Eran Lipkin

Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers

17

‏2‏ ‏תגובות‏

☑️  Maybe you’re just a #Stalker? Using #OSINT tools does not automatically mean you are practicing OSINT. 🕵 The difference lies in the intent, the methodology, and the respect of legal and ethical boundaries. Tools do not define the practice, how and why they are used does. 👉Follow Epieos for more OSINT stories, techniques, tips and tricks.

28

A Gmail address isn't just contact details. It's a gateway to an entire digital footprint 🫆🔍 Our latest guide breaks down 4 Gmail OSINT techniques every investigator should master: → Fraud Detection → Threat Intelligence → Due Diligence → Digital Evidence Real case studies included. Read here 👉🏼 https://lnkd.in/ea3Z-bDb

88

‏1‏ ‏תגובה‏

A fast-evolving Android spyware campaign known as “ClayRat,” initially targeting Russian users but now spreading far beyond, has produced more than 600 samples and 50 droppers in just three months. According to Zimperium’s Zlabs observations, ClayRat is distributed via phishing sites and Telegram channels posing as popular apps such as TikTok, YouTube, and Google Photos, to trick users into sideloading infected APKs. https://lnkd.in/gmXEEimC

12

‏1‏ ‏תגובה‏

𝗪𝗲𝗲𝗸𝗹𝘆 𝗧𝗵𝗿𝗲𝗮𝘁 𝗔𝗱𝘃𝗶𝘀𝗼𝗿𝘆. ⚠  𝑾𝒆𝒆𝒌𝒍𝒚 𝑻𝒉𝒓𝒆𝒂𝒕 𝑨𝒅𝒗𝒊𝒔𝒐𝒓𝒚: 𝑻𝒐𝒑 𝑪𝒚𝒃𝒆𝒓 𝑻𝒉𝒓𝒆𝒂𝒕𝒔 𝒇𝒓𝒐𝒎 𝑴𝒂𝒓𝒄𝒉 30 – 𝑨𝒑𝒓𝒊𝒍 06, 2025 ⚠ 🛡️Weekly Threat Advisory delivers a comprehensive overview of emerging 𝑻𝒉𝒓𝒆𝒂𝒕 𝑨𝒄𝒕𝒐𝒓𝒔, 𝑴𝒂𝒍𝒘𝒂𝒓𝒆 𝒔𝒕𝒓𝒂𝒊𝒏𝒔, 𝑹𝒂𝒏𝒔𝒐𝒎𝒘𝒂𝒓𝒆 𝒊𝒏𝒄𝒊𝒅𝒆𝒏𝒕𝒔, 𝑪𝒂𝒎𝒑𝒂𝒊𝒈𝒏𝒔, 𝑪𝑽𝑬𝒔, 𝒂𝒏𝒅 𝑷𝒉𝒊𝒔𝒉𝒊𝒏𝒈 𝑲𝒊𝒕𝒔 𝒕𝒂𝒓𝒈𝒆𝒕𝒊𝒏𝒈 𝒗𝒂𝒓𝒊𝒐𝒖𝒔 𝒔𝒆𝒄𝒕𝒐𝒓𝒔. 🛡️ Adversaries are actively exploiting 𝒓𝒆𝒄𝒆𝒏𝒕 𝒗𝒖𝒍𝒏𝒆𝒓𝒂𝒃𝒊𝒍𝒊𝒕𝒊𝒆𝒔, 𝒖𝒔𝒊𝒏𝒈 𝒔𝒐𝒑𝒉𝒊𝒔𝒕𝒊𝒄𝒂𝒕𝒆𝒅 𝒑𝒉𝒊𝒔𝒉𝒊𝒏𝒈 𝒕𝒂𝒄𝒕𝒊𝒄𝒔, 𝒂𝒏𝒅 𝒅𝒆𝒑𝒍𝒐𝒚𝒊𝒏𝒈 𝒂𝒅𝒂𝒑𝒕𝒊𝒗𝒆 𝒎𝒂𝒍𝒘𝒂𝒓𝒆 to bypass security controls. 🛡️Ransomware campaigns are growing in scale and complexity, with attackers leveraging double extortion and supply chain infiltration for maximum disruption. 🛡️At the same time, phishing kits are advancing, enabling widespread credential harvesting and unauthorized system access. 🛡️To effectively mitigate these risks, security teams must stay ahead with proactive patching, robust threat hunting practices, and improved detection capabilities to fortify their defenses. 👉 Based on continuous research, intelligence & hunting efforts we have identified active & trending adversaries of the last week. Please find the top 💡 Threat Actor 💡 Malware 💡 Ransomware 💡 Campaign 💡 Impacted Vulnerability 💡 Phishing Kit https://lnkd.in/gcJQanND #threathunting #threatintelligence #cybersecurity #threatactor #malware #CVE #campaign #ransomware #phishing #threatadvisory

13

🔐 The EU PQC Migration Roadmap is out! 🗓 By 31.12.2026, Member States should have: ✔️ Defined initial national PQC roadmaps ✔️ Started pilots for medium- and high-risk use cases ✔️ Taken key first steps - including:  • Stakeholder engagement  • Mapping cryptographic dependencies  • Quantum risk analysis  • Cryptographic asset management  • Awareness & communication programs  • Transition timelines & implementation plans But this does not stop at government level. 📣 All organizations under NIS2 are expected to align with this approach - especially those relying on public key infrastructure. 🎯 Focus is on crypto agility, lifecycle management, and impact-based prioritization. 💡 “Medium” and “high” quantum risk use cases are determined by:  • The sensitivity of data  • The lifespan of the system or asset  • The impact of a potential quantum attack For example: Long-term confidentiality needs = medium risk High-impact systems with >8-year lifespan = high risk 🕒 Next key milestones: 2030 and 2035 If you are not mapping cryptographic assets and engaging stakeholders today - you are already behind. Need guidance on how to start your roadmap, run pilots, or prioritize assets? Let's talk. #PQC #CryptoAgility #QuantumResilience #EUCyber

24

After lengthy late-night discussions with Cédric Bonhomme on sightings and KEV formats, we produced a first draft of a generic format for Known Exploited Vulnerabilities (KEV).  Initially, we considered extending GCVE BCP-05 using the CVE Record format. However, we ultimately concluded that it may be more appropriate to define a standalone format, allowing sources to publish their KEV data independently. Feel free to comment on the discourse link below. KEV Assertion Format – Draft Specification (potential BCP?) This format describes a generic KEV (Known Exploited Vulnerability) assertion format. The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended. 🔗 https://lnkd.in/eaBUFXie GCVE-EU CIRCL (Computer Incident Response Center Luxembourg) CVE Program

145

‏11‏ ‏תגובות‏

The Endor Labs Security Research team discovered and responsibly disclosed a high-severity vulnerability in Koa, an npm package with ~6M weekly downloads. CVE-2026-27959 Severity: CVSS 7.5 (High) Affected: Koa ≤2.16.3 and 3.0.0–3.1.1 Fixed: Koa 2.16.4 and 3.1.2 Full details and technical analysis: https://lnkd.in/gs6Qq8pe #KOA #SecurityResearch

17

Initial Drafts of 1.1 OpenID Federation Specs The OpenID Federation 1.0 specification contains two kinds of functionality: - Protocol-independent federation functionality used for establishing trust and applying policies in multilateral federations, and - Protocol-specific federation functionality that can be used by OpenID Connect and OAuth 2.0 deployments to apply the protocol-independent federation functionality. At the urging of implementers and working group members, I’ve created new specifications splitting the two kinds of functionality apart. I’m pleased to announce that initial editor’s drafts of both split specifications are now available for your reviewing pleasure. They are: - OpenID Federation 1.1 (protocol-independent) - OpenID Connect Federation 1.1 (protocol-specific) Together, they are equivalent to OpenID Federation 1.0, by design. No functionality is added or removed from that present in 1.0. Rather, it’s factored into protocol-independent and protocol-specific specifications. Reading every line of the 1.0 spec to perform the split had the additional benefit of identifying editorial improvements to apply to the 1.0 spec before it becomes final. I intentionally started the split while 1.0 is still in the 60-day review to become final exactly so improvements identified could be applied both to the original and the split specs. As background for this work, several people had suggested splitting the two apart into separate specifications – particularly once the core federation functionality started being used with protocols other than OpenID Connect, such as with digital credentials. There was a discussion about this possibility at the Internet Identity Workshop in the Fall of 2024. During the April 2025 Federation Interop event at SUNET, there was consensus to do the split after finishing OpenID Federation 1.0. Starting the work to perform the split was proposed to both Pacific-friendly and Atlantic-friendly OpenID Connect working group calls in December 2025 after the 60-day review had started, with no opposition to proceeding. Now it’s your turn! Please review both OpenID Federation 1.0 and the OpenID Federation 1.1 and OpenID Connect Federation 1.1 specifications derived from it. Please send any issues found to the OpenID Connect Working Group mailing list, or file GitHub issues in the respective repositories: OpenID Federation 1.0 repository, OpenID Federation 1.1 repository, and OpenID Connect Federation 1.1 repository. Please review for both the readability and correctness of the specs and whether you believe aspects of the split should have been done differently. In particular, please consider the examples in Appendix A, which contain both protocol-independent and protocol-specific content. Hopefully this split will make the OpenID Federation content easier to navigate and understand for those using it and considering it. Happy New Year 2026! See https://lnkd.in/gA7UYYwM for links.

