home.social

#ics — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #ics, aggregated by home.social.

  1. Life Japan @[email protected] ·

    wacoca.com/life/401754/ 保険業界は「経済価値ベースのソルベンシー比率」導入で何が変わるのか？有識者3人が徹底討論、内部モデル活用に課題も【鼎談前編】 | ダイヤモンド保険ラボ | ダイヤモンド・オンライン #AIR #ALM #ESR #Hoken #IAIS #ICS #Insurance #キャピタスコンサルティング #保険 #保険資本基準 #明治大学 #松山直樹 #森本祐司 #植村信保 #福岡大学 #経済価値ベースのソルベンシー比率 #経済価値ベースのソルベンシー規制 #資産集約型再保険 #金利上昇 #金融危機 #金融庁

    #air #alm #esr #hoken #iais #ics
  2. Life Japan @[email protected] ·

    wacoca.com/life/401754/ 保険業界は「経済価値ベースのソルベンシー比率」導入で何が変わるのか？有識者3人が徹底討論、内部モデル活用に課題も【鼎談前編】 | ダイヤモンド保険ラボ | ダイヤモンド・オンライン #AIR #ALM #ESR #Hoken #IAIS #ICS #Insurance #キャピタスコンサルティング #保険 #保険資本基準 #明治大学 #松山直樹 #森本祐司 #植村信保 #福岡大学 #経済価値ベースのソルベンシー比率 #経済価値ベースのソルベンシー規制 #資産集約型再保険 #金利上昇 #金融危機 #金融庁

    #金融庁 #金融危機 #金利上昇 #資産集約型再保険 #経済価値ベースのソルベンシー規制 #経済価値ベースのソルベンシー比率
  3. OTX Bot @[email protected] ·

    The Gentleman Ransomware | Defense Evasion TTPs Uncovered

    In April and May 2026, investigations revealed two incidents involving The Gentlemen ransomware-as-a-service operation, which has claimed over 400 victims across 70 countries since mid-2025. Both incidents demonstrated common tactics including Scheduled Tasks, PowerShell commands, and defense evasion techniques such as clearing Security, System, and Application Event Logs, disabling Microsoft Defender, and adding antivirus exclusions. A leaked internal database in early May exposed the operation's infrastructure, affiliate structure, and targeting of vulnerabilities like CVE-2024-55591. The attacks showed threat actors using RDP connections, disguised executables, SOCKS proxy connections for persistence, and domain-wide deployment via NETLOGON shares. Despite attempts to evade detection, sufficient forensic telemetry remained for analysis, revealing workstation names previously associated with Qilin ransomware and Lazarus infrastructure.

    Pulse ID: 6a0f8f34dd916c38a643df30
    Pulse Link: otx.alienvault.com/pulse/6a0f8
    Pulse Author: AlienVault
    Created: 2026-05-21 23:03:16

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Lazarus #Microsoft #MicrosoftDefender #OTX #OpenThreatExchange #PowerShell #Proxy #RAT #RDP #RansomWare #RansomwareAsAService #bot #AlienVault

    #cybersecurity #ics #infosec #lazarus #microsoft #microsoftdefender
  4. OTX Bot @[email protected] ·

    The Gentleman Ransomware | Defense Evasion TTPs Uncovered

    In April and May 2026, investigations revealed two incidents involving The Gentlemen ransomware-as-a-service operation, which has claimed over 400 victims across 70 countries since mid-2025. Both incidents demonstrated common tactics including Scheduled Tasks, PowerShell commands, and defense evasion techniques such as clearing Security, System, and Application Event Logs, disabling Microsoft Defender, and adding antivirus exclusions. A leaked internal database in early May exposed the operation's infrastructure, affiliate structure, and targeting of vulnerabilities like CVE-2024-55591. The attacks showed threat actors using RDP connections, disguised executables, SOCKS proxy connections for persistence, and domain-wide deployment via NETLOGON shares. Despite attempts to evade detection, sufficient forensic telemetry remained for analysis, revealing workstation names previously associated with Qilin ransomware and Lazarus infrastructure.

    Pulse ID: 6a0f8f34dd916c38a643df30
    Pulse Link: otx.alienvault.com/pulse/6a0f8
    Pulse Author: AlienVault
    Created: 2026-05-21 23:03:16

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Lazarus #Microsoft #MicrosoftDefender #OTX #OpenThreatExchange #PowerShell #Proxy #RAT #RDP #RansomWare #RansomwareAsAService #bot #AlienVault

    #cybersecurity #ics #infosec #lazarus #microsoft #microsoftdefender
  5. OTX Bot @[email protected] ·

    The Gentleman Ransomware | Defense Evasion TTPs Uncovered

    In April and May 2026, investigations revealed two incidents involving The Gentlemen ransomware-as-a-service operation, which has claimed over 400 victims across 70 countries since mid-2025. Both incidents demonstrated common tactics including Scheduled Tasks, PowerShell commands, and defense evasion techniques such as clearing Security, System, and Application Event Logs, disabling Microsoft Defender, and adding antivirus exclusions. A leaked internal database in early May exposed the operation's infrastructure, affiliate structure, and targeting of vulnerabilities like CVE-2024-55591. The attacks showed threat actors using RDP connections, disguised executables, SOCKS proxy connections for persistence, and domain-wide deployment via NETLOGON shares. Despite attempts to evade detection, sufficient forensic telemetry remained for analysis, revealing workstation names previously associated with Qilin ransomware and Lazarus infrastructure.

    Pulse ID: 6a0f8f34dd916c38a643df30
    Pulse Link: otx.alienvault.com/pulse/6a0f8
    Pulse Author: AlienVault
    Created: 2026-05-21 23:03:16

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Lazarus #Microsoft #MicrosoftDefender #OTX #OpenThreatExchange #PowerShell #Proxy #RAT #RDP #RansomWare #RansomwareAsAService #bot #AlienVault

    #cybersecurity #ics #infosec #lazarus #microsoft #microsoftdefender
  6. OTX Bot @[email protected] ·

    The Gentleman Ransomware | Defense Evasion TTPs Uncovered

    In April and May 2026, investigations revealed two incidents involving The Gentlemen ransomware-as-a-service operation, which has claimed over 400 victims across 70 countries since mid-2025. Both incidents demonstrated common tactics including Scheduled Tasks, PowerShell commands, and defense evasion techniques such as clearing Security, System, and Application Event Logs, disabling Microsoft Defender, and adding antivirus exclusions. A leaked internal database in early May exposed the operation's infrastructure, affiliate structure, and targeting of vulnerabilities like CVE-2024-55591. The attacks showed threat actors using RDP connections, disguised executables, SOCKS proxy connections for persistence, and domain-wide deployment via NETLOGON shares. Despite attempts to evade detection, sufficient forensic telemetry remained for analysis, revealing workstation names previously associated with Qilin ransomware and Lazarus infrastructure.

    Pulse ID: 6a0f8f34dd916c38a643df30
    Pulse Link: otx.alienvault.com/pulse/6a0f8
    Pulse Author: AlienVault
    Created: 2026-05-21 23:03:16

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Lazarus #Microsoft #MicrosoftDefender #OTX #OpenThreatExchange #PowerShell #Proxy #RAT #RDP #RansomWare #RansomwareAsAService #bot #AlienVault

    #alienvault #bot #ransomwareasaservice #ransomware #rdp #rat
  7. OTX Bot @[email protected] ·

    The Gentleman Ransomware | Defense Evasion TTPs Uncovered

    In April and May 2026, investigations revealed two incidents involving The Gentlemen ransomware-as-a-service operation, which has claimed over 400 victims across 70 countries since mid-2025. Both incidents demonstrated common tactics including Scheduled Tasks, PowerShell commands, and defense evasion techniques such as clearing Security, System, and Application Event Logs, disabling Microsoft Defender, and adding antivirus exclusions. A leaked internal database in early May exposed the operation's infrastructure, affiliate structure, and targeting of vulnerabilities like CVE-2024-55591. The attacks showed threat actors using RDP connections, disguised executables, SOCKS proxy connections for persistence, and domain-wide deployment via NETLOGON shares. Despite attempts to evade detection, sufficient forensic telemetry remained for analysis, revealing workstation names previously associated with Qilin ransomware and Lazarus infrastructure.

    Pulse ID: 6a0f8f34dd916c38a643df30
    Pulse Link: otx.alienvault.com/pulse/6a0f8
    Pulse Author: AlienVault
    Created: 2026-05-21 23:03:16

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Lazarus #Microsoft #MicrosoftDefender #OTX #OpenThreatExchange #PowerShell #Proxy #RAT #RDP #RansomWare #RansomwareAsAService #bot #AlienVault

    #cybersecurity #ics #infosec #lazarus #microsoft #microsoftdefender
  8. DomainTools @[email protected] ·

    Our team at DomainTools Investigations (DTI) took a deep dive into the ZionSiphon malware sample(“SCADA_SecurityPatch_v8.4.exe”) that’s been circling in sandboxes since 2025.

    Read our investigation here⬇️ dti.domaintools.com/research/t
    #Cybersecurity #ICS #Malware #InfoSec #DomainTools

    #cybersecurity #ics #malware #infosec #domaintools
  9. DomainTools @[email protected] ·

    Our team at DomainTools Investigations (DTI) took a deep dive into the ZionSiphon malware sample(“SCADA_SecurityPatch_v8.4.exe”) that’s been circling in sandboxes since 2025.

    Read our investigation here⬇️ dti.domaintools.com/research/t
    #Cybersecurity #ICS #Malware #InfoSec #DomainTools

    #cybersecurity #ics #malware #infosec #domaintools
  10. DomainTools @[email protected] ·

    Our team at DomainTools Investigations (DTI) took a deep dive into the ZionSiphon malware sample(“SCADA_SecurityPatch_v8.4.exe”) that’s been circling in sandboxes since 2025.

    Read our investigation here⬇️ dti.domaintools.com/research/t
    #Cybersecurity #ICS #Malware #InfoSec #DomainTools

    #cybersecurity #ics #malware #infosec #domaintools
  11. DomainTools @[email protected] ·

    Our team at DomainTools Investigations (DTI) took a deep dive into the ZionSiphon malware sample(“SCADA_SecurityPatch_v8.4.exe”) that’s been circling in sandboxes since 2025.

    Read our investigation here⬇️ dti.domaintools.com/research/t
    #Cybersecurity #ICS #Malware #InfoSec #DomainTools

    #domaintools #infosec #malware #ics #cybersecurity
  12. DomainTools @[email protected] ·

    Our team at DomainTools Investigations (DTI) took a deep dive into the ZionSiphon malware sample(“SCADA_SecurityPatch_v8.4.exe”) that’s been circling in sandboxes since 2025.

    Read our investigation here⬇️ dti.domaintools.com/research/t
    #Cybersecurity #ICS #Malware #InfoSec #DomainTools

    #cybersecurity #ics #malware #infosec #domaintools
  13. OTX Bot @[email protected] ·

    The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

    The ClickFix campaign has evolved from basic disk-based infections to sophisticated, obfuscated attacks using fake CAPTCHA pages that trick victims into executing malicious PowerShell commands. Initial variants used cleartext commands downloading batch scripts to deploy DeerStealer InfoStealer. The campaign advanced to fileless execution using XOR encryption or Base64 compression, operating entirely in memory. The most dangerous evolution involves server-side polymorphism, where attacker infrastructure dynamically generates unique obfuscated payloads for each victim, delivering Vidar InfoStealer. Active since March 2026 with surging activity through May, the campaign utilizes approximately 4,500 live domains. Both XOR and Base64 variants execute payloads in memory, download executables from attacker infrastructure, and delete traces to evade forensics.

    Pulse ID: 6a0d971608b49dfc89267777
    Pulse Link: otx.alienvault.com/pulse/6a0d9
    Pulse Author: AlienVault
    Created: 2026-05-20 11:12:22

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CAPTCHA #CyberSecurity #Encryption #ICS #InfoSec #InfoStealer #OTX #OpenThreatExchange #PowerShell #RAT #Vidar #bot #AlienVault

    #captcha #cybersecurity #encryption #ics #infosec #infostealer
  14. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.05.2, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.05.2 is out?!? What, already? Déjà vu? We bumped up to the timetable on this release as a critical vulnerability found in NGINX made it expedient for us to do so.

    Malcolm v26.05.2 focuses heavily on security updates, most notably upgrading OpenResty to address a critical NGINX remote code execution heap buffer overflow vulnerability. It also adds new Suricata OT detections for D-Link HNAP abuse, improves alerting webhook support, introduces the File Tree dashboard, and includes Suricata parsing/mapping fixes and documentation updates. Several other components received version bumps as well.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Reference Counting (Use-After-Free) Bug for PyList_SetItem in filescan's python-statfs (#960 #962)
      • Added a few missing Suricata fields (suricata.tc_progress, suricata.ts_progress, suricata.tunnel.pcap_cnt, suricata.tunnel.pkt_src) to the index mapping template
      • When suricata.app_proto_ts and/or suricata.app_proto_tc reported that protocol parsing had failed (due to malformed input data), invalid data could be stored in HTTP, DNS, and/or TLS fields. This is now detected and those invalid values are dropped, and some combination of proto_parse_failed, client_stream_failed, or server_stream_failed are added to tags.
      • Suricata's HTTP version was not being normalized to network.protocol_version.
    • 🧹 Code and project maintenance

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  15. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.05.2, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.05.2 is out?!? What, already? Déjà vu? We bumped up to the timetable on this release as a critical vulnerability found in NGINX made it expedient for us to do so.

    Malcolm v26.05.2 focuses heavily on security updates, most notably upgrading OpenResty to address a critical NGINX remote code execution heap buffer overflow vulnerability. It also adds new Suricata OT detections for D-Link HNAP abuse, improves alerting webhook support, introduces the File Tree dashboard, and includes Suricata parsing/mapping fixes and documentation updates. Several other components received version bumps as well.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Reference Counting (Use-After-Free) Bug for PyList_SetItem in filescan's python-statfs (#960 #962)
      • Added a few missing Suricata fields (suricata.tc_progress, suricata.ts_progress, suricata.tunnel.pcap_cnt, suricata.tunnel.pkt_src) to the index mapping template
      • When suricata.app_proto_ts and/or suricata.app_proto_tc reported that protocol parsing had failed (due to malformed input data), invalid data could be stored in HTTP, DNS, and/or TLS fields. This is now detected and those invalid values are dropped, and some combination of proto_parse_failed, client_stream_failed, or server_stream_failed are added to tags.
      • Suricata's HTTP version was not being normalized to network.protocol_version.
    • 🧹 Code and project maintenance

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  16. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.05.2, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.05.2 is out?!? What, already? Déjà vu? We bumped up to the timetable on this release as a critical vulnerability found in NGINX made it expedient for us to do so.

    Malcolm v26.05.2 focuses heavily on security updates, most notably upgrading OpenResty to address a critical NGINX remote code execution heap buffer overflow vulnerability. It also adds new Suricata OT detections for D-Link HNAP abuse, improves alerting webhook support, introduces the File Tree dashboard, and includes Suricata parsing/mapping fixes and documentation updates. Several other components received version bumps as well.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Reference Counting (Use-After-Free) Bug for PyList_SetItem in filescan's python-statfs (#960 #962)
      • Added a few missing Suricata fields (suricata.tc_progress, suricata.ts_progress, suricata.tunnel.pcap_cnt, suricata.tunnel.pkt_src) to the index mapping template
      • When suricata.app_proto_ts and/or suricata.app_proto_tc reported that protocol parsing had failed (due to malformed input data), invalid data could be stored in HTTP, DNS, and/or TLS fields. This is now detected and those invalid values are dropped, and some combination of proto_parse_failed, client_stream_failed, or server_stream_failed are added to tags.
      • Suricata's HTTP version was not being normalized to network.protocol_version.
    • 🧹 Code and project maintenance

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  17. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.05.2, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.05.2 is out?!? What, already? Déjà vu? We bumped up to the timetable on this release as a critical vulnerability found in NGINX made it expedient for us to do so.

    Malcolm v26.05.2 focuses heavily on security updates, most notably upgrading OpenResty to address a critical NGINX remote code execution heap buffer overflow vulnerability. It also adds new Suricata OT detections for D-Link HNAP abuse, improves alerting webhook support, introduces the File Tree dashboard, and includes Suricata parsing/mapping fixes and documentation updates. Several other components received version bumps as well.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Reference Counting (Use-After-Free) Bug for PyList_SetItem in filescan's python-statfs (#960 #962)
      • Added a few missing Suricata fields (suricata.tc_progress, suricata.ts_progress, suricata.tunnel.pcap_cnt, suricata.tunnel.pkt_src) to the index mapping template
      • When suricata.app_proto_ts and/or suricata.app_proto_tc reported that protocol parsing had failed (due to malformed input data), invalid data could be stored in HTTP, DNS, and/or TLS fields. This is now detected and those invalid values are dropped, and some combination of proto_parse_failed, client_stream_failed, or server_stream_failed are added to tags.
      • Suricata's HTTP version was not being normalized to network.protocol_version.
    • 🧹 Code and project maintenance

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #inl #infosec #cyber #cybersecurity #icssecurity #ics
  18. Seth Grover @[email protected] ·
    CW: release notes for Malcolm v26.05.2, a network traffic analysis tool suite for network security monitoring

    Malcolm v26.05.2 is out?!? What, already? Déjà vu? We bumped up to the timetable on this release as a critical vulnerability found in NGINX made it expedient for us to do so.

    Malcolm v26.05.2 focuses heavily on security updates, most notably upgrading OpenResty to address a critical NGINX remote code execution heap buffer overflow vulnerability. It also adds new Suricata OT detections for D-Link HNAP abuse, improves alerting webhook support, introduces the File Tree dashboard, and includes Suricata parsing/mapping fixes and documentation updates. Several other components received version bumps as well.

    If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.

    github.com/idaholab/Malcolm/co

    • ✨ Features and enhancements
    • ✅ Component version updates
    • 🐛 Bug fixes
      • Reference Counting (Use-After-Free) Bug for PyList_SetItem in filescan's python-statfs (#960 #962)
      • Added a few missing Suricata fields (suricata.tc_progress, suricata.ts_progress, suricata.tunnel.pcap_cnt, suricata.tunnel.pkt_src) to the index mapping template
      • When suricata.app_proto_ts and/or suricata.app_proto_tc reported that protocol parsing had failed (due to malformed input data), invalid data could be stored in HTTP, DNS, and/or TLS fields. This is now detected and those invalid values are dropped, and some combination of proto_parse_failed, client_stream_failed, or server_stream_failed are added to tags.
      • Suricata's HTTP version was not being normalized to network.protocol_version.
    • 🧹 Code and project maintenance

    Malcolm is a powerful, easily deployable network 🖧 traffic analysis tool suite for network security monitoring 🕵🏻‍♀️.

    Malcolm operates as a cluster of containers 📦, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker 🐋, Podman 🦭, and Kubernetes ⎈. Check out the Quick Start guide for examples on how to get up and running.

    Alternatively, dedicated official ISO installer images 💿 for Malcolm and Hedgehog Linux 🦔 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split 🪓 into 2GB chunks and can be reassembled with scripts provided for both Bash 🐧 (release_cleaver.sh) and PowerShell 🪟 (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.

    As always, join us on the Malcolm discussions board 💬 to engage with the community, or pop some corn 🍿 and watch a video 📼.

    #Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL

    #malcolm #hedgehoglinux #zeek #arkime #strelka #netbox
  19. Netherlands @[email protected] ·

    ASML, Tata Electronics Partner on India’s First 300-mm Fab

    //php echo do_shortcode(‘[responsivevoice_button voice=”US English Male” buttontext=”Listen to Post”]’) ?> Netherlands-based Dutch lithography equipment maker ASML has signed a strategic partnership…
    #Netherlands #Nederland #NL #Europe #Europa #EU #ASML #EUVlithography #fabequipment #ICs #semiconductors #wafercapacity #wafermanufacturing
    europesays.com/netherlands/132

    #wafermanufacturing #wafercapacity #semiconductors #ics #fabequipment #euvlithography
  20. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab6894e0fcb58e1a56bd0
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:49:45

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #cybersecurity #ics #infosec #otx #openthreatexchange #rce
  21. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab6894e0fcb58e1a56bd0
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:49:45

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #cybersecurity #ics #infosec #otx #openthreatexchange #rce
  22. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab6894e0fcb58e1a56bd0
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:49:45

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #cybersecurity #ics #infosec #otx #openthreatexchange #rce
  23. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab6894e0fcb58e1a56bd0
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:49:45

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #tr1sa111 #bot #rce #openthreatexchange #otx #infosec
  24. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab6894e0fcb58e1a56bd0
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:49:45

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #cybersecurity #ics #infosec #otx #openthreatexchange #rce
  25. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab6942ce25e7ca5b9ed54
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:49:56

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #cybersecurity #ics #infosec #otx #openthreatexchange #rce
  26. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab6942ce25e7ca5b9ed54
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:49:56

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #cybersecurity #ics #infosec #otx #openthreatexchange #rce
  27. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab6942ce25e7ca5b9ed54
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:49:56

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #cybersecurity #ics #infosec #otx #openthreatexchange #rce
  28. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab6942ce25e7ca5b9ed54
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:49:56

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #tr1sa111 #bot #rce #openthreatexchange #otx #infosec
  29. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab6942ce25e7ca5b9ed54
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:49:56

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #cybersecurity #ics #infosec #otx #openthreatexchange #rce
  30. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab698394234e08ec70977
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:50:00

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #cybersecurity #ics #infosec #otx #openthreatexchange #rce
  31. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab698394234e08ec70977
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:50:00

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #cybersecurity #ics #infosec #otx #openthreatexchange #rce
  32. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab698394234e08ec70977
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:50:00

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #cybersecurity #ics #infosec #otx #openthreatexchange #rce
  33. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab698394234e08ec70977
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:50:00

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #tr1sa111 #bot #rce #openthreatexchange #otx #infosec
  34. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    Pulse ID: 6a0ab698394234e08ec70977
    Pulse Link: otx.alienvault.com/pulse/6a0ab
    Pulse Author: Tr1sa111
    Created: 2026-05-18 06:50:00

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #RCE #bot #Tr1sa111

    #cybersecurity #ics #infosec #otx #openthreatexchange #rce
  35. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    This analysis examines new obfuscation techniques employed by Gremlin stealer malware to conceal malicious payloads within embedded resources. A variant protected by sophisticated commercial packing utility uses instruction virtualization, transforming code into custom bytecode executed by a private virtual machine. The malware siphons sensitive information including payment card details, browser cookies, session tokens, cryptocurrency wallet data, and FTP/VPN credentials from compromised systems. It exfiltrates data to attacker-controlled servers at hxxp[:]194.87.92[.]109 for potential publication or sale. Recent iterations incorporate expanded Discord token extraction, active financial fraud through crypto clipper functionality that replaces cryptocurrency wallet addresses in real-time, and WebSocket-based session hijacking to bypass modern cookie protections. The malware employs advanced anti-analysis techniques including XOR-encoded payloads in .NET resource sections, identifier renaming, string encryp...

    Pulse ID: 6a073a73501adf1f890b1a5e
    Pulse Link: otx.alienvault.com/pulse/6a073
    Pulse Author: AlienVault
    Created: 2026-05-15 15:23:31

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Browser #Cookies #CyberSecurity #Discord #FinancialFraud #ICS #InfoSec #Mac #Malware #NET #OTX #OpenThreatExchange #RAT #RCE #Troll #VPN #bot #cryptocurrency #AlienVault

    #browser #cookies #cybersecurity #discord #financialfraud #ics
  36. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    This analysis examines new obfuscation techniques employed by Gremlin stealer malware to conceal malicious payloads within embedded resources. A variant protected by sophisticated commercial packing utility uses instruction virtualization, transforming code into custom bytecode executed by a private virtual machine. The malware siphons sensitive information including payment card details, browser cookies, session tokens, cryptocurrency wallet data, and FTP/VPN credentials from compromised systems. It exfiltrates data to attacker-controlled servers at hxxp[:]194.87.92[.]109 for potential publication or sale. Recent iterations incorporate expanded Discord token extraction, active financial fraud through crypto clipper functionality that replaces cryptocurrency wallet addresses in real-time, and WebSocket-based session hijacking to bypass modern cookie protections. The malware employs advanced anti-analysis techniques including XOR-encoded payloads in .NET resource sections, identifier renaming, string encryp...

    Pulse ID: 6a073a73501adf1f890b1a5e
    Pulse Link: otx.alienvault.com/pulse/6a073
    Pulse Author: AlienVault
    Created: 2026-05-15 15:23:31

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Browser #Cookies #CyberSecurity #Discord #FinancialFraud #ICS #InfoSec #Mac #Malware #NET #OTX #OpenThreatExchange #RAT #RCE #Troll #VPN #bot #cryptocurrency #AlienVault

    #browser #cookies #cybersecurity #discord #financialfraud #ics
  37. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    This analysis examines new obfuscation techniques employed by Gremlin stealer malware to conceal malicious payloads within embedded resources. A variant protected by sophisticated commercial packing utility uses instruction virtualization, transforming code into custom bytecode executed by a private virtual machine. The malware siphons sensitive information including payment card details, browser cookies, session tokens, cryptocurrency wallet data, and FTP/VPN credentials from compromised systems. It exfiltrates data to attacker-controlled servers at hxxp[:]194.87.92[.]109 for potential publication or sale. Recent iterations incorporate expanded Discord token extraction, active financial fraud through crypto clipper functionality that replaces cryptocurrency wallet addresses in real-time, and WebSocket-based session hijacking to bypass modern cookie protections. The malware employs advanced anti-analysis techniques including XOR-encoded payloads in .NET resource sections, identifier renaming, string encryp...

    Pulse ID: 6a073a73501adf1f890b1a5e
    Pulse Link: otx.alienvault.com/pulse/6a073
    Pulse Author: AlienVault
    Created: 2026-05-15 15:23:31

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Browser #Cookies #CyberSecurity #Discord #FinancialFraud #ICS #InfoSec #Mac #Malware #NET #OTX #OpenThreatExchange #RAT #RCE #Troll #VPN #bot #cryptocurrency #AlienVault

    #browser #cookies #cybersecurity #discord #financialfraud #ics
  38. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    This analysis examines new obfuscation techniques employed by Gremlin stealer malware to conceal malicious payloads within embedded resources. A variant protected by sophisticated commercial packing utility uses instruction virtualization, transforming code into custom bytecode executed by a private virtual machine. The malware siphons sensitive information including payment card details, browser cookies, session tokens, cryptocurrency wallet data, and FTP/VPN credentials from compromised systems. It exfiltrates data to attacker-controlled servers at hxxp[:]194.87.92[.]109 for potential publication or sale. Recent iterations incorporate expanded Discord token extraction, active financial fraud through crypto clipper functionality that replaces cryptocurrency wallet addresses in real-time, and WebSocket-based session hijacking to bypass modern cookie protections. The malware employs advanced anti-analysis techniques including XOR-encoded payloads in .NET resource sections, identifier renaming, string encryp...

    Pulse ID: 6a073a73501adf1f890b1a5e
    Pulse Link: otx.alienvault.com/pulse/6a073
    Pulse Author: AlienVault
    Created: 2026-05-15 15:23:31

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Browser #Cookies #CyberSecurity #Discord #FinancialFraud #ICS #InfoSec #Mac #Malware #NET #OTX #OpenThreatExchange #RAT #RCE #Troll #VPN #bot #cryptocurrency #AlienVault

    #alienvault #cryptocurrency #bot #vpn #troll #rce
  39. OTX Bot @[email protected] ·

    Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

    This analysis examines new obfuscation techniques employed by Gremlin stealer malware to conceal malicious payloads within embedded resources. A variant protected by sophisticated commercial packing utility uses instruction virtualization, transforming code into custom bytecode executed by a private virtual machine. The malware siphons sensitive information including payment card details, browser cookies, session tokens, cryptocurrency wallet data, and FTP/VPN credentials from compromised systems. It exfiltrates data to attacker-controlled servers at hxxp[:]194.87.92[.]109 for potential publication or sale. Recent iterations incorporate expanded Discord token extraction, active financial fraud through crypto clipper functionality that replaces cryptocurrency wallet addresses in real-time, and WebSocket-based session hijacking to bypass modern cookie protections. The malware employs advanced anti-analysis techniques including XOR-encoded payloads in .NET resource sections, identifier renaming, string encryp...

    Pulse ID: 6a073a73501adf1f890b1a5e
    Pulse Link: otx.alienvault.com/pulse/6a073
    Pulse Author: AlienVault
    Created: 2026-05-15 15:23:31

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Browser #Cookies #CyberSecurity #Discord #FinancialFraud #ICS #InfoSec #Mac #Malware #NET #OTX #OpenThreatExchange #RAT #RCE #Troll #VPN #bot #cryptocurrency #AlienVault

    #browser #cookies #cybersecurity #discord #financialfraud #ics
  40. CyberNetsecIO @[email protected] ·

    📰 Industrial Sector Most Targeted by Ransomware, NCC Group Report Warns

    A new NCC Group report reveals the industrial sector is the #1 target for ransomware, suffering 2,073 attacks in one year. The convergence of IT and OT is creating a perfect storm of risk for critical infrastructure. 🏭⚠️ #OTsecurity #ICS #Ransomware

    🌐 cyber[.]netsecops[.]io

    🔗 cyber.netsecops.io/articles/nc

    #otsecurity #ics #ransomware
  41. OTX Bot @[email protected] ·

    Thus Spoke…The Gentlemen

    On May 4th, 2026, The Gentlemen RaaS administrator acknowledged that an internal backend database called Rocket had been leaked, exposing nine accounts including zeta88, the program's effective administrator. The leak revealed internal discussions detailing initial access methods through Fortinet and Cisco edge appliances, NTLM relay, and credential logs, along with the group's role divisions and toolsets. Evidence shows evaluation of CVEs including CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073. Leaked ransom negotiations showed a successful payment of 190,000 USD. The group reused stolen data from a UK software consultancy to attack a Turkish company, employing dual-pressure tactics during negotiations. Analysis of ransomware samples identified eight distinct affiliate TOX IDs, indicating the administrator actively participates in infections alongside managing the RaaS program.

    Pulse ID: 6a04aad1cd2da41f0087f85d
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:46:09

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Cisco #CyberSecurity #Edge #ICS #InfoSec #LUA #OTX #OpenThreatExchange #RAT #RaaS #RansomWare #Turkish #UK #bot #AlienVault

    #cisco #cybersecurity #edge #ics #infosec #lua
  42. OTX Bot @[email protected] ·

    Thus Spoke…The Gentlemen

    On May 4th, 2026, The Gentlemen RaaS administrator acknowledged that an internal backend database called Rocket had been leaked, exposing nine accounts including zeta88, the program's effective administrator. The leak revealed internal discussions detailing initial access methods through Fortinet and Cisco edge appliances, NTLM relay, and credential logs, along with the group's role divisions and toolsets. Evidence shows evaluation of CVEs including CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073. Leaked ransom negotiations showed a successful payment of 190,000 USD. The group reused stolen data from a UK software consultancy to attack a Turkish company, employing dual-pressure tactics during negotiations. Analysis of ransomware samples identified eight distinct affiliate TOX IDs, indicating the administrator actively participates in infections alongside managing the RaaS program.

    Pulse ID: 6a04aad1cd2da41f0087f85d
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:46:09

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Cisco #CyberSecurity #Edge #ICS #InfoSec #LUA #OTX #OpenThreatExchange #RAT #RaaS #RansomWare #Turkish #UK #bot #AlienVault

    #cisco #cybersecurity #edge #ics #infosec #lua
  43. OTX Bot @[email protected] ·

    Thus Spoke…The Gentlemen

    On May 4th, 2026, The Gentlemen RaaS administrator acknowledged that an internal backend database called Rocket had been leaked, exposing nine accounts including zeta88, the program's effective administrator. The leak revealed internal discussions detailing initial access methods through Fortinet and Cisco edge appliances, NTLM relay, and credential logs, along with the group's role divisions and toolsets. Evidence shows evaluation of CVEs including CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073. Leaked ransom negotiations showed a successful payment of 190,000 USD. The group reused stolen data from a UK software consultancy to attack a Turkish company, employing dual-pressure tactics during negotiations. Analysis of ransomware samples identified eight distinct affiliate TOX IDs, indicating the administrator actively participates in infections alongside managing the RaaS program.

    Pulse ID: 6a04aad1cd2da41f0087f85d
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:46:09

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Cisco #CyberSecurity #Edge #ICS #InfoSec #LUA #OTX #OpenThreatExchange #RAT #RaaS #RansomWare #Turkish #UK #bot #AlienVault

    #cisco #cybersecurity #edge #ics #infosec #lua
  44. OTX Bot @[email protected] ·

    Thus Spoke…The Gentlemen

    On May 4th, 2026, The Gentlemen RaaS administrator acknowledged that an internal backend database called Rocket had been leaked, exposing nine accounts including zeta88, the program's effective administrator. The leak revealed internal discussions detailing initial access methods through Fortinet and Cisco edge appliances, NTLM relay, and credential logs, along with the group's role divisions and toolsets. Evidence shows evaluation of CVEs including CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073. Leaked ransom negotiations showed a successful payment of 190,000 USD. The group reused stolen data from a UK software consultancy to attack a Turkish company, employing dual-pressure tactics during negotiations. Analysis of ransomware samples identified eight distinct affiliate TOX IDs, indicating the administrator actively participates in infections alongside managing the RaaS program.

    Pulse ID: 6a04aad1cd2da41f0087f85d
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:46:09

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Cisco #CyberSecurity #Edge #ICS #InfoSec #LUA #OTX #OpenThreatExchange #RAT #RaaS #RansomWare #Turkish #UK #bot #AlienVault

    #alienvault #bot #uk #turkish #ransomware #raas
  45. OTX Bot @[email protected] ·

    Thus Spoke…The Gentlemen

    On May 4th, 2026, The Gentlemen RaaS administrator acknowledged that an internal backend database called Rocket had been leaked, exposing nine accounts including zeta88, the program's effective administrator. The leak revealed internal discussions detailing initial access methods through Fortinet and Cisco edge appliances, NTLM relay, and credential logs, along with the group's role divisions and toolsets. Evidence shows evaluation of CVEs including CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073. Leaked ransom negotiations showed a successful payment of 190,000 USD. The group reused stolen data from a UK software consultancy to attack a Turkish company, employing dual-pressure tactics during negotiations. Analysis of ransomware samples identified eight distinct affiliate TOX IDs, indicating the administrator actively participates in infections alongside managing the RaaS program.

    Pulse ID: 6a04aad1cd2da41f0087f85d
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:46:09

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Cisco #CyberSecurity #Edge #ICS #InfoSec #LUA #OTX #OpenThreatExchange #RAT #RaaS #RansomWare #Turkish #UK #bot #AlienVault

    #cisco #cybersecurity #edge #ics #infosec #lua
  46. CyberNetsecIO @[email protected] ·

    📰 Industrial Sector Most Targeted by Ransomware, NCC Group Report Warns

    A new NCC Group report reveals the industrial sector is the #1 target for ransomware, suffering 2,073 attacks in one year. The convergence of IT and OT is creating a perfect storm of risk for critical infrastructure. 🏭⚠️ #OTsecurity #ICS #Ransomware

    🔗 cyber.netsecops.io

    #otsecurity #ics #ransomware
  47. Spain @[email protected] ·

    Europe’s Photonics Push Runs Through Spain- EE Times

    //php echo do_shortcode(‘[responsivevoice_button voice=”US English Male” buttontext=”Listen to Post”]’) ?> Europe has spent decades building world-class photonics research.…
    #Spain #ES #Europe #Europa #EU #AIinfrastructure #Co-PackagedOptics #datacenters #EUchipsact #ICs #Optics&Photonics #Semiconductors #SovereignAI #Startups
    europesays.com/spain/22533/

    #startups #sovereignai #semiconductors #optics #ics #euchipsact
  48. OTX Bot @[email protected] ·

    Iran-Linked Hackers Breached Korean Electronics Maker in Global Spying Campaign

    Pulse ID: 6a0408708f3b49cc2cf1627a
    Pulse Link: otx.alienvault.com/pulse/6a040
    Pulse Author: Tr1sa111
    Created: 2026-05-13 05:13:20

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Iran #Korea #OTX #OpenThreatExchange #bot #Tr1sa111

    #cybersecurity #ics #infosec #iran #korea #otx
  49. OTX Bot @[email protected] ·

    Iran-Linked Hackers Breached Korean Electronics Maker in Global Spying Campaign

    Pulse ID: 6a0408708f3b49cc2cf1627a
    Pulse Link: otx.alienvault.com/pulse/6a040
    Pulse Author: Tr1sa111
    Created: 2026-05-13 05:13:20

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Iran #Korea #OTX #OpenThreatExchange #bot #Tr1sa111

    #cybersecurity #ics #infosec #iran #korea #otx
  50. OTX Bot @[email protected] ·

    Iran-Linked Hackers Breached Korean Electronics Maker in Global Spying Campaign

    Pulse ID: 6a0408708f3b49cc2cf1627a
    Pulse Link: otx.alienvault.com/pulse/6a040
    Pulse Author: Tr1sa111
    Created: 2026-05-13 05:13:20

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Iran #Korea #OTX #OpenThreatExchange #bot #Tr1sa111

    #cybersecurity #ics #infosec #iran #korea #otx