Christian Blumer

🚨 Oracle just rushed a patch for CVE-2025-61882 — a 9.8 critical flaw in E-Business Suite already exploited by Cl0p in live data theft attacks. The zero-day lets attackers seize control without a username or password. Experts warn many may already be breached. Details here ↓ https://lnkd.in/gifXEzUq

270

3 Kommentare

Microsoft has released its September security updates. This included: • 81 vulnerabilities patched. • 0 vulnerabilities with evidence of exploitation. • 9 'Critical' rated. The ASD’s ACSC encourages all users to apply the available patch updates ASAP👉 https://lnkd.in/dHpTjmk8

91

1 Kommentar

🚨 𝗪𝗲𝗮𝗽𝗼𝗻𝗶𝘇𝗲𝗱 𝗣𝘂𝗧𝗧𝗬 𝗔𝗱𝘀 𝗔𝗹𝗲𝗿𝘁 🚨 | Read more: https://lnkd.in/gqeN6eci Trojanized PuTTY downloads via Bing ads are compromising enterprise networks—stealing Kerberos tickets and moving laterally through Active Directory. Key defenses: Validate admin tools, enforce AES-only Kerberos, and monitor endpoints continuously. #CyberSecurity #InfoSec #ActiveDirectory #Kerberos #Malvertising

139

9 Kommentare

🔐 𝗠𝗼𝘀𝘁 𝗨𝘀𝗲𝗱 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗠𝗲𝗰𝗵𝗮𝗻𝗶𝘀𝗺𝘀 𝗘𝘅𝗽𝗹𝗮𝗶𝗻𝗲𝗱 🚀 Authentication is the first line of defense in cybersecurity. It ensures that only the right people — or systems — can access sensitive resources. From traditional logins to advanced token-based systems, here are the most widely used methods today: ✅ Credentials (Username/Password) The oldest and most familiar method, often strengthened with SSL encryption. ✅ SSL Certificates Provide secure, encrypted communication between client and server, verified through certificate authorities (CAs). ✅ OAuth Tokens Common in APIs and modern web apps — uses access tokens for delegated authorization without exposing user credentials. ✅ SSH Keys Widely used in secure server access; relies on key pairs (public/private) for authentication instead of passwords. 💡 Each mechanism has its strengths and weaknesses. While passwords are easy to use, they are vulnerable if not managed well. Tokens and keys, on the other hand, offer stronger security but require careful handling. 👉 As cyber threats grow, combining these methods (multi-factor authentication, certificates, and tokenization) is becoming the gold standard. 🔎 Question for you: Which authentication method do you trust most in your daily work — and why? 🔔 Follow Cyber Talks for more cybersecurity tips! #Cybersecurity #Authentication #InfoSec #DataProtection #OAuth #SSL #SSH #MFA

697

13 Kommentare

🚨 New #LockBit Variant Tagets ESXi and Linux: Critical Infrastructure at Risk. In September 2025, the LockBit group released LockBit 5.0, a new version of its #ransomware. The new variant introduces stronger obfuscation, flexible configurations, and advanced anti-analysis techniques. ⚠️ The most alarming development is the expansion to #Linux and #VMware ESXi, signaling a clear focus on server environments and critical infrastructure. Ransomware has shifted from targeting endpoints to directly disrupting core infrastructure. ❗️ A single intrusion can cause outages with severe financial and reputational impact. LockBit 5.0 comes in three builds, each optimized for its target OS. 🚨 VMware ESXi: The most critical new variant, a dedicated encryptor for hypervisors that can simultaneously disable all VMs on a host. Its CLI resembles the other builds but adds VM datastore and config targeting. See live execution: https://lnkd.in/eVy9fwfu 📌 Windows: Main variant. Runs with DLL reflection, supports both GUI and console, encrypts local and network files, removes VSS shadow copies, stops services, clears event logs, and drops ransom notes linking to live chat support. See live execution: https://lnkd.in/efDmAAUQ 📌 Linux: Console-based, replicates Windows functionality with mount point filters, post-encryption disk wiping, and anti-analysis checks such as geolocation restrictions and build expiry. See live execution: https://lnkd.in/erQugDNg 🔍 Use these TI Lookup search queries to enrich detection logic with live threat data: ESXi Lockbit 5.0: https://lnkd.in/ehTxKDS2 Linux Lockbit 5.0: https://lnkd.in/ekchCh39 Windows Lockbit 5.0: https://lnkd.in/e4mtH7bF 🚀 Strengthen resilience, protect business continuity through proactive security with #ANYRUN. #ExploreWithANYRUN #CybersecurityAwarenessMonth

99

1 Kommentar

⚠️ Netskope Windows Client Vulnerability Enables Privilege Escalation via Rogue Server | Read more: https://lnkd.in/gcN2Ssmz A serious security vulnerability in Netskope’s Windows client has been discovered that could allow attackers to escalate privileges from a low-privileged user to full system-level access. The flaw, tracked as CVE-2025-0309, affects all versions of the Netskope Windows client prior to version R129 and has prompted the company to release urgent security updates. The vulnerability centers around the Netskope client’s enrollment process; the exploit takes advantage of the communication between the low-privileged client UI process (stAgentUI) and the privileged service (stAgentSvc) that runs with SYSTEM privileges. #cybersecuritynews

394

10 Kommentare

🚨 𝗜𝘀 𝗬𝗼𝘂𝗿 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗦𝗲𝗰𝘂𝗿𝗲? Active Directory (AD) remains one of the most targeted assets by cyber attackers. From privilege escalation to password spraying, a single overlooked configuration can lead to devastating breaches. Here are the Top 10 AD Attack Methods you should know about: 1️⃣ Kerberoasting 2️⃣ Password Spraying 3️⃣ Local Loop Multicast Name Resolution (LLMNR) 4️⃣ Pass-the-hash with Mimikatz 5️⃣ Default Credentials 6️⃣ Hard-coded Credentials 7️⃣ Privilege Escalation 8️⃣ LDAP Reconnaissance 9️⃣ BloodHound Reconnaissance 🔟 NTDS.dit Extraction Why this matters: AD attacks often go undetected until it’s too late. Regular audits, patching, and implementing strong authentication measures are crucial to prevent compromise. 💬 Which of these attack methods do you think is the hardest to defend against? Let’s discuss in the comments! 🔔 Follow e-Learn Cyber Security for more cybersecurity tips! #CyberSecurity #ActiveDirectory #ThreatHunting #IdentitySecurity #PrivilegeEscalation #PasswordSecurity #RedTeam

117

6 Kommentare

🚨 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝘂𝗽𝗱𝗮𝘁𝗲: Drift OAuth compromise goes deeper than you thought. When Google’s Threat Intelligence Group first disclosed UNC6395’s attack on Salesforce via Drift OAuth tokens, the scope looked serious but contained. 𝗢𝘂𝗿 𝗿𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝘁𝗲𝗮𝗺 𝗮𝘁 𝗔𝘀𝘁𝗿𝗶𝘅 𝗵𝗮𝘀 𝗻𝗼𝘄 𝘂𝗻𝗰𝗼𝘃𝗲𝗿𝗲𝗱 𝗮 𝗺𝘂𝗰𝗵 𝗯𝗿𝗼𝗮𝗱𝗲𝗿 𝗰𝗮𝗺𝗽𝗮𝗶𝗴𝗻: • Drift Email OAuth in Google Workspace was also compromised for email exfiltration • A malicious AWS account was probing for exposed S3 buckets • 108 new IP-based IoCs have been identified, expanding the attacker’s footprint This campaign is a wake-up call: OAuth token abuse isn’t just a Salesforce problem, it’s a multi-cloud problem. Read the full analysis and get the IoCs your team needs here: https://lnkd.in/d9jjE9Rc

91

19 Kommentare

[TRAINING] Attacking Web Applications 🏴 Web applications represent a large part of the attack surface exposed on the Internet. With technology constantly evolving, new vulnerabilities and exploitation methods continue to emerge, making intrusion stages more complex. To address this, our ninjas have designed an intensive 5-day training course based on their experience in #pentesting. What you will learn: ▪️ Understand the security mechanisms of modern web applications. ▪️ Refine your intrusion methods to exploit the most complex vulnerabilities. ▪️ Master the specifics of languages and frameworks such as Java, PHP, Python, and ASP.NET. This 35-hour training course includes more than 30 practical exercises to help you quickly develop your skills. 🗓️ 17 to 21 November 2025 💰 €4500 per person 🎯 Penetration testers and developers with experience in web intrusion techniques ℹ️ https://lnkd.in/evdSDSAk Ready to take your skills to the next level? Join us and become an expert in web application auditing. 🔗 To find out more and register, contact us at [email protected]

31

🚨 HTTP/2 “MadeYouReset” (CVE-2025-8671): Large-Scale DDoS Enabler A newly disclosed HTTP/2 flaw, MadeYouReset, can render servers unavailable for legitimate users by bypassing defenses that stopped 2023’s “Rapid Reset.” Researchers showed six ways to trigger server-initiated RST_STREAM resets—no client cancel required—letting attackers effectively sidestep rate-limits and force near-unbounded concurrency with minimal effort. What’s affected (confirmed): Netty (CVE-2025-55163) Apache Tomcat (CVE-2025-48989) F5 BIG-IP (CVE-2025-54500) h2o, swift-nio-http2 Why this matters: Targets a core internet protocol (HTTP/2) → broad blast radius Asymmetric cost: low attacker effort, high victim resource burn Organizations that felt “protected” against Rapid Reset may now be exposed Actions now: Review vendor advisories and patch immediately (HTTP/2 stacks, load balancers, proxies). Monitor abnormal concurrency/stream patterns; add temporary rate-limits while permanent fixes roll out. Validate WAF/edge rules against server-side reset abuse scenarios. #HTTP2 #DDoS #CVE20258671 #AppSec #NetSec #IncidentResponse #BlueTeam

23