73

‏1‏ ‏תגובה‏

🚨 Security Advisory: CGGMP21 Vulnerabilities Patched Two vulnerabilities were recently disclosed in CGGMP21, a threshold ECDSA protocol widely used in MPC systems. Both issues are fully patched in Dfns’ implementation. ➡️ 𝟵𝟵% 𝗼𝗳 𝗰𝗹𝗶𝗲𝗻𝘁𝘀 𝘄𝗲𝗿𝗲 𝗻𝗲𝘃𝗲𝗿 𝗲𝘅𝗽𝗼𝘀𝗲𝗱, since our default protocol, KU23, is unaffected. ➡️ For clients still using CGGMP21, patches have been deployed. No operations or funds were impacted. 🔍 What happened? Researchers from Fireblocks (Arik Galansky) and Dfns (Antoine Urban) found two weaknesses in CGGMP21 that, under specific conditions, could weaken its security guarantees. The flaws did 𝘯𝘰𝘵 break the cryptography itself, and thanks to early disclosure, they were fixed quickly and safely. ✅ Bottom line for Dfns clients: 𝘆𝗼𝘂𝗿 𝗸𝗲𝘆𝘀 𝗮𝗻𝗱 𝘁𝗿𝗮𝗻𝘀𝗮𝗰𝘁𝗶𝗼𝗻𝘀 ��𝗲𝗺𝗮𝗶𝗻 𝘀𝗲𝗰𝘂𝗿𝗲. ⚠️ For developers using our open-source library, we’ve published a full advisory with clear steps: ⏫ Upgrade to cggmp24 v0.7 for the strongest guarantees 🩹 Or apply the short-term fix by upgrading to cggmp21 v0.6.3 Security is a continuous process. Discovery, disclosure, and remediation are part of a shared responsibility across the industry. This coordinated response shows the MPC ecosystem is maturing: vulnerabilities were identified, disclosed responsibly, and patched quickly by multiple providers. Dfns will continue investing in MPC research and collaboration. Advancing security requires collective effort, which is why we actively support initiatives like the MPC Alliance and Lockness by LF Decentralized Trust. 🔗 Read the full advisory by our researcher Denis Varlakov, with context, technical details, and recommended actions: https://lnkd.in/ea3zvdtm

27

‏1‏ ‏תגובה‏

🚨 New Cato CTRL threat brief: React2Shell (CVE-2025-55182) has emerged as a critical vulnerability affecting React Server Components (RSC). Since the vulnerability disclosure on December 3, Cato CTRL has observed 10,000+ React2Shell attacks mostly originating from Bulgaria, Germany, Laos, Netherlands, Poland, and United States. The top affected sectors include manufacturing, healthcare, technology, construction, and consumer goods. The good news: ✔️Cato’s own SASE architecture was not affected ✔️ Early React2Shell variants were blocked by existing Cato IPS signatures ✔️On the day each new PoC was released, dedicated Cato IPS signatures for React2Shell variants were deployed across the Cato SASE Cloud Platform Read full disclosure in this blog 👉 https://bit.ly/4azA9da

51

In this Root Causes Podcast episode, Jason Soroko and I define Cryptographic Bill of Materials (CBOM), which is more than a list of your cryptography and where it is. A CBOM need also include information about the PQC readiness of environments, availability of updates, and the importance of secrets.  Audio: https://lnkd.in/gJC5y3at Video: https://lnkd.in/gHuXd69B

22

‏2‏ ‏תגובות‏

I’ve been having many conversations about SBOMs vs component inventories. Requirements affecting the financial sector, notably PCI-DSS and DORA, mandate an “inventory of.. 3rd party software components” (PCI) or the capability to “track the usage of… third party libraries.” (DORA). So what’s the difference? The simple way to think about it as that all *good* SBOMs are inventories or component lists, but not all component lists are SBOMs. Section 10(j) of EO 14028 defines an SBOM as a “formal record containing the details and supply chain relationships of various components used in building software.” This means that an SBOM should capture some details about the dependency structure, and it must be represented in a way that supports automation. Functionally? It’s a graph, and it’s in a widely used, machine-readable format (CycloneDX or SPDX). SBOMs are structured to support trust, provenance, and action. The trust derives from the generation process—something that’s explicitly captured in the draft CISA Minimum Elements. Being able to trace provenance can derive from a number of features, including producing a hash of the original software code, if the SBOM generator had access to it. Alternatively, an SBOM generation tool can offer real evidence that observed bits in a binary correlate to the component building blocks. Most importantly, an SBOM is designed to be used, not just as a static inventory. When properly assembled and maintained, it can feed directly into vulnerability management, incident response, license tracking, and a host of other risk management tools, as well as overall metrics on software freshness and quality. It goes beyond “what do I have” and helps answer “what am I exposed to”? By explicitly being defined as a dynamic feature (“if you update your code, update your SBOM”), SBOMs are inherently temporal, tracking specific releases and often lifecycle phases. This is why that can be so powerful for things like incident response and forensic risk management. We are also in a world where quality SBOM tools exist. SBOM tools can always produce inventories, but not vice versa. Every SBOM generator has to be a very good inventory tool. But most inventory tools aren’t prepared to make the security, provenance, and legal claims that SBOMs require. Later this week, I’ll do a deeper dive into what we’re seeing around the CRA draft around vulnerability handling, and the language around the identification of software components vs. SBOMs.

96

‏5‏ ‏תגובות‏