Category Archive
Detection
53 reports·All intelligence
Detection engineering — YARA, Sigma, and hunt logic turned from raw intelligence into rules you can deploy.
Showing 1–24 of 53 reports
Trusted Notifications, Untrusted Instructions: Close the Email Content Gap
Cisco Talos reports phishing carried by legitimate order notifications and delivery reports. Practical controls for email inspection, callback verification and response.
BRONZE SANDCASTLE: Hunt the DLL Load Chain, Not the Trusted Executable
Sophos details BRONZE SANDCASTLE DLL sideloading and memory-resident payloads. Practical hunting and response priorities for lean security teams.
One Stolen Identity, Several SaaS Platforms: Respond Beyond the Mailbox
A Sophos case connects vishing, password recovery and a device-backed session to SharePoint downloads and a ServiceNow export. A practical cross-SaaS response plan.
Siemens Software Center ClickFix Attacks: Hunt Beyond the Trusted Signature
Siemens confirms active DLL-sideloading attacks. Update Software Center, investigate unexpected signed copies, and correlate process paths, persistence and network evidence.
PEERSTITCH: Recover the Management Trust, Not Just the Firewall
PEERSTITCH research highlights the recovery gap after firewall-management compromise: patch the entry point, investigate managed devices, and replace exposed trust material.
CikaBika Bot: Detect the Document-to-Discord Attack Chain
CikaBika Bot turns a document lure into Discord-based remote control. Practical detection priorities for lean security teams, from shortcut execution to outbound service access.
ConnectWise Cloud Backup Incident: Revocation Is Not Tenant Recovery
ConnectWise suspended Cloud Backup after application identities were abused. A practical tenant-response guide covering persistence, evidence preservation, and backup continuity.
AOMEI Update Tampering Shows Why Clean URLs Cannot Close Endpoint Alerts
Google researchers documented brief AOMEI update-server tampering windows. A practical response guide for SMBs and government contractors: preserve event-time evidence and distinguish vendor remediation from endpoint recovery.
Third-Party VPN Access Shows Basic Controls Still Stop Bank Intrusions
A Unit 42 investigation into a European bank intrusion shows how vendor-managed gateway gaps, weak authentication, and noisy reconnaissance can create real business risk even when the attacker is not sophisticated.
Microsoft Patch Tuesday Record Shows Patch Triage Must Be Risk-Based
Microsoft’s October 2026 Patch Tuesday dropped a record 1,411 fixes, including an actively exploited Windows Shell flaw. SMBs and government contractors need a risk-based triage workflow, not a spreadsheet panic cycle.
Ivanti Connect Secure Zero-Day Shows Edge Gateways Need Patch-and-Hunt Discipline
An actively exploited Ivanti Connect Secure authentication-bypass zero-day reinforces a hard lesson: edge gateways must be patched fast, checked for compromise, and monitored like privileged infrastructure.
LiteLLM Gateway Flaws Show AI Infrastructure Needs Real Access Control
Check Point Research found LiteLLM gateway vulnerabilities that could let lower-privileged users alter runtime configuration, read files, take over admin access, or reach RCE paths. Here is what defenders should do now.
LiteLLM Gateway Flaws Show AI Proxies Need Control-Plane Security
Check Point found LiteLLM gateway vulnerabilities that could let low-privileged users tamper with configuration, read files, take over admin access, execute code, and leak provider keys. The defense is treating AI gateways like privileged infrastructure.
AhsayCBS Webshell Attacks Show Backup Servers Are High-Value Entry Points
Active exploitation of AhsayCBS backup-management flaws shows why backup consoles need restricted access, compromise hunting, credential rotation, and recovery validation.
Dutch Warning on Chinese Edge-Device Attacks Shows Why Firewall Logs Must Leave the Firewall
A Dutch AIVD/MIVD/NCSC advisory warns that Chinese actors are expected to intensify edge-device exploitation. For SMBs and government contractors, the priority is centralized logging, segmentation, forensic readiness, and faster perimeter patch decisions.
UAT-11985 Shows AI-Assisted Phishing Is Now Real-Time Account Takeover
Cisco Talos reported an APT campaign using AI-assisted event lures, malicious QR codes, and real-time Google AitM phishing. The defensive answer is phishing-resistant MFA, invitation verification, and identity telemetry that connects clicks to sessions.
Trojanized Terraform Providers Show IaC Pipelines Are Developer Endpoints
Zscaler ThreatLabz detailed a suspected TraderTraitor campaign using a fake Terraform provider to launch cross-platform malware. The practical lesson: infrastructure-as-code plugins run on developer and CI/CD systems, so they need endpoint controls, provenance checks, and egress monitoring.
Malicious AI Agent Skills Turn Prompt Instructions Into Supply-Chain Risk
VirusTotal found thousands of malicious AI agent skills, many carrying the attack in plain-language instructions rather than code. The defensive move is to review skills like software, sandbox agents, and monitor outbound behavior.
ARTEX AI Bank Attacks Show Agentic Tools Are Now an Incident-Response Problem
CrowdStrike found ARTEX configuration files and Claude Code histories tied to attacks on South Korean financial organizations. The lesson for defenders is not AI panic—it is faster triage, stronger application logging, and tighter controls around data-access workflows.
Internet Scanning Turns Open Ports Into Threat-Intel Pivots
VirusTotal added daily public IPv4 scanning data to IP reports, including ports, banners, services, versions, fingerprints, and port history. The practical lesson: open ports are weak signals alone, but service metadata can turn exposure into useful threat-intel pivots.
AnyDesk Linux Exploit Shows Remote Access Tools Need Exposure Controls
A public exploit for a pre-authentication AnyDesk Linux flaw shows why remote access tools need patching, exposure controls, inventory, and monitoring—not just user approval prompts.
Go Security Release Shows Why HTTP/2 and Proxy Paths Need Patch Discipline
Go 1.27.2 and 1.26.9 fix 15 security issues across HTTP/2, reverse proxy behavior, TLS, templates, multipart parsing, and module checksum trust. The operational lesson is simple: language-runtime patches are infrastructure patches.
AI-Analysis Evasion Shows Why Malware Triage Needs Prompt Boundaries
Cisco Talos found malware families embedding natural-language instructions meant to steer AI-assisted analysis. The lesson for defenders: treat sample text as evidence, not instruction.
Web3 C2 Shows Why Build Pipelines Need Egress Controls
Unit 42 warns that supply-chain malware is using Web3 infrastructure to hide command-and-control while stealing cloud credentials from developer workstations and CI/CD runners.