“At the end of the day, it’s about peace of mind. Customers trust us to watch their backs so they can focus on running their business.” 🛡️ In our SOC, that’s the mission.

🚨 The Rapid7 MDR team has observed a significant rise in the number of threat actors leveraging Direct Send, a lesser-known feature within #Microsoft365. Find our mitigation advice & more in a new blog: r-7.co/3VMtAeH

Automated security scanners are often stopped in their tracks by MFA. This is great for security, but poses a challenge for scanning. Luckily, Rapid7's InsightAppSec makes it easy to handle Time-based One-Time Passwords (TOTP). Find a guide in our blog: http://r-7.co/46DTiXV

Threat actors are exploiting CVE-2025-53770, a critical Microsoft #SharePoint vulnerability, to gain initial access to victim networks – notably across the public sector. Find actionable next steps & a free download of Rapid7's September Threat Report in our latest blog: r-7.co/3VILFu7

🚨 On September 25, 2025, #Cisco published advisories for 3 vulnerabilities affecting multiple different Cisco products. CVE-2025-20333 & CVE-2025-20362 are known to be exploited in the wild, while the third, CVE-2025-20363, is at high risk thereof. More in our blog: r-7.co/4pLZs0Y

We have published our AttackerKB @rapid7.com Analysis for the recent GoAnywhere MFT vuln, CVE-2025-10035. It's an access control bypass + unsafe deserialization + an as-yet unknown issue in how an attacker can know a specific private key! attackerkb.com/topics/LbA9A...

Most SIEMs collect data. Incident Command helps you act on it. AI-powered workflows give analysts speed and clarity, while leaders see progress they can measure. Faster investigations, smarter response, real outcomes. 🔗 https://r-7.co/4n01JUs

⚠️ Rapid7 has identified a permission bypass vuln. in multiple versions of #OnePlus OxygenOS installed on its Android smartphones. When leveraged, any app on the device may read SMS/MMS data & metadata via the default Telephony provider. More in our blog: r-7.co/42EujlR

Analysts shouldn’t have to carry the weight of 4,400 alerts a day. Incident Command flips the model: AI trained by Rapid7’s SOC drives accurate triage, guided investigations, and a unified workflow that actually accelerates analysts. 🔗 https://r-7.co/4mui03e

🚨 On 9/18/2025, #Fortra published an advisory for CVE-2025-10035, a new vulnerability affecting GoAnywhere MFT. The vulnerability allows an attacker to achieve unauthenticated remote code execution. More details & mitigation guidance in a new blog: https://r-7.co/4mAaweQ

Casinos rely on eyes in the sky to see every table and every move. Rapid7 gives you that same clarity across your environment—endpoint to cloud, users to attackers—with the context to act. Watch the full interview for more insights: https://r-7.co/45Rshje

🚨 Yesterday, September 17, 2025, #SonicWall disclosed a security breach affecting customers with MySonicWall[.]com cloud backups enabled. Rapid7 has updated its September 10 blog with the latest guidance: r-7.co/46hbAOu

You may be outnumbered, but with Rapid7 MDR, you're never outmatched. Rapid7 MDR delivers expert-led, attacker-aware detection and response across every corner of your environment. Discover the Rapid7 MDR difference: https://r-7.co/3Ibgi8r

September #PatchTuesday: 176 fixes, five critical RCEs, and multiple zero-days. Key priorities include SQL Server (CVE-2024-21907), Azure HPC (CVE-2025-55232), and SMB server (CVE-2025-55234). Full analysis 👉 https://r-7.co/4m9MBm1

In Q2, 2025... 🛡️ Bunny Loader was still one of the most commonly observed malicious files 🛡️ Helpdesk & MS Teams remained top targets for social engineering 🛡️ Valid accounts with no MFA: here for the long haul More insights from our IR team in a new blog: r-7.co/4mZrTqr

🚨 An #Akira ransomware campaign targeting #SonicWall devices kicked off early August, 2025. While initially believed to be a new, emerging threat, SonicWall has since disclosed disclosed this is related to a CVE from 2024. More in our latest blog: https://r-7.co/46hbAOu

Salt Typhoon uses rootkits, backdoors, & “living-off-the-land” tools to infiltrate telecoms & critical sectors worldwide. 🛡️ Our report covers their TTPs and provides defensive recommendations for defenders: https://r-7.co/3VHDz4V

What if your company’s network was already for sale? Initial Access Brokers are selling access, often with user privileges, for as little as $500. Our 2025 Access Brokers Report shows how they operate and how to fight back: r-7.co/411cmgP

Learn from casinos. Seriously. They observe everything, manage risk tightly, and the house always wins. Can your security program do the same? Watch the full interview for more insights: https://r-7.co/45Rshje

Rapid7 is the only vendor to be recognized as a Leader in the following 3 reports: 🛡️ 2025 IDC MarketScape for Exposure Management 🛡️ IDC MarketScape: Worldwide SIEM for Enterprise (2024) 🛡️ IDC MarketScape: Worldwide SIEM for SMB (2024) More on the distinction in a new blog: https://r-7.co/47jSR70

At #DEFCON33, Rapid7's Deral Heiland challenged IoT Village participants to extract a smart camera's firmware, manipulate its flash memory, and ultimately gain root access 📸 Today, the full exercise is available in whitepaper form! Find a free download via our blog: r-7.co/462gJcW

Attackers don’t target assets. They exploit exposures. Exposure Command helps you see real attack paths, validate defenses, and cut risk with confidence. Learn more: https://r-7.co/3U7X0mE

Rapid7 recently observed threat actors misusing @velocidex. ⚠️ No vulnerability exists in the tool itself—the risk is in how attackers abuse it. To help org's detect misuse, Velociraptor deliberately creates easy to detect IOCs. Learn what to look for 👉 https://r-7.co/4g2JomU

20% of breaches stem from exploited vulnerabilities. 46% come from assets VM can’t see. Exposure Command helps you uncover risks and focus where it matters most. See how: https://r-7.co/3U7X0mE

Rapid7 has been named a Leader in the IDC MarketScape: Worldwide Exposure Management 2025 Vendor Assessment. 👏 IDC recognized the Command Platform for unifying exposure management & threat detection, giving security teams situational awareness. Learn more: https://r-7.co/3Jyhnrf

🚨 On August 26, 2025, #Citrix published a security bulletin for 3 new vulnerabilities affecting #NetScaler ADC and NetScaler Gateway. Find mitigation guidance & more in the Rapid7 blog: r-7.co/41qASrX

Most breaches succeed after initial access. Lateral movement inside the network is where real damage happens. Vector Command Advanced adds internal and lateral testing to continuous red teaming, to validate defenses and prove controls work. See how in a new blog: https://r-7.co/41UQWCe

Attackers don’t need to break in. They can buy their way in. The 2025 Access Brokers Report reveals how stolen access is fueling a booming underground economy. Read more: https://r-7.co/411cmgP

⚠️ While performing continuous red teaming exercises, Rapid7 discovered a total of 4 vulnerabilities in #Securden Unified PAM. Securden effectively coordinated with Rapid7 and quickly provided a patch to remediate all 4. Read on in our blog: r-7.co/47954eI

Security leaders need proof their controls work. Rapid7 launched Vector Command Advanced to extend continuous red teaming with internal testing, giving teams confidence in risk reduction and compliance. Read more: https://r-7.co/3JoZKKq

AI is transforming cyber threat intelligence, but resource gaps and complexity still get in the way. The 2025 SANS CTI Survey, sponsored by Rapid7, reveals how teams are using AI today and what’s next. Read the report: https://r-7.co/4luUwKZ

Rapid7 is expanding continuous red teaming with Vector Command Advanced. 🚀 A new service that adds internal penetration testing and compliance validation to one unified platform experience. Read the release: https://r-7.co/3HwaSEI

🛜 What happens when the convenience of network-edge NAS devices goes terribly wrong? Read on via 'DisguiseDelimit', Rapid7 Researcher Ryan Emmons' (@booleanblind.bsky.social) main-stage #DEFCON33 talk-turned-whitepaper on his discovery of a critical Synology NAS vulnerability: r-7.co/4lvMm4q

Microsoft is addressing 111 vulnerabilities for #PatchTuesday, including 1 zero-day EoP vuln in the Windows implementation of #Kerberos, and 9 critical RCE vulns. 🧩 Find a full summary in a new blog: r-7.co/3UVYPU7

🔎 Step inside the hidden market selling your network to the highest bidder. Thanks to Initial Access Brokers (IABs), a foothold into your network is now up for sale. Introducing Rapid7's 2025 Access Brokers Report. Download it for free via our blog: r-7.co/411cmgP

Starting soon at #DEFCON: DisguiseDelimit: Exploiting Synology NAS with Delimiters and Novel Tricks 📍 LVCC, Exhibit Hall West 3, Track 2 🕑 2:00 PM 🔊 Ryan Emmons See how Rapid7 uncovered a zero-day in millions of NAS devices, plus a novel Linux exploitation technique.

🍽️🔥 Order up! Rapid7 is bringing the heat at #BHUSA. Stop by the Command Grill @ Booth 5042 for a live demo, a theater session, or just to say hi to our crew! More to look forward to here: r-7.co/40dw4Wc | @blackhatevents.bsky.social

Today at 11:00 AM: Akheron Proxy – Interchip Serial Proxy 📍 Arsenal Station 9 Replay and fuzz microprocessor comms on embedded devices in real time Metasploit Attack Capability + Workflow Updates 📍 Arsenal Station 6 Demo: SMB relaying, ESC15, SCCM attack methods #BHUSA @metasploit-r7.bsky.social

📍We’ve made it to #BHUSA. See you at Booth 5042 tomorrow! Swing by for sharp insights, live demos, and a few sizzling surprises. 🔗 r-7.co/3GyObzi

👾 The ransomware landscape in 2025 is dynamic, fast-moving, and more industrialized than ever, but the playbook remains consistent: infiltrate, persist, exfiltrate, extort. Read on for 5 takeaways from Rapid7's Q2 Ransomware Trends Analysis: r-7.co/4lviVQd

Rapid7 is now FedRAMP Authorized. Our solutions can now be deployed across federal environments to deliver proactive threat exposure management and automated response at scale. This includes hybrid cloud and on-prem environments. 💼 r-7.co/3UtfbDt

📱 MFA is often touted as a cure-all for data breaches. But a well-timed push notification might be all a threat actor needs to get a foothold. Read on for how a Rapid7 pentester breached a university's systems – all thanks to one unsuspecting professor: r-7.co/3IMdcaK

Rapid7 is showing up at #BHUSA and DEF CON with live demos, new tooling, and research on everything from embedded exploits to AI-driven attacks. 🎤 Explore the full session lineup: r-7.co/46p4Xv7

✅ Major ransomware groups disbanding (or disappearing altogether) ✅ Affiliates drifting between threat groups, their loyalty in question ✅ Threat actors "padding their stats" by repurposing stale data Rapid7's Q2 2025 ransomware analysis has it all: r-7.co/413FFPD

On 7/19/25, #Microsoft released an advisory for CVE-2025-53770, a critical RCE vuln. affecting on-prem #SharePoint servers. Rapid7 has since observed active exploitation in customer environments. Find indicators of compromise & more in a new blog: r-7.co/3GYD7eN

🚨 On 7/18/25, CrushFTP disclosed CVE-2025-54309 affecting versions <10.8.5 and 11.3.4_23 across all platforms The vuln is being exploited in the wild. A “last_logins” value set for the internal ‘default’ user may indicate compromise. Full analysis: r-7.co/40pEUjN

Rapid7 was named a Leader in the 2025 Frost Radar™ for MDR. 🛡️🏆 We’re recognized for AI-driven investigation, risk-aware response, and a platform that unifies telemetry, context, and action. 📰 More here: r-7.co/3ILKiHI

Firmware gaps. Custom tools. Ransomware in CPUs. Christiaan Beek breaks down where attackers are headed, what orgs are missing, and why basics like patching still matter. 🔍 More in @cyberdailyau.bsky.social: r-7.co/40T4r4R

“An unauthenticated attacker can trigger SQLi via an HTTP request to the /api/fabric/device/status endpoint (and possibly several other endpoints, according to [watchTowr’s] analysis).” - @stephenfewer.bsky.social, Rapid7 Principal Security Researcher More in @helpnetsecurity.com ⤵️

🎣 Social engineering isn’t just phishing anymore. Today's threat actors are bypassing controls via real-time impersonation, help desk fraud & more. In a new blog, check out 3 ways social engineering is evolving – plus how security teams can stay ahead: r-7.co/44AQ1r5