Live and recent posts from across the Fediverse tagged #threat-hunting, aggregated by home.social.
🔵 THREAT INTELLIGENCE
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
Vulnerability | CRITICAL
CVEs: CVE-2026-110447
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server...
Full analysis:
https://www.yazoul.net/news/article/cisa-flags-two-actively-exploited-critical-flaws-in-collabora-online-and-arista-
by Yazoul AI
I’ve published an independent technical investigation into Hirudo, an Android banking RAT, focusing on its Indonesian banking-app replacement workflow, recovered APK artifacts, and associated infrastructure. This independent investigation was inspired by the research published by ThreatFabric. Motivated by their findings, I conducted a separate static reverse-engineering investigation focusing on Indonesian banking-app replacement artifacts, MQTT-based RAT communications, and additional infrastructure indicators. Sharing these findings with the cybersecurity community Cyber Defense Indonesia & Surabaya Hacker Link, to contribute to technical knowledge-sharing and further research into Android banking malware.
Findings include: Banking app replacement (Recovered samples) associated with m-BCA, myBCA, BNI, BRI, BTN, Livin, JakOne, and BSI.
RAT infrastructure: Hardcoded C2 references and MQTT broker configurations recovered from DEX code, including 134[.]122.153[.]8:18085 and 134[.]122.153[.]8:1884.
APK internals: Hooking-engine artifacts, shared trigger-file mechanisms, certificate-substitution evidence, and embedded development paths.
Infrastructure pivots: Additional API endpoints, APK-processing panels, and certificate/DNS correlations for further investigation. The analysis is based primarily on static reverse engineering and supporting OSINT evidence. Live infrastructure behavior, several suspected relationships, and threat-actor attribution remain unverified. The objective is to document reproducible technical evidence and provide additional pivots for malware researchers, threat hunters, and incident responders.
#CyberSecurity #ThreatIntelligence #MalwareAnalysis #ReverseEngineering #DFIR #ThreatHunting #AndroidSecurity #DigitalForensics #InfoSec #InformationSecurity #CyberDefense #FinancialSecurity
Blue Team, heads up!
In questo articolo presento una versione, migliorata e al passo coi tempi, di sysmon.
Presento tutte le modifiche effettuate e vi lascio il link al file xml pronto da scaricare e usare.
https://blog.lobsec.com/2026/10/sysmon-2026-xdr-configurazione-domain-controller/
🔵 THREAT INTELLIGENCE
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Vulnerability | CRITICAL
CVEs: CVE-2026-105133, CVE-2026-105134
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop...
Full analysis:
https://www.yazoul.net/news/article/ahsaycbs-flaws-exploited-to-deploy-web-shells-get-new-fixes-after-incomplete-pat
by Yazoul AI
🆒 Cool new feature at Scan Malware:
You can now explore relationships between websites using interactive graph visualizations, with multiple layout options
This makes it easier to discover connections between malicious websites that share common indicators, even when they're one or two hops away
The feature is on the "Pivot" tab ➡ and click "Open in graph". Also useful in OSINT investigations
#CyberSecurity #ThreatIntelligence #MalwareAnalysis #OSINT #GraphVisualization #ThreatHunting #ScanMalware
Blue Team, heads up!
In questo articolo presento una versione, migliorata e al passo coi tempi, di sysmon.
Presento tutte le modifiche effettuate e vi lascio il link al file xml pronto da scaricare e usare.
https://blog.lobsec.com/2026/10/sysmon-2026-xdr-configurazione-domain-controller/
Threat Hunting on the endpoint: https://www.blackhillsinfosec.com/threat-hunting-endpoint/
Virustotal now does IPv4 infra scanning à la Censys/Shodan.
https://blog.virustotal.com/2026/10/internet-scanning-in-vt.html?m=1
Brand abuse happens outside the corporate perimeter, across the public Internet. Censys gives defenders visibility into the scammers and attackers behind it.
This new guide walks through how to use Censys to find and investigate brand impersonation, with queries you can adapt to your own brand.
Read the guide: https://censys.com/blog/the-ultimate-guide-to-brand-protection-with-censys/
📢 DEF CON Training is now accepting course submissions for 2027!
Whether you’re an experienced instructor or bringing a new course to the community, we’re looking for high-quality, hands-on training that helps security professionals build real-world skills.
Submit your training material today for the opportunity to teach alongside the DEF CON community in locations around the world including Las Vegas, the Middle East, and Singapore!
For more details, see the application. The deadline to apply is November 13, 2026.
Apply here today 🔗: https://forms.cloud.microsoft/r/z2f4igJPuu
Already submitted your course for Singapore March 2027? As long as you selected your other sessions of interest at the end of the application form, you don’t need to reapply! We have your application on file.
Questions? Email us at [email protected]
#DEFCON #DEFCON35 #DEFCONSG #DEFCONME #DEFCONTraining #training #cybersecurity #handsonlearning #infosec #AI #incidentresponse #threathunting #cloud #IoT #hacking
📢 Unified Threat Hunting Process : méthodologie structurée pour les programmes de threat hunting
Cet article présente un Unified Threat Hunting Process développé par un Lead Threat Hunter pour construire un programme de threat hunting structuré et reproductible à partir de zéro.
📖 cyberveille : https://cyberveille.ch/posts/2026-04-10-unified-threat-hunting-process-methodologie-structuree-pour-les-programmes-de-threat-hunting/
🌐 source : https://github.com/sims718718/UnifiedThreatHunting
🔴 vérification factuelle basse
#méthodologie #ThreatHunting #Cyberveille
📢 Japon : initiative nationale de threat hunting sur les infrastructures critiques pour 2027
Cet article présente l'initiative japonaise de threat hunting actif sur les infrastructures critiques, prévue dans le cadre du budget fiscal 2027. Cette initiative s'inscrit dans la stratégie plus large de défense cyber active du Japon, dont la…
📖 cyberveille : https://cyberveille.ch/posts/2026-10-05-japon-initiative-nationale-de-threat-hunting-sur-les-infrastructures-critiques-pour-2027/
🌐 source : https://thecyberexpress.com/japan-threat-hunting-plan/
🔴 vérification factuelle basse
#ThreatHunting #DéfenseCyberActive #Cyberveille
How to find domains in an IP range with WorldIP.io owner data
issued.live finds every domain in an IP range, and Plus and Pro subscribers now get a free WorldIP.io API beta key that adds who holds the range: organization, ASN, proxy verdicts and, on Pro, live BGP data.
https://issued.live/news/find-domains-in-ip-range
#reverseiplookup #threathunting #certificatetransparency #bugbounty
Hunting adversary infrastructure with issued.live and WorldIP.io
Hunting adversary infrastructure from one IP address: WorldIP.io enriches it and issued.live pivots from it. Until WorldIP.io's paid plans launch, issued.live Plus and Pro include a free WorldIP.io beta key.
https://tuxxin.com/blog/hunting-adversary-infrastructure
#threathunting #threatintelligence #ipintelligence #reverseiplookup
Mapping out your unknown: A threat hunter’s guide to GitHub: https://securitylabs.datadoghq.com/articles/mapping-out-your-unknown-threat-hunters-guide-to-github/
Spotted a fresh ClickFix chain in the wild today.
Compromised-looking product page → fake Cloudflare image CAPTCHA → “manual verification” → user is tricked into running PowerShell.
Chain:
hxxps://dns-ssl[.]com/mgk9wvvm4RfVNWO2GN
→ obfuscated PS1
→ hxxps://dns-ssl[.]com/seyoW8g8woHPrUio
→ second-stage PS1
→ 31 MB MSI from R2.dev / dns-ssl fallback
→ silent msiexec
Interesting behavior from the MSI:
- process injection
- unsigned image loaded into LSASS
- autorun persistence
- potential jli.dll side-loading
- headless Chromium
- USB/peripheral discovery
- C2 to 65[.]20[.]113[.]167
- Ethereum RPC traffic
Hashes:
Stage 1:
AB3017B4E203A6023561F524120BF94F9CD96E4B5EE26212E4B0B75D3C2932C5
Stage 2:
60360C6A9617BCD57BDDF124D0DE77BD3C99C63285F0FECA28CAA1BBD20CB691
MSI:
5887410F2747AE6D6A6F2054450A4C5B0ED341842514C86A3B6B5C9D1063A52B
VT was only 1/59 on the MSI when checked, but the behavior is much louder than the static detection ratio.
Likely ClickFix-delivered loader / infostealer activity. Still digging into family attribution.
#infosec #malware #ClickFix #PowerShell #DFIR #ThreatHunting #threatintel
🔵 THREAT INTELLIGENCE
Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
Vulnerability | CRITICAL
CVEs: CVE-2026-88772
Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root...
Full analysis:
https://www.yazoul.net/news/article/citrix-netscaler-cve-2026-88772-exploit-details-show-pre-auth-path-to-shellcode-
by Yazoul AI
Whew! @letswastetime and I just turned in our new #ThreatHunting course to SANS. Can't wait to finally get this in front of students!
CERT-EU shares their insights on CVE-2026-88771 exploitation and provides threat hunting tips in different logs.
https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771
Driving threat hunting with cyber intelligence: https://bi-zone.medium.com/driving-threat-hunting-with-cyber-intelligence-e5d63b207f89
Pattern search on issued.live finds domains by the shape of their names
issued.live pattern search matches a naming grammar, such as a short word followed by agent in .com, against every registrable domain in its corpus. It comes with the Pro plan at $199 a month. Each pattern names a TLD, counted character classes stop at 64, a pattern runs to 128 characters and eight labels, and every…
https://tuxxin.com/blog/issued-live-pattern-search
#threathunting #domainintelligence #issuedlive #patternsearch
🚨 Dates Updated and Location Confirmed! 🚨
DEF CON Training is headed back to Bahrain on November 9-11, this time at the Wyndham Grand Manama. The course line up has a bit of everything - AI, threat hunting, cryptocurrency, cloud infrastructure, and more!
Now's a great time to make plans to add to your skill toolkit before the end of the year. Browse the course catalogue and secure your seat today:
https://me.shop.defcon.org/collections/trainings
📆 November 9-11, 2026
📍 Wyndham Grand Manama
DEF CON Middle East
#DEFCON #DEFCONMiddleEast #DEFCONTraining #CyberTraining #HandsOnTraining #EthicalHacking #AI #InfoSec #threathunting #cloud #Cryptocurrency #Bahrain #MiddleEast
Companies integrating #AI into their #Sharepoint is a huge win for attackers. Its the modern equivalent of leaving the back door chocked open or leaving everyone's salaries on a printer.
Do you know how many project names and budget sheets and system configurations are just sitting in your LLM now?
Large part of your day can just spent being nosey, wondering what Sharepoints #Copilot has been hooked too.
Copilot, give me a list of all documents containing passwords. Call it #ThreatHunting
Data Quality Overtakes Skills as Top Threat Hunting Barrier
Even the best threat hunters can come up empty-handed if their data is incomplete, inconsistent, or hard to access. Data quality has now overtaken skills as the top barrier to effective threat hunting, with 50% of cybersecurity practitioners citing it as their biggest hurdle.
#ThreatHunting #DataQuality #Cybersecurity #SansInstitute #EmergingThreats
Malwoverview 8.2.0 (codename: Revolutions)
This version adds a component vulnerability search, gives every NIST query a chosen ordering reference, and repairs the queries themselves.
https://github.com/alexandreborges/malwoverview
To install it:
python -m pip install -U malwoverview[all]
[+] New — --nist 6, list the CVEs of a component
Give it a component name, or the path to a local binary:
malwoverview --nist 6 --NIST openssl malwoverview --nist 6 --NIST "C:\Windows\System32\drivers\afd.sys"
The same works by name on any platform: ksmbd and nf_tables on Linux, iCloud and WebKit on macOS and iOS.
[+] New — --sort-by
Chooses what "most recent" means: the year in the CVE ID (default) or the NVD publication date. NVD often publishes a record years after the ID was assigned, so the two disagree on about 30% of rows. --time now bounds results by the same reference.
Note: check the ## WHAT IS NEW IN 8.2.0, BY EXAMPLE section from README.md to learn how to use the new options.
#malware #cybersecurity #infosec #informationsecurity #vulnerability #cve #threathunting #threatintelligence
Suricata produces rich network telemetry, alerts, anomalies, flow data, DNS, TLS, SSH, Kerberos, and more, but raw EVE JSON isn't investigation ready on its own.
The Suricata IDS/IPS Content Pack for Graylog parses, enriches, and maps that data to the Graylog Information Model, with a dashboard built in. Setup covers Filebeat via Sidecar or syslog forwarding.
Full breakdown here: https://graylog.org/post/suricata-ids-ips-data-in-graylog/
#Graylog #Suricata #SIEM #ThreatHunting #InfoSec #NetworkSecurity
CISA Deploys Cyber Decoys to Disrupt Attackers
CISA is shaking things up in the cybersecurity world with a clever tactic: deploying cyber decoys to lure in and expose attackers, making it easier to detect and respond to threats. By using these low-cost, high-impact decoys, critical infrastructure owners and operators can stay one step ahead of intruders.
#CyberDecoys #Cisa #EmergingThreats #DetectionAndResponse #ThreatHunting
What does Mythic C2 look like across the public Internet?
Censys ARC sees 131 Mythic-associated hosts, and many leave recognizable fingerprints.
The infrastructure also tells a deeper story. One cluster appeared consistent with a shared lab environment. Another revealed custom Rust implants, Discord-based C2 transport, steganographic staging, and infrastructure designed to blend with legitimate telemetry traffic.
This new Censys Threat Overview maps Mythic across the Internet and shares detection signals defenders can use to hunt for it: https://censys.com/blog/mythic-c2/
Your CFO’s phone has been compromised. The alert is only the beginning.
For incident responders, the next challenge is investigation:
✴️ What infrastructure was involved?
✴️What was it doing at the time?
✴️Are there related IOCs we should go hunt for?
In this new DFIR walkthrough, Alex Gartner follows two hypothetical mobile incidents, one Android, one iPhone, to show how responders can move from an initial indicator to the broader infrastructure and context needed to understand scope.
Follow the DFIR journey: https://censys.com/blog/so-your-cfos-phone-has-been-pwned-a-dfir-journey/
#DFIR #IncidentResponse #SecOps #ThreatHunting #Cybersecurity #Censys
🚨 ANNOUNCEMENT FOR TOP CONTRIBUTORS! 🚨
We’ve been working on something huge and the cat 🐈 is finally out of the bag 👀 ...
We’ve officially partnered with Modat to give FREE Magnify licenses to our top contributors! 🎉🔥
You give your time, brainpower, and expertise to this community 👏. You hunt down the bad guys every single day - we want to make sure you have the best tools 🛠️ available to do what you do for the good of the internet every single day!
Consider this our way of saying THANK YOU 🙏
Top contributors - keep an eye out, we'll be reaching out in the coming weeks to get your access sorted 🎉.
More details below 👇
CyberSecurity #Infosec #Modat #CommunityFirst #FreeTools #ThreatHunting
NPS is a legitimate tunneling tool with ~17,500 Internet-facing deployments observed by Censys. Most are likely benign.
So detecting NPS alone doesn't tell you much. The stronger signal is co-occurrence.
New Censys ARC research from @silas looks at how to hunt NPS in context. https://censys.com/blog/nps-proxy-server/
It looks like an MP4. But try to play it and things get interesting.
Censys ARC uncovered an active malware payload hiding inside a fake video file.
Starting with one observed host, they identified 18 builds across 40 live endpoints and mapped the PowerShell → MP4 carrier → NetSupport RAT delivery chain.
Full analysis, detection opportunities, and IOCs: https://censys.com/blog/fake-mp4-file-carries-malicious-payload/
#CensysARC #ThreatIntelligence #Malware #ThreatHunting #DFIR
Censys ARC Principal Security Researcher @silas uncovered Moobot source code alongside active attack records, additional DoS tooling and a fraudulent identity verification service.
Read the research: https://censys.com/blog/open-directory-exposes-moobot-source-code-and-activity/
#CensysARC #ThreatIntelligence #ThreatHunting #Malware #DDoS
The practical half: rebranding a panel takes one line of source, and the firewall these operators ship hides the panel, the API, and the implant socket from scanners. So what still works for hunting? Aidan makes the case for the APK builder, on a port the firewall never covers.
https://censys.com/blog/ermac-source-leak-hookbot/
#CensysARC #ThreatIntelligence #Malware #AndroidSecurity #ThreatHunting
Got malicious or suspicious IPs, domains, URLs, or raw source to share?
👉 Join the fight against cybercrime: https://submit.spamhaus.org/submit/
I will hold a Paralus LLC #CyberThreatIntelligence (CTI) + #DetectionEngineering & #ThreatHunting (DE&TH) ONLINE training from 26-29 OCT, 1400-1600 US Eastern Time. Full details and cost in the following Google Form link. Please register your interest for high-velocity, low-cost #Infosec training!
🛡️ HAVOC C2 — DEFENDER CHEAT SHEET
Havoc is a powerful Command & Control framework used in authorized red-team operations. 🔴⚡ Understanding how C2 infrastructure, agents and communications behave can also help defenders recognize suspicious activity and improve detection. 🔍
Learn the framework. Hunt the signals. Strengthen your defenses. 🔐
💬 Comment “HAVOC” if you want more cybersecurity cheat sheets.
Malwoverview version 8.1.0 is available:
https://github.com/alexandreborges/malwoverview
To install it:
$ python -m pip install -U malwoverview
This version aims to:
01. Introduce new features.
02. Fix most existing issues, particularly those found between versions 8.0.0 and 8.0.5.
03. Address a number of security issues.
The number of changes is significant, so it is recommended reading the following sections of the README.md:
01. WHAT IS NEW IN 8.1.0, BY EXAMPLE
02. WHAT IS NEW IN 8.0.0 TO 8.0.5, BY EXAMPLE
03. EXAMPLES
#malware #threathunting #vulnerability #informationsecurity #infosec #cybersecurity
Hackers are exploiting AI to accelerate cyberattacks and inflate cloud costs. Discover how AI cyber threat trends show an 89% surge in malicious activity.
#Cybersecurity #ArtificialIntelligence #CrowdStrike #ThreatHunting #Malware
https://meterpreter.org/ai-cyber-threat-trends/?utm_source=mastodon&utm_medium=jetpack_social
