| DATE |
|
NAME |
INFO |
CATEGORIE |
WEB |
|
10.10.26 |
 |
Scans for Atlassian vulnerablity (CVE-2026-21589) |
Atlassian published patches for
multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589].
An attacker can read arbitrary files in the web application's directory,
potentially exposing sensitive information such as configuration files. |
Vulnerebility |
SANS |
|
10.10.26 |
 |
More
RMM Tools In the Wild |
It seems that a trend started… I continue my
journey discovering more RMM ("Remote Management & Monitoring") tools abused by
threat actors! A few days ago, I wrote a diary[1]
about ScreenConnect used in the wild. Today, I found another one. |
Security |
SANS |
|
10.10.26 |
 |
Reconstructing AI Agent Activity: Two New Scripts for Forensic
Review |
We just did a major update
to FOR577 and added a lot of new material on day 5 about investigating AI usage
in incident response. In the new material we dicsuss 8 of the most popular AI
coding assistants and agents including Claude Code, Codex, Gemini CLI, Cursor,
Copilot, Warp, Windsurf, and Qwen Code. |
AI |
SANS |
|
7.10.26 |
 |
CrocoRat Adds a New Twist to ClickFix with DNS Payload
Delivery |
ClickFix campaigns have become one of the most effective ways to
turn a browser session into code execution. The technique is simple: show the
victim a fake verification page, place a command on the clipboard, and convince
them to paste it into the Windows Run dialog. |
Virus |
Flare |
|
7.10.26 |
 |
IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly
Downtime |
During Cybersecurity Awareness Month, ransomware remains one of the clearest
examples of how a cyber incident can become a business continuity issue.
IronChain shows why. It puts business-critical data at risk of permanent loss
and can bring operations to a halt. |
Ransom |
ANYRUN BLOG |
|
7.10.26 |
 |
More Shells Than a Seafood Buffet: Tracking Citrix NetScaler
Exploitation Activities (CVE-2026-88771) |
As
early as the beginning of September 2026, eSentire's
Threat Response Unit (TRU)
observed multiple threat actor clusters exploiting
CVE-2026-88771, a
zero-day vulnerability later disclosed in Citrix's September 27, 2026 security
bulletin
CTX697096. This blog
examines the distinct attack clusters identified by TRU and highlights the
tactics, techniques, and procedures observed across these intrusions. |
Exploit |
eSentire |
|
6.10.26 |
 |
ATOMIC MACOS (AMOS) STEALER INFECTION FROM MALICIOUS AD
IMPERSONATING CLAUDE CODE |
Zip files are password-protected. Of note, this site has a new password
scheme. For the password, see the "about" page of this website. |
MALWARE TRAFFICS |
MALWARE TRAFFIC |
|
6.10.26 |
|
User
Agent Strings Curiosities |
Sometimes I have to smile, or my interest is triggered, when I
review new User Agent Strings in the honeypot logs. |
Security |
SANS |
|
6.10.26 |
|
TTY Logs and the Data it Captures |
For an experiment, I created a script [1]
that parses and send the TTY logs collected from actors or bots activity that
run various commands after they successfully login the DShield sensor. Those TTY
logs are sent daily at the end of each day to the DShield SIEM [2]
to be correlated with all the data. |
Security |
SANS |
|
5.10.26 |
 |
UAC-0277: ClickFix on compromised websites to spread LUNEXSTEALER |
In
September 2026, CERT-UA specialists discovered over 100 compromised websites to
which malicious JavaScript code had been added by attackers. When visiting such
a site, the user was shown a fake Cloudflare verification page, which, under the
pretext of confirming that the visitor was a human, offered to execute a
command. Executing the command resulted in downloading and installing an MSI
package from a remote server (ClickFix technique). |
BATTLE OF UKRAINE |
BATTLE OF UKRAINE |
|
2.10.26 |
 |
Gotta
breach 'em all! The journey of ShinyHunters |
ShinyHunters has outlasted forum
takedowns, multiple arrests, and its own founders' convictions. This report
traces six years of activity and tactical evolution. From stolen S3 buckets to
zero-day exploits, we attempted to explain why the brand keeps surviving what
should have ended it. |
APT |
SEKOIA |