ransomware-on-an-sftp-only-server/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">pentestpartners.com/security-b</span><span class="invisible">log/sil3ncer-deployed-rce-porn-diversion-and-ransomware-on-an-sftp-only-server/</span></a></p><p><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/IncidentResponse" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IncidentResponse</span></a> <a href="https://infosec.exchange/tags/Ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Ransomware</span></a> <a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatDetection</span></a> <a href="https://infosec.exchange/tags/DigitalForensics" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DigitalForensics</span></a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InfoSec</span></a></p>
shakedown.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A community for live music fans with roots in the jam scene. Shakedown Social is run by a team of volunteers (led by @clifff and @sethadam1) and funded by donations.
Administered by:
Server stats:
269active users
shakedown.social: About · Status · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.4.2
#threatdetection
0 posts · 0 participants · 0 posts today
Kunai Project<p>🚀 New Blog Post: Kunai vs io_uring (<a href="https://why.kunai.rocks/blog/kunai-vs-io_uring" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">why.kunai.rocks/blog/kunai-vs-</span><span class="invisible">io_uring</span></a>) 🚀</p><p>💡 Ever wondered how io_uring revolutionizes I/O operations in the Linux kernel? Inspired by Armo's blog post (<a href="https://www.armosec.io/blog/io_uring-rootkit-bypasses-linux-security/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">armosec.io/blog/io_uring-rootk</span><span class="invisible">it-bypasses-linux-security/</span></a>) about a PoC rootkit using io_uring, we explored this feature's security implications and how tools like Kunai can monitor these operations.</p><p>🔍 Key Takeaways:<br>🔹 io_uring boosts I/O performance by reducing system call overhead and enabling asynchronous operations<br>🔹 Security tools struggle to monitor io_uring due to its unique handling of operations<br>🔹 Kunai now provides visibility into io_uring operations, though blocking malicious activities remains challenging<br>🔹 Recent kernel versions have introduced auditing and security controls for io_uring, but these are still limited</p><p>📖 Read more: <a href="https://why.kunai.rocks/blog/kunai-vs-io_uring" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">why.kunai.rocks/blog/kunai-vs-</span><span class="invisible">io_uring</span></a></p><p><a href="https://infosec.exchange/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://infosec.exchange/tags/io_uring" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>io_uring</span></a> <a href="https://infosec.exchange/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Security</span></a> <a href="https://infosec.exchange/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a> <a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatDetection</span></a> <a href="https://infosec.exchange/tags/SOC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SOC</span></a> <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DFIR</span></a></p>
Slim Bill (He/Him)<p>The Risks of AI for Detecting Threats - A Bit of Security for March 17, 2025 <br>What is the downside of relying on AI to detect threats? Listen to this - <br><a href="https://youtu.be/_0AdSztIT9Y" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="">youtu.be/_0AdSztIT9Y</span><span class="invisible"></span></a> <br><a href="https://noc.social/tags/cybersecuritytips" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecuritytips</span></a> <a href="https://noc.social/tags/attachsurface" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>attachsurface</span></a> <a href="https://noc.social/tags/antimalware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>antimalware</span></a> <a href="https://noc.social/tags/AIsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AIsecurity</span></a> <a href="https://noc.social/tags/threatdetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatdetection</span></a> <a href="https://noc.social/tags/BitofSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BitofSec</span></a></p>
DomainTools<p>🚨 Now Available in the AWS Marketplace!</p><p>Check out our listing to see how we enable security practitioners to stop threats before they happen, using best-in-class internet intelligence data, detection and monitoring tools, and predictive risk scoring.</p><p><a href="https://aws.amazon.com/marketplace/pp/prodview-dzycfqt76d5ew?sr=0-1&ref_=beagle&applicationId=AWSMPContessa" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">aws.amazon.com/marketplace/pp/</span><span class="invisible">prodview-dzycfqt76d5ew?sr=0-1&ref_=beagle&applicationId=AWSMPContessa</span></a> </p><p><a href="https://infosec.exchange/tags/AWSMarketplace" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AWSMarketplace</span></a> <a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatDetection</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/RiskManagement" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RiskManagement</span></a> <a href="https://infosec.exchange/tags/SecuritySolutions" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecuritySolutions</span></a></p>
DomainTools<p>Scattered Spider continues its operations despite high-profile arrests. These arrests have pushed the group to iterate and adopt new tactics, including using different domain name patterns to target new employees unfamiliar with security protocols.</p><p><a href="https://www.govinfosecurity.com/tracking-elusive-cybercriminals-through-domain-analysis-a-26022" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">govinfosecurity.com/tracking-e</span><span class="invisible">lusive-cybercriminals-through-domain-analysis-a-26022</span></a></p><p>🔍 Key Insights from Malachi Walker, Security Adviser at DomainTools:<br>🔹 The group’s decentralized structure allows it to remain resilient and operational.<br>🔹Analyzing domain registrations and IP addresses can uncover connections between campaigns and aid law enforcement.<br>🔹Knowing when a domain was created helps narrow down the compromise window and block associated domains.</p><p>📽️ Watch Malachi Walker’s interview at DEF CON 2024 with Information Security Media Group (ISMG) to learn more about:<br>🔹Scattered Spider’s decentralized operations<br>🔹The importance of a domain activity timeline<br>🔹Proactive threat detection and incident response</p><p>Stay vigilant and proactive! 🛡️ </p><p><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatDetection</span></a> <a href="https://infosec.exchange/tags/DEFCON2024" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DEFCON2024</span></a> <a href="https://infosec.exchange/tags/DomainTools" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DomainTools</span></a></p>
Just Another Blue Teamer<p>Happy Monday everyone!</p><p>We are going to start our week off with a <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>readoftheday</span></a> that focuses on an <a href="https://ioc.exchange/tags/APT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APT</span></a> group known as <a href="https://ioc.exchange/tags/Kimsuky" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Kimsuky</span></a> and how they used a new Google Chrome extension to spy on their victims. This tool, dubbed "TRANSLATEXT" was used for cyber espionage and was able to steal emails, usernames, passwords, cookies, and captures browser screenshots, according to the article. </p><p>Looking at the attack chain, Kimsuky delivered the malicious files via a zipped archive with two decoy files, one an HWP document and the other a Windows executable. This executable pulls down a PowerShell script (T1059.001 - Command and Scripting Interpreter: PowerShell) which would gather information (TA0007 - Discovery) about the victims machine and transfer that to a command and control server (TA0011 - Command and Control) and retrieve a shortcut file. </p><p>One interesting take-away was that the script checked for the presence of installed Chrome extensions (T1012 - Query Registry). The registry key in question is HKCU\Software\Policies\Google\Chrome\ExtensionInstallForcelist. This may be a nice registry key to add to your list that you monitor. Enjoy and Happy Hunting!</p><p>Kimsuky deploys TRANSLATEXT to target South Korean academia</p><p><a href="https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">zscaler.com/blogs/security-res</span><span class="invisible">earch/kimsuky-deploys-translatext-target-south-korean-academia</span></a></p><p>Intel 471 <a href="https://ioc.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://ioc.exchange/tags/ITSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ITSecurity</span></a> <a href="https://ioc.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InfoSec</span></a> <a href="https://ioc.exchange/tags/BlueTeam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BlueTeam</span></a> <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatIntel</span></a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatHunting</span></a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatDetection</span></a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>HappyHunting</span></a> <a href="https://ioc.exchange/tags/gethunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>gethunting</span></a> <a href="https://ioc.exchange/tags/Intel471" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Intel471</span></a></p>
IT News<p>US Bans Kaspersky Software - Using a Trump-era authority, the US Commerce Department has banned the sale of Kaspersky’... - <a href="https://www.wired.com/story/us-bans-kaspersky-software/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">wired.com/story/us-bans-kasper</span><span class="invisible">sky-software/</span></a> <a href="https://schleuss.online/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a>/nationalsecurity <a href="https://schleuss.online/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a>/securitynews <a href="https://schleuss.online/tags/threatdetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatdetection</span></a> <a href="https://schleuss.online/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a></p>
da_667<p>Also consider that you can create columns that you can use to follow up to four hashtags at once. I have a column following: <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatdetection</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> <a href="https://infosec.exchange/tags/iocsharing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iocsharing</span></a></p>
TrendingLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload