Blog

clearinfosec.com ↗

Author: Clear Infosec

  • 5 Identity Attack Tactics Used Against Global Retail Brands

    5 Identity Attack Tactics Used Against Global Retail Brands

    Modern cyberattacks have evolved far beyond firewalls and malware. Instead of brute-forcing their way into networks, attackers are slipping through the cracks using something far more subtle: legitimate credentials and over-permissioned identities.

    In the past year, high-profile retail giants such as Adidas, The North Face, Dior, Victoria’s Secret, and others have become targets of identity-centric attacks. These aren’t incidents driven by sophisticated zero-days or ransomware payloads. Instead, they highlight a chilling trend: your greatest vulnerability may already be inside your system — and logged in.

    Let’s examine five critical patterns showing how identity is being exploited—and what organizations can do to defend against this stealthy new wave of cyberattacks.

    1. Compromised Third Parties: The Unseen Entry Point

    One of the most effective attack vectors today doesn’t involve attacking your infrastructure directly—it’s about hitting your vendors. In the case of Adidas, attackers infiltrated through a third-party partner who had retained access to internal systems, long after the initial contract had ended.

    Because vendors often hold access tokens to your SaaS applications and are not required to follow your internal MFA policies, they present a soft target. Worse still, these credentials often have elevated access privileges that go unmonitored.

    What you should do:

    • Regularly audit all third-party access.

    • Ensure all vendor accounts expire after contract termination.

    • Require MFA and token rotation even for external collaborators.

    2. Credential Reuse and Account Takeover: A Quiet Invasion

    The attack on The North Face wasn’t through malware. It was through credential stuffing—a tactic where attackers use previously leaked usernames and passwords to log into systems. Because many users still reuse passwords across platforms, one old breach can open the door to another.

    This form of attack is fast, automated, and incredibly difficult to detect, especially when the login is coming from a legitimate IP or device.

    What you should do:

    • Enforce unique passwords and implement account lockout thresholds.

    • Use anomaly-based login monitoring.

    • Educate customers and employees on the risks of password reuse.

    3. Bypassing MFA Through Social Engineering and SIM Swaps

    You’d think Multi-Factor Authentication (MFA) would stop most attacks. But threat actors have found a way around that too. Using SIM swapping, attackers convince telecom providers to port a user’s number to their own SIM card. Once in control, they intercept SMS-based OTPs and reset credentials.

    In other cases, attackers impersonate employees and trick helpdesks into resetting login credentials, effectively bypassing MFA altogether.

    What you should do:

    • Avoid SMS-based MFA; opt for app-based or hardware token solutions.

    • Train support staff to verify all identity reset requests with multi-layer verification.

    • Monitor for unusual password resets or SIM change behavior in your logs.

    4. Overpowered Admin Roles: When Access Becomes a Liability

    Imagine someone gaining access not to a file—but to your entire cloud environment. That’s what happened to Victoria’s Secret, where the breach of a single over-permissioned admin account led to operational shutdowns both online and in physical stores.

    SaaS platforms often lack granular role controls, and admin accounts are rarely audited for excessive permissions. Once compromised, attackers can reconfigure systems, disable monitoring, or exfiltrate sensitive data undetected.

    What you should do:

    • Apply the principle of least privilege across all admin roles.

    • Implement just-in-time access for privileged accounts.

    • Monitor and log all admin-level activities for anomalies.

    5. Support Systems and CRMs: The Backdoor to Customer Data

    Support platforms and CRMs hold goldmines of sensitive customer information. In breaches involving luxury brands like Dior and Cartier, attackers didn’t hack into databases—they simply accessed support portals using valid user sessions or API tokens, which often go unmonitored.

    APIs, tokens, and session IDs tied to these platforms can persist far beyond intended lifespans and, if compromised, provide unfettered access to customer profiles, communications, and order history.

    What you should do:

    • Use short-lived session tokens and regularly revoke idle ones.

    • Secure API endpoints with behavioral analytics and rate limiting.

    • Continuously review role-based access in customer-facing platforms.

    A New Paradigm: Identity as the Security Perimeter

    The lesson is clear: identity is no longer just a user attribute—it’s the frontline of your security strategy. Attackers aren’t trying to break in through firewalls anymore; they’re logging in through the front door.

    Organizations must shift from device-centric or network-centric models to identity-first security architectures, which include:

    • Stronger authentication: Go beyond MFA to adopt phishing-resistant standards like FIDO2 and passkeys.

    • Continuous monitoring: Detect anomalous behavior tied to session reuse, geo-velocity, or sudden permission escalations.

    • Access governance: Audit users, roles, and service accounts frequently. Remove unused accounts proactively.

    • Zero Trust enforcement: Validate every user, device, and action continuously—especially within SaaS platforms.

    • Dedicated ITDR tools: Leverage Identity Threat Detection and Response systems to spot lateral movement via accounts.

    Wrapping Up

    Identity-based threats represent the next frontier in cybersecurity—one where trust, not technology, becomes the weakest link. These attacks are stealthy, persistent, and devastatingly effective. Whether it’s a compromised vendor, a hijacked session, or a socially engineered support desk, attackers are playing the long game with stolen identities as their primary weapon.

    To defend against this evolving threat landscape, businesses must stop treating identity as just another checkbox. It must become the core lens through which all risk is assessed and all access is granted.

    Reference:

    This article was inspired by insights from: The Hacker News – 5 Ways Identity-Based Attacks Are Breaching Retai

  • Golden DMSA Attack: A New Stealth Technique That Bypasses Windows Security

    Golden DMSA Attack: A New Stealth Technique That Bypasses Windows Security

    Cybersecurity researchers have unveiled a newly discovered post-exploitation technique targeting Microsoft Windows systems. Dubbed Golden DMSA (Golden Distributed Monitoring Service Account), this stealthy attack vector exploits Microsoft’s own Windows Management Infrastructure (WMI) architecture to maintain persistent, undetectable access on compromised machines — posing serious threats to enterprise networks.

    What Is the Golden DMSA Attack?

    The Golden DMSA attack enables adversaries to plant persistent payloads using legitimate WMI subscription mechanisms. The attackers leverage Distributed Monitoring Service Accounts — typically used by Microsoft System Center Operations Manager (SCOM) — to execute malicious activities under the guise of a trusted and authorized user account.

    This is not just a new method — it’s a highly evasive technique. Threat actors can execute malicious scripts or commands without creating new services, registry modifications, or scheduled tasks, which are typically picked up by EDR (Endpoint Detection and Response) tools or SIEM solutions. The technique effectively bypasses detection by hiding within native system processes.

    The Role of SCOM and DMSA Accounts

    Microsoft’s System Center Operations Manager (SCOM) is used by enterprises to monitor IT infrastructure. It deploys agents across machines and leverages Delegated Managed Service Accounts (DMSA) to perform tasks and retrieve telemetry data.

    Delegated Managed Service Accounts (DMSA) is a new feature introduced by Microsoft in Windows Server 2025, designed to replace legacy service accounts and help counter advanced threats like Kerberoasting attacks.

    Unlike traditional service accounts, DMSAs bind authentication directly to authorized machine identities in Active Directory (AD). This prevents unauthorized usage and significantly reduces the chances of credential theft or lateral movement. By tying access control to device identity, only explicitly permitted machines can use the account, creating a robust layer of trust.

    However, in the Golden DMSA attack, this very trust is abused. Threat actors hijack or spoof DMSA accounts to configure malicious WMI event subscriptions, thus creating a stealth persistence backdoor that looks like legitimate monitoring behavior.

    Why This Attack Is So Dangerous

    Here’s what makes the Golden DMSA attack uniquely threatening:

    • No File Drops or Registry Modifications: Unlike traditional persistence mechanisms, this technique doesn’t rely on modifying the registry or dropping files, making it harder for EDR systems to detect.

    • Blends With Legitimate Traffic: Since DMSA accounts are used legitimately by SCOM, malicious behavior can be easily misattributed as normal system monitoring activity.

    • Bypasses Most Detection Tools: EDRs typically focus on well-known persistence techniques (scheduled tasks, registry run keys, services), but this method leverages WMI — an area often under-monitored.

    • Long-Term Persistence: Once set, the attacker’s payload can remain functional and dormant for long periods, surviving reboots and user logouts.

    How the Attack Works: Technical Breakdown

    1. Discovery: The attacker identifies an organization running SCOM and using DMSA accounts.

    2. Hijack or Spoof: They hijack a DMSA account or create a fake one with similar permissions.

    3. WMI Subscription: The attacker sets up a WMI Event Consumer — a legitimate Windows mechanism — to execute payloads when specific triggers (like system reboot or user login) occur.

    4. Execution: Malicious commands or scripts are executed invisibly, often leveraging PowerShell or VBScript.

    5. Persistence: Since it’s tied to system events and hidden under the DMSA account, the attack remains under the radar.

    Detection and Mitigation Challenges

    Security tools that focus on signature-based detection are largely ineffective here. Most EDR solutions are not tuned to detect WMI-based persistence, especially when executed under legitimate accounts.

    Moreover, since the DMSA account is seen as “trusted,” its actions often bypass heuristic anomaly-based monitoring too.

    Recommendations for Security Teams

    Security experts recommend the following steps to detect and defend against Golden DMSA-style attacks:

    1. Audit WMI Subscriptions Regularly: Use PowerShell or WMI Explorer tools to list existing Event Filters, Consumers, and Bindings.

    2. Monitor SCOM Account Usage: Track unusual activity or deviations in behavior by DMSA accounts using UEBA (User and Entity Behavior Analytics).

    3. Isolate Monitoring Accounts: Limit DMSA privileges strictly to necessary operations and avoid giving them interactive login permissions.

    4. Use Sysmon: Enable and configure Microsoft Sysmon to monitor WMI activity and log suspicious behavior.

    5. Deploy Advanced Threat Detection Tools: Utilize XDR (Extended Detection and Response) platforms capable of correlating WMI activity across the enterprise.

    6. Use Application Whitelisting: Tools like AppLocker or WDAC can prevent unauthorized script execution through WMI.

    Comparisons to Past Attacks

    The Golden DMSA attack draws parallels to older WMI-based persistence techniques such as:

    • WMI Event Subscription Backdoors: First documented in 2015, these involved setting up malicious WMI consumers tied to system events.

    • APT Techniques: Advanced Persistent Threat groups like APT29 (Cozy Bear) have used WMI persistence in nation-state campaigns.

    However, the use of legitimate enterprise monitoring tools like SCOM makes Golden DMSA more deceptive and harder to trace.

    A Wake-Up Call for Enterprises

    This discovery highlights a major blind spot in many organizations’ security frameworks. Monitoring and security teams often exclude trusted accounts and tools from their threat models, giving adversaries the perfect hiding place.

    The Golden DMSA attack is a powerful example of how attackers continuously innovate to exploit trusted components in enterprise environments. As reliance on monitoring solutions like SCOM grows, so does the attack surface.

    Final Thoughts

    The Golden DMSA technique is a sobering reminder that attackers no longer need malware to compromise systems — they just need access and creativity. Security isn’t just about watching the doors and windows anymore; it’s also about knowing what’s happening inside the house, especially in the corners we think are safe.

    Organizations must broaden their detection lenses, pay closer attention to WMI activity, and start treating every system process — even legitimate ones — with a degree of healthy suspicion.

    Sources Referenced

  • Ransomware Skies & Crashing Defenses: A Cybersecurity Recap

    Ransomware Skies & Crashing Defenses: A Cybersecurity Recap

    What if the biggest cybersecurity risks aren’t flaws at all—but features working as intended? This week’s cyber incidents shine a spotlight on a new and troubling trend:
    attackers aren’t just exploiting vulnerabilities—they’re taking advantage of the way things are supposed to work. Misused APIs, default trust settings, outdated routers, and socially engineered workflows are proving to be just as dangerous as zero-days.

    From nation-state surveillance campaigns to phishing operations and critical infrastructure attacks, this week’s stories illustrate how the boundaries between misconfiguration, oversight, and outright exploitation are increasingly blurred. It’s no longer enough to patch your systems—now you have to rethink how they’re designed and used.

     This Week in Cybersecurity: Top 5 Threats You Should Know (July 2025)


    1. LapDogs ORB Network: Over 1,000 Routers Compromised in Global Espionage Campaign

    A China-linked APT group has constructed a massive covert surveillance operation dubbed LapDogs, leveraging over 1,000 compromised SOHO routers across five countries. The campaign uses known Linux vulnerabilities to implant ShortLeash, a stealthy backdoor that converts everyday routers and IoT devices into Operational Relay Boxes (ORBs). These ORBs act as persistent entry points, facilitating encrypted
    command-and-control (C2) traffic and lateral movement into sensitive networks.

    Why it matters: This operation reveals how attackers weaponize aging consumer-grade infrastructure to bypass enterprise defenses. It’s not the router’s job to protect a nation—but its compromise could endanger one.

     

    2. Iranian Hackers Target Israeli Cybersecurity Experts

    The Iranian state-aligned group APT35 (a.k.a. Charming Kitten) has escalated its spear-phishing campaign targeting Israel-based cybersecurity professionals, professors, and journalists. The campaign uses convincing Google Meet links, fake interview requests, and cloned Gmail login pages. Attackers are contacting targets through email and WhatsApp to increase credibility.

    Why it matters: Cyber professionals are now themselves targets—not just defenders. This attack underscores how threat actors are expanding beyond traditional government or corporate targets to exploit trust within the infosec community itself.

     

    3. Citrix NetScaler Under Fire for Dual 0-Days

    Two actively exploited zero-day vulnerabilities (CVE-2025-6543 and CVE-2025-5777) have rocked Citrix’s NetScaler ADC platform. The flaws allow memory overflow and unauthorized remote access, raising alarms across enterprises that rely on NetScaler for VPN and application delivery. While patches are available, incomplete details on
    exploitation methods have left many scrambling to assess exposure.

    Why it matters: NetScaler is deeply embedded in enterprise IT stacks. Even a short exploitation window could offer attackers privileged access to core business applications—underscoring the importance of prompt patching and real-time telemetry.

     

    4. U.S. House Bans WhatsApp on Official
    Devices

    The U.S. House of Representatives has officially banned WhatsApp from all government-issued devices, citing opaque data handling and potential foreign influence. Despite WhatsApp’s end-to-end encryption, lawmakers expressed concern over how metadata and message storage are managed, especially given Meta’s ownership and international hosting practices.

    Why it matters: The decision reflects a broader shift in policy thinking—where metadata and app governance are now as important as message content. It’s a cautionary tale for any platform operating in sensitive environments.

     

    5. Akamai’s XMRogue: A Weapon Against Cryptomining Botnets

    Akamai has released XMRogue, a novel proof-of-concept that targets cryptomining botnets not by disinfecting systems, but by financially starving them. By spoofing login attempts to mining pools using the attacker’s wallet, XMRogue causes the pool to temporarily block the attacker—disrupting the profit model behind the botnet.

    Why it matters: It’s a shift in strategy—from cleanup to counterattack. While not a full solution, it represents an emerging trend in threat disruption: hit attackers where it hurts—their wallets.

     Also in the Headlines: Expanded Developments

    Airline Cyber Incidents Under Investigation

    Multiple major airlines reported outages and IT disruptions this week, with at least one launching a formal cyber investigation. The FBI has warned of increased activity from the Scattered Spider group, known for sophisticated social engineering and SIM-swapping attacks.

    What’s unfolding: Critical infrastructure like aviation is under increasing pressure. The concern isn’t just disruption—it’s the potential access to crew systems, flight paths, or passenger data.

     Outlook Malware Campaigns Surge

    Outlook users are the target of a new malware wave that hijacks email threads to spread banking trojans, info stealers, and ransomware. Messages appear to come from trusted senders in ongoing threads, with malicious links deeply embedded in reply to chains.

    What to watch: This tactic drastically reduces suspicion from recipients, bypassing even well-trained employees. Email security filters and behavioural monitoring are more essential than ever.

     BreachForums Admins Taken Down

    French authorities arrested five top administrators of BreachForums, including notorious hacker IntelBroker, in a coordinated global sting. The U.S. is seeking extradition. 

    Why it’s important: BreachForums was a major hub for stolen data trading, responsible for breaches affecting healthcare, education, and government sectors. Its takedown is a rare and welcome blow to the cybercrime economy.

     Canada Bans Hikvision Over Security Concerns

    Citing national security risks, Canada has ordered Chinese surveillance tech firm Hikvision to shut down operations and banned its use in government systems. 

    Geopolitical impact: The move aligns with growing efforts by Western
    nations to reduce reliance on Chinese tech in critical infrastructure. Similar
    reviews are ongoing in the U.K., U.S., and EU.

     Quick Bytes: Headlines That Matter

    • Microsoft is decoupling security modules from the Windows kernel to avoid global outages like the CrowdStrike crash.
    • New Outlook token-stealing malware poses risk to cloud access.
    • REvil ransomware group leaders released in Russia, prompting international concern.
    • Python package found to be intentionally destructive, part of a growing trend of software supply chain threats.
    • Chinese hackers hit South Korean infrastructure, continuing regional tensions.
    • AndroxGh0st botnet evolves, now exfiltrating API keys and credentials at scale.
    • CapCut scam emails target iOS users, disguising fraudulent invoices as app receipts.
    • Smartwatch malware used to exfiltrate air-gapped data, hinting at increasingly creative attack methods.
    • Bluetooth vulnerabilities put wireless headsets and mics at risk of eavesdropping.
    • Rust promoted as a secure-by-default language by U.S. cyber agencies for future software systems.

     

    Conclusion: What This Week Tells Us

    This week’s incidents remind us that cybersecurity isn’t just about patching holes—it’s about rethinking the architecture. Attackers are increasingly manipulating systems as designed, weaponizing trust, default settings, and human behaviour to achieve their
    goals. Whether it’s nation-state actors building hidden botnets, criminals hijacking email threads, or policy responses to app insecurity, the trend is clear:

    The perimeter is long gone. Assumptions are the new attack surface.

    Security leaders must focus not just on detection and response but also on architectural risk, user behaviour, and systemic exposure. The challenge ahead isn’t just to stop the breach—but to predict where trust will be misused next.


    Reference:

    The Hacker News. (2025b, July 3). ⚡ weekly recap: Airline Hacks, Citrix 0-day, Outlook malware, banking trojans and more. https://thehackernews.com/2025/06/weekly-recap-airline-hacks-citrix-0-day.html

  • Security at a Breaking Point? Key Lessons from This Week’s Major Exploits

    Security at a Breaking Point? Key Lessons from This Week’s Major Exploits

    Cybersecurity isn’t slowing down—and neither are the adversaries. This past week has been a whirlwind of high-impact zero-days, aggressive malware campaigns, certificate trust shifts, and nation-state operations. At ClearInfosec, we break down the noise to highlight what matters to your cyber defense strategy.

    Below is our deep-dive recap of the week’s most alarming developments and what they mean for enterprises worldwide.


    1. Google Chrome Zero‑Day (CVE‑2025‑5419) – Actively Exploited in the Wild

    Google disclosed a high-severity vulnerability in Chrome’s V8 JavaScript engine that could allow attackers to execute arbitrary code via out-of-bounds memory manipulation. Tracked as CVE-2025-5419, this zero-day is actively exploited in the wild—affecting users across all major desktop platforms.

    Key Details:

    • Vulnerability: Out-of-bounds memory access in V8 engine.

    • Affected versions: Chrome for Windows, macOS, and Linux.

    • Patched version: Chrome 137.0.7151.69 (Windows) and 137.0.7151.68 (Mac/Linux).

    • Impact: Remote code execution through malicious JavaScript payloads.

    What You Should Do:

    • Push emergency patch updates across all managed endpoints.

    • Leverage browser isolation for high-risk users or contractors.

    • Use web content filters to block known malicious JavaScript exploit kits.


    2. PathWiper Malware Wreaks Havoc in Ukraine

    A sophisticated wiper malware dubbed PathWiper has been observed erasing files in critical Ukrainian infrastructure. Unlike ransomware, PathWiper is not monetarily motivated—its sole goal is data destruction and disruption.

    What We Know:

    • Target: Ukrainian IT infrastructure.

    • Behavior: Deletes files and renders systems unrecoverable.

    • Attribution: Suspected to be politically motivated, possibly state-sponsored.

    • Noteworthy: The malware is similar in behavior to past tools like NotPetya and HermeticWiper.

    Strategic Response:

    • Employ immutable backup solutions that are air-gapped from the network.

    • Monitor system logs for abnormal deletion activities or failed boot processes.

    • Utilize endpoint detection and response (EDR) tools with behavior-based detection.


    3. APT Spotlight: BladedFeline’s Advanced Espionage in Kurdistan & Iraq

    The Iranian-linked BladedFeline (aka OilRig) APT group has been discovered using multiple custom backdoors against high-ranking government and diplomatic entities.

    Threat Profile:

    • Tools: Whisper (Veaty), Spearal, Optimizer.

    • Initial Access: Unknown, but possibly phishing or supply chain compromise.

    • Objective: Espionage and long-term surveillance.

    • Active Since: At least 2017; expanded aggressively since 2024.

    Mitigation Guidance:

    • Perform deep forensic analysis of systems handling sensitive government or strategic intel.

    • Audit all installed software for known command-and-control (C2) backdoor variants.

    • Conduct network segmentation for high-value targets.


    4. UNC6040 Group Targets Salesforce via Vishing and Fake Apps

    UNC6040—a threat actor believed to be aligned with Scattered Spider TTPs—is employing voice phishing (vishing) to target Salesforce customers. They impersonate IT support teams to trick employees into installing a malicious Data Loader clone.

    Attack Flow:

    1. Cold-call users under the guise of IT support.

    2. Direct victims to download a fake “Salesforce Data Loader.”

    3. Steal credentials and access CRM data, potentially leading to mass data exfiltration.

    Prevention:

    • Train employees to verify IT requests through official internal channels.

    • Restrict downloads and installations via admin policies.

    • Log and monitor for new OAuth tokens and API activity in Salesforce.


    5. Certificate Distrust Incoming: Chrome 139 to Revoke Chunghwa & Netlock CAs

    Google Chrome will officially distrust certificates issued by Chunghwa Telecom (Taiwan) and Netlock (Hungary) starting with Chrome 139 (August 2025).

    Reason for Distrust:

    • Failure to meet baseline compliance requirements.

    • Risk of compromised or misissued certificates.

    • Apple already distrusted Netlock as of Nov 15, 2024.

    For Enterprise:

    • Replace all certificates issued by these CAs before August.

    • Run an inventory check across your infrastructure to ensure certificate hygiene.

    • Audit internal PKI systems for any embedded dependency on these root certificates.


    6. Crocodilus Android Trojan Spreads Globally

    Originally spotted in Turkey, Crocodilus has now expanded its infection base to Poland, Spain, parts of Asia, and South America. The malware disguises itself as fake banking apps to steal credentials and crypto wallet seed phrases.

    Capabilities:

    • Block legitimate financial apps.

    • Harvest SMS codes and 2FA tokens.

    • Create fake contact entries to support future phishing or scam campaigns.

    Mobile Security Recommendations:

    • Mandate app downloads from Google Play Store or other trusted sources.

    • Deploy Mobile Threat Defense (MTD) for corporate-managed devices.

    • Enforce mobile OS patch compliance via Mobile Device Management (MDM).


    7. Zero‑Click iMessage Exploit: “NICKNAME” Strikes Apple Devices

    Apple patched a zero-click vulnerability (dubbed NICKNAME) in the imagent daemon, exploited via iMessage. This allowed remote attackers to gain access to iPhones without any user interaction.

    Key Details:

    • Exploit vector: Apple’s iMessage service.

    • Patched in: iOS 18.3.1 (released January 2025).

    • Target: High-profile individuals likely under surveillance.

    Defense Plan:

    • Apply iOS security updates immediately, especially on executive devices.

    • Enforce iMessage usage policies for high-risk profiles (e.g., diplomats, execs).

    • Monitor Apple logs for anomalous imagent behavior.


    8. Rising Abuse of Trusted Tools and Plugins

    Attackers are leveraging legitimate applications and trusted platforms to deploy malicious code or steal credentials—raising supply chain and shadow IT concerns.

    Recent Examples:

    • Fake Chrome extensions with credential harvesting capabilities.

    • Malicious Salesforce plugins impersonating productivity tools.

    • “Shadow apps” installed without IT department knowledge.

    Proactive Measures:

    • Enforce zero trust for third-party tools.

    • Vet all extensions and plugins before deployment.

    • Monitor OAuth token issuance and third-party app access logs.


    9. Critical CVEs You Need to Patch Now

    Here are some newly disclosed vulnerabilities organizations must prioritize for remediation:

    CVE Description
    CVE‑2025‑20286 Cisco Identity Services Engine RCE
    CVE‑2025‑5419 Chrome V8 Zero-Day
    CVE‑2025‑49113 Roundcube Webmail RCE
    CVE‑2025‑21479 / 21480 / 27038 Qualcomm Chipset Vulnerabilities
    CVE‑2025‑37093 HPE StoreOnce Backup Appliance Flaws
    CVE‑2025‑48866 ModSecurity WAF Bypass
    CVE‑2025‑25022 IBM QRadar Suite XSS
    CVE‑2025‑22243 VMware NSX Manager Privilege Escalation
    CVE‑2025‑24364 / 24365 Vaultwarden Server-Side Issues
    CVE‑2024‑53298 Dell PowerScale OneFS DoS Bug

    Use vulnerability management platforms to prioritize based on exploitability and patch accordingly.


    Final Thoughts: What This Week Teaches Us

    Cyber attackers are moving faster, exploiting zero-days more frequently, weaponizing plugins, and deploying destructive malware that bypasses traditional defenses. In this hostile landscape, cybersecurity isn’t just a technical function—it’s a business survival strategy.

    ClearInfosec Recommendations:

    1. Enforce browser and mobile OS updates within 48 hours of release.

    2. Apply the Principle of Least Privilege (PoLP)—especially on CMS platforms.

    3. Validate plugin and third-party software integrity before deployment.

    4. Prepare for data loss with secure backups and rapid recovery playbooks.

    5. Stay updated with CVE feeds and subscribe to trusted advisories.

    At ClearInfosec, we’re committed to helping organizations stay ahead of the curve. Whether it’s vulnerability management, incident response, or GRC strategy, we bring clarity to security chaos.

    Reference:

    The Hacker News. (2025, June 9). ⚡ weekly recap: Chrome 0-day, data wipers, misused tools and zero-click iPhone attacks. https://thehackernews.com/2025/06/weekly-recap-chrome-0-day-data-wipers.html 

  • Why Exposed Credentials Remain a Security Risk

    Why Exposed Credentials Remain a Security Risk

    In today’s cybersecurity landscape, exposed credentials such as API keys, tokens, passwords, and certificates pose one of the most significant threats to organizational security. While detection capabilities have vastly improved, a worrying trend remains: once credentials are exposed, they often stay valid and unfixed for months or even years. This creates a persistent risk that attackers can exploit repeatedly, long after the original exposure.

    This blog unpacks the findings from GitGuardian’s State of Secrets Sprawl 2025 report and explores why exposed secrets remain unrevoked, the dangers this poses, and best practices for mitigating the problem, an alarming percentage of credentials detected as far back as 2022 remain valid today:


    The Longevity of Exposed Credentials — A Deep Dive

    GitGuardian’s analysis of millions of public GitHub repositories uncovered that many secrets exposed in 2022 remained valid and active well into 2025. This persistence demonstrates a critical failure in organizational security processes: detection is happening, but remediation is either slow or absent. Here are the key factors contributing to this problem:

    1. Lack of Awareness and Visibility

    Organizations often lack sufficient visibility over their codebases and deployment environments. Secrets might be hardcoded deep within legacy code, or scattered across multiple repositories and environments, making it difficult to find all exposed credentials. Even if automated detection tools are in place, they might not cover all repositories or branches, leading to incomplete awareness.

    2. Complex and Risky Remediation

    Remediation is not always straightforward. Rotating or revoking secrets requires updating them across all dependent services and applications. This coordinated update is complex and prone to risk—if a secret is rotated but one system still relies on the old one, it can cause outages or service failures.

    3. Resource and Priority Constraints

    Many organizations operate with limited security resources and competing priorities. Consequently, remediation efforts may be deprioritized, especially if the exposed secret appears low risk or the impact of a breach is underestimated.


    The Stakes: High-Risk Services Most Affected

    The credentials that remain valid post-exposure are not trivial or test accounts; rather, they are often keys to critical infrastructure and data:

    • Databases like MongoDB, MySQL, and PostgreSQL continue to be exposed with valid credentials, allowing attackers potential full read/write access to sensitive data stores.

    • Cloud service credentials such as API keys and tokens for providers like AWS, Google Cloud, and Tencent Cloud remain active after exposure, putting entire cloud infrastructures at risk.

    • Access to these services can enable attackers to extract sensitive data, modify configurations, deploy malware, or pivot to other parts of an organization’s network.

    Statistics from GitGuardian’s report show alarming trends:

    • Valid exposed cloud credentials increased from under 10% in 2023 to nearly 16% in 2024.

    • Credentials leaked for critical services like MongoDB and Google Cloud increased each year, underscoring a growing attack surface.


    Why Do Exposed Credentials Remain Valid For So Long?

    Beyond the awareness and operational issues, technical challenges play a big role:

    Hardcoded Secrets in Source Code

    Developers sometimes embed secrets directly into source code for convenience, but these secrets can end up committed into public or private repositories and remain unnoticed. These secrets are often hardcoded in numerous places, making identification and revocation a massive, error-prone task.

    Legacy and Non-Modern Systems

    Older systems may lack the capability to handle ephemeral or short-lived credentials, forcing organizations to use long-lived static credentials, which once exposed, are a persistent risk.

    Secret Rotation is Disruptive

    Rotating secrets is often perceived as disruptive to business operations. This can cause downtime, service interruptions, or require coordination across multiple teams, discouraging frequent rotation.


    Strategies for Addressing the Persistence Problem

    The good news is that modern security practices and technologies can effectively tackle this problem. Organizations must combine visibility, automation, and culture changes to reduce credential persistence risks:

    1. Comprehensive Secret Detection

    Automated scanning tools should be integrated into the software development lifecycle (SDLC) to continuously detect exposed secrets in code repositories, including branches and forked repositories.

    2. Automated and Rapid Remediation

    Automating secret rotation and revocation reduces the remediation window. Tools and platforms that integrate with CI/CD pipelines can facilitate seamless secret replacement without manual errors.

    3. Adopt Ephemeral Credentials

    Moving to short-lived, ephemeral credentials significantly reduces risk since even if exposed, they expire quickly and are unusable after their short lifespan.

    4. Centralized Secret Management

    Centralizing secrets in dedicated management platforms (e.g., HashiCorp Vault, AWS Secrets Manager) ensures consistent policy enforcement, audit trails, and easy rotation without scattering credentials in source code.

    5. Shift-Left Security and Developer Training

    Educate developers on secure coding practices and implement secret scanning early in the development lifecycle to prevent secrets from being committed in the first place.

    6. Regular Auditing and Monitoring

    Perform periodic audits of secrets and monitor cloud service usage for anomalies that could indicate misuse of exposed credentials.


    Final Thoughts

    Exposed credentials are an open door for attackers. The persistence of these credentials long after exposure reflects gaps in organizational processes, tooling, and culture around security.

    Organizations must move beyond detection and invest in swift remediation, secret lifecycle management, and secure development practices. The adoption of ephemeral credentials, centralized secret management, and automated remediation will play a critical role in shrinking this persistent attack surface.

    By taking these proactive steps, organizations can significantly reduce the risk associated with leaked secrets and enhance their overall security posture in the face of growing cloud and software complexity.

    Rerefence: 

    The Hacker News. (2025, May 12). The persistence problem: Why exposed credentials remain unfixed-and how to change that. https://thehackernews.com/2025/05/the-persistence-problem-why-exposed.html

  • The AD Pentest Mindset

    The AD Pentest Mindset

    TL;DR

    ·      AD pentesting is different from traditional app testing, focusing on
    misconfigurations, permissions, and relationships.

    ·      The goal is to move from a foothold to the Domain Controller (DC) by
    escalating privileges and leveraging lateral movement.

    ·      Key steps after gaining a foothold: escalate privileges, enumerate
    permissions, map the network, and pivot.

    ·      Common tools: SharpUp, BloodHound, Mimikatz, Rubeus, PowerView.

    ·      OpSec is crucial—use quieter tools and techniques to avoid detection.

    ·      The process involves strategic mapping, privilege escalation, credential
    dumping, and exploiting trust relationships.

    Introduction

    This article is intended for individuals beginning their journey into Active Directory (AD) pentesting and is put together from personal experience gained while pursuing the CRTP certification. The goal is not to provide a deep, all-in-one technical breakdown, but rather a quick and practical read that gives an idea of what to expect and helps set things in the right direction. It’s meant to build the proper mindset for approaching AD environments, offer a foundational understanding of how attacks typically flow,
    and highlight the areas most targeted. Hopefully by understanding the right mindset early on, this should serve as a head start, helping avoid the trial-and-error process of figuring things out the long way.

    Mindset

    The mindset required for Active Directory (AD) pentesting is quite different from traditional application security testing. These differences also demand a change in methodology when approaching an AD environment.

    Perspective

    The first major shift is in perspective—application pentesting is usually conducted from an outsider’s point of view, attempting to break into asystem from the perimeter. In contrast, AD pentesting typically starts from an internal, low-privileged foothold that’s either obtained through techniques like phishing or pre-assigned as part of the engagement.

    Nature Of Vulnerabilities

    Another key difference lies in the nature of the vulnerabilities. In application security, flaws are often rooted in the code—think injection attacks, authentication bypasses, or logic flaws. But in AD, it’s less about exploitable software and more about misconfigurations. While traditional internal network pentests may focus on outdated software and unpatched systems, AD pentesting revolves around weak permissions, overly permissive group memberships, and flawed trust relationships. Many attacks—such as Kerberoasting or DCSync—abuse features that function as intended. They don’t rely on traditional exploits; instead, they take advantage of how the environment is configured, exploiting design flaws and weak operational practices.

    Environment

    Unlike applications, which are finite and functionally scoped, AD environments are interconnected ecosystems. The attacker must think in terms of relationships across users, computers, services, and groups. While chaining vulnerabilities is common across all forms of security testing, AD pentesting heavily emphasizes lateral movement—navigating and abusing relationships rather than targeting isolated exploits.

    Long Game

    Unlike application pentests that can result in individual high-impact wins, AD attacks are strategic and incremental. Pentesters must adopt a long-game approach—gathering information, chaining missteps, and thinking of abusing relationships to move deeper into the network.

    Methodology

    The core idea behind Active Directory (AD) pentesting is to move from a starting
    point (foothold)     to the final target (Domain Controller). All the other systems in the environment—especially those with high-value users or roles—are considered stepping stones. These intermediate machines help us gradually escalate our privileges and move closer to the Domain Controller (DC).

    Once we gain access to the network as a low-privileged user, the first goal is to elevate privileges on the current machine to local administrator. This is important because it allows us to perform actions like credential dumping, which helps with further movement across the network. If local privilege escalation isn’t possible on the foothold, we look to pivot to other machines and try to find one where we can gain local admin access. 

    After Gaining a Foothold – Key Directions to Explore

    1. Privilege Escalation on the Foothold Machine

    ·      Try to move from a low-privileged user to local admin.

    ·      This enables techniques like credential dumping, process injection,
    and deep enumeration of the environment.

    2. Permission Enumeration

    ·      Check what permissions the current user has, including group memberships and DACLs (Discretionary Access Control Lists).

    ·      Enumerate permissions of the foothold machine itself—some systems
    have rights over other machines.

    3. AD Enumeration

    ·      Identify other computers in the domain.

    ·      Identify machines where high-privileged users are logged in. Then, check if your current user or system has any level of access or control over those machines. If so, you may be able to dump their account hashes and use techniques like Pass-the-Hash to move forward.

    ·      Check if the foothold user has local admin access on other machines.

    ·      Identify delegation settings like Unconstrained, Constrained, or Resource-Based Constrained Delegation (RBCD), which can often be abused for privilege escalation.

    4. Build a Map of Knowns and Unknowns

    ·      Create a list of what you currently know: users, computers, permissions,
    relationships, and access levels.

    ·       Then note what’s missing or unclear—these are your “unknowns.”

    ·      Mapping out these knowns and unknowns helps you understand how things
    are connected and where the gaps are. This will help you identify the next
    target    , which may be the “missing link” between you and the Domain Controller.

    5. Pivot Step-by-Step

    ·      Start with the first machine in your list of knowns where the foothold user has an exploitable path.

    ·      Once you gain access, repeat the enumeration process.

    ·      Use new access to fill in the unknowns, uncover more relationships, and
    move deeper into the network.

    This process continues in a loop—foothold → privilege escalation → enumeration → lateral movement → repeat—until you finally reach and compromise the Domain Controller. AD pentesting is all about smart mapping, strategic movement, and making connections across the domain.

    Common Tools and Techniques

    Active Directory pentesting relies on a combination of smart enumeration, privilege abuse, and lateral movement. Here are some of the most used tools and techniques you’ll come across during an assessment:

    Enumeration Tools

    Before exploiting anything, you need good intel. Enumeration tools help map out the domain, users, permissions, and potential attack paths. These are essential for understanding how the environment is structured and where to move next.

    ·      net, whoami, dsquery, PowerView – For gathering basic AD information like
    user accounts, group memberships, domain trusts, and more.

    ·      Seatbelt, SharpUp, winPEAS, linPEAS – Help identify local privilege escalation
    opportunities by collecting system-specific information like service
    configurations, user privileges, and vulnerable settings.

    ·      BloodHound (with SharpHound) – Visualizes AD relationships by collecting data on users, groups, sessions, permissions, and trusts. It’s widely used to identify privilege escalation paths and lateral movement opportunities across the domain.

    Kerberoasting

    Kerberoasting is a technique that abuses how Kerberos works in AD. Any domain user can request a service ticket (TGS) for services running under user accounts. These tickets are encrypted with the service account’s password hash. You can extract these tickets and attempt to crack the hashes offline to recover plaintext passwords, potentially revealing high-privileged credentials like SQL service accounts or domain admins.

    Tools: Rubeus, Impacket, or GetUserSPNs.py.

    Pass-the-Hash (PtH)

    This technique allows an attacker to authenticate using NTLM hashes instead of plaintext passwords. If you can dump the hash of a privileged user, you can use it to access other systems without cracking it. This is useful for lateral movement and privilege escalation.

    Tools: Mimikatz, Evil-WinRM, psexec.py.

    Credential Dumping

    Dumping credentials from memory or disk is key to AD movement. Once local admin access is gained, tools like Mimikatz can extract cleartext passwords, hashes, Kerberos tickets, and more. This often gives you access to other systems or users.

    Tools: Mimikatz, lsass
    dump    , procdump + pypykatz.

    DCSync

    DCSync is a powerful technique where an attacker simulates the behavior of a Domain Controller and asks another DC to replicate credentials. If the current user has replication rights (like Replicating Directory Changes permissions), you can pull password hashes of any user in the domain, including the domain admin or KRBTGT account.

    Tools: Mimikatz, Impacket’s
    secretsdump.py    .

    Ticket Attacks

    Ticket attacks in Active Directory take advantage of Kerberos authentication to forge
    access tokens. A Golden Ticket is a forged Ticket Granting Ticket (TGT) created using the KRBTGT account’s hash, allowing full domain access. A Silver Ticket is a forged service ticket (TGS) used to access specific services without contacting the Domain Controller. A Diamond Ticket involves modifying a real, valid TGT to escalate privileges while preserving legitimate ticket structure. These attacks are powerful for maintaining persistence and lateral movement.

    Tools: Mimikatz, Rubeus.

    These tools and techniques work best when used together, as part of a well-planned strategy. AD pentesting isn’t about finding one big vulnerability—it’s about combining small weaknesses to eventually take over the domain.

    Staying OpSec-Safe During AD Pentesting

    When pentesting an Active Directory (AD) environment—especially in a mature or heavily monitored network—stealth is critical. Many common tools, commands, and techniques can trigger alerts, shut down your access, or even burn the entire operation.

    It’s also important to understand that red teaming is not the same as traditional pentesting. In a red team engagement, the goal isn’t just to find vulnerabilities—it’s to simulate a real-world attack while avoiding detection by the blue team. That means your actions must not only be effective but also quiet and unnoticeable.

    To help you stay under the radar, here are some key habits for keeping your operations OpSec-safe:

    Be Smart with Your Tools & Commands

    ·      Use winrs instead of PowerShell Remoting:
    PowerShell remoting (Invoke-Command, Enter-PSSession, etc.) is often logged and detected by Microsoft Defender for Identity (MDI) and Microsoft Defender for Endpoint(MDE).  Replace it with winrs, which is quieter and less likely to trigger alerts.

    ·      Avoid noisy recon commands like whoami and hostname:
     Instead, use built-in environment variables:

    o  PowerShell: $env:COMPUTERNAME, $env:USERNAME

    o  CMD: set computername, set username

    ·      Prefer LDAP-based tools over net commands:
    Commands like net user, net group, and others are simple and effective—but they’re also noisy. These legacy commands generate logs that stand out and can quickly catch the attention of monitoring tools. Instead, use LDAP-based
    enumeration tools like PowerView, ADFind. It’s used constantly by legitimate
    systems and services. So, when you stick to LDAP queries, your activity blends
    in with normal traffic—making it far less likely to raise any red flags.

    Choose Safer Credential Dumping Methods

    LSASS holds juicy credentials, but it’s also one of the most heavily monitored processes. Touching it directly is risky. Instead, consider these quieter sources:

    ·      SAM Hive (Registry) – For local user account hashes

    ·      SECURITY Hive / LSA Secrets – For service account passwords and cached domain credentials

    ·      DPAPI-Protected Files – For saved browser data, credentials, and Azure tokens

    ·      PSReadline History – Often contains credentials or mistyped secrets in plain text

    Be Tactical with Kerberos Ticket Attacks

    ·      Avoid Domain Admins:
    These accounts are highly sensitive and constantly watched. Instead, go after privileged service accounts or delegated admins, which are usually less guarded.

    ·       Golden Tickets: Use With Caution

    o  Always use AES keys instead of NTLM/RC4 for lower detection rates

    o  Golden Tickets skip the Kerberos AS-REQ/AS-REP process, making them moresuspicious in logs

    o  Use only when necessary and keep lifetimes short

    ·       Prefer Silver Tickets

    o  These target services (like CIFS, MSSQL, etc.) and avoid Domain
    Controllers altogether

    o  Less likely to be detected because they don’t involve the KDC

    o  RC4 can be used here, especially for older service accounts still using
    it

    ·       Use Diamond Tickets for Stealth

    o  Modify real, captured TGTs instead of forging new ones

    o  Since the original ticket passed through AS-REQ/AS-REP, it blends in
    naturally and is far less suspicious

    Minimize Noise During Enumeration

    ·      Kerberoast One Account at a Time: 
     Bulk Kerberoasting is a red flag. Instead,
    identify high-value SPNs and target them individually.

    ·      Don’t Touch LSASS Unless You Must:
     Exhaust registry and file-based credential
    sources before considering LSASS dumping.

    ·      Even klist Can Be Loud:
     Some EDRs flag the klist command. If needed, run it via Rubeus using a loader to stay quiet.

    OpSec isn’t just about hiding—it’s about being intentional. Every action you take can either blend in or stand out. Choosing the right tools, using native alternatives, and thinking like a blue team defender will let you explore more, escalate better, and operate longer.

    A Basic AD Attack Path

    The attack path used in this example is just a basic, straightforward
    one. In real-world scenarios, the path can go in different directions depending
    on the environment, available privileges, and opportunities for lateral
    movement. The actual flow of an AD attack may involve more complexity, with
    attackers taking advantage of various misconfigurations, vulnerabilities, or
    trust relationships to reach the Domain Controller.

    Let’s say you’re inside a company’s internal network after a successful
    phishing attack. You land on an employee’s Windows machine as a low-privileged
    domain user.

    Step 1: Settling Into the Foothold

    You check the basics:

    ·       Who am I?
     (Instead of noisy commands like whoami, you use PowerShell’s quieter: $env:USERNAME, $env:COMPUTERNAME)

    ·       What am I running on?
     (Seatbelt gives you a full breakdown of OS
    info, processes, services, UAC settings, and more.)

    You’re just a normal user. No admin rights yet.

    Step 2: Escalating Privileges Locally

    You run SharpUp to look for misconfigurations.

    Boom—there’s a service running with SYSTEM privileges, but the binary
    path is unquoted and writable by you. You replace it with your payload and
    restart the service.

    Now, you’re local admin on this machine.

    Step 3: Dumping Credentials

    With admin rights, you dump credentials.

    Instead of going for LSASS (too noisy), you check:

    ·      The SAM hive for local accounts.

    ·      The LSA secrets for cached domain creds.

    ·      You also peek at PSReadline history—and jackpot! A developer had stored
    a password in cleartext while testing.

    You now have a password for another user, who seems more privileged.

    Step 4: Mapping the Network

    Time to plan your next move.

    You deploy SharpHound to collect AD data, then load it in BloodHound.
    You see that this newly found user has local admin rights on another server.

    That’s your next stop.

    Step 5: Lateral Movement

    You use Pass-the-Hash with the cracked NTLM hash from earlier to access
    the next server using Evil-WinRM.

    You’re now in.

    Step 6: Discovering Domain Escalation Paths

    On the new server, BloodHound reveals something critical:
     Your current user has GenericAll permission
    over a group that includes a user with DCSync rights.

    You update group membership using PowerView, wait for the change to
    apply, and then use Mimikatz’s DCSync feature to replicate all the hashes in
    the domain—including the KRBTGT hash.

    Step 7: Domain Dominance

    With the KRBTGT hash in hand, you forge a Golden Ticket using Mimikatz.

    You now have unlimited access across the domain, disguised as a Domain
    Admin.

    You’ve won. And you never touched LSASS directly or ran a single noisy
    net command.

    Conclusion

    Now that the foundation is in place, the next step is to explore each stage of an AD attack in detail—such as recon, lateral movement, and privilege escalation. More focused articles on these topics will be published soon.

    It’s important to note that the tools mentioned here are not the only set of tools available. Take the time to explore other tools as well. While the ones highlighted here are some of the most commonly used and effective in AD pentesting, there may be better alternatives that suit individual preferences or specific environments. Experimenting with different tools can help identify what works best for each unique situation.

    Hopefully, this article has provided a helpful head start. With the right mindset from the beginning, the learning process will be faster and more efficient, allowing you to avoid
    unnecessary mistakes as you progress.

  • Salt Typhoon Strikes: Over 1,000 Cisco Devices Compromised

    Salt Typhoon Strikes: Over 1,000 Cisco Devices Compromised

    The ever-evolving landscape of cyber threats has once again seen a sophisticated attack targeting critical infrastructure. In a recent cybersecurity alert, researchers uncovered a large-scale cyber-espionage operation orchestrated by a threat group known as Salt Typhoon. This state-backed hacking group exploited vulnerabilities in Cisco network devices, affecting over 1,000 systems worldwide.

    How the Attack Unfolded

    Salt Typhoon, identified as an advanced persistent threat (APT) group, leveraged unpatched vulnerabilities in Cisco’s IOS XE operating system to gain unauthorized access to targeted devices. The attackers exploited critical flaws, particularly CVE-2023-20198 and CVE-2023-20273, which allowed them to escalate privileges and obtain administrative control over network routers.

                                                                                     Source: cybersecuritynews 

    Once access was gained, the hackers deployed malicious configurations that enabled the creation of covert communication channels. One of the primary techniques involved setting up Generic Routing Encapsulation (GRE) tunnels, which allowed them to maintain stealthy and persistent access. These tunnels facilitated the extraction of sensitive data while bypassing conventional security controls.

    Key Targets and Impact

    Salt Typhoon’s attack campaign predominantly focused on high-value targets, including:

    • Telecommunications Providers: A major focus of the attack, as these networks provide critical infrastructure for communications and data transfer.

    • Academic Institutions: Universities and research centers with a strong emphasis on engineering, IT, and cybersecurity were affected, potentially exposing proprietary research and sensitive collaborations.

    • Government and Enterprise Networks: Organizations involved in strategic sectors, including defense and finance, also found themselves in the crosshairs.

                                                                                  Source: cybersecuritynews

    The attack had global ramifications, with the highest concentration of breaches reported in the United States, India, and South America. The scale of infiltration suggests a well-coordinated effort aimed at long-term intelligence gathering rather than immediate financial gains.

    Methods of Exploitation

    Salt Typhoon’s methodology showcases a high level of sophistication in targeting unpatched and outdated network devices. Their approach included:

    1. Initial Reconnaissance: Identifying publicly exposed Cisco devices and assessing their vulnerability status.

    2. Privilege Escalation: Exploiting zero-day vulnerabilities to gain root-level access.

    3. Stealthy Persistence: Deploying GRE tunnels to maintain covert control and exfiltrate data over encrypted channels.

    4. Manipulating Network Traffic: Redirecting or intercepting data flows to monitor and extract intelligence.

    Why This Attack Is Alarming

    This large-scale breach underscores a significant gap in network security across organizations relying on outdated Cisco hardware. The attack highlights key concerns such as:

    • Insufficient Patch Management: Many organizations failed to apply security updates in a timely manner, leaving them exposed to known exploits.

    • Underestimated Risk of Network Appliances: While endpoint security receives significant attention, network infrastructure security is often overlooked, making routers and switches attractive targets for attackers.

    • Advanced Tactics in Cyber-Espionage: The use of GRE tunnels and privilege escalation techniques reflects the increasing sophistication of state-backed hacking groups.

    Steps to Mitigate Such Attacks

    To prevent similar breaches in the future, organizations should adopt proactive cybersecurity strategies:

    • Immediate Patching: Apply security updates for Cisco IOS XE software to close the exploited vulnerabilities.

    • Access Restriction: Disable unnecessary web-based administrative interfaces and limit access to trusted IPs.

    • Continuous Monitoring: Deploy security solutions that detect unauthorized configuration changes or suspicious tunneling activities.

    • Network Segmentation: Implement segmentation strategies to restrict lateral movement within an organization’s infrastructure.

    • Incident Response Planning: Establish robust incident response protocols to quickly detect and mitigate network intrusions.

    The Bigger Picture: State-Sponsored Threats on the Rise

    The Salt Typhoon attack serves as a stark reminder that state-sponsored cyber threats are growing in scale and complexity. These operations are not driven by financial motives but by geopolitical objectives, focusing on intelligence gathering and long-term surveillance.

    As cyber-espionage campaigns become more sophisticated, organizations must prioritize security at the infrastructure level, ensuring their network devices are not the weakest link in their cybersecurity posture.

    Conclusion

    The exploitation of over 1,000 Cisco devices by Salt Typhoon is a wake-up call for enterprises and government agencies alike. Proactive security measures, timely patching, and advanced threat detection mechanisms are crucial in mitigating such threats. With cyber warfare intensifying, staying ahead of adversaries requires constant vigilance and a robust security framework.

    Reference: Baran, G. (2025b, February 14). RedMike hackers exploited 1000+ cisco devices to gain admin access . Cyber Security News. https://cybersecuritynews.com/salt-typhoon-hackers-exploited-1000-cisco-devices/

  • OpenAI Data Breach Exposes 20 Million User Credentials: What You Need to Know

    OpenAI Data Breach Exposes 20 Million User Credentials: What You Need to Know

    In recent years, artificial intelligence (AI) has taken center stage in technological advancements, with companies like OpenAI leading the charge. However, with great innovation comes great responsibility—especially in cybersecurity. Recent reports suggest that threat actors on dark web forums allege they have stolen and leaked 20 million OpenAI user login credentials. This claim, if verified, would mark one of the most substantial data breaches in the tech industry to date. 

    According to Bleeping Computer, sources indicate that OpenAI may have suffered an internal security incident that led to unauthorized access to proprietary research and discussions. SecurityWeek further reported that the breach could involve leaked employee credentials, raising concerns about insider threats or phishing attacks targeting OpenAI personnel.

    Understanding the Alleged Breach

    According to a report by CyberDaily, an anonymous source has claimed to have accessed OpenAI’s internal discussions and proprietary information. The details of the breach remain unclear, but there are indications that certain confidential messages and internal documents may have surfaced on underground hacking forums. The anonymous threat actor advertised their haul on a dark web forum, stating, “I have more than 20 million access codes to OpenAI accounts. If you want, you can contact me – this is a treasure, and Jesus thinks so too.” They also expressed concerns about OpenAI potentially auditing accounts in bulk, implying that their password might be exposed during such checks.

    Threat actor’s claims on an underground forum (Source : HackManac)

    The credentials, comprising email addresses and passwords, are reportedly being offered for sale at minimal prices. While the authenticity of these claims remains unverified, the sheer volume of purportedly compromised accounts has raised alarms among cybersecurity experts and users alike.

    As of now, OpenAI has not issued an official statement confirming or denying the alleged breach. In similar situations, organizations typically initiate thorough investigations and collaborate with cybersecurity experts to assess the validity of such claims and mitigate potential damages.

    Potential Risks and Consequences

    If the alleged breach is genuine, it could have far-reaching implications for OpenAI and the wider AI industry. Some of the key risks include:

    1. Intellectual Property Theft

    One of the biggest concerns in this scenario is the potential exposure of OpenAI’s proprietary algorithms, research, and AI training data. AI companies invest years into developing innovative models, and if their intellectual property is leaked, it could lead to unauthorized replication or misuse.

    2. Data Privacy Concerns

    If customer or user data was accessed, OpenAI could face severe regulatory scrutiny. With strict data protection laws such as GDPR in Europe and CCPA in California, any mishandling of personal data could result in significant legal and financial consequences. Reports indicate that up to 100,000 user accounts may have been affected, raising serious privacy concerns.

    3. Trust and Reputation Damage

    A cybersecurity incident of this scale could erode trust among OpenAI’s customers, partners, and investors. AI companies, particularly those working with enterprises and governments, must maintain high security standards. Any sign of vulnerability could make potential clients hesitant to adopt AI-driven solutions.

    4. Potential National Security Implications

    Given that OpenAI collaborates with governments and large enterprises on AI research, a data leak could have national security implications. Sensitive AI advancements in areas like cybersecurity, automation, and defense could fall into the wrong hands, leading to geopolitical concerns.

    5. Risk of Model Manipulation and AI Misuse

    If adversaries gain access to OpenAI’s proprietary AI models, they could manipulate the datasets or tweak the training processes to introduce bias, misinformation, or security vulnerabilities. Malicious actors could repurpose AI tools for nefarious purposes, such as generating deepfake content or automating cyberattacks.

    Lessons for the AI Industry

    Whether or not the OpenAI data breach is confirmed, this incident serves as an essential reminder for AI companies worldwide to reinforce their cybersecurity frameworks. Here are some crucial steps that organizations developing AI should take:

    1. Implement Zero Trust Security

    A Zero Trust architecture ensures that no system, user, or device is automatically trusted. Every access request must be verified through authentication and monitoring, reducing the risk of unauthorized intrusions.

    2. Conduct Regular Cybersecurity Audits

    Routine security assessments help identify and address vulnerabilities before threat actors can exploit them. Companies should also conduct penetration testing to evaluate how well their defenses hold up against real-world attack scenarios.

    3. Deploy AI-Driven Threat Detection

    Ironically, AI itself can be a powerful tool in cybersecurity. AI-driven security analytics can detect anomalies and potential threats in real time, allowing organizations to respond proactively to cyber risks.

    4. Strengthen Employee Awareness & Access Controls

    Human error is often a leading cause of data breaches. Organizations must invest in cybersecurity awareness programs to train employees on secure communication practices and access control measures.

    5. Adopt Secure Development Practices

    AI developers should integrate security into the software development lifecycle (SDLC) by using secure coding practices, regular code reviews, and encrypted storage for sensitive data.

    6. Monitor Dark Web for Leaked Credentials

    Organizations should proactively monitor dark web forums and underground marketplaces for leaked employee credentials and sensitive corporate data to prevent exploitation. Reports suggest that cybercriminals attempted to sell OpenAI’s stolen data on underground marketplaces, increasing concerns about cyber espionage.

    7. Strengthen API and Cloud Security

    Given the heavy reliance on cloud infrastructure, AI companies must secure APIs, enforce strict access policies, and use multi-layer encryption for data storage and transmission.

    Conclusion

    The OpenAI alleged data breach, whether real or speculative, underscores the urgent need for robust cybersecurity in the AI industry. As AI technologies become more sophisticated, they also become more attractive targets for cybercriminals and nation-state actors. Organizations developing AI-driven solutions must prioritize security as a fundamental pillar of their operations.

    For enterprises relying on AI, the takeaway is clear: Investing in cybersecurity is not just about protecting intellectual property—it’s about ensuring trust, compliance, and the long-term viability of AI advancements. As the AI industry continues to evolve, so must its approach to safeguarding its most valuable asset—data.

    Reference: 

    Baran, G. (2025, February 6). OpenAI Data Breach: Threat actor allegedly claims 20 million logins for sale. Cyber Security News. https://cybersecuritynews.com/openai-alleged-data-breach/

  • Connecting Kali Linux to Active Directory Made Easy

    Connecting Kali Linux to Active Directory Made Easy

    TL;DR

    Joining Kali Machine to AD:

    1. Change DNS Server: Edit `/etc/resolv.conf` to set the AD server as DNS.
    2. Install Tools: Run `sudo apt update` and install required packages.
    3. Join Domain: Discover the domain with `sudo realm discover THEHIVE.LOCAL` and join with `sudo realm join –user=<username> <DOMAIN NAME>

    Common Errors:

    No Installation Candidate: Add the correct repository to `/etc/apt/sources.list` and update.

    Insufficient Privileges:

    • Ensure the AD account used has admin rights or use an admin account.
    • Ensure that `/etc/krb5.conf` If not create one with the content given in this article.

    Introduction

    This short blog will focus mainly on how to join a Kali Linux machine to AD. During the process we encountered a few issues for which we couldn’t find many good articles that discuss the same. Instead of just giving instructions, this article aims to quickly resolve two common issues you might run into, saving you the trouble of searching through multiple articles for solutions.

    Joining a Kali VM to AD

    This is the same process that is followed in general for Debian distributions.

    Step 1 – Changing the DNS server

    1.    Open the “/etc/resolv.conf “ using any text editor. It should be opened using sudo so that it can be edited.

    sudo nano /etc/resolv.conf

     

    2.   Comment out the initial nameserver entry and add a new entry to configure the AD windows server as the DNS server. You can find the IP in the “DNS” section in the “Server Manager”.

    3.      Confirm that the domain is accessible by pinging the domain.

    ping thehive.local

    Note:
    The nameserver settings in /etc/resolv.conf aren’t persistent across reboots, but using any tool like “resolvconf” to manage the file can resolve this issue. An article on configuring DNS in Linux will be posted in the future for more detailed guidance.

    Step 2 – Install
    required tools

    1.      Do a sudo update

    sudo apt update

    2.      Install all the required tools

    sudo apt -y install realmd libnss-sss libpam-sss sssd sssd-tools adcli samba-common-bin oddjob oddjob-mkhomedir packagekit

    Step 3 – Joining AD

    1.       This command lists the basic configuration of the AD along with the tools that must be installed in the machine to join the domain. A domain must be discoverable first to join it.

     

    sudo realm discover THEHIVE.LOCAL

     

    2.       We don’t have to worry about the tools as we have already installed all the tools.

    3.       Once we see that the domain is discoverable, we can join this machine to the domain. For this, we need the credentials of an account that belongs to the domain.

    4.       We can now join this machine to AD using the below command.

    sudo realm join –user=ad-admin THEHIVE.LOCAL

    Note that the account mentioned in the user account must be an AD user account, not this machine’s local one. Make sure this account is part of the Administrator group, or it’ll cause an error detailed in the coming section.

    Common Errors Encountered

    Error – Package has no installation candidate

    You might see an error saying “Package ‘<package name>’ has no installation candidate” when trying to install some tools. This happens because your package manager, like “apt,” is trying to get the package from a repository that doesn’t have it. To fix this, you need to add the right repository to your “sources.list” file. This file lists the URLs of repositories that apt uses, and it’s located at “/etc/apt/sources.list.”

    1.      Visit         this site and scroll down to the package search section. 

     

    2.      Search for the package you need.

    3.   Click on the package name under “Exact hits” to see more details. You can also select a specific release if needed by clicking on their respective names at the top right corner.

    4.   Scroll down to the download section, find your system architecture (like amd64 or i386), and open the link.

    5.      Note the repository URL listed on that page.

    6.    Open the “/etc/apt/sources.list” file in a text editor with sudo, so you have permission to edit it.

     

    sudo nano /etc/apt/sources.list

    7.      Add the copied repository URL to this file and save your changes.

    8.      Run apt update to refresh the package list.

    sudo apt update

     

    9.   Try installing the tools again. They should install without any issues now.

     Insufficient Privileges

    If you’re encountering this error, it might be due to a few different issues. To identify the problem, follow these steps:

    1.      Copy and run the command provided with the error message

    journalctl REALMD_OPERATION=r417249.186880

    2.  Press Enter repeatedly to scroll through the log until you find the relevant error details.

    Two common issues are as below:

    Couldn’t get Kerberos ticket

     

    If the error indicates that the machine failed to join AD due to an inability to obtain a Kerberos ticket, it might be because the `/etc/krb5.conf` file is missing. This file is usually created automatically, but if it isn’t present, you can create it manually.

    1.       Use the following command to create and edit
    the file:

    sudo nano /etc/krb5.conf

     Add the following
    configuration:

    [libdefaults]

    udp_preference_limit = 0

    default_realm = THEHIVE.LOCAL

    2.      Try joining the machines to AD again. It
    should be able to join without any issues.

     Insufficient permissions to modify computer account

     In this case, from the log, you can see that the computer account for this machine is missing in AD, and a new account can’t be created due to insufficient permissions. The problem typically arises when the account used to join the machine to AD does not have the required administrative rights.

    To fix this, either use an administrator account or add the current account to the administrator group.

    Conclusion

    In summary, these steps should work for most Debian-based systems, not just Kali Linux. We hope this guide helps you avoid common problems and saves you time. Keep an eye out for our next posts, where we’ll cover important Active Directory attacks to help you better protect your systems.

     

  • 2024’s Leading Malware Techniques You Should Know

    2024’s Leading Malware Techniques You Should Know

    Modern defense strategies heavily rely on tactics, techniques, and procedures (TTPs) as a stable framework for identifying cyber threats. Unlike indicators of compromise (IOCs), TTPs are more enduring, providing a consistent foundation to detect specific threats. Based on ANY.RUN’s Q3 2024 malware trends report, here are some of the most frequently utilized techniques, illustrated through real-world cases.

    1. Disabling of Windows Event Logging (T1562.002)

    By disrupting Windows Event Logging, attackers prevent the recording of key details about their activities, such as login attempts and system changes. Without these logs, security teams face gaps in data, making it harder to trace malicious behavior. Common manipulation tactics include altering registry keys, stopping services with commands like “net stop eventlog,” and modifying group policies. Since many detection tools depend on log analysis to identify unusual actions, malware can evade detection for extended periods.

    XWorm Disables Remote Access Service Logs– 

    To detect malware in real-time and understand its behavior, it’s essential to execute it in a controlled environment while monitoring system and network activity. By tracking malicious actions, such as altering system logs or disabling security features like Windows Event Logging, security professionals can identify indicators of compromise. This approach helps in pinpointing the malware’s operational patterns and objectives, allowing for effective response and mitigation of potential threats within the network or system environment.

    Check out this session showing how XWorm, a prevalent remote access trojan (RAT), utilizes tactic T1562.002.

    It alters the registry to disable trace logs for RASAPI32, the component managing remote access connections on the system.

    By adjusting registry settings like ENABLEAUTOFILETRACING for RASAPI32 to 0, attackers effectively block log generation, which hinders security tools from detecting suspicious activity.

    2. PowerShell Exploitation (T1059.001)

    PowerShell, a built-in Windows scripting language and command-line tool, is frequently exploited by attackers for tasks like changing system settings, data exfiltration, and maintaining access. Its powerful capabilities allow threat actors to use obfuscation techniques, such as command encoding and complex scripting, to evade detection.
    BlanGrabber uses PowerShell to bypass security detection

    This analysis focuses on a BlankGrabber sample, a type of malware designed to steal sensitive information from compromised systems. Upon execution, the malware launches multiple processes, including PowerShell, to alter system settings and avoid detection by security tools. It specifically targets vulnerabilities to disable protective measures and ensure it remains undetected. By modifying key configurations, the malware can bypass security monitoring and maintain control over the infected system, allowing it to exfiltrate sensitive data without triggering alarms.

    For example, BlankGrabber uses PowerShell to disable key security features of Windows, such as the Intrusion Prevention System (IPS), OAV Protection, and Real-time Monitoring services. 

    3. Windows Command Shell (T1059.003) Exploitation

    Attackers often misuse the Windows Command Shell (cmd.exe), a tool intended for legitimate administrative tasks, to execute malicious commands. Its common use allows harmful actions to blend in with regular system activity, making detection harder. By running scripts or downloading malware, attackers can exploit cmd.exe, and even use obfuscation techniques to evade security measures. Since it’s a trusted utility, malicious commands often go unnoticed by real-time monitoring systems.

    Lumma Utilizes CMD for Payload Delivery

    Here’s an analysis of Lumma, a widely used information stealer active since 2022, highlighting its key features and methods of operation.
     

     

    Lumma uses the Windows Command Shell (cmd) to execute malicious commands, delivering its payload while evading detection. It launches applications with unusual extensions and modifies executable content, masking its true intentions. This method helps Lumma avoid security measures and ensures it remains undetected on the system, allowing it to steal sensitive data without triggering alarms.

    4. Exploiting Registry Run Keys (T1547.001) 

    Attackers ensure malware runs at startup by adding entries to registry keys that trigger program launches or by placing files in the Startup Folder, which Windows automatically executes during login. This method grants persistent access, allowing attackers to continue malicious activities such as data theft, lateral movement, or further system exploitation.

    Remcos Maintains Access via RUN Key

    Here’s an example of how Remcos uses this technique. The malware modifies the registry key at HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN 
    to ensure its persistence. This key is specifically used to launch programs automatically upon system startup.

    5. Evasion Through Timing Manipulation (T1497.003)

    Time-based evasion is a tactic malware uses to avoid detection by security systems, particularly sandboxes with short monitoring windows. By delaying malicious actions, the malware can evade detection before the sandboxing period ends.

    This technique also helps malware appear harmless initially, reducing the chance of being flagged during behavioral analysis. Additionally, delays can synchronize various components of the malware or manage dependencies in its infection process, ensuring each step happens in the correct order before the full attack is launched.

    DCRAT Evades Detection with Delayed Execution

    Dark Crystal RAT is a malware family that uses time-based evasion techniques to remain undetected on compromised systems. By delaying the execution of malicious actions, it can avoid detection by security tools, allowing the malware to operate quietly without triggering alarms. This method helps it bypass sandboxes and behavioral analysis systems that monitor for suspicious activity during a limited observation window.

    In this sandbox session, DCRAT remains idle for 2 seconds (2000 milliseconds) before proceeding with its execution. This brief delay likely ensures that all necessary files for the next phase of the infection are fully prepared and ready to run. This tactic helps synchronize the malware’s components, ensuring a smoother execution process without triggering detection mechanisms.

    DCRAT also uses the legitimate tool w32tm.exe as part of its time-based evasion strategy. This tool is typically used for time synchronization, but in this case, it serves to introduce a delay in the malware’s execution process, helping it avoid detection and making it harder for security systems to identify malicious behavior. This tactic is another example of how DCRAT manipulates system tools to evade security monitoring.

     

    Reference –  The Hacker News. (2024, November 7). 5 most common malware techniques in 2024. https://thehackernews.com/2024/11/5-most-common-malware-techniques-in-2024.html