31Wedge

Source: BleepingComputer

Author: Bill Toulas

URL: https://www.bleepingcomputer.com/news/security/new-blacksanta-edr-killer-spotted-targeting-hr-departments/

ONE SENTENCE SUMMARY:

A Russian-speaking actor spear-phished HR with ISO “resumes,” deploying stealthy loaders and BlackSanta to disable EDR using BYOD drivers.

MAIN POINTS:

1. Russian-speaking threat actor targeted HR departments for over a year with malware.
2. Initial access likely used spear-phishing emails directing victims to cloud-hosted ISO files.
3. Malicious ISOs impersonated resumes and were hosted on services like Dropbox.
4. ISO contained LNK masquerading as PDF, PowerShell script, image, and ICO file.
5. LNK executed PowerShell to extract steganographic payload from image into memory.
6. ZIP download included legitimate SumatraPDF plus malicious DWrite.dll for DLL sideloading.
7. Malware fingerprinted hosts, contacted C2, and evaded sandboxes, VMs, and debuggers.
8. Windows Defender was weakened, disk-write tests performed, and payloads ran via process hollowing.
9. BlackSanta EDR killer reduced alerts, altered Defender exclusions, and lowered telemetry/submission settings.
10. BYOD drivers RogueKiller and IObitUnlocker enabled kernel-level unlocking and termination of security processes.

TAKEAWAYS:

1. HR-focused lures exploiting resume workflows remain highly effective for initial compromise.
2. ISO/LNK plus PowerShell and steganography form a stealthy, memory-resident infection chain.
3. DLL sideloading with trusted executables helps attackers blend malicious code into legitimate processes.
4. EDR killers increasingly rely on kernel-level BYOD techniques to reliably disable defenses.
5. Strong opsec and resilient infrastructure can keep campaigns undetected even when C2 is intermittently unavailable.

Source: BleepingComputer

Author: Sergiu Gatlan

URL: https://www.bleepingcomputer.com/news/microsoft/microsoft-to-enable-hotpatch-security-updates-by-default-in-may/

ONE SENTENCE SUMMARY:

Microsoft will enable Windows hotpatch updates by default via Autopatch from May 2026, accelerating Intune-managed device compliance while allowing opt-out controls.

MAIN POINTS:

1. Hotpatch security updates become default for eligible Intune and Microsoft Graph-managed devices in May 2026.
2. Delivery will occur through Windows Autopatch for Windows and Microsoft 365 enterprise update management.
3. Prior restart grace periods of 3–5 days left organizations exposed before forced compliance.
4. Microsoft expects 90% patch compliance time to be reduced by roughly half.
5. Default hotpatching affects all eligible devices, with additional IT controls arriving in April 2026.
6. Tenant-level settings can disable hotpatching or selectively enable it per-device.
7. Admins can verify readiness using Intune’s Hotpatch quality updates report.
8. April 2026 acts as the baseline update required for May hotpatch eligibility.
9. Opt-out controls go live April 1, 2026 within Intune Tenant administration settings.
10. Administrators have until May 11, 2026 before hotpatch updates begin deploying.

TAKEAWAYS:

1. Faster patching reduces exposure windows created by delayed user restarts.
2. Testing readiness in April is critical to avoid unexpected May rollout issues.
3. Centralized tenant toggles provide governance while still supporting targeted exceptions.
4. Autopatch’s scale and maturity suggest operational viability for large enterprise fleets.
5. Planning should include change management for restart-less updates and updated compliance reporting.

Source: SC Media

Author: unknown

URL: https://news.google.com/rss/articles/CBMimwFBVV95cUxPSnlRT2F6dm5ndW0xYW5wUUhrMlFMX2lTLW53cmE0cVlwSGVPSEYtUWZUVk9CdEhuSW5yb0J0TW0tWDViVk1SWUlTRG0xejZ0anRPQUs0M2NDR3RYZTU3Y1czdU9MNGVfMHZ5MlNURkl4OUZpRGlLUmpDNjJlT3J2bDNBclZVODhGV2xaNDlsMjNtdWtnWFNKRVZsYw?oc=5

ONE SENTENCE SUMMARY:

SoundCloud’s breach highlights that rapid detection, credential containment, transparent communication, and post-incident hardening define effective modern incident response.

MAIN POINTS:

1. Early anomaly detection depends on high-fidelity logging, alerting, and clear ownership.
2. Containment should prioritize revoking sessions, tokens, and API keys immediately.
3. Forensic triage requires preserving evidence while restoring critical services safely.
4. Credential exposures demand forced resets, MFA rollout, and monitoring for credential stuffing.
5. Third-party integrations can amplify impact, so inventory and rotate shared secrets quickly.
6. Least-privilege access limits blast radius when attacker reaches internal systems.
7. Clear user communications reduce confusion and enable faster protective actions.
8. Cross-functional war rooms align security, engineering, legal, and support during response.
9. Postmortems must translate findings into measurable controls and tracked remediation work.
10. Continuous testing via tabletop exercises and drills improves speed and decision quality.

TAKEAWAYS:

1. Build playbooks that treat token revocation and key rotation as first-class actions.
2. Invest in telemetry that shortens time-to-detect and time-to-contain.
3. Assume password reuse; combine resets with MFA and anti-stuffing protections.
4. Maintain an accurate secrets and integration inventory to reduce response chaos.
5. Turn lessons into engineering backlog items with deadlines, owners, and verification.

Source: dmarcian

Author: Steven Iacoviello

URL: https://dmarcian.com/dangling-dns-cname-records/

ONE SENTENCE SUMMARY:

Dangling CNAMEs can delegate SPF to attackers, enabling DMARC-passing spoofing; maintain DNS hygiene, monitor sources, and alert on changes.

MAIN POINTS:

1. CNAME records alias one domain to another canonical domain in DNS.
2. Organizations delegate SPF or DKIM via CNAMEs to third-party vendors for easier management.
3. SPF delegation through CNAME lets the target domain owner control authorized sending IPs.
4. Dangling CNAMEs persist after services retire, pointing to nonexistent or abandoned resources.
5. Domain ownership changes can let attackers weaponize dangling CNAME targets for malicious hosting.
6. Abusers can publish their own SPF under the acquired CNAME target and send authorized mail.
7. DMARC p=reject won’t stop aligned SPF mail if attackers control the delegated SPF path.
8. Regularly review vendors and delete obsolete CNAMEs and other unnecessary DNS records.
9. Examine MAIL FROM subdomains for SPF delivered via CNAME, removing unused delegations.
10. DMARC reporting and alerting reveal anomalies like new sources, 100% SPF alignment, 0% DKIM.

TAKEAWAYS:

1. Removing unused CNAMEs prevents domain-takeover abuse paths in DNS and email authentication.
2. Delegated SPF via CNAME is powerful; treat the CNAME target as a critical trust boundary.
3. DMARC visibility can expose dangling-CNAME exploitation patterns before major damage occurs.
4. Automated monitoring for new subdomains and DNS changes speeds detection and response.
5. Alerting integrations (email, Slack, Teams, webhooks) help operationalize continuous DNS hygiene.

Source: Only 30 minutes per quarter on cyber risk: Why CISO-board conversations are falling short | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4141873/only-30-minutes-per-quarter-on-cyber-risk-why-ciso-board-conversations-are-falling-short.html

ONE SENTENCE SUMMARY:

Report finds board-CISO cybersecurity discussions are brief, passive, and insufficiently forward-looking, especially regarding AI-driven threats and strategic risk decisions.

MAIN POINTS:

1. Enterprise boards increasingly include cybersecurity, yet conversations remain superficial and time-boxed.
2. Typical CISO-board interaction lasts 30 minutes per quarter, limiting meaningful engagement.
3. Only 30% of boards rate relationships with CISOs as strong and collaborative.
4. Most CISOs report quarterly, but updates are often routed through committees.
5. Limited follow-through makes cybersecurity feel like a briefing rather than exploration.
6. Extended airtime correlates with strategic dialogue on trade-offs, risk tolerance, and decisions.
7. Directors understand regulatory trends and current initiatives better than emerging AI threats.
8. AI amplifies attack sophistication while creating new high-value assets and loss scenarios.
9. Less than half of boards join simulations or tabletop exercises, keeping oversight passive.
10. Effective CISOs tie cyber narratives to business risk, ROI, and enterprise strategy.

TAKEAWAYS:

1. Prioritize longer, discussion-oriented board sessions to enable strategic cybersecurity decision-making.
2. Translate cyber metrics into business-impact narratives about risk tolerance and trade-offs.
3. Provide forward-looking analysis on AI-enabled threats and AI model/asset protection.
4. Increase board participation in exercises to build experiential understanding of incident dynamics.
5. Adopt a business-leader posture to shape the cyber agenda around enterprise risks.

Source: Ryan McGeehan

Author: unknown

URL: https://r10n.com/mvp-cyber-risk-quantification/

ONE SENTENCE SUMMARY:

A minimum viable, panel-elicited probabilistic method builds annual cyber loss distributions and tail scenarios for iterative, calibration-driven security prioritization.

MAIN POINTS:

1. Produces incident definition, annual loss distribution, tail-loss taxonomy, and review cadence with scoring loop.
2. Requires no platforms, minimal time, and works without historical loss datasets.
3. Starts by defining “incident” using operational triggers like on-call pages or IR activation.
4. Elicits P50/P90 incident costs, then fits a parametric severity distribution (often lognormal).
5. Forecasts annual incident counts via P50/P90 to create a frequency distribution.
6. Combines frequency and severity with Monte Carlo sampling to generate annual loss distribution.
7. Includes comprehensive cost components such as churn, delivery disruption, sales friction, and regulatory delays.
8. Uses anonymous-first elicitation and re-elicitation to reduce anchoring, dominance, and bias.
9. Constructs MECE taxonomy for >P90 “heavy hitter” scenarios, with controlled “other” category usage.
10. Links every mitigation initiative to scenario classes and updates probabilities/impacts over time.

TAKEAWAYS:

1. Treat risk quant as an updateable forecast artifact, not a claim of truth.
2. Fast elicitation plus simple modeling enables early prioritization without becoming a data project.
3. Tail-loss scenario thinking drives actionable alignment between mitigations and largest potential damages.
4. Bias-resistant group forecasting improves calibration and decision quality over ad-hoc judgment.
5. Quarterly refreshes and scoring create a feedback loop that continuously refines assumptions.

Source: Lares

Author: Andrew Heller

URL: https://www.lares.com/blog/ttxttp-faq/

ONE SENTENCE SUMMARY:

Integrating tabletop exercises with TTP replays replaces assumed readiness with quantified control effectiveness, aligning people, process, and technology for defensible cyber resilience.

MAIN POINTS:

1. Confidence in incident readiness often exceeds real-world decision accuracy during crises.
2. Traditional security testing stays siloed, creating gaps between plans and technical reality.
3. Tabletop Exercises evaluate coordination, process maturity, and decisions under pressure.
4. TTX outcomes depend on unverified assumptions about control behavior and tool performance.
5. TTP Replays execute real adversary behaviors safely in production to validate detections.
6. Running only TTX yields theoretical response plans detached from actual telemetry.
7. Running only TTP Replay produces technical findings lacking executive context and escalation paths.
8. Integrated TTX+TTP links scenarios to measured outcomes, enabling evidence-backed improvements.
9. Quantitative metrics include MTTD, MTTR, alert fidelity, and false negative rate.
10. A five-level maturity model progresses from compliance confidence to continuous validation aligned with CTEM.

TAKEAWAYS:

1. Capture technical assumptions during tabletops, then test them via adversary emulation playbooks.
2. Prioritize detection engineering using replay-exposed visibility gaps rather than MITRE “coverage” targets.
3. Validate ROSI by proving tool effectiveness, enabling tuning, vendor remediation, or budget reallocation.
4. Strengthen board oversight using objective control-performance data instead of theoretical response narratives.
5. Support regulatory timelines like SEC 4-day disclosure by combining fast detection validation and materiality decision rehearsal.

Source: Feedly Blog

Author: Dave Johnson

URL: https://feedly.com/ti-essentials/posts/structured-analysis-for-small-cti-teams-using-ai-to-reinforce-tradecraft

ONE SENTENCE SUMMARY:

Small CTI teams can use prompt-driven LLM workflows to apply structured analytic techniques quickly, improving rigor, consistency, and defensibility.

MAIN POINTS:

1. Structured analytic techniques are taught widely but frequently skipped under operational time pressure.
2. Collaboration-centric SATs clash with remote, understaffed CTI team realities.
3. Accepting reporting at face value increases bias risk and weakens conclusions.
4. LLMs can act as sparring partners that challenge assumptions, not replace analysts.
5. AI assistance can surface assumptions, organize evidence, and generate alternative hypotheses.
6. Salt Typhoon case study illustrated uncertainty hidden beneath confident attribution narratives.
7. Key assumptions checks can be accelerated via prompts producing assumption tables and gaps.
8. ACH prompts help eliminate weaker hypotheses by structuring evidence against alternatives.
9. Devil’s advocacy prompts generate credible critiques to harden assessments against stakeholder challenges.
10. Pre-mortems reconstruct failure paths to reveal missing evidence, dependencies, and overconfidence drivers.

TAKEAWAYS:

1. Lightweight SATs can be completed in roughly 20 minutes using repeatable prompt templates.
2. Separate sessions per problem reduces anchoring and cross-contamination bias in analysis.
3. Grounding outputs in curated intelligence and citations improves defensibility and traceability.
4. Using structured outputs increases clarity, consistency, and auditability of analytic reasoning.
5. Some structured analysis is better than none when resources prevent full team collaboration.

Source: Cloud Security Alliance

Author: unknown

URL: https://cloudsecurityalliance.org/articles/securing-the-modern-cloud-5-best-practices-for-protecting-multi-cloud-workloads

ONE SENTENCE SUMMARY:

Comprehensive cloud security requires CNAPP-based workload protection across multi-cloud environments using continuous scanning, container lifecycle security, compliance automation, and centralized visibility.

MAIN POINTS:

1. CSPM alone misses workload-layer risks; workloads require dedicated security controls.
2. Dynamic, distributed architectures expand attack surface across VMs, containers, databases, serverless functions.
3. Multi-cloud deployments demand consistent visibility and protections across disparate providers.
4. Workload integrity underpins operational resilience, not only data protection.
5. CNAPP platforms unify prevention, detection, and response for vulnerabilities, misconfigurations, insecure APIs.
6. Continuous vulnerability scanning must replace periodic assessments in fast-moving cloud deployments.
7. Contextual enrichment enables risk-based prioritization beyond raw CVSS severity.
8. Agentless scanning uses CSP APIs for scalable posture insights without agent management overhead.
9. Container security should span build-to-runtime, integrating into CI/CD and registry scanning.
10. Automated compliance monitoring maintains audit readiness amid rapid cloud configuration changes.

TAKEAWAYS:

1. Shift from infrastructure-only posture management to full workload security coverage.
2. Favor continuous, context-driven vulnerability management to surface truly exploitable “toxic combinations.”
3. Use agentless approaches for broad, low-friction multi-cloud workload visibility.
4. Embed container security into DevOps from build through production runtime.
5. Centralize exposure management to create a single source of truth for collaboration and prioritization.

Source: Help Net Security

Author: Mirko Zorz

URL: https://www.helpnetsecurity.com/2026/03/02/ciso-security-debt-report/

ONE SENTENCE SUMMARY:

Veracode’s 2026 report shows growing, aging application security backlogs, urging board-level governance, risk-based prioritization, and automation to reduce exploitable exposure.

MAIN POINTS:

1. Study analyzed 1.6 million applications using SAST, DAST, SCA, and pen testing.
2. Security debt means known vulnerabilities unresolved for more than one year.
3. Organizations with security debt rose to 82% in 2026 from 74%.
4. Critical security debt increased to 60% of organizations from 50%.
5. Legacy and business-critical systems slow fixes due to change risk and dependency.
6. Wysopal advocates board-level KPIs, quarterly targets, and governed risk acceptance.
7. Suggested policy: fix high-risk vulnerabilities before release, especially crown-jewel applications.
8. Overall flaw prevalence remained high at 78% of applications in 2026.
9. Highly severe and exploitable vulnerabilities grew to 11.3% from 8.3%.
10. Remediation half-life improved slightly to 243 days; third-party critical debt stayed high at 66%.

TAKEAWAYS:

1. Treat security debt like financial debt with executive oversight and measurable reduction goals.
2. Prioritize exploitable, high-impact vulnerabilities over raw vulnerability counts.
3. Focus remediation on crown-jewel applications using fast lanes and strict release gates.
4. Embed automation and AI-assisted fixes into developer workflows to maintain velocity.
5. Strengthen supply-chain governance via dependency visibility, update cadences, and ownership clarity.

Source: Threat Intelligence Blog | Flashpoint

Author: Flashpoint

URL: https://flashpoint.io/blog/what-to-know-about-the-notepad-supply-chain-attack/

ONE SENTENCE SUMMARY:

CVE-2025-15556 let attackers hijack Notepad++ updates via missing signature checks, enabling Lotus Blossom backdoors, persistence, and data theft.

MAIN POINTS:

1. Vulnerability resides in Notepad++ WinGUP updater lacking installer signature integrity verification.
2. Hosting-provider compromise enabled supply-chain tampering beyond simple coding mistakes.
3. Attackers intercepted WinGUP update requests and redirected them to malicious infrastructure.
4. MitM techniques and DNS cache poisoning facilitated redirection to attacker-controlled servers.
5. Trojanized update.exe installers were delivered while appearing as legitimate software patches.
6. Lotus Blossom campaign operated July–October 2025 across three evolving attack chains.
7. Early chains deployed Cobalt Strike beacons using NSIS installers and rotating C2 URLs.
8. Final chain installed Chrysalis backdoor via BluetoothService.exe, log.DLL, and shellcode.
9. Mapped ATT&CK techniques include DLL hijacking, registry run keys, services, and process injection.
10. Recommended defenses include patching to v8.9.1+, hunting TTPs, monitoring domains, and hardening endpoints.

TAKEAWAYS:

1. Prioritize upgrading Notepad++ to v8.9.1+ to enforce signature verification.
2. Treat software supply-chain risk as infrastructure-dependent, not only code-dependent.
3. Hunt for persistence artifacts like suspicious DLL loads, run keys, and new services.
4. Strengthen network controls against redirect-based delivery using domain monitoring and blocking.
5. Use MITRE ATT&CK mappings to guide detection engineering and proactive threat hunting.

Source: The Hacker News

Author: info@thehackernews.com (The Hacker News)

URL: https://thehackernews.com/2026/02/google-disrupts-unc2814-gridtide.html

ONE SENTENCE SUMMARY:

Google and partners disrupted UNC2814’s China-linked espionage campaign using Google Sheets C2 backdoor GRIDTIDE across governments and telecoms worldwide.

MAIN POINTS:

1. Google, Mandiant, and partners dismantled suspected China-nexus UNC2814 infrastructure.
2. Confirmed breaches impacted at least 53 organizations across 42 countries.
3. Additional suspected infections span more than 20 other nations.
4. Tracking since 2017 revealed SaaS API calls used as disguised command-and-control.
5. GRIDTIDE backdoor abuses Google Sheets API to blend C2 within legitimate traffic.
6. Malware supports file transfer and arbitrary shell command execution on compromised systems.
7. Initial access likely involves exploiting web servers and edge systems, still under investigation.
8. Lateral movement utilized service accounts and SSH within victim environments.
9. LotL binaries enabled reconnaissance, privilege escalation, and persistence via systemd service xapt.
10. SoftEther VPN Bridge established encrypted outbound connectivity, consistent with other Chinese groups’ tactics.

TAKEAWAYS:

1. SaaS platforms can be repurposed as stealthy C2 channels via legitimate APIs.
2. Edge appliances remain high-risk entry points due to exposure and weak detection coverage.
3. Persistence commonly leverages native services (e.g., systemd) to survive reboots and scrutiny.
4. Telecom and government sectors face sustained, global-scale espionage with high evasion capability.
5. Large disruptions may be temporary; defenders should expect rapid attacker reconstitution efforts.

Source: The Red Canary Blog: Information Security Insights

Author: Nick Weber

URL: https://redcanary.com/blog/security-operations/saas-session-integrity/

ONE SENTENCE SUMMARY:

Strong MFA secures login, but portable SSO sessions remain hijackable; continuous session validation mitigates cookie and token replay attacks.

MAIN POINTS:

1. Confusing secure authentication with secure access creates a dangerous post-login blind spot.
2. FIDO2, device trust, UEBA, and conditional access harden the IdP login “front door.”
3. SAML assertions or OIDC tokens are handed to service providers to enable SSO.
4. Service providers mint session cookies after validation, ending IdP involvement.
5. Stolen session cookies grant access because possession effectively equals authentication.
6. Information-stealer malware commonly exfiltrates browser cookie jars from compromised endpoints.
7. Device-bound IdP sessions don’t automatically bind downstream SaaS sessions like AWS or Salesforce.
8. HTTP and federation standards make bearer cookies/tokens portable by design, limiting native defenses.
9. DPoP/token binding can reduce replay risk, but SaaS support remains sparse.
10. Defense-in-depth requires shorter TTLs, IP pinning, anomaly detection, and real-time session revocation.

TAKEAWAYS:

1. Treat session integrity as a separate control plane from login assurance.
2. Reduce attacker dwell time by tightening service-provider session lifetimes for critical apps.
3. Constrain replay usefulness by forcing application access through VPN/SSE-controlled IP ranges.
4. Detect hijacks by correlating IdP “known good” IPs with service-provider session telemetry in a SIEM.
5. Prioritize vendors implementing Shared Signals Framework for continuous access evaluation and rapid session revocation.

Source: How to prevent business email compromise | CSO Online

Author: unknown

URL: https://www.huntress.com/business-email-compromise-guide/how-to-prevent-business-email-compromise

ONE SENTENCE SUMMARY:

Business email compromise uses targeted social engineering to steal money or data, countered by MFA, verification workflows, monitoring, training, and incident response.

MAIN POINTS:

1. BEC relies on persuasion, not malware, making it harder for scanners to catch.
2. Attackers research staff and processes, sometimes hijacking vendor threads to blend in.
3. Common lures include fake invoices, “CEO” urgency, and payroll or bank-detail changes.
4. Absence of links/attachments shifts defense toward identity controls and human verification.
5. Enforcing MFA blocks most credential-stuffing attempts targeting email accounts.
6. DMARC, DKIM, and SPF checks reduce spoofing; block look-alike domains and mismatched reply-to.
7. Continuous security awareness training and simulations improve reporting and reduce successful replies.
8. Dual-approval thresholds for wire transfers prevent single-user mistakes from causing losses.
9. Help desk must use out-of-band identity proofing before resets to stop impersonation.
10. Detection hinges on anomalies: odd timing, payment reroutes, risky mailbox rules, and impossible-travel logins.

TAKEAWAYS:

1. Prioritize layered defenses because one convincing email can trigger massive financial loss.
2. Build “verify before you pay” procedures into finance and vendor-management workflows.
3. Monitor identity and mailbox behaviors continuously to catch takeovers early.
4. Maintain a rapid BEC playbook: recall funds, secure accounts, preserve logs, investigate endpoints.
5. Combine ITDR, awareness training, and EDR for prevention, detection, and containment across the attack chain.

Source: It’s time to rethink CISO reporting lines | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4136293/its-time-to-rethink-ciso-reporting-lines.html

ONE SENTENCE SUMMARY:

Most CISOs still report to IT, risking conflicts of interest; influence, independence, and emerging digital-risk models may reshape governance.

MAIN POINTS:

1. Benchmark data shows 64% of CISOs report into IT, mainly CIO/CTO.
2. Only 11% of CISOs report directly to the CEO, limiting executive independence.
3. Smaller shares report to CFO, CRO, legal counsel, or other business roles.
4. Reporting lines are slowly shifting, with dotted-line influence sometimes outweighing hierarchy.
5. Security under CIO perpetuates a legacy view of cybersecurity as technical, not enterprise risk.
6. Incentives clash: CIOs optimize efficiency while CISOs advocate spending to reduce risk.
7. Availability goals can conflict with patching and downtime required for secure operations.
8. IT delivery incentives can starve security resourcing for privacy-by-design and secure projects.
9. Moving reporting to legal or finance may weaken essential alignment between CISO and IT execution.
10. Analysts argue IT reporting is a governance anti-pattern that filters risk and weakens escalation.

TAKEAWAYS:

1. Prioritize CISO independence to ensure unfiltered risk visibility and board-level accountability.
2. Align incentives so security decisions reflect risk appetite, not IT cost or delivery metrics.
3. Ensure CISOs are involved early and empowered, regardless of formal org chart placement.
4. Expect regulators to scrutinize reporting structures, especially in heavily regulated sectors.
5. Consider CDRO-style models treating digital risk as a board-level domain beyond IT.

Source: The Hacker News

Author: info@thehackernews.com (The Hacker News)

URL: https://thehackernews.com/2026/02/identity-prioritization-isnt-backlog.html

ONE SENTENCE SUMMARY:

Prioritize identity work by contextual exposure—controls, hygiene, business impact, and intent—focusing on toxic combinations that drive nonlinear breach risk today.

MAIN POINTS:

1. Traditional ticket-style prioritization fails in environments with many non-human, unonboarded identities.
2. Identity risk emerges from combined control posture, hygiene, business context, and intent.
3. Controls should be treated as risk signals, not binary configured/not configured checkboxes.
4. Authentication and session protections meaningfully change exposure for sensitive identities.
5. Credential and secret management failures amplify compromise likelihood and persistence.
6. Authorization, auditing, and secure SSO flow handling reduce lateral movement opportunities.
7. Hygiene gaps like local, orphan, dormant, and unmanaged NHI accounts create systemic weakness.
8. Business criticality, data sensitivity, and trust-path blast radius determine real-world impact.
9. Intent signals identify active misuse even when credentials and access look legitimate.
10. Nonlinear “toxic combinations” demand urgent remediation over numerous low-context findings.

TAKEAWAYS:

1. Shift focus from closing findings to shrinking the exposure surface across trust paths.
2. Weigh missing MFA differently for privileged, business-critical identities than low-impact accounts.
3. Treat ownership and lifecycle clarity as core security controls for both humans and NHIs.
4. Elevate incidents when anomalous activity appears alongside weak controls or poor hygiene.
5. Use contextual scoring to sequence remediation where one fix removes multiple chained risks.

Source: The Red Canary Blog: Information Security Insights

Author: Matt Graeber

URL: https://redcanary.com/blog/threat-detection/entra-id-oauth-attacks/

ONE SENTENCE SUMMARY:

Red Canary models an Entra ID OAuth consent attack using ChatGPT, outlining investigative questions, required AuditLogs, and remediation strategies.

MAIN POINTS:

1. Threat research pivots from observed OAuth attacks to anticipate evolving adversary techniques.
2. Hypothetical Entra ID scenario uses ChatGPT to gain Microsoft Graph email access.
3. A non-admin user consented to Mail.Read, offline_access, profile, and openid permissions.
4. The event includes precise timestamp, tenant, user, app IDs, and source IP.
5. ChatGPT service principal matched the legitimate OpenAI application, not an impersonator.
6. Mail.Read is highlighted as a frequently abused permission prompting investigation.
7. Investigation aims to confirm user intent and possible coercion into granting consent.
8. Authorization questions assess whether email-reading access is appropriate for the app.
9. Tenant governance concerns include whether the application is sanctioned internally.
10. Correlated Log Analytics AuditLogs required: “Consent to application” and “Add service principal.”

TAKEAWAYS:

1. Treat high-impact OAuth permissions like Mail.Read as investigation triggers even for known apps.
2. Validate application authenticity and publisher identity to detect lookalike OAuth abuse.
3. Determine user intent and potential social engineering behind non-admin consent actions.
4. Use CorrelationId to link consent events with service principal creation for complete timelines.
5. Enforce tenant sanctioning and approval workflows to reduce risky third-party OAuth access.

Source: TrustedSec

Author: Carlos Perez

URL: https://trustedsec.com/blog/building-a-detection-foundation-part-1-the-single-source-problem

ONE SENTENCE SUMMARY:

Incident response experience reveals a recurring pattern: organizations overtrust “telemetry” that proves incomplete, misleading, and insufficient under pressure.

MAIN POINTS:

1. Field observations from incident response highlight consistent failures in security visibility.
2. Tabletop exercises repeatedly expose gaps between perceived and actual monitoring coverage.
3. Collected telemetry often looks comprehensive until real attackers stress it.
4. Hidden assumptions about logging create blind spots during investigations.
5. Detection confidence frequently exceeds evidence quality and completeness.
6. Operational reality shows some critical events are never captured or retained.
7. Response teams commonly discover missing context when reconstructing timelines.
8. Measurement of security posture is skewed by unvalidated data sources.
9. Overreliance on dashboards can mask telemetry brittleness and collection failures.
10. Patterns across cases suggest telemetry programs need continuous verification, not faith.

TAKEAWAYS:

1. Validate monitoring with realistic exercises rather than trusting tool outputs.
2. Prioritize completeness, integrity, and retention of logs for investigatory usefulness.
3. Challenge assumptions about what is actually being captured across environments.
4. Use incident learnings to iteratively harden telemetry collection and coverage.
5. Treat visibility as an engineering problem requiring testing, maintenance, and accountability.

Source: CISO Tradecraft® Newsletter

Author: CISO Tradecraft

URL: https://cisotradecraft.substack.com/p/why-your-perimeter-is-a-lie-and-your

ONE SENTENCE SUMMARY:

Security must shift from perimeter tools to continuous, data-centric visibility, governance, and masking to withstand AI-accelerated threats.

MAIN POINTS:

1. Perimeter-focused “outside-in” defenses fail when attackers move at AI speed.
2. Data-centric protection treats sensitive information as the primary asset needing direct safeguards.
3. “Radio Shacking” infrastructure fragments data across clouds, SaaS, and ad-hoc storage choices.
4. Data sprawl creates too many owners, weak oversight, and inconsistent accountability.
5. Shared responsibility means cloud providers secure uptime, while customers alone secure their data.
6. Data discovery is never finished; it must continuously re-identify sensitive data everywhere.
7. Effective discovery targets content across structured, unstructured, and messaging channels.
8. Test and QA environments commonly expose unencrypted backups and real sensitive test datasets.
9. Masking and obfuscation “neuter” non-production data, reducing breach impact and compliance scope.
10. AI amplifies outcomes; poor permissions and hygiene make mistakes faster and more damaging.

TAKEAWAYS:

1. Spend initial CISO effort on mapping data locations and access before buying “silver bullet” tools.
2. Treat stale, ownerless data as high-risk and prioritize deletion alongside protection.
3. Automate detection of over-permissioned files to shrink organizational blast radius quickly.
4. Replace real customer data in dev/test with masked equivalents to eliminate “dirty secret” exposure.
5. Monitor and protect data flows through APIs and partners, not only data stored at rest.

Source: Tenable Blog

Author: Antoine Cauchois

URL: https://www.tenable.com/blog/active-directory-dynamic-objects-stealthy-threat

ONE SENTENCE SUMMARY:

Active Directory dynamic objects enable stealthy attacks by self-deleting without tombstones, leaving only confusing artifacts and requiring real-time detection.

MAIN POINTS:

1. Dynamic objects use a TTL timer to self-destruct via the AD garbage collector.
2. Expired dynamic objects bypass recycle bin and tombstones, eliminating directory-side forensic metadata.
3. Deletion timing may lag up to 15 minutes, briefly enabling live inspection opportunities.
4. entryTTL and msDS-Entry-Time-To-Die jointly represent countdown and absolute expiration.
5. TTL limits are governed by msDS-Other-Settings, including minimum and default lifetimes.
6. Attackers can evade MAQ evidence by creating self-deleting dynamic computer accounts.
7. primaryGroupID can reference a dynamic group, yielding invisible membership and later corruption.
8. Orphan SIDs persist in ACLs, including AdminSDHolder, polluting Tier-0 permissions visibility.
9. Dynamic GPOs can execute via malicious gPCFileSysPath, then vanish leaving broken gPLink traces.
10. Entra Connect may miss dynamic deletions, leaving orphaned, functional cloud users indefinitely.

TAKEAWAYS:

1. Favor in-flight detection over post-mortems because directory evidence can fully disappear.
2. Monitor and alert on creation of objects with entryTTL or msDS-Entry-Time-To-Die set.
3. Reduce attack surface by setting ms-DS-MachineAccountQuota to zero where feasible.
4. Hunt for inconsistencies: unresolved SIDs, broken gPLinks, corrupted primaryGroupID references.
5. Validate hybrid identity hygiene by detecting and remediating Entra ID orphans from dynamic objects.