Kroll is revealing a new AMOS infostealer delivery vector where malicious instructions appeared inside a legitimate ChatGPT session. Basically ClickFix-style malware delivery, but presented through a real LLM chat URL. www.kroll.com/en/publicati...

React2Shell exploitation frequency in GreyNoise dec 5-dec 6

The amount of times today I've typed React2j or React4Shell....

Censys identifies ~2.15M exposed web services running Next.js or other RSC-based frameworks, predominantly in the U.S. and China. Not all are vulnerable, but given the scale, “spray-and-prey” seems more accurate than "spray-and-pray." censys.com/advisory/cve...

Comparing the IOCs released by Gainsight and Salesloft, there is one overlapping IP: 185.220.101[.]185 communities.gainsight.com/community-ne... trust.salesloft.com?uid=Drift%2F...

Annoying as hell when a security vendor (and CNA) with a global PSIRT doesn't update its CSAF with a CVE once it's assigned. Like what is even the point.

Some of the LLM skepticism in security looks more like backlash to hype than analysis. AlphaFold showed how experts can underestimate capability jumps. Dismissing early signals from Anthropic/Google assumes the future stays static, but AI capability and adoption curves may not behave that way.

This is a popular tactic. Google recently said that Chinese hackers got vulnerability information from Gemini by posing as capture-the-flag participants. cloud.google.com/blog/topics/...

404 Media is suing ICE for documents relating to its $2 million contract with Paragon Solutions. These are the journalists you should be supporting with your subscription money because they are meeting the moment. www.404media.co/were-suing-i...

The critical RCE Vulnerability in Microsoft #SharePoint was disclosed at #Pwn2Own in May. Because of Trend @thezdi.bsky.social, our customers have been protected since May. Stay up to date on the latest with this vulnerability here: https//www.trendmi...

Iran's APT42 (Charming Kitten) hacker team is now conducting targeted spearphishing attacks on high-profile Israeli national security journalists and cybersecurity researchers, according to Check Point. blog.checkpoint.com/security/edu...

Supposed experts and mainstream media have spent the past few days hyperventilating over reports of a colossal data breach that exposed more than 16 billion credentials. There’s just one inconvenient detail: evidence to support its sensational claim is lacking. cyberscoop.com/colossal-dat...

Iran has demonstrated its capability/intent to keep up cyber operations amid Israeli strikes. On Friday, an IRGC-linked group targeted Albania's capital in retaliation for the country hosting ~3k Iranian dissidents. The intrusion could disrupt services/expose data: www.politico.eu/article/iran...

News: The Washington Post has suffered a cyber intrusion that compromised the emails of at least several reporters at the paper, including those on the national security and economic policy teams, according to people familiar with the matter.

Google's @hultquist.bsky.social‬ says his threat intel team expects Iranian hackers to "rededicate themselves to attacks against Israeli targets" following Israel's bombing operation, though he says 🇮🇷-on🇮🇱 hacking "is already persistent and aggressive." US infrastructure could face more hacks too.

The cybercriminal group FIN6 (Skeleton Spider) is phishing recruiters by posing as job seekers on LinkedIn/Indeed and luring them to fake resume sites that deliver the "more_eggs" backdoor via AWS-hosted, CAPTCHA-protected pages. More from DomainTools: dti.domaintools.com/Skeleton-Spi...

"This research underscores the persistent threat Chinese cyberespionage actors pose to global industries and public sector organizations, while also highlighting a rarely discussed target they pursue: cybersecurity vendors." www.sentinelone.com/labs/follow-...

🥤& #threat-intel: CISA added Langflow Code Injection CVE-2025-3248 to the KEV on May 5. Recently, it has garnered considerable attention, with South Korea leading the pack. This vuln enables unauthenticated attackers to execute arbitrary code via /api/v1/validate/code viz.greynoise.io/tag...

@npr.org EXCLUSIVE: The Department of Agriculture is demanding states hand over personal data of food assistance recipients — including Social Security numbers, addresses and, in at least one state, citizenship status, according to emails shared with NPR.

Deploying realistic honeypots at scale is hard—DECEIVE makes it simple. Join David Bianco at #Honeynet2025 in Prague as he presents an AI-assisted SSH honeypot that enables high-fidelity deception with minimal effort. 📅 June 2–4, 2025 🔗 prague2025.honeynet.org #honeypots #llm #ai

In December, leading EdTech company PowerSchool was hacked, exposing the private information of tens of millions of American kids. PowerSchool paid the ransom to keep the data private. That apparently didn't work: somebody started using that data today to extort public schools in North Carolina.

🔥 Dispatch Debrief: April 2025 is live 🔥 Explore star sign-inspired hunting techniques, organizing your hunt squad, and the value of finding "nothing." Discover this month's insights from @thorcollective.bsky.social Dispatch - dispatch.thorcollective.com/p/april-debr...

Hm! He argues the CSRB has to evolve + be fully separated from CISA (it was dismantled at start of Trump 2.0), noting that, during the board's Salt Typhoon probe, some telcos got nervous and said they will not share information with the agency b/c CSRB is tied to the DHS office.

Initial probe into cause of power outages in Spain & Portugal today suggests fault rather than cyberattack, according to the European Union Agency for Cybersecurity (ENISA). “For the moment the investigation seems to point out to a technical/cable issue,” a spokesperson for the agency tells me.

When incidents hit, how you communicate shapes the outcome. This week’s @thorcollective.bsky.social Dispatch features @audrastreetman.bsky.social, former journalist turned cyber intel analyst. dispatch.thorcollective.com/p/how-commun...

News: @thekrebscycle.bsky.social, a target of Trump's wrath last week, is resigning from SentinelOne to focus fully on fighting back against against the White House's campaign to punish dissent. www.wsj.com/politics/pol...

If this contract ends, the damage will be immense. To be clear, that's immense damage to the US' ability to protect its computer systems, both in the commercial and in the public sectors. And yes, this includes critical infrastructure such as power, water, and transportation.

BREAKING. From a reliable source. MITRE support for the CVE program is due to expire tomorrow. The attached letter was sent out to CVE Board Members.

Infosec must not remain silent while Trump goes after Chris Krebs: www.eff.org/deeplinks/20...

THREAD: When @thekrebscycle.bsky.social and his workplace, @sentinelone.com, were singled out by Donald Trump on Wednesday, I thought it was an opportunity to weigh the cybersecurity industry's rhetoric against their real world actions.

“When you see important societal actors — be it university presidents, media outlets, C.E.O.s, mayors, governors — changing their behavior in order to avoid the wrath of the government, that’s a sign that we’ve crossed the line into some form of authoritarianism..” www.nytimes.com/2025/03/06/u...

Big Law has failed to stand up to Trump and now infosec is following suit.

“Reuters contacted 33 of the largest U.S. cybersecurity companies… for comment on Trump's action against SentinelOne. Only one offered comment on Trump's action. The rest declined, did not respond or did not answer questions.” www.reuters.com/world/us/cyb...

"The Chinese official’s remarks at the December meeting were indirect and somewhat ambiguous, but most of the American delegation in the room interpreted it as a tacit admission and a warning to the U.S. about Taiwan, a former U.S. official familiar with the meeting said" www.wsj.com/politics/nat...

So I stuck up for Sean Plankey as future CISA, now time to stick up for Chris Krebs, past CISA - this shit is bonkers and should give pause to anyone even considering federal employment if this kind of shit is what you get for doing your job: www.whitehouse.gov/fact-sheets/...

The Trump administration is now going after its first cybersecurity company, stripping @sentinelone.com of "any active security clearance." Will the infosec industry do any better than the legal industry in showing solidarity? www.whitehouse.gov/fact-sheets/...

New from WSJ: North Korea commands 8,000+ hackers who "can wait months or years to exploit a single slip in a company’s digital security." Over the past decade, regime has stolen more than $6 billion in cryptocurrency: www.wsj.com/world/asia/n...

The actor behind the alleged Oracle breach shared a class action complaint filed yesterday that claims #Oracle became aware of a ransomware attack on or around Jan. 22 and failed to report the data breach to customers as outlined in its privacy policies. www.pacermonitor.com/public/filin...

Sekoia found DPRK targeting of job seekers in the cryptocurrency sector has evolved to include the "ClickFix" tactic of displaying a fake error message in a browser to deceive users into executing malicious PowerShell to deploy the GolangGhost backdoor on Windows/macOS blog.sekoia.io/clickfix-tac...

The Cisco Talos 2024 Year in Review found that #ransomware actors are less likely to fully rebound from a law enforcement takedown if decryption tools are made publicly available. Compares the impact of the ALPHV takedown (key provided) vs LockBit (no key). blog.talosintelligence.com/content/file...

The Multi-State Information & Analysis Center contacted member states Wed night to share which services it can keep providing (Albert, MDBR, EDR, NCSR, & SOC) and which it can't (IR, CTI, member engagement, VDP) after its host organization lost federal funding. www.documentcloud.org/documents/25...

“The Lazarus Group’s campaign targeted applications used in cryptocurrency and authentication systems, embedding malware into trusted software packages. Developers unknowingly included these compromised packages in their projects...” securityscorecard.com/blog/operati...

Registration is open for the SANS New2Cyber Summit on March 13! The free virtual event is for anyone new to cybersecurity or looking to level up their skills. I'm presenting at 4:25pm ET about my career change from local TV news to cyber threat intelligence: www.sans.org/cyber-securi...

DHS has terminated the memberships of everyone on its advisory committees. This includes several cyber committees, like CISA's advisory panel and the Cyber Safety Review Board, which was investigating Salt Typhoon. That review is "dead," person familiar says. www.documentcloud.org/documents/25...

Congratulations @letswastetime.bsky.social, @davidjbianco.bsky.social, and Dr. Ryan Fetterman for being named the community winners in the “Innovation of the Year” category at the SANS Difference Makers Awards! So proud to work with you and see the impact of the PEAK Threat Hunting framework.

New on @darkreading.bsky.social: "The consequences of large-scale incidents, such as Log4j ..., have had lasting impacts on the cybersecurity world. However, cybersecurity defenders can learn from these experiences." By Audra Streetman @audrastreetman.bsky.social www.darkreading.com/vulnerabilit...

One of Romania's most important energy services companies has announced it is currently tackling an ongoing cyberattack. Electrica Group, which is listed on the Bucharest and London stock exchanges, published a note to investors on Monday warning of a “cyber attack in progress.”