The Cyber Threat Perspective

In this week's review Roasting 0ktapus: The phishing campaign going after Okta identity credentials Advanced BEC Scam Campaign Targeting Executives on O365 The Rise of LNK Files (T1547.009) and Ways To Detect Them Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: h...

It's an unfortunate truth that we see these common high risk findings time and time again on internal pentests. We find these issues on super-maximum secured environments as well in less hardened environments. The end result though is the same. Tune in to learn more about these common high risk findings and most importantly, how to mitigate them for free! Blog: https://offsec.blog/ Youtube: h...

In this week's review Hackers Breach LastPass Developer System to Steal Source Code You Can’t Audit Me: APT29 Continues Targeting Microsoft 365 | Mandiant The GitLab 2022 Global DevSecOps Survey Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: https://offsec.blog/...

In order to stay relevant and up-to-date with new techniques and tools, it requires a certain amount of focus day after day, week after week, year after year. That focus being constant improvement. If we, as pentesters, don’t get better, we can’t help businesses defend better. So that’s what this podcast is about. Constant improvement and showing that off to the world. We are going to talk about W...

In this week's review Cleartext Shenanigans: Gifting User Passwords to Adversaries With NPPSPY Realtek SDK Vulnerability Exposes Routers InfoSec Handlers Diary Blog - SANS Internet Storm Center CVE-2022-27255 - Realtek eCos SDK SIP ALG buffer overflow Clop Ransomware Gang Breaches Water Utility, Just Not the Right One https://twitter.com/malwrhunterteam/status/1559244860636413952?s=20&t=i...

This podcast is a discussion about 4 Common Pentesting Mistakes that we oursleves have made and have seen other pentesters make. Hopefully, the dialog around these mistakes and how we go about solving them, helps you not make them yourself or to realize them and recover from them quickly. Read the associated blog post here: https://offsec.blog/its-a-trap-avoid-these-4-common-pentesting-mistakes/ B...

In this week's review BumbleBee Roasts Its Way to Domain Admin SMS & Voice Phishing Attacks https://www.twilio.com/blog/august-2022-social-engineering-attack https://blog.cloudflare.com/2022-07-sms-phishing-attacks/ https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https...

Brad and Spencer discuss a common finding on internal penetration tests. Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer&apos...

In this week's review Large-Scale AiTM Attack targeting enterprise users of Microsoft email services Deception at a scale Initial Access Brokers Are Key to Rise in Ransomware Attacks Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: ht...

This podcast is a discussion about the 2022 Verizon Data Breach Investigations Report and some of our key takeaways. From the Executive Summary of the DBIR:  As introduced in the 2018 report, the DBIR provides “a place for security practitioners to look for data-driven, real-world views on what commonly befalls companies with regard to cybercrime.” For this, our 15th anniversary installment, we co...

In this week's review IPFS The New Hotbed of Phishing How Threat Actors Are Adapting to a Post-Macro World Palo Alto 2022 Incident Response Threat Report Fewer Ransomware Victims Pay As Medium Ransom Falls in Q2 2022 Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog...

In this week's review:  Microsoft resumes default blocking of Office macros after updating docs https://docs.microsoft.com/en-us/deployoffice/security/internet-macros-blocked A potentially dangerous macro has been blocked BlackCat ransomware attacks not merely a byproduct of bad luck 'AIG' Threat Group Launches With Unique Business Model Blog: https://offsec.blog/ Youtube: https://w...

In this week's review: Microsoft DOES plan to work on blocking internet macros by default in Office , their pause is apparently temporary The DFIR Report - SELECT XMRig FROM SQLServer Hive ransomware gets upgrades in Rust From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCC...

In this week's review Microsoft Rolls Back Decision to Block Office Macros By Default 😢 Possible APT29/Ransomware Groups Use of Brute Ratel C4 When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors Reversing Malware Also How is APT 29 Successful with This Phishing Technique Raspberry Robin/QNAPWorm Raspberry Robin gets the worm early Microsoft finds Raspberry Robin w...

In this week's review Rise of LNK (Shortcut files) Malware LockBit 3.0 Released Now With Bug Bounty Program CISA Says PwnKit Exploited in the Wild Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpo...

In this week's review: New NTLM Relaying Attack via DFSCoerce Ransomware Potential for OneDrive & SharePoint Files Keeping PowerShell: Security Measures to Use and Embrace Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://w...

In this week's review: The rise of BlackCat (ALPHV) ransomware Microsoft Analysis of BlackCat AdvIntel Analysis of BlackCat Ransomware Group Debuts Searchable Victim Data LockBit 2.0: How This RaaS Operates and How to Protect Against It Translating Saitama's DNS tunneling messages - SANS Internet Storm Center Public Travis CI Logs (Still) Expose Users to Cyber Attacks Blog: https://offse...

In this week's review: A DFIR Report with no Ransomware and no Cobalt Strike Path Traversal & MOTW Bypass - DIAGCAB Windows Zero-day aka "Dogwalk" Linux version of Black Basta ransomware targets VMware ESXi servers TA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt) Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twit...

In this week's review: Microsoft Diagnostics Tool Remote Code Execution Zero Day New Windows Search zero-day added to Microsoft protocol nightmare Vendor Refuses to Remove Backdoor Account That Can... Over 3.6 million exposed MySQL servers on IPv4 and IPv6 |... APTs Overwhelmingly Share Known Vulnerabilities Rather Than Attack O-Days Blog: https://offsec.blog/ Youtube: https://www.youtube.com...

The sky IS NOT falling with this one. Is it important? Yes. Does it highlight an area that's under-researched and likely contains additional attack vectors and techniques? Absolutely. Resources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190 https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e https://www.huntress.com/blog/microsof...

In This Weeks Review PDF Malware Is Not Dead Yet Detecting & Preventing Rogue Azure Subscriptions Python and PHP Library Updated with 'Extra' Features by a "Security Researcher" 2022 Verizon Data Breach Investigations Report Zoom: Remote Code Execution with XMPP Exploit released for critical VMware auth bypass bug Blog: https://offsec.blog/ Youtube: https://www.youtube.com/...

In This Weeks Review Gootloader & Gootkit Analysis by DFIR Report and Red Canary Authenticated PetitPotam Lives On (CVE-2022-26925) The Hunter Becomes the Hunted: Evicting the Adversary Spoofing SaaS Vanity URLS for Social Engineering Attacks Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: ht...

In This Weeks Review Threat Actor using Windows Event Logs for "fileless" Malware CVE-2022-1388 - F5 BIG-IP PoC Released CVE-2021-22600 - Privilege Escalation Bug In The Linux Kernel CVE-2022-26925 - A Windows LSA Spoofing Vulnerability (PetitPotam) CVE-2022–26923 - Another ADCS Domain Privilege Escalation Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAF...

In this week's review: Detecting SharpHound using Decoys UNC3524: Eye Spy on Your Email | Mandiant The New Initial Access Trend: ZIPs, ISOs & LNKs Unauthenticated RCE in F5 BIG-IP CVE-2022-1388 Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: https://offsec.bl...

There exists a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings). Thanks to the research and open source tools of several researchers, it's now trivial to elevate to SYSTEM on most Windows Operating Systems. Resources: https://github.com/Dec0ne/KrbRelayUp https://googleprojectzero.blogspot.com/2021/10/using-ker...