If you're running Lantronix gear on the internet, you might want to check your logs for suspicious logins and command execution. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

We're excited to introduce IFIN's first open source project! RSS-Filter solves a problem we suspect is common: our RSS feeds were full of noise. codeberg.org/ifin/rss-fil...

Another Mini Shai-Hulud-like attack. Again using Bun, but this one also installs persistence to AI coding assistant configs. If you're not a JS dev shop, maybe block Bun? The attackers will move on, but for now it's a favorite. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

We're excited to introduce IFIN's first open source project! RSS-Filter solves a problem we suspect is common: our RSS feeds were full of noise. codeberg.org/ifin/rss-fil...

A thousand blessings upon Dirk-Jan and Fabian for this post about CAP bypasses in Entra, and the EntraScopes lookup tool.

ISP maintenance has us down for a few hours. We expect to be back up by 0900 PDT.

Local ISP maintenance may make the forum unavailable for the next few hours. We'll keep you posted here!

Let's talk about ClickFix.

We've updated our post with the latest information from CloudSek and, of course, @doublepulsar.com

Trusted sites are favorites for the baddies as command-and-control and exfiltration destinations, because they think you can't block them or observe them. That's exactly what this attack expects. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

Etherhiding is so hot right now. When your malware sample contains blockchain artifacts, learn how to pivot on them and get all the indicators from the campaign.

Courtesy of GAYINT, a comprehensive domain list is now available: blog.gayint.org/intel/fortib...

Fortinet customers: please take note of this massive breach of SSL VPN credentials. The scale of attacker infrastructure and list of impacted organizations commands attention. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

This report from GTIG is worth a moment's consideration. Research institutions with public-facing assets should take this opportunity to harden their external posture. discourse.ifin.netwo... #ThreatInte #ThreatIntelligence #IFIN

News feed server going down for upgrade. Should be back in ~20 minutes!

A quick note on process regarding the recent AUR story. Everything worked exactly as community-driven threat intel should. 1. A user tipped us off 2. We investigated and reported 3. Community information refined the information 4. Everyone got the necessary information We protected each other.

The wave appears to have subsided for now. The response of the AUR maintainers was praiseworthy indeed, although without some process/policy changes, this could happen again at any time.

This attack is ongoing, with the attackers shifting from `npm` to `bun` for malware installation. If you see information we're missing, please consider contributing!

400+ Arch User Repository packages have been compromised in a massive, sophisticated supply chain attack, including a rootkit installation. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

This is not actually the reason Oracle stock is down today. But it probably didn't help. Anyway if you use PeopleSoft, please patch ASAP.

The idea is when you go to make the case for ad blockers, you can point to this external, "authoritative" resource and say look, these very serious people said so.

Even if Chrome is nerfing old ones, ad blockers still matter. Get them on your users' systems for one of the most impactful one-move security wins available.

Ivanti's latest perfect 10—this time a preauth command injection—has been confirmed exploited in the wild. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

We have all the details on Nightmare Eclipse's latest 0-day, the "Rogue Planet" Defender local privilege escalation.

As requested: a sticker. shop.ifin-intel.org/... We'll have others available at cons (more news on that soon)!

Our Microsoft Patch Tuesday response:

Do you like T-shirts? How about coffee mugs? You can support IFIN's mission and also get some cool merch! All proceeds go directly to operational costs and building our capacity to produce and share free cyber threat intelligence resources. (stickers coming soon) shop.ifin-intel.org

FYI: we've removed the NatSec category from the IFIN News Feed. We aren't just about the US.

We just added a ton of feeds to the IFIN news feed aggregator! If you want to keep your view/ingest clean, make sure you're pulling by publication date. Here's the full URL with correct parameters: news.ifin.network/i/...

A developing story: Microsoft is disabling repos related to Azure Functions, Durable Task, and more in what appears to be another supply chain compromise. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

No patches or workarounds for this exploited Cisco SD-WAN privilege escalation vulnerability. It requires a public-facing admin interface and either netadmin creds or chaining prior CVEs. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

Looks like we had some server trubz overnight. Coming back up now, apologies! This is the second time, but this time we have more logging enabled for better troubleshooting.

Watch out, security researchers! If you search for "Ghidra download," you may be sent to a spoofing site that will gift you an infostealer instead of a disassembler. Multiple tools have spoof sites like this. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

Patches are available for Nginx and Apache against the latest HTTP/2 DoS. Other servers, who knows??

VS Code extensions: developers won't stop using them, but knowing the attendant risks and possible mitigations could save you from the next supply chain worm. ifin-intel.org/blog/... #ThreatIntel #ThreatIntelligence #IFIN

VS Code extensions: developers won't stop using them, but knowing the attendant risks and possible mitigations could save you from the next supply chain worm. ifin-intel.org/blog/... #ThreatIntel #ThreatIntelligence #IFIN

We would be remiss in our duty indeed if we did not shout out our colleagues and friends at GAYINT. IFIN itself is made of LGBTQIA+ community members and allies, and we wish everyone a Happy Pride. Celebrate by adding the GAYINT feeds to your block lists.

This has been assigned CVE-2026-46243. No word on distro patches yet.

Well it's another week, so here's yet another NPM package compromise in the "Mini Shai-Hulud" family of compromises. This time, it's Red Hat cloud services. Some interesting differences here, including 100% trusted site exfiltration, with Claude being the primary!

Hello again, Linux administrators. The large language models and their operators continue to find and disclose kernel exploits without patches arriving in downstream distributions. This one doesn't even have a CVE. Enjoy!

IPs and domains are just the beginning of the IoC journey. Effective defense requires the distillation of atomic indicators to something more generally applicable. IFIN Staff Member Mike B walks us through the distillation process. ifin-intel.org/blog/... #ThreatIntel #ThreatIntelligence #IFIN

IPs and domains are just the beginning of the IoC journey. Effective defense requires the distillation of atomic indicators to something more generally applicable. IFIN Staff Member Mike B walks us through the distillation process. ifin-intel.org/blog/... #ThreatIntel #ThreatIntelligence #IFIN

Got Nessus? Got Crowdstrike? You might also have a huge pile of false positives this morning, as Nessus attempted to run a PoC of the "MiniPlasma" exploit proactively, triggering CrowdStrike alerts.

Thank God for @ifin-intel.org... or this would have been a boring dead day at work

Add Laravel to the list of large projects whose GitHub repos have been compromised. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

Ubiquiti has disclosed several critical Unifi OS vulnerabilities that can lead to remote code execution/account takeover. Patches are available and should be applied with haste, given the internet-facing nature of these devices.

We regret to inform you that yet *another* GitHub attack is underway—this time compromising GitHub Actions with infostealer scripts. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

GitHub's internal repositories have been exfiltrated and offered for sale.

One maintainer's compromised tokens are responsible for the takeover of 500+ NPM packages, including the AntV family of packages. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

Microsoft Power BI is under a DDoS attack claimed by 313 Team, the same group that recently claimed the attack on Ubuntu. Their booter is still protected by Cloudflare, btw. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN