Nick Lockard, OSCP, CEH, CND

Step two of ransomware: maintaining access, aka Persistence. Once attackers are in, they don’t stop. They escalate privileges, dump creds, map the network, and burrow deeper. Huntress SOC Analyst Dani D. breaks down how they do it, and how defenders can spot the signs.

475

6 Comments

Before you detonate… have you even looked at the file? Static indicators can tell you what it is... and sometimes even who made it. 🔍 🧠 PE headers, strings, and metadata reveal the story before execution. This is your first line of defense in malware analysis. Don’t skip it. Learn it. Use it. 📌 Follow us for more cybersecurity tips.  #CyberDefenders #MalwareAnalysis #ThreatHunting #SOC

44

The Splunk Threat Research Team is releasing v4.0 of Splunk Attack Range, an open source project that allows security teams to spin up a detection development environment to emulate adversary behavior and use the generated telemetry data to build detections in Splunk. https://bit.ly/4lucvkM

26

“Friends don’t let friends expose RDP.” Take it from Dray A., Senior Manager of Huntress Hunt & Response. Open RDP was the number one threat Huntress saw in 2025. Attackers hammer it day and night, looking for weak creds. Once they’re in, they move fast—dumping creds, staging persistence, pivoting to other systems. We’ve posted about this more than 150 times this year for a reason. If you’re still exposing 3389 to the internet, now’s the time to fix it. Close it down. Put it behind a VPN or firewall. Use account lockouts and strong creds. Check your external services regularly.

146

9 Comments

“Security frameworks don’t fail. People fail to use them correctly.”   ↳ 78% of organizations compliant "on paper" still suffer breaches.   ↳ Standards like NIST, IEC 62443, and NCA OTCC-1 aren't flawed. Yet over 60% of their implementations stay stuck in PDFs, not practices. ⇨ Why read further?   - See common compliance errors clearly   - Learn from an authentic client scenario   - Turn frameworks into effective security actions Compliance without real-world capability is merely paperwork.    ↳ Especially in Operational Technology (OT), the gap isn't just technical it's deeply cultural. 📖 REAL-WORLD CLIENT STORY:    ↳ We recently partnered with a major manufacturing organization, responsible for multiple critical facilities. Their documentation for IEC 62443 compliance was outstanding:   ✅ Clearly defined OT network segmentation   ✅ Fully documented cybersecurity roles   ✅ Asset inventory marked as comprehensive But our on-site validation revealed something very different:    ⇨ Asset Inventory: Managed via quarterly Excel updates, creating significant blind spots between reviews.    ⇨ Network Segmentation: Logical on paper, but physically nonexistent, with IT and OT systems openly interconnected.    ⇨ Privileged Account Management: Shared passwords were common practice, significantly compromising accountability. ↳ The standard wasn't faulty the implementation was. 🛑 PROBLEM:    ↳ Many organizations mistakenly equate passing audits with real security. True security requires continuous testing, clear ownership, and constant refinement. 💡 INSIGHT:  ↳ Standards mark your start not your finish line.  Real security comes when frameworks become daily practices:   ⇨ Clearly map security controls to operational tasks.    ⇨ Regularly perform realistic security drills.    ⇨ Embed clear security accountability throughout the organization. 🔄 MINDSET SHIFT:    ↳ From: "We passed the audit." ⇨ To: "We confidently handle real-world incidents."   ↳ From: "The policy covers it." ⇨ To: "Our team actively practices security daily." ✅ KEY TAKEAWAYS:    ↳ Move from checklist compliance to actionable, daily security behaviors.    ↳ Validate controls through realistic exercises not just paper-based audits.    ↳ Develop a culture where compliance naturally follows from proactive security. 📩 Ready to turn standards into practical security?    ↳ DM me for our Frameworks-to-Action Toolkit, designed specifically to help OT and cyber leaders bridge the compliance-practice gap effectively. 👇 Join the discussion: Have you witnessed frameworks being misapplied? Share your insights! #CyberResilience #SecurityFrameworks #IEC62443 #NISTCSF #GRC #OTSecurity #CyberStrategy #OperationalSecurity #Leadership #SecurityCulture

413

21 Comments

MITRE ATT&CK v18 lands today with a groundbreaking update to ATT&CK's threat detection taxonomy. This restructuring—announced during ATT&CKcon by MITRE ATT&CK defense lead Lex Crumpton—will help cybersecurity teams better connect the dots across adversary behaviors, enabling more effective and informed defenses. Read more on Inside Cybersecurity: http://spklr.io/6047BzpN3 #ATTACKcon #Cybersecurity #ThreatInformedDefense #MITREattack

328

6 Comments

🚨 𝗧𝗼𝗽 𝟭𝟬 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗻𝗰𝗶𝗱𝗲𝗻𝘁𝘀 that Cyber Security News ® have reported Yesterday! 🚨 Cyber threats continue to evolve, targeting vulnerabilities across various systems. Here's a roundup of the most critical incidents reported yesterday by Cybersecurity News: 𝟭. 𝗖���𝗦𝗔 𝗔𝗱𝗱𝘀 𝗜𝘃𝗮𝗻𝘁𝗶 𝗘𝗻𝗱𝗽𝗼𝗶𝗻𝘁 𝗠𝗮𝗻𝗮𝗴𝗲𝗿 𝗕𝘂𝗴𝘀 𝘁𝗼 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗲𝗱 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗖𝗮𝘁𝗮𝗹𝗼𝗴 Three critical vulnerabilities in Ivanti Endpoint Manager have been added to CISA’s Known Exploited Vulnerabilities catalog due to active exploitation. 𝟮. 𝗩𝗲𝗿𝗮𝗖𝗼𝗿𝗲 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗔𝗰𝘁𝗶𝘃𝗲𝗹𝘆 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗲𝗱 𝗯𝘆 𝗧𝗵𝗿𝗲𝗮𝘁 𝗔𝗰𝘁𝗼𝗿𝘀 Two vulnerabilities in VeraCore software are being actively exploited by the XE group, posing risks to supply chains. 𝟯. 𝗡𝗼𝗿𝘁𝗵 𝗞𝗼𝗿𝗲𝗮𝗻 𝗛𝗮𝗰𝗸𝗲𝗿𝘀 𝗪𝗲𝗮𝗽𝗼𝗻𝗶𝘇𝗲 𝗭𝗜𝗣 𝗙𝗶𝗹𝗲𝘀 𝗳𝗼𝗿 𝗠𝗮𝗹𝗶𝗰𝗶𝗼𝘂𝘀 𝗣𝗼𝘄𝗲𝗿𝗦𝗵𝗲𝗹𝗹 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 APT37, a North Korean hacking group, is leveraging ZIP files to execute malicious PowerShell scripts in targeted attacks. 𝟰. 𝗟𝗮𝗿𝗮𝘃𝗲𝗹 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗘𝗻𝗮𝗯𝗹𝗲𝘀 𝗔𝗿𝗯𝗶𝘁𝗿𝗮𝗿𝘆 𝗝𝗮𝘃𝗮𝗦𝗰𝗿𝗶𝗽𝘁 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 A critical flaw (CVE-2024-13918) in the Laravel framework allows attackers to execute malicious JavaScript code on websites using affected versions. 𝟱. 𝗠𝗼𝘅𝗮 𝗜𝗻𝗱𝘂𝘀𝘁𝗿𝗶𝗮𝗹 𝗘𝘁𝗵𝗲𝗿𝗻𝗲𝘁 𝗦𝘄𝗶𝘁𝗰𝗵𝗲𝘀 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗘𝘅𝗽𝗼𝘀𝗲𝘀 𝗔𝗱𝗺𝗶𝗻 𝗔𝗰𝗰𝗲𝘀𝘀 A flaw in Moxa’s PT series switches enables attackers to bypass authentication and gain administrative access. 𝟲. 𝗙𝗮𝗸𝗲 𝗕𝗶𝗮𝗻𝗟𝗶𝗮𝗻 𝗥𝗮𝗻𝘀𝗼𝗺 𝗖𝗹𝗮𝗶𝗺𝘀 𝗗𝗲𝗹𝗶𝘃𝗲𝗿𝗲𝗱 𝘃𝗶𝗮 𝗣𝗵𝘆𝘀𝗶𝗰𝗮𝗹 𝗟𝗲𝘁𝘁𝗲𝗿𝘀 US organizations have reported receiving fraudulent physical letters claiming to be from the BianLian ransomware group. 𝟳. 𝗠𝗲𝗱𝘂𝘀𝗮 𝗥𝗮𝗻𝘀𝗼𝗺𝘄𝗮𝗿𝗲 𝗔𝘁𝘁𝗮𝗰𝗸𝘀 𝗦𝘂𝗿𝗴𝗲 𝗯𝘆 𝟰𝟮% 𝘄𝗶𝘁𝗵 𝗡𝗲𝘄 𝗧𝗲𝗰𝗵𝗻𝗶𝗾𝘂𝗲𝘀 Medusa ransomware has seen a sharp increase in activity, employing advanced tools and double extortion methods. 𝟴. 𝗦𝘁𝗿𝗲𝗹𝗮 𝗦𝘁𝗲𝗮𝗹𝗲𝗿 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 𝗧𝗮𝗿𝗴𝗲𝘁𝘀 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗢𝘂𝘁𝗹𝗼𝗼𝗸 𝗨𝘀𝗲𝗿𝘀 The Strela Stealer malware campaign is actively harvesting login credentials from Microsoft Outlook users worldwide. 𝟵. 𝗣𝘆𝗣𝗜 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 𝗧𝗮𝗿𝗴𝗲𝘁𝘀 𝗘𝘁𝗵𝗲𝗿𝗲𝘂𝗺 𝗪𝗮𝗹𝗹𝗲𝘁𝘀 𝘃𝗶𝗮 𝗗𝗲𝘃𝗲𝗹𝗼𝗽𝗲𝗿𝘀 A malicious PyPI package named 'set-utils' has been discovered stealing Ethereum private keys from developers. 𝟭𝟬. 𝗠𝗼𝗼𝗻𝘀𝘁𝗼𝗻𝗲 𝗦𝗹𝗲𝗲𝘁 𝗗𝗲𝗽𝗹𝗼𝘆𝘀 𝗖𝘂𝘀𝘁𝗼𝗺 𝗥𝗮𝗻𝘀𝗼𝗺𝘄𝗮𝗿𝗲 𝗨𝘀𝗶𝗻𝗴 𝗖𝗿𝗲𝗮𝘁𝗶𝘃𝗲 𝗧𝗮𝗰𝘁𝗶𝗰𝘀 North Korean threat actor Moonstone Sleet is deploying advanced custom ransomware in targeted operations globally. 🔒 Stay informed and protect your systems! Read More Articles: www.cybersecuritynews.com & www.gbhackers.com #CyberSecurity #ThreatIntel #Ransomware #Vulnerabilities

411

11 Comments

A vulnerability in a Signal-based enterprise messaging app could expose plaintext usernames and passwords via an unauthenticated memory dump. Now added to CISA’s KEV list, GreyNoise has observed early exploit attempts and is actively tracking related scanning. Full analysis + malicious IPs: https://lnkd.in/e4gsXVe7 #Cybersecurity #ThreatIntel #GreyNoise #CVE202548927 #Signal

23

2 Comments

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical security flaw impacting the Sudo command-line utility for Linux and Unix-like operating systems to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. https://lnkd.in/gsdrayXU

74

2 Comments

CISA warns of state-backed attacks on Signal, WhatsApp, Telegram users... Although end-to-end encryption can secure messages on their journey between two devices, and prevents snooping by anyone intercepting your communications, it doesn't prevent anyone who has access to the device itself from reading your messages. Read more in my article on the Bitdefender blog: https://lnkd.in/eteG-tF4 #cybersecurity #privacy

134

23 Comments

🚨 ReliaQuest’s Threat Research team supported the FBI and Cybersecurity and Infrastructure Security Agency (CISA) in their action against LummaC2—a highly active info-stealing malware targeting systems via spearphishing links, attachments, and deceptive CAPTCHAs. The LummaC2 report includes IOCs, tactics, and actionable recommendations to mitigate this evolving threat: 👉 Use least privilege, separate user/privileged accounts, and audit/remove inactive accounts. 👉 Implement phishing-resistant MFA, allowlisting, and keep systems patched. 👉 Monitor logs, detect unusual API usage, and analyze anomalies. 👉 Use segmentation (e.g., DMZ or VPC) to isolate sensitive systems and restrict command-line access. 🔗 Read the report: https://bit.ly/43EkR2O #ReliaQuest #MakeSecurityPossible #FBI #CISA #Cybersecurity

98

2 Comments

New joint CISA/NSA/CCCS report confirms that PRC state-sponsored actors are using the BRICKSTORM backdoor to maintain longterm, covert access to VMware vCenter and ESXi systems across government and IT infrastructure. The operation relies on advanced tradecraft—including nested TLS, DoH, rogue VMs, and snapshot theft—to evade detection and extract credentials while remaining persistently embedded. Authors/Researchers: Cybersecurity and Infrastructure Security Agency National Security Agency Canadian Centre for Cyber Security Alert: https://lnkd.in/e4qrGB9w Analysis: https://lnkd.in/eE6c_mzg PDF Report: https://lnkd.in/emSwAxTh #CISA #BRICKSTORM #Cyber #Threats #StateSponsored #CTI #InfoSec #VMware #Malware #ESXi

54

1 Comment

Most cyber teams stop at alerts. But real investigators dig deeper. Computer Hacking Forensic Investigator program is built for professionals who reconstruct what happened, preserve what matters, and deliver reports that hold up in legal, executive, and crisis-response environments. With over 68 hands-on labs, 30+ forensic modules, and scenarios mapped to real-world attack surfaces from Windows, Linux, and macOS to IoT, mobile, cloud, and dark web, this certification turns practitioners into specialists. If you’re ready to move from incident response to investigative authority, this is your path. To know more, check out the link: https://buff.ly/zmHge4H #DigitalForensics #Cybersecurity #ComputerHacking #Forensics #DarkWebForensics #IoTForensics #CloudForensics #CyberForensicExpert #ForensicAnalyst #ComputerForensics #CybersecurityTraining #CybersecurityCareers #ECCouncil #CHFI

44

2 Comments

Your SOC isn’t short on tools, it’s short on time. Between chasing false positives and stitching together siloed alerts, your analysts are drowning. What if your team could: - Detect threats as they move, before they escalate - Reconstruct full attack sessions in minutes, not hours - See into encrypted traffic without breaking it - Cut investigation time by over 50% That’s the power of Network Detection and Response (NDR), especially when it’s built with real-time analytics and full network visibility. Read the blog to discover how NetWitness NDR is helping SOC teams respond faster, investigate deeper, and stay ahead of advanced threats. - https://lnkd.in/gynrZvzy ?trk=netwitness-social-media-organic-webpage&utm_source=netwitness&utm_medium=social-media-organic&utm_campaign=gl-26-q3-unified-security-linkedIn-post&utm_content=webpage #CyberSecurity #NDR #SOCEfficiency #ThreatDetection #NetWitness #NetworkSecurity #CyberThreatDetection #IncidentResponse

24

🚨 CRITICAL ALERT: n8n RCE Vulnerability A critical vulnerability (CVE-2025-68613, CVSS 9.9/10.0) was disclosed affecting the n8n workflow automation platform, allowing attackers to execute arbitrary code on the underlying server via expression injection in workflow definitions. Due to the potential for full instance takeover, data exposure, and lateral movement, immediate patching is required. Roi Nisimi explains recommended action and how Orca can help 👇 https://lnkd.in/gWGyREXm

60