Diego Sarnataro

Microsoft has released its September security updates. This included: • 81 vulnerabilities patched. • 0 vulnerabilities with evidence of exploitation. • 9 'Critical' rated. The ASD’s ACSC encourages all users to apply the available patch updates ASAP👉 https://lnkd.in/dHpTjmk8

91

1 commento

🚨 New CTI Labs: CVE-2025-53770 (ToolShell SharePoint RCE) 🚨 This critical zero-day vulnerability allows for a full, unauