Back in 2018, when a CVE was released, it took 2.3 years to exploit. 2024: 56 days. Now: 1 day. End of 2026? 1 hour. Reactive approaches to security are no longer effective. If you want expert guidance for the new era, get in touch. https://www.volkis.com.au/contact/

🧪 Volkis Lab Challenge: Command Execution   Drop your payload 🐺

🧪 Volkis Lab: Privilege Escalation   You don’t need exploits when the system hands you the right tool. 🐺 Can you spot it?

Another happy customer review came through today. 😊

In a recent red team engagement, we needed to get close to the target office, which was on the 15th floor of a skyscraper. It was too difficult to get to the elevators without having an ID badge, so we thought about good excuses to have them let us in.

It is common to think an AI agent is safe because it only handles "public" data. But the most dangerous instructions aren't written by developers. They are the "Injected" commands 👇

We did this pentest recently where we got Domain Admin. Cool, but we wanted more! We had the admin's creds so we just waited... When the admin logged out and left for the day, we just logged back in through RDP as him! 👇

🧪 Volkis Lab: This seems suspicious, doesn't it? Sleep → Decode → Decrypt → Runtime API resolution → explorer.exe 🐺 Name the technique. Drop the ATT&CK ID if you know it.👇

Does guessing or brute-forcing passwords still work? Yep! CompanyName123, Monday2026!, Commodore#1... We still see these, and it's often our foothold into a network. 👇

Hackers don’t need fancy tooling anymore, the target system carries it for us. We can "live off the land". Your PowerShell. Your MSHTA. Your CERTUTIL. Your tools, our commands. #HackingTips

🧪 Volkis Lab: Can you recognise it? Bonus: Drop the MITRE ATT&CK ID 👇🐺

Pumping yourself up to write a pentest report on a Friday afternoon 📢 🎵🕺

🧪 Volkis Lab: Got a reverse shell? Don’t rush into recon or privilege escalation.   Raw, fragile access gets you caught. Stabilise it first.  Control before capability. Drop your thoughts 👇🐺

We were on a red team engagement searching through the external infrastructure for a way in.  Struggling for a way in, a junior asked: "What about DNS?" That comment made us zoom out a notch.👇

Throughout many years in cybersecurity, we've learned a hard lesson. Cybersecurity is not the most important thing. Let me explain 👇

It’s common to enumerate your attack surface using DNS records. But the weakest systems usually aren’t in DNS. They are the ones that have drifted: 👇

🧪 Volkis Lab: What attack would you do and what tool(s) would you use? The scan is telling you everything if you know how to read it. Drop your answers below 👇🐺

The company rolled out a new webpage. It looked normal. Just another page asking you to “verify you’re human.” It was a ClickFix attack. 👇

Nothing annoys us, as attackers, more than well placed honeypots/tokens. It makes us paranoid at every step. That's good! 👇

🧪 Volkis Lab: What attack can you perform here? In this code, nothing is executed, dropped or broken. Yet, there are multiple attack possibilities.   The important thing is how you think. Drop your thoughts below 👇🐺

It took us months, but we're in. And now it's time to pull the trigger. We'll go in fast, hit our goals, and leave. At 7pm no one's around right? It works! The 6 of us get our goal in an hour. Turns out, no one was "officially" on call. An easy mistake to make🐺 #HackingStories

🧪 Volkis Lab: What’s the attack? A good attacker knows what their activity looks like in logs. Here, everything looks legit, but it's not. Bonus: What tools would you use to perform it? Drop your answers below 👇🐺

Everyone thinks attackers start by cracking passwords. Most of the time, we don’t. 🐺 We relay NTLM authentication instead. You authenticate to one system → we relay that authentication attempt to another system. No passwords needed. #VolkExplains

🧪 Volkis Lab: The Validation Trap The code looks clean. It checks the protocol. It checks the hostname against an allowlist. On the surface, it’s "safe." What part of the URL are we forgetting to validate?  Drop your answers below👇

Do you think your SIEM alerts will catch a brute force attack? Some of the ways to try and remain undetected: 🐺 Low-and-slow attempts 🐺 Valid Usernames. 🐺 Distributed IPs If you are waiting for a spike in the dashboard it may never come. #VolkExplains

"G’day, it’s IT. Just hit 'allow' so we can fix that sync error." Marketing was in a rush and just wanted to be helpful. One click later, we were them. Who needs fancy exploits or zero-days when the system trusts the user, and the user trusts the attacker? 🐺 #HackingStories

Think your 1970s mainframe is safe? Think again Our attackers used evasion techniques to bypass detection and compromise a major insurance company's legacy IBM system, the "Gibson"; we found the master customer data table and executive PII. Contact us today to learn morw

Is your security ready for a full-on, extended attack? The Volkis Red Team uses tailored infrastructure and social engineering over weeks to target your core services. Watch how we went from an initial block to gaining full data access via a simple printer account👇

Wakey Wakey, Volk! Back to work from the holidays... or maybe just 5 more minutes? It's #mascotmonday! 🐺

Volk pondering his New Year's Resolutions 🐺👇 #mascotmonday

Volk loves a Monday morning cuddle! 🥰🐺 #mascotmonday

We are MIA until Monday 🌴 Volkis & Family are heading away today to the Hunter Valley for the next three days to enjoy Hacker house. We are looking forward to swimming, walking tracks, botanical gardens, Christmas lights and maybe some vino! 🍷🍇 Back Monday 🐺

Just stay in bed today.  From Volk 🐾 #mascotmonday

Being a hacker means being a part of a team! Its not a solo sport. (with 🖊 Alexei Doudkine at BSides Canberra with Ricki Bourke)

Is your security a quick fix or a long-term roadmap? We'll help you define a 3-5 year security strategy that aligns with your business goals. Stop wasting money, start enabling growth. Ready for a plan that lasts? Learn more about our advisory services.👇 https://tinyurl.com/yadb8atn

Volk's new favourite cafe is called XS Espresso!  Or... XSS-presso. He eats vulnerabilities for breakfast 🥞 Coincidence? I think not! 🐺 #mascotmonday

The Taylor Swift concert hype in Australia gave us the perfect cover for our phishing campaign as a part of a Red Team: Operation TayTay.  We can use current events to test and strengthen your users' security awareness program. #SocialEngineering #Volkis #RedTeam

Cloud environments are complex, but a potential compromise doesn't have to be devastating. We harden Microsoft 365, AWS, and Azure beyond checklists to drastically lessen the impact of a compromise.  Ready to secure your cloud? Learn more about it👇 https://tinyurl.com/2yjsycvk

Do you know the CIA Triad? It’s the foundation of security: 🐺 Confidentiality – keep data private 🐺 Integrity – keep data accurate 🐺 Availability – keep data accessible Balancing all 3 helps you manage risk. Learn more 👉 https://www.volkis.com.au/blog/cyber-security-basics/

Happy #Mascotmonday to everyone that didn't want to get out of bed this morning! Sorry Volk might be late this morning! 🐺

Is your security posture built on a generic checklist or real-world experience? Our Secure Config Reviews are based on industry-recognized guides plus our own checks built from years of penetration testing experience. Learn more: https://www.volkis.com.au/services/secure-config-reviews/

"Our security sucks, so why bother with a pentest?" 🤔  A good test is more than a bad report. It’s a prioritized roadmap showing execs exactly what to fix and helping them turn known problems into a clear plan.   Read our blog! 👇 https://tinyurl.com/3wbf9wyv

True security is about more than just compliance, it's about aligning your defenses with your organization’s strategic goals. We help you achieve your objectives while building a greater level of security for a lower cost. Learn more here👇 https://tinyurl.com/yadb8atn

Happy Birthday Josh! 🎂🥳🎉 We hope you have a great day! Lots of love your Volkis Family ❤️

Join us in wishing a very spooky halloween and welcome to Jasie, our newest team member! 🎃🐕 Her official job title is Supervisor. Favourite activities include: - Threat Hunting (for bikes) - Security Testing (biting ankles) - Compliance Monitoring (sniff testing) Welcome!

We’re excited to share that Alissa Borg will be presenting at #BSides Sydney next week! Alissa and her co-presenter, Paula Sillars, will be leading an important and empowering discussion: "Breaking the Mould: Women Thriving in Technical Roles"

A critical cyber risk for one company isn't always a priority for another. For example, while data integrity is critical for a hospital, the theft of intellectual property is catastrophic for a military R&D firm.  Want to learn more? Read this👇 https://www.volkis.com.au/blog/cyber-security-basics/

The Volkis team is heading to New Zealand next week for Kawaiicon! The Volkis team will be in Wellington from Nov 5th to 8th attending Kawaiicon. If you're attending, let us know!👇 We can't wait to catch up with everyone. 🇳🇿 More about the event here: https://kawaiicon.org/

🐺 #mascotmondays on tour! 🚗💨

We did it again! ⭐️ ⭐️ ⭐️ ⭐️ ⭐️  "Volkis are knowlegeable, professional and an essential part of our security mix" - CEO of Sports Technology SaaS Company in Australia! If you're in Australia and need local cybersecurity services, get in touch today: https://www.volkis.com.au/contact/