Fabio Gianotti

LogonTracer: Visualizes Suspicious Activities - Free! Who logged into the network and how? A single logon event can provide critical insights into the timeline of an attack, but without the right tools, connecting the dots is a challenge. LogonTracer makes this process easier by analyzing Windows Active Directory event logs and visualizing them as graphs. This allows security teams to identify patterns quickly. Whether it's a series of failed logins or unusual authentication requests: • Visualize logon data with Neo4j & Cytoscape • Install with Docker for easy setup • Detailed event log analysis in chronological order • Use advanced algorithms to pinpoint suspicious activity Learn more: https://lnkd.in/gd535s84 Threat hunting isn’t just about identifying a potential attack; it’s about understanding the context around it. Discover over 10+ essential data analysis techniques for effective threat hunting in my "Cyber Threat Hunt 101" YouTube series, explained simply: https://lnkd.in/gkVB6B2j Please share and subscribe if you enjoy the content! #cybersecurity #threathunting #threatdetection #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #DataAnalysis #IncidentResponse

358

12 commenti

🚨 CRITICAL ALERT: Mass exploitation of multiple Oracle E-Business Suite (EBS) vulnerabilities, including a 0-day, by Clop for data theft and extortion   Here's what you need to know:   1️⃣ Clop exploited multiple vulnerabilities in Oracle EBS which enabled them to steal large amounts of data from several victim in August 2025. 2️⃣ Clop is the actor behind prior mass exploitation, data theft, and extortion campaigns impacting customers of MOVEit and other managed file transfer solutions. They've made a lot of money over the years. 3️⃣ Clop has been sending extortion emails to several victims since last Monday. However, please note they may not have attempted to reach out to all victims yet. 4️⃣ Multiple vulnerabilities were exploited including vulnerabilities that were patched in Oracle's July 2025 update as well as one that was patched this weekend (CVE-2025-61882). 5️⃣ CVE-2025-61882 is a critical (9.8 CVSS) vulnerability that enables unauthenticated remote code execution.   ⚠️ Given the broad mass 0-day exploitation that has already occurred (and the n-day exploitation that will likely continue by other actors), irrespective of when the patch is applied, organizations should examine whether they were already compromised.   Thanks to the Oracle team for the collaboration.   🔗 Additional details from Oracle: https://lnkd.in/eFaF-hu3

550

9 commenti

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77

Cyber-spying is possible with embedded sensors in the mobile phone. For those who don't know, modern mobile devices are full of these sensors and they all look innocent. Because of their embedded mechanisms, most data is hosted locally. The most widely used of these sensors are MEMS (Micro-Electro-Mechanical Systems) based structures such as accelerometers, gyroscopes and magnetometers. As a note and an example, these sensors are usually called directly at the system level via APIs such as SensorManager (Android) or Core Motion (iOS). Third-party applications can receive hundreds of samples per second through these APIs, subject to permissions. Sensor data is usually unencrypted, processed directly in user space, and accessible to multiple applications simultaneously. If you are curious, you can check how many apps installed on your mobile device ask for this permission. With each permission, the manufacturer can access your sensor data. Keylogger? Yes, even that is possible. When typing on a mobile device, the user creates very slight tilts and movements on the surface of the device. In 2014, a concept called Touchlogger demonstrated that by analyzing only gyroscope and accelerometer data, it could predict with up to 70% accuracy which keys the user pressed on a virtual keyboard. Ambient sound listening? That is possible. Gyroscopes show a low frequency (typically 80-250 Hz) sensitivity to sound waves. This makes them low-resolution passive microphones. In 2014, researchers from Stanford University developed a system that uses gyroscope sensors in mobile devices to detect surrounding speech. Take a look at the concept of a "gyrophone". PIN attack? Yes. Mobile browsers support access to sensor data via JavaScript. This means that sensor data can be collected from a user simply by visiting a website, without the need to install an application. A 2017 study by Newcastle University showed that by collecting accelerometer and gyroscope data through a web page, 4-digit PINs can be guessed with 74% accuracy. To all this you need to add behavior patterns. If I tell you that the Pegasus spyware developed by NSO Group also accesses sensor data, I think you will understand the seriousness of the situation. Such data has been used to determine when the target person is in a meeting, how often they enter and leave a room, or even if they are asleep. The misuse of these sensors threatens not only individual privacy but also national security. In particular, surveillance of vulnerable individuals such as diplomatic officials, journalists and corporate executives through sensors on their devices poses a great risk. I suggest you take a look at this little spy data. Just as a matter of awareness, friends! ^-^/ #cybersecurity #dataprivacy #informationsecurity #privacy #technology #threatintelligence

203

9 commenti

🔐 Security programs don’t fail due to a lack of alerts — they fail when decisions get buried in noise. High-performing CISOs don’t chase every signal. They triage risk like surgeons — with clarity, intent, and speed. The real question isn’t what happened, but: 👉 What demands attention 👉 What runs itself 👉 What can be parked This clarity doesn’t come from more tools — it comes from a decision model aligned with business pressure. 🚨 Most teams escalate what’s loud. 🏛️ Mature teams escalate what can move the boardroom. While many chase false positives, top CISOs build triage layers that cut through clutter and expose real exposure paths. 🔍 High-functioning security teams do three things better: Link alerts to asset criticality — not just severity Escalate based on crown jewel impact — not noise frequency Automate only when reliability, context, and closure are guaranteed What you automate, defer, and escalate defines your operational maturity. #CyberSecurity #CISO #RiskManagement #SecurityLeadership #OperationalExcellence #ThreatIntelligence #DecisionMaking #SecurityStrategy

43

5 commenti

Public Preview – Microsoft Entra Private Access for Active Directory Domain Controllers now available✨ 🛡 Zero Trust Security – Enforces Conditional Access & MFA directly at the domain controller for Kerberos-based authentication. ⚡ Lightweight Sensor – Private Access sensor intercepts authentication, applies policies, and supports legacy protocols without code or hardware changes. 🌍 Consistent Protection – Unified enforcement across on-premises, hybrid, and remote environments with seamless user experience. 🖥 Local Performance – App traffic stays local, while authentication traffic is validated in Entra. 🔍 ITDR Enablement – Supports Identity Threat Detection & Response, blocking lateral movement and verifying every access request. 🎯 Granular Controls – SPN-level policies (e.g., MFA for file shares, step-up auth for RDP, compliant device access for SQL). 📋 Centralized Management – Configure policies in Entra admin center under Global Secure Access; dynamic updates with no restarts. 🔒 Lateral Movement Defense – Blocks RDP-in-RDP session risks without costly appliances or routing all data through cloud. ⚙ Deployment Features – Audit Mode, SPN Exclusions, Unmanaged Device Blocking, Break Glass Mode for phased rollouts. ✅ On-Premises MFA – Enforces MFA at the domain controller without extra hardware or network redesign. 📌Read More: https://lnkd.in/gyxWipbb

94