Extracting Lines of Interest From Zeek Logs
Overview Imagine that you’re looking at a potential issue that shows up in a Zeek log file. Instead of attaching the entire log file to a response ticket it might make sense to extract just the lin...
ictsec.pl
DeepSeek Deception Sainbox RAT & Hidden Rootkit Delivery
Summary Netskope Threat Labs has discovered a campaign using fake installers to deliver the Sainbox RAT and a Hidden rootkit. During our threat hunting activities, we encountered multiple installer...
Decrement by one to rule them all AsIO3.sys driver exploitation
Source: Cisco Talos Excerpt: Armory Crate and AI Suite are applications used to manage and monitor ASUS motherboards and related components such as the processor, RAM or the increasingly popular ...
Cisco ISE Vulnerability Allows Remote Attackers to Execute Malicious Commands
Nature of the Vulnerabilities The vulnerabilities, tracked as CVE-2025-20281 and CVE-2025-20282, target specific APIs within Cisco ISE and ISE-PIC. Both can be exploited without any valid credent...
The Case of Hidden Spam Pages
Spammy posts and pages being placed on WordPress websites is one of the most common infections that we come across. The reason being is that the attack is very low-level in terms of sophistication:...
Surge in MOVEit Transfer Scanning Could Signal Emerging Threat Activity
GreyNoise has identified a notable surge in scanning activity targeting MOVEit Transfer systems, beginning on May 27, 2025. Prior to this date, scanning was minimal—typically fewer than 10 IPs obse...
Realtek Bluetooth Flaw Allows Attackers to Launch DoS Attacks During Pairing
A critical vulnerability in Realtek’s Bluetooth Low Energy (BLE) implementation enables attackers to launch denial-of-service (DoS) attacks during device pairing. The flaw (CVE-2024-48290) affects...
Patch and Persist Darktrace’s Detection of Blind Eagle (APT-C-36)
Since November 2024, Blind Eagle actors have been conducting an ongoing campaign targeting Colombian organizations. In this campaign, threat actors have been observed using phishing emails to deliv...
Iranian Educated Manticore Targets Leading Tech Academics
Key findings Amid ongoing tensions between Iran and Israel, the Iranian threat group Educated Manticore, associated with the Islamic Revolutionary Guard Corps, has launched spear-phishing campaign...
In the Wild Malware Prototype with Embedded Prompt Injection
The public discourse surrounding the capabilities and emerging role of AI is drowned in a sea of fervor and confusion. The few attempts to ground the discussion in concrete arguments and experiment...
Cybercriminal abuse of large language models
Cybercriminals are continuing to explore artificial intelligence (AI) technologies such as large language models (LLMs) to aid in their criminal hacking activities. Some cybercriminals have resort...
Cybercrime is surging across Africa
The report, published this week, paints a sobering picture with two-thirds of surveyed African countries reporting that cybercrime represents a medium-to-high proportion of their total reported cri...
Crash (exploit) and burn Securing the offensive cyber supply chain to counter China in cyberspace
Key findings: Zero-day exploitation is becoming more difficult, opaque, and expensive, leading to “feast-or-famine” contract cycles. Middlemen with prior government connections further drive up cos...
2025-06-25 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2025-34033 5VTechnologies - Blue ...
Why a Classic MCP Server Vulnerability Can Undermine Your Entire AI Agent
Key Takeaways The supply-chain blast radius is extensive. Anthropic’s vulnerable SQLite MCP server was forked over 5,000 times before being archived. This means this unpatched code now exists insi...
Russia-linked APT28 use Signal chats to target Ukraine official with malware
In March–April 2024, during incident response within the information and communication system of a central executive body, Ukraine’s Computer and Emergency Response identified a Windows system infe...
OneClik A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure
The Trellix Advanced Research Center has uncovered a sophisticated APT malware campaign that we’ve dubbed OneClik. It specifically targets the energy, oil, and gas sector through phishing attacks a...
Don't panic, but it's only a matter of time before critical 'CitrixBleed 2' is under attack
Citrix patched a critical vulnerability in its NetScaler ADC and NetScaler Gateway products that is already being compared to the infamous CitrixBleed flaw exploited by ransomware gangs and other c...
Cybercriminals Abuse Open-Source Tools To Target Africa’s Financial Sector
Executive Summary Unit 42 researchers have been monitoring a series of attacks targeting financial organizations across Africa. We assess that the threat actor may be gaining initial access to the...
Cryptominers’ Anatomy Shutting Down Mining Botnets
Introduction Welcome to the final installment of our Cryptominers’ Anatomy blog series: In our first post, we discussed cryptocurrencies’ fundamentals, their various attributes, and what makes so...