Alexis Reclus

🚨 CRITICAL ALERT: Mass exploitation of multiple Oracle E-Business Suite (EBS) vulnerabilities, including a 0-day, by Clop for data theft and extortion   Here's what you need to know:   1️⃣ Clop exploited multiple vulnerabilities in Oracle EBS which enabled them to steal large amounts of data from several victim in August 2025. 2️⃣ Clop is the actor behind prior mass exploitation, data theft, and extortion campaigns impacting customers of MOVEit and other managed file transfer solutions. They've made a lot of money over the years. 3️⃣ Clop has been sending extortion emails to several victims since last Monday. However, please note they may not have attempted to reach out to all victims yet. 4️⃣ Multiple vulnerabilities were exploited including vulnerabilities that were patched in Oracle's July 2025 update as well as one that was patched this weekend (CVE-2025-61882). 5️⃣ CVE-2025-61882 is a critical (9.8 CVSS) vulnerability that enables unauthenticated remote code execution.   ⚠️ Given the broad mass 0-day exploitation that has already occurred (and the n-day exploitation that will likely continue by other actors), irrespective of when the patch is applied, organizations should examine whether they were already compromised.   Thanks to the Oracle team for the collaboration.   🔗 Additional details from Oracle: https://lnkd.in/eFaF-hu3

545

8 commentaires

🚨 Urgent Security Alert: SharePoint Vulnerability (CVE-2025-53770) – No Patch Available Microsoft has confirmed active exploitation of a critical SharePoint Server vulnerability (CVE-2025-53770). This affects on-premises SharePoint—SharePoint Online is not impacted. No patch is currently available. 🔒 What to Do Now: 1️⃣ Enable AMSI integration (enabled by default since Sept 2023 updates). 2️⃣ If AMSI cannot be enabled, disconnect servers from the internet until a fix is available. 3️⃣ Asume breach and monitor for suspicious activities 🔍 Hunting for Indicators of Compromise (IOCs): ⚠️ Look for creation of spinstall0.aspx – a clear sign of successful exploitation. ⚠️ Use Advanced Hunting and search DeviceFileEvents for this file and related anomalous activity over the past 7 to 30 days. 📢 This is a live threat. Stay ahead with guidance: 👉 https://lnkd.in/gH_JFmyY #CyberSecurity #SharePoint #Vulnerability #NoPatch #ZeroDay #IncidentResponse #CVE202553770 #ThreatHunt #SOC

153

1 commentaire

Urgent: Microsoft SharePoint Zero-Day Vulnerabilities (CVE-2025-53770 & CVE-2025-53771) Actively Exploited Since July 7, 2025, critical zero-day vulnerabilities in Microsoft SharePoint (CVE-2025-53770 and CVE-2025-53771) have been exploited, targeting government, telecom, and tech sectors. These vulnerabilities, bypassing earlier patches (CVE-2025-49704 and CVE-2025-49706) from the July update ( these vulns were found on Pwn2Own Berlin 2025) , enable unauthenticated remote code execution (RCE) via the ToolShell exploit chain, allowing attackers to steal cryptographic keys and forge access even post-patch. Vulnerability Details: CVE-2025-53770 (ToolShell RCE) A critical deserialization flaw allows unauthenticated attackers to execute arbitrary code through crafted POST requests to /_layouts/15/ToolPane.aspx with an HTTP Referer header set to /_layouts/SignOut.aspx. Attackers extract MachineKey configurations to generate valid __VIEWSTATE payloads, enabling RCE with a single HTTP request. Over 54 organizations have been impacted. Microsoft’s Response Microsoft has released an emergency out-of-band update for: - Microsoft SharePoint Subscription Edition - SharePoint Server 2019 - SharePoint Server 2016 Action Required Apply the Update: Immediately install the latest Microsoft security patches. Regenerate Machine Keys: Post-update, regenerate SharePoint machine keys to prevent further exploitation. Method 1: PowerShell Set-SPMachineKey -WebApplication <SPWebApplicationPipeBind> Update-SPMachineKey -WebApplication <SPWebApplicationPipeBind> Method 2: Central Administration Navigate to Central Administration > Monitoring > Review job definitions > Run the “Machine Key Rotation Job” > Execute iisreset.exe on all SharePoint servers. Check for Compromise: - Verify if the file C:\Program Files\Microsoft Office Servers\16.0\TEMPLATE\LAYOUTS\spinstall0.aspx exists. - Review IIS logs for POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx with an HTTP Referer of /_layouts/SignOut.aspx. Resources Research:https://lnkd.in/epCHVPqb Proof of Concept:https://lnkd.in/eqPJDM39 Exploit Details:https://lnkd.in/eGVU_3Zc #Cybersecurity #SharePoint #ZeroDay #MicrosoftSecurity

44

1 commentaire

Active Directory Tier 0 Remediation: A Critical Blueprint from ANSSI In today’s threat landscape, recovering from an advanced intrusion requires more than incident response—it demands strategic, operational, and technical excellence. The French national cybersecurity agency ANSSI provides a comprehensive remediation guide focused on Active Directory (AD) Tier 0, the heart of identity and privilege management in enterprise environments. This technical framework emphasizes the “CEER” approach: ➡️ Containment ➡️ Eviction ➡️ Eradication ➡️ Rebuild Key Highlights from the Guide: Eviction and Recovery: Full reinstallation of Domain Controllers, revoking compromised secrets (krbtgt, DSRM, KDS), and eliminating dangerous control paths. Hardening Measures: Increasing AD forest functional levels, cleaning GPOs, removing weak permissions, and adopting secure admin workstations (PAWs). Sustainable Practices: Implementing OU-based Tier segregation, reducing privileged accounts, and enforcing administrative silos. Supervision for Detection: Leveraging logging and SIEM tools to detect post-remediation persistence or misuse of old credentials. The document outlines three remediation scenarios: Restore critical services fast. Regain full control of the IS. Rebuild for long-term security resilience. This guide is a must-read for incident response teams, SOC managers, and AD administrators aiming to secure the backbone of their identity infrastructure post-compromise. I highly recommend all cybersecurity professionals read this if you're involved in incident recovery, Active Directory security, or privileged access management. Let’s treat incidents not just as disasters—but as opportunities to redesign for resilience. Cybersecurity ActiveDirectory Expert RedTeam Talents BlueTeam Walker Pest Management - Bed Bug Control & Thermal Remediation ANSSI - Agence nationale de la sécurité des systèmes d'information

50

LogonTracer: Visualizes Suspicious Activities - Free! Who logged into the network and how? A single logon event can provide critical insights into the timeline of an attack, but without the right tools, connecting the dots is a challenge. LogonTracer makes this process easier by analyzing Windows Active Directory event logs and visualizing them as graphs. This allows security teams to identify patterns quickly. Whether it's a series of failed logins or unusual authentication requests: • Visualize logon data with Neo4j & Cytoscape • Install with Docker for easy setup • Detailed event log analysis in chronological order • Use advanced algorithms to pinpoint suspicious activity Learn more: https://lnkd.in/gd535s84 Threat hunting isn’t just about identifying a potential attack; it’s about understanding the context around it. Discover over 10+ essential data analysis techniques for effective threat hunting in my "Cyber Threat Hunt 101" YouTube series, explained simply: https://lnkd.in/gkVB6B2j Please share and subscribe if you enjoy the content! #cybersecurity #threathunting #threatdetection #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #DataAnalysis #IncidentResponse

358

12 commentaires

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77