Author: Curated

Fire Ant Exploits VMware Flaws to Compromise ESXi Hosts and vCenter Environments

Source: The Hacker News

Author: The Hacker News

URL: https://thehackernews.com/2025/07/fire-ant-exploits-vmware-flaw-to.html

ONE SENTENCE SUMMARY:

Fire Ant, linked to China’s UNC3886, targets virtualization and networking infrastructure using stealthy methods for cyber espionage.

MAIN POINTS:

  1. Fire Ant targets VMware ESXi, vCenter, and network appliances in cyber espionage.
  2. Uses sophisticated techniques for multilayered attack chains accessing segmented networks.
  3. Shares attributes with UNC3886, a known China-nexus cyber espionage group.
  4. Establishes control in VMware environments and bypasses network segmentation.
  5. Exploits vulnerabilities, notably CVE-2023-34048 and CVE-2023-20867, for prolonged access.
  6. Deploys persistent backdoors and Python-based implants for remote command execution.
  7. Facilitates network tunneling and compromises F5 load balancers using CVE-2022-1388.
  8. Maintains low intrusion footprint by tampering with logging and using stealth techniques.
  9. Highlighted as a threat to national security by Singapore’s Minister for National Security.
  10. Operates covertly, targeting under-secured infrastructure layers lacking detection solutions.

TAKEAWAYS:

  1. The campaign shows advanced, stealthy intrusions targeting critical network infrastructure.
  2. Fire Ant demonstrates persistent, sophisticated cyber espionage capabilities.
  3. Traditional security tools struggle to detect hypervisor and network infrastructure attacks.
  4. The threat extends risks to critical infrastructures beyond regional borders.
  5. UNC3886’s activities raise significant national security concerns globally.

DNS Packet Inspection for Network Threat Hunters

Source: Active Countermeasures

Author: Faan Rossouw

URL: https://www.activecountermeasures.com/dns-packet-inspection-for-network-threat-hunters/

ONE SENTENCE SUMMARY:

DNS packet inspection is crucial for network threat hunters to effectively identify and mitigate command and control threats.

MAIN POINTS:

  1. Command and Control (C2) often uses DNS for covert communication.
  2. DNS packet inspection helps detect unusual patterns.
  3. Long, garbled DNS queries can indicate malicious activity.
  4. Network threat hunters focus on identifying C2 channels.
  5. Active Countermeasures provides insights into DNS analytics.
  6. DNS data can reveal hidden C2 servers.
  7. Understanding common DNS behaviors assists in threat detection.
  8. Tools are available to aid in DNS packet analysis.
  9. Analyzing DNS traffic enhances security measures.
  10. DNS inspection is a key part of cybersecurity strategies.

TAKEAWAYS:

  1. DNS packet analysis is vital for identifying hidden threats.
  2. Recognizing C2 patterns aids in early threat detection.
  3. Effective tools improve DNS traffic scrutiny.
  4. Familiarity with DNS behavior is crucial for cybersecurity.
  5. Proactive DNS inspection strengthens network defenses.

Autoswagger: Open-source tool to expose hidden API authorization flaws

Source: Help Net Security

Author: Help Net Security

URL: https://www.helpnetsecurity.com/2025/07/24/autoswagger-open-source-tool-expose-hidden-api-authorization-flaws/

ONE SENTENCE SUMMARY:

Autoswagger is a free tool that scans APIs for broken authorization vulnerabilities by analyzing OpenAPI documentation and endpoint responses.

MAIN POINTS:

  1. Autoswagger scans APIs for broken authorization vulnerabilities.
  2. It detects API schemas in various formats across organization domains.
  3. Scans for OpenAPI and Swagger documentation pages to find valid schemas.
  4. Automatically generates endpoints list for testing based on API specifications.
  5. Tests endpoints for authorization flaws by sending valid requests.
  6. Flags endpoints with unexpected valid responses instead of HTTP errors.
  7. Highlights endpoints with missing or ineffective authentication.
  8. Can simulate bypassing validation checks with a –brute flag.
  9. Analyzes responses for exposed sensitive data like PII or credentials.
  10. Available for free on GitHub to enhance API security practices.

TAKEAWAYS:

  1. Autoswagger helps identify broken authorization in API endpoints effortlessly.
  2. Publicly exposing API documentation increases risk; avoid unless necessary.
  3. Regular API scanning is critical after each development iteration.
  4. Simulating bypass checks can uncover deeper security flaws.
  5. Tool emphasizes importance of not exposing APIs unnecessarily.

DNS Packet Inspection for Network Threat Hunters

Source: Active Countermeasures

Author: Faan Rossouw

URL: https://www.activecountermeasures.com/dns-packet-inspection-for-network-threat-hunters/

ONE SENTENCE SUMMARY:

DNS packet inspection helps network threat hunters detect Command and Control (C2) communications by analyzing atypical DNS traffic patterns.

MAIN POINTS:

  1. DNS is often used for Command and Control (C2) communications due to its commonality and stealth capabilities.
  2. Analyzing DNS traffic can reveal hidden malicious activities within network communications.
  3. DNS packet inspection involves scrutinizing packet data for unusual patterns or anomalies.
  4. Long, garbled DNS queries are potential indicators of C2 communications.
  5. Insight into DNS anomalies helps identify compromised systems in a network.
  6. Effective DNS monitoring requires understanding typical traffic patterns and deviations.
  7. Network threat hunters utilize DNS inspection to trace back malicious activities.
  8. DNS logging and analysis tools facilitate the detection of C2 communications.
  9. Real-time monitoring of DNS traffic enhances threat detection capabilities.
  10. Proper DNS inspection can prevent data breaches by identifying early signs of threats.

TAKEAWAYS:

  1. DNS traffic analysis is crucial in identifying covert C2 communications.
  2. Understanding normal DNS patterns aids in detecting anomalies.
  3. Real-time inspection can proactively mitigate network threats.
  4. Long, suspicious queries are key indicators of malicious activities.
  5. Effective DNS inspection prevents potential security breaches.

Detecting ADCS Privilege Escalation

Source: Black Hills Information Security, Inc.

Author: BHIS

URL: https://www.blackhillsinfosec.com/detecting-adcs-privilege-escalation/

ONE SENTENCE SUMMARY:

Misconfigurations in ADCS can create vulnerabilities; enabling auditing and using Sentinel helps detect and alert on credential escalations.

MAIN POINTS:

  1. ADCS manages certificates for systems, users, and applications in enterprises.
  2. Misconfigurations can lead to critical vulnerabilities in Active Directory environments.
  3. Default settings do not enable ADCS event logging; it must be manually configured.
  4. ESC1 technique allows low privileged accounts to gain elevated access.
  5. Important security event IDs for detection are 4886 and 4887.
  6. Microsoft Sentinel uses Kusto Query Language for identifying escalation activities.
  7. Alerts can be configured in Sentinel to notify on detected attacks.
  8. Sentinel alerts using Event ID mismatches for privilege misuse.
  9. Additional event IDs include 4900 for security permission changes and 4899 for template updates.
  10. Ensuring proper auditing is crucial for detection and alert configuration.

TAKEAWAYS:

  1. Enable ADCS auditing manually to detect exploitation.
  2. Use Microsoft Sentinel for continuous monitoring and alerting.
  3. Security event IDs are essential for tracking privilege escalation.
  4. Regularly update alert rules to incorporate new vulnerabilities.
  5. Stay informed about patches and updates for security enhancements.

CQURE HACKS #66 Hiding and Modifying Windows Services with Service Control

Source: CQURE Academy

Author: Kate Chrzan

URL: https://cqureacademy.com/blog/66-hiding-and-modifying-windows-services/

ONE SENTENCE SUMMARY:

The guide explains using SDDL to hide Windows services for persistence and detection methods via different tools.

MAIN POINTS:

  1. SDDL manipulation can hide Windows services for post-incident investigations.
  2. Use “sc sdshow” to display a service’s SDDL string.
  3. Modify a service’s SDDL with “sc sdset” to change visibility.
  4. The DACL section of SDDL controls permissions and visibility.
  5. Different APIs respond differently based on permission settings.
  6. “Get-Service” may not show hidden services due to SDDL settings.
  7. Autoruns detects services by reading the registry, bypassing SDDL restrictions.
  8. Unhide services by resetting the SDDL to a default descriptor.
  9. Advanced techniques include DKOM for deeper process hiding.
  10. SDDL is applicable to many Windows objects beyond services.

TAKEAWAYS:

  1. SDDL manipulation is crucial for understanding service persistence.
  2. Autoruns can detect hidden services through the registry.
  3. Resetting SDDL settings reveals hidden services.
  4. Different tools respond to hidden services based on API interaction.
  5. Understanding SDDL enhances cybersecurity incident investigation skills.

The CISO code of conduct: Ditch the ego, lead for real

Source: The CISO code of conduct: Ditch the ego, lead for real | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4022903/the-ciso-code-of-conduct-ditch-the-ego-lead-for-real.html

ONE SENTENCE SUMMARY:

The article criticizes inflated egos among CISOs, advocating for humility, collaboration, and real leadership within the cybersecurity field.

MAIN POINTS:

  1. CISOs’ egos can overshadow their intelligence, impacting collaboration and decency.
  2. The industry glorifies the CISO role, rewarding poor behavior over genuine leadership.
  3. CISOs often create echo chambers, avoiding challenges and hoarding influence.
  4. Toxic behaviors extend to vendor interactions, negatively affecting collaboration.
  5. There’s a call for CISOs to embrace humility and accountability for true leadership.
  6. Security leadership involves aligning with business outcomes, not just technical functions.
  7. Respect across domains like Legal and Finance is essential for trust and effectiveness.
  8. Effective leadership involves building resilient teams and mentoring future leaders.
  9. Real leaders make themselves replaceable, ensuring continuity and growth.
  10. The CISO Code of Conduct emphasizes integrity, humility, and respect in leadership.

TAKEAWAYS:

  1. Recognize and address inflated egos to foster a healthier leadership environment.
  2. Shift focus from influence to integrity in the CISO role.
  3. Encourage collaboration, mentorship, and team-building over control and ego.
  4. Align security initiatives with the business for meaningful impact.
  5. Uphold a shared standard of conduct to elevate the role’s credibility.

Beyond IAM access keys: Modern authentication approaches for AWS

Source: AWS Security Blog

Author: Mitch Beaumont

URL: https://aws.amazon.com/blogs/security/beyond-iam-access-keys-modern-authentication-approaches-for-aws/

ONE SENTENCE SUMMARY:

Enhance AWS authentication security by replacing long-term IAM access keys with secure alternatives, such as CloudShell, IAM Identity Center, and IAM roles.

MAIN POINTS:

  1. Long-term IAM access keys pose security risks like credential exposure and unauthorized access.
  2. Use AWS CloudShell for AWS CLI to avoid local credential management.
  3. Combine AWS CLI v2 with IAM Identity Center for centralized user management and MFA.
  4. Integrated development environments like Visual Studio Code support secure IAM Identity Center authentication.
  5. Use IAM roles for AWS compute services and CI/CD pipelines to automate credential rotation.
  6. For third-party applications, use temporary credentials through IAM roles and avoid root account keys.
  7. Implement IAM Roles Anywhere for non-AWS workloads to generate temporary credentials.
  8. Use OpenID Connect with IAM roles for SaaS CI/CD services to reduce long-term credential usage.
  9. Apply the principle of least privilege to ensure minimal necessary permissions.
  10. Utilize AWS tools for policy generation based on CloudTrail logs to optimize security strategies.

TAKEAWAYS:

  1. Prefer temporary credentials to enhance security over long-term access keys.
  2. Choose authentication methods suited to specific use cases.
  3. Implement the principle of least privilege on all access pathways.
  4. Leverage AWS tools for efficient policy generation and management.
  5. Regularly assess and update authentication methods as new solutions appear.

Containment as a Core Security Strategy

Source: Dark Reading

Author: Ariadne Conill

URL: https://www.darkreading.com/vulnerabilities-threats/containment-core-security-strategy

ONE SENTENCE SUMMARY:

The website’s security system blocked access due to suspicious activity, and resolution involves contacting the site owner with details.

MAIN POINTS:

  1. The website uses a security service against online attacks.
  2. Blocking can result from triggering security measures.
  3. Specific actions like submitting certain data can cause blocks.
  4. A SQL command or malformed data might trigger a block.
  5. Users should contact the site owner to resolve issues.
  6. Provide details of the action when the block occurred.
  7. Include the Cloudflare Ray ID in communication.
  8. Emailing the site owner is recommended for assistance.
  9. Determining specific triggering action may help prevent future blocks.
  10. Website protection prioritizes security and user safety.

TAKEAWAYS:

  1. Website employs robust security systems to prevent attacks.
  2. Understand which actions might trigger security blocks.
  3. Direct contact with site owner is essential for resolution.
  4. Sharing detailed incident information aids troubleshooting.
  5. Automation in security may occasionally cause user inconvenience.

Microsoft SharePoint zero-day exploited in RCE attacks, no patch available

Source: BleepingComputer

Author: Lawrence Abrams

URL: https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/

ONE SENTENCE SUMMARY:

A zero-day vulnerability in Microsoft SharePoint, CVE-2025-53770, has led to widespread exploitation, with ongoing efforts to mitigate and patch the issue.

MAIN POINTS:

  1. Updated article reveals 54 organizations affected by SharePoint vulnerability.
  2. CVE-2025-53770 has been exploited since July 18, affecting 85 servers.
  3. Viettel’s “ToolShell” attack used chained SharePoint flaws CVE-2025-49706/49704.
  4. Microsoft has not yet patched CVE-2025-53770; AMSI integration is recommended.
  5. Enabling AMSI and Defender AV as mitigations prevent unauthenticated attacks.
  6. SharePoint 2016/2019 updates include AMSI by default since September 2023.
  7. Disconnect unprotected SharePoint servers to prevent exploitation.
  8. CISA added CVE-2025-53770 to its Known Exploited Vulnerability catalog.
  9. Over 29 organizations initially compromised, detected by Eye Security.
  10. Attackers use “spinstall0.aspx” for MachineKey theft and RCE.

TAKEAWAYS:

  1. Prompt application of upcoming SharePoint security patches is crucial.
  2. Enabling AMSI and deploying Defender AV mitigates vulnerability risks.
  3. Detecting specific IOCs can indicate compromised SharePoint servers.
  4. Disconnect from the internet if unable to apply mitigations swiftly.
  5. Monitoring for IP addresses associated with exploitation is essential.

Citrix Bleed 2 exploited weeks before PoCs as Citrix denied attacks

Source: BleepingComputer

Author: Lawrence Abrams

URL: https://www.bleepingcomputer.com/news/security/citrix-bleed-2-exploited-weeks-before-pocs-as-citrix-denied-attacks/

ONE SENTENCE SUMMARY:

Citrix’s critical vulnerability “CitrixBleed 2” was exploited before public PoC release, prompting patch urgency and revealing transparency issues.

MAIN POINTS:

  1. CVE-2025-5777, known as CitrixBleed 2, faced early exploitation despite no initial evidence claims by Citrix.
  2. GreyNoise detected attacks from China beginning June 23, 2025, before PoC release.
  3. Exploitation allowed attackers to extract sensitive data by manipulating login parameters.
  4. Citrix was slow to acknowledge active exploitation and did not update advisories timely.
  5. Security researcher Kevin Beaumont identified indicators of exploitation attempts in logs.
  6. Misconfigured session terminations advised by Citrix may not fully prevent exploitation.
  7. Over 120 companies compromised by the vulnerability as of June 2025.
  8. Imperva reported 11.5 million attempts, with heavy targeting of the financial sector.
  9. Citrix urged immediate patching of affected NetScaler versions for security.
  10. No mitigations exist beyond patching; outdated versions need upgrading.

TAKEAWAYS:

  1. Immediate patching is essential to protect systems against CVE-2025-5777.
  2. Citrix’s advisory and communication processes need improvement for better transparency.
  3. Monitoring specific log activities can help identify attempted exploitations early.
  4. Organizations must address all session types for complete security.
  5. Financial and other critical sectors need heightened vigilance due to targeted attacks.

The Cake Guide to Cyber Risk Quantification: Understanding Lognormal Distributions for Absolute Beginners

Source: Medium

Author: Mehdi

URL: https://medium.com/@mpmab1/the-cake-guide-to-cyber-risk-quantification-understanding-lognormal-distributions-for-absolute-b31ee12daaa3

ONE SENTENCE SUMMARY:

This beginner’s guide explains lognormal distributions and their application in cyber risk quantification, using intuitive analogies and Python.

MAIN POINTS:

  1. Lognormal distribution is essential in cyber risk quantification (CRQ).
  2. Aimed at beginners without prior statistics knowledge.
  3. Uses intuitive analogies like cake and cars.
  4. Describes why averages are misleading in skewed data.
  5. Explains transforming, validating, and reverse-transforming lognormal data.
  6. Python and Monte Carlo simulations model cyber loss scenarios.
  7. Visualize results with histograms and CDFs.
  8. Lognormal properties: only positive, skewed, starts at zero, log is normal.
  9. Misleading averages corrected by data transformation.
  10. Applies to real-world scenarios like incomes and cyber losses.

TAKEAWAYS:

  1. Averages in lognormal distributions can be misleading.
  2. Log transformations stabilize data for better analysis.
  3. Exponentiation returns data to its original scale.
  4. Visualizing data helps to identify skewness and distribution types.
  5. Monte Carlo simulations provide insights into possible outcomes.

Cisco Warns of Critical ISE Flaw Allowing Unauthenticated Attackers to Execute Root Code

Source: The Hacker News

Author: info@thehackernews.com (The Hacker News)

URL: https://thehackernews.com/2025/07/cisco-warns-of-critical-ise-flaw.html

ONE SENTENCE SUMMARY:

A critical Cisco security vulnerability could allow unauthorized remote code execution in ISE systems, urging immediate patching and system updates.

MAIN POINTS:

  1. New vulnerability affects Cisco ISE, allowing arbitrary code execution with root privileges.
  2. Tracked as CVE-2025-20337 with a maximum CVSS score of 10.0.
  3. Similar to CVE-2025-20281, recently patched.
  4. Exploitable through crafted API requests due to insufficient input validation.
  5. Kentaro Kawane credited with discovering the flaw.
  6. Affects ISE versions 3.3 and 3.4, fixed in specific patches.
  7. No current evidence of malicious exploitation of this vulnerability.
  8. Related exploits in Fortinet FortiWeb are reportedly being used maliciously.
  9. 77 FortiWeb instances compromised, primarily in North America, Asia, and Europe.
  10. Censys reports 20,098 online FortiWeb appliances, with unknown vulnerability status.

TAKEAWAYS:

  1. Patch ISE systems immediately to safeguard against CVE-2025-20337.
  2. Ensure robust validation procedures for API inputs to prevent exploits.
  3. Continually monitor security advisories for timely updates.
  4. Stay informed of related exploits affecting similar systems like FortiWeb.
  5. Regular system updates are crucial to minimize security threats.

7 obsolete security practices that should be terminated immediately

Source: 7 obsolete security practices that should be terminated immediately | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4022848/7-obsolete-security-practices-that-should-be-terminated-immediately.html

ONE SENTENCE SUMMARY:

Modern security requires moving beyond outdated practices, emphasizing zero trust, user awareness, and adaptive strategies against evolving threats.

MAIN POINTS:

  1. Perimeter-only security is inadequate for cloud-based, remote, and distributed environments.
  2. Compliance-driven security prioritizes regulations over actual threat mitigation.
  3. Legacy VPNs are inefficient and risky, needing replacement with modern solutions like SASE.
  4. Sole reliance on EDR is insufficient against non-endpoint threats; broader strategies are needed.
  5. SMS-based two-factor authentication is vulnerable to multiple attack vectors.
  6. On-prem SIEMs lead to inefficiencies and need upgrading for cloud capability.
  7. End users must transition from passive to active participants in security culture.
  8. User education and empowerment are crucial to building strong security defenses.
  9. Zero trust and CARTA are recommended for continuous threat monitoring.
  10. Adversaries exploit trust relationships and technology gaps beyond traditional detection methods.

TAKEAWAYS:

  1. Adopt zero-trust principles to enhance security across diverse work environments.
  2. Move beyond compliance-driven security, focus on real threat management.
  3. Replace legacy VPNs with secure, adaptive access solutions like SASE.
  4. Enhance security practices beyond endpoint solutions like EDR.
  5. Educate users to actively engage in security efforts, strengthening organizational defenses.

Update Google Chrome to fix actively exploited zero-day (CVE-2025-6558)

Source: Help Net Security

Author: Zeljka Zorz

URL: https://www.helpnetsecurity.com/2025/07/16/update-google-chrome-to-fix-actively-exploited-zero-day-cve-2025-6558/

ONE SENTENCE SUMMARY:

Google patched a critical Chrome zero-day vulnerability, CVE-2025-6558, actively exploited to escape the browser’s security sandbox.

MAIN POINTS:

  1. CVE-2025-6558 is a high-severity vulnerability in Chrome’s ANGLE and GPU.
  2. Incorrect input validation enables attackers to escape Chrome’s sandbox.
  3. The flaw was reported by Google Threat Analysis Group researchers.
  4. Attack requires users to visit a specially crafted HTML page.
  5. Active exploitation suggests involvement of state-sponsored or mercenary actors.
  6. Also patched: CVE-2025-7656 (V8 engine) and CVE-2025-7657 (WebRTC).
  7. Affects Chrome for Windows, macOS, and Linux prior to v138.0.7204.157/.158.
  8. Users are advised to update Chrome to the latest version promptly.
  9. Other Chromium-based browsers are expected to receive similar updates.
  10. Microsoft is preparing a similar fix for the Edge browser.

TAKEAWAYS:

  1. Update Chrome to prevent exploitation of CVE-2025-6558.
  2. The vulnerability underscores the importance of regular software updates.
  3. Stay informed about security alerts for proactive protection.
  4. Other browsers like Edge, Brave, Opera, and Vivaldi are implementing fixes.
  5. Vigilance against specially crafted web content is crucial for security.

HIPAA, HITECH, and HITRUST – It’s HI Time to Make Sense of it All

Source: TrustedSec

Author: Chris Camejo

URL: https://trustedsec.com/blog/hipaa-hitech-and-hitrust-its-high-time-to-make-sense-of-it-all

ONE SENTENCE SUMMARY:

HIPAA, HITECH, and HITRUST are interrelated frameworks ensuring healthcare organizations protect patient data and maintain compliance.

MAIN POINTS:

  1. HIPAA sets national standards for protecting sensitive patient health information.
  2. HITECH Act strengthens HIPAA by promoting electronic health records and increasing penalties for violations.
  3. HITRUST provides a certifiable framework to help organizations meet HIPAA and HITECH requirements.
  4. HIPAA compliance is mandatory for covered entities and business associates in healthcare.
  5. HITECH incentivizes adoption of secure electronic health records while enforcing stricter data security.
  6. HITRUST CSF combines HIPAA, HITECH, and other standards into a unified security framework.
  7. HITRUST certification demonstrates proactive risk management and regulatory compliance.
  8. HIPAA focuses on privacy and security rules for protected health information (PHI).
  9. HITECH enhances enforcement and extends HIPAA responsibilities to third-party vendors.
  10. HITRUST helps organizations streamline compliance efforts through standardized assessments.

TAKEAWAYS:

  1. HIPAA is the foundational regulation for healthcare data privacy and security.
  2. HITECH reinforces HIPAA with stronger enforcement and EHR adoption incentives.
  3. HITRUST offers a practical path to demonstrate HIPAA and HITECH compliance.
  4. Certification through HITRUST can reduce compliance complexity and increase trust.
  5. Understanding all three frameworks ensures comprehensive data protection in healthcare environments.

CQURE HACKS #65 NTLM reflection SMB flaw – CVE-2025-33073: From zero to Domain Admin

Source: CQURE Academy

Author: Kate Chrzan

URL: https://cqureacademy.com/blog/65-ntlm-reflection-smb-flaw/

  1. ONE SENTENCE SUMMARY: CVE-2025-33073 enables attackers to exploit legacy SMB protocols and coercion methods for full system compromise via NTLM relay.

  2. MAIN POINTS:

  3. SMB signing must be disabled on the target machine to allow authentication relay attacks.

  4. The target must be vulnerable to coercion techniques like PetitPotam for exploitation to proceed.

  5. Initial attack attempts without a DNS record fail due to inability to authenticate properly.

  6. Adding a DNS record pointing to the attacker’s machine enables successful NTLM relay and SAM dump.

  7. Changing the IP to the DNS record value allows the machine to relay authentication to itself.

  8. LLMNR poisoning via Responder enables attacks without needing the DNS record.

  9. Using impacket-ntlmrelayx with netexec and coerce_plus exploits the PrinterBug vulnerability.

  10. Successful execution allows retrieval of local admin hash and local authentication.

  11. Module LSA from netexec can be used to dump LSASS and gain further access.

  12. The vulnerability highlights critical risks from legacy authentication protocols and misconfigurations.

  13. TAKEAWAYS:

  14. Disable SMB signing only if absolutely necessary, as it allows dangerous relay attacks.

  15. Monitor and restrict DNS records to prevent abuse in authentication redirection.

  16. Employ modern authentication mechanisms to mitigate legacy protocol exploitation.

  17. Use tools like Responder and PetitPotam carefully during red team engagements or internal audits.

  18. Regularly update systems and audit for coercion vulnerabilities like PrinterBug.

Active Directory Attack Detections Part 1

Source: Dylan’s Blog

Author: Dylan Davis

URL: https://dylandavis1.github.io/2025-07-04-active-directory-detections-Part-1/

  1. ONE SENTENCE SUMMARY: This blog details detection techniques for various Active Directory attacks, providing practical rules for identifying malicious behavior using logs.

  2. MAIN POINTS:

  3. Password spraying with Kerbrute generates Event ID 4768 logs with suspicious TicketOptions value 0x10.

  4. AS-REP Roasting uses GetNPUsers and shows TicketOptions 0x50800000 and PreAuthType 0 in Event ID 4768.

  5. Impacket’s getTGT tool creates anomalous TGT requests with 0x50800000 TicketOptions and Encryption Type 0x12.

  6. Kerberoasting via GetUserSPNs triggers Event ID 4768 and 4769 logs with RC4 encryption (0x17).

  7. Kerberoasting without pre-auth uses non-krbtgt SPNs and PreAuthType 0, mimicking AS-REP roasting logs.

  8. Mimikatz DCSync attacks generate four 4662 logs using anomalous GUIDs and user accounts, not DC machine accounts.

  9. Netexec DCSync via drsuapi produces three 4662 logs with DS-Replication-Get-Changes-All GUID in the third.

  10. Netexec’s ntdsutil method triggers Event ID 4799 and uses suspicious command lines and temporary directories.

  11. Netexec’s VSS method generates Event IDs 4904 and 4905 using VSSVC.exe and command-line shadow copy activity.

  12. Pass-the-Hash attacks show Event IDs 4624 and 4672 with Logon Type 9 and LogonProcessName “seclogo”.

  13. TAKEAWAYS:

  14. Anomalous TicketOptions and Encryption Types in Kerberos logs are strong indicators of credential-based attacks.

  15. Detection of DCSync should include GUID analysis and monitoring for non-DC accounts triggering 4662 logs.

  16. Netexec’s use of LOLBINs like ntdsutil and VSS can be detected through unique process creation patterns.

  17. Pass-the-Hash activity correlates Event IDs 4624 and 4672 using shared Logon IDs and elevated privileges.

  18. Effective detection relies on combining Event ID analysis, GUIDs, and process command-line behaviors.

Why your Microsoft 365 setup might be more vulnerable than you think

Source: Help Net Security

Author: Help Net Security

URL: https://www.helpnetsecurity.com/2025/07/14/microsoft-365-attack-surface/

  1. ONE SENTENCE SUMMARY: Despite claiming advanced Microsoft 365 security, many organizations face frequent attacks due to misconfigurations, weak oversight, and misunderstood responsibilities.

  2. MAIN POINTS:

  3. 60% of organizations rate their Microsoft 365 security as strong, yet still suffer account compromise incidents.

  4. Complexity from managing multiple tenants increases risk, with 78% of organizations using multi-tenant setups.

  5. 49% of IT leaders incorrectly assume Microsoft backs up configurations automatically.

  6. Misconfigurations and overlooked admin roles introduce serious vulnerabilities due to limited governance and visibility.

  7. Organizations with 10+ tenants face 2.3x higher operational overhead compared to those with fewer tenants.

  8. Only 20% of organizations have over 10 global admins, aligning with best practices.

  9. 51% of organizations have over 250 Entra apps with read-write permissions, posing significant security risks.

  10. 16% have no app permission oversight; most rely on manual or inadequate tools.

  11. 68% of organizations face frequent Microsoft 365 access attempts by attackers.

  12. Only 41% of organizations have effectively implemented MFA, despite its proven effectiveness in preventing breaches.

  13. TAKEAWAYS:

  14. Declaring strong security doesn’t equate to actual protection—oversight and enforcement are critical.

  15. Multi-tenant architecture adds complexity, necessitating robust management and governance frameworks.

  16. Many organizations neglect to back up configurations, exposing them to disaster recovery failures.

  17. MFA is underutilized despite its proven ability to prevent 99.9% of account compromises.

  18. Formal change control and disaster recovery plans significantly reduce misconfiguration and operational disruptions.

Kanvas: Open-source incident response case management tool

Source: Help Net Security

Author: Mirko Zorz

URL: https://www.helpnetsecurity.com/2025/07/09/kanvas-open-source-incident-response-case-management-tool/

  1. ONE SENTENCE SUMMARY: Kanvas is a Python-based, open-source incident response tool that streamlines investigations with Excel integration, visualizations, and threat intelligence features.

  2. MAIN POINTS:

  3. Kanvas is an open-source incident response case management tool with a simple desktop interface.

  4. Built in Python, it uses Excel as a backend for collaboration and easy data sharing.

  5. Supports Markdown note-taking for structured, portable, and exportable investigator notes.

  6. Enables external lookups to provide contextual data without switching tools during investigations.

  7. One-click data visualizations help infer timelines and lateral movement, exported as images for reporting.

  8. Integrates MITRE D3FEND to map threat actor techniques to defensive strategies.

  9. Future updates will include Diamond Model mapping and additional visualizations.

  10. Plans to integrate LLMs for automated, accurate draft report generation from spreadsheet data.

  11. Upcoming support for MISP and OpenCTI will allow direct threat intelligence platform integration.

  12. macOS users will benefit from UI enhancements aimed at better usability and performance.

  13. TAKEAWAYS:

  14. Kanvas centralizes incident response workflows using familiar Excel files as a foundation.

  15. Markdown notes and visual reporting boost portability and documentation efficiency.

  16. Visualization tools save time by simplifying data interpretation and presentation.

  17. Integration with MITRE D3FEND helps bridge threat analysis and defense planning.

  18. Planned LLM and threat intelligence integrations will enhance automation and contextual awareness.

Why your security team feels stuck

Source: Help Net Security

Author: Mirko Zorz

URL: https://www.helpnetsecurity.com/2025/07/09/why-cybersecurity-friction/

  1. ONE SENTENCE SUMMARY: Internal cybersecurity friction, driven by complex tools, unclear processes, and cautious culture, hinders security teams more than external threats.

  2. MAIN POINTS:

  3. Security teams face internal friction due to tool sprawl, unclear ownership, and rigid processes.

  4. Disconnected tools require analysts to switch dashboards, slowing response and increasing alert fatigue.

  5. Approval-heavy workflows delay incident response, risking critical containment windows.

  6. Lack of context in access requests leads to repeated clarification cycles, wasting time.

  7. Ambiguities in responsibilities cause delays and confusion during handoffs between teams.

  8. Caution culture discourages initiative, pushing decisions upward and reducing overall team agility.

  9. Burnout and normalized inefficiencies lower morale and inhibit improvement efforts.

  10. Evolving security roles now require balancing protection with enabling business growth.

  11. Integration and shared data visibility can reduce both friction and risk.

  12. Clear thresholds and role clarity empower faster, accountable responses without sacrificing security.

  13. TAKEAWAYS:

  14. Streamlining tools and processes can significantly improve security team efficiency and morale.

  15. Trust frameworks and role clarity reduce the need for excessive approvals.

  16. Culture change must promote speed and responsibility, not just caution.

  17. Shared visibility and system-level enforcement reduce manual friction.

  18. Internal delays are a silent threat that can undermine security more than external attacks.

Windows Shortcut (LNK) Malware Strategies

Source: Unit 42

Author: Haizhou Wang, Ashkan Hosseini, Ashutosh Chitwadgi

URL: https://unit42.paloaltonetworks.com/lnk-malware/

  1. ONE SENTENCE SUMMARY: Attackers increasingly exploit Windows LNK files, using varied techniques such as exploits, malicious file execution, and embedded scripts for malware delivery.

  2. MAIN POINTS:

  3. Malicious LNK samples surged from 21,098 in 2023 to 68,392 in 2024.

  4. LNK files act as shortcuts to other files, applications, or folders in Windows.

  5. Attackers abuse LNK flexibility, disguising malware as legitimate files to trick users.

  6. Four types of LNK malware: exploit execution, malicious file execution, in-argument scripts, and overlay content execution.

  7. Most malicious LNK files contain LINKTARGET_IDLIST, RELATIVE_PATH, or COMMAND_LINE_ARGUMENTS structures.

  8. Common system targets abused include powershell.exe, cmd.exe, rundll32.exe, conhost.exe, and mshta.exe.

  9. COMMAND_LINE_ARGUMENTS can embed malicious scripts directly within LNK files.

  10. Overlay content execution techniques involve find/findstr, mshta, or PowerShell commands.

  11. CVE-2010-2568 vulnerability is notably exploited using corrupted LNK binaries.

  12. Users should carefully inspect LNK file properties, especially target paths, to detect malware.

  13. TAKEAWAYS:

  14. Windows users should be cautious and verify LNK files’ properties before execution.

  15. Cybersecurity teams must understand LNK malware techniques to enhance defenses.

  16. Palo Alto Networks products offer protection against various LNK-based attacks.

  17. Overlay content execution techniques are increasingly used to hide malicious payloads.

  18. Awareness of common system targets and malware structures significantly aids malware detection.

NTLM relay attacks are back from the dead

Source: Help Net Security

Author: Help Net Security

URL: https://www.helpnetsecurity.com/2025/07/04/ntlm-relay-attacks/

ONE SENTENCE SUMMARY: NTLM relay attacks remain prevalent, simple to execute, and effective at compromising Active Directory environments, requiring proactive mitigation strategies.

MAIN POINTS:

  1. NTLM relay attacks exploit authentication exchanges without needing password cracking or weak passwords.
  2. Relay attacks often combine with authentication coercion techniques like Printer Bug or PetitPotam.
  3. SMB servers, LDAP/LDAPS services, and ADCS web enrollment are primary NTLM relay targets.
  4. SMB relay attacks can grant attackers access to sensitive shares and enable lateral movement.
  5. LDAP relay attacks exploit unenforced LDAP signing and channel binding on domain controllers.
  6. ADCS web enrollment relay attacks enable attackers to impersonate victims using malicious certificates.
  7. Microsoft is introducing mitigations such as enforced SMB signing and LDAP sealing starting Windows Server 2025.
  8. NTLM is still widely used due to legacy software hard-coded to use it instead of Kerberos.
  9. Default configurations often leave older Windows environments highly vulnerable to relay attacks.
  10. Enforcing signing, channel binding, and regularly evaluating environments are critical for defense.

TAKEAWAYS:

  1. NTLM relay attacks remain a significant threat, commonly used in real-world attacks.
  2. Authentication coercion makes relay attacks viable anytime, not relying on victim-initiated authentication.
  3. Default configurations leave many organizations vulnerable; proactive changes are necessary.
  4. Upcoming Windows Server 2025 security defaults will help, but organizations shouldn’t wait to implement mitigations.
  5. Regular security evaluations, SMB/LDAP signing enforcement, and channel binding are essential defensive practices.

We see what we expect – and miss what matters

Source: Secure by Choice

Author: Sarah Aalborg

URL: https://securebychoice.com/blog/108175-we-see-what-we-expect-and-miss-what

ONE SENTENCE SUMMARY: Forensic investigations are impacted by cognitive biases like confirmation and anchoring, requiring deliberate strategies to mitigate their influence effectively.

MAIN POINTS:

  1. Forensic analysis, despite being data-driven, is heavily influenced by cognitive biases.
  2. Human brains naturally create stories, filtering new data through existing assumptions.
  3. Confirmation bias leads investigators to focus only on evidence supporting initial theories.
  4. Anchoring bias causes undue emphasis on the first piece of evidence discovered.
  5. A Guardian-cited study found forensic experts influenced by contextual biases reached differing conclusions.
  6. Bias affects even highly experienced experts, often without their awareness.
  7. Explicitly naming biases can help teams recognize and counteract their impact.
  8. Conducting pre-mortems encourages consideration of alternative hypotheses before deep investigation.
  9. Introducing fresh perspectives can reduce anchoring effects and improve investigative accuracy.
  10. Tracking multiple scenarios and reflecting on assumptions enhances learning and accuracy in forensics.

TAKEAWAYS:

  1. Recognize that even expert investigators are vulnerable to cognitive biases.
  2. Explicitly acknowledging biases helps mitigate their negative impact.
  3. Regularly question initial assumptions and entertain multiple theories.
  4. Seek input from individuals not influenced by initial investigative contexts.
  5. Reflecting systematically on investigative processes improves future outcomes.

Cisco warns that Unified CM has hardcoded root SSH credentials

Source: BleepingComputer

Author: Sergiu Gatlan

URL: https://www.bleepingcomputer.com/news/security/cisco-removes-unified-cm-callManager-backdoor-root-account/

  1. ONE SENTENCE SUMMARY: Cisco has patched a critical backdoor vulnerability (CVE-2025-20309) in Unified Communications Manager allowing attackers remote root access.

  2. MAIN POINTS:

  3. Cisco Unified CM had a critical backdoor root account vulnerability identified as CVE-2025-20309.

  4. The vulnerability arises from static, default credentials used during development and testing.

  5. CVE-2025-20309 affects Unified CM and SME Engineering Special releases 15.0.1.13010-1 to 15.0.1.13017-1.

  6. Exploitation allows unauthenticated attackers root-level remote access to affected systems.

  7. No workarounds exist; admins must upgrade or apply the CSCwp27755 security patch.

  8. Cisco provided indicators of compromise to assist detection and response efforts.

  9. Successful exploitation creates log entries under /var/log/active/syslog/secure accessible by admins.

  10. Cisco previously experienced similar backdoor vulnerabilities in IOS XE, DNA Center, and Emergency Responder.

  11. Earlier this year, Cisco patched similar issues in Smart Licensing Utility and IOS XE devices.

  12. No current evidence indicates active exploitation or available proof-of-concept code online.

  13. TAKEAWAYS:

  14. Immediately apply the Cisco-provided security patch or upgrade to mitigate this severe vulnerability.

  15. Regularly check logs at /var/log/active/syslog/secure for suspicious root user activities.

  16. Stay vigilant for security advisories from Cisco regarding hardcoded credential vulnerabilities.

  17. Maintain awareness that even reputable products may have hidden backdoor accounts.

  18. Prioritize patch management to rapidly address high-severity vulnerabilities in critical infrastructure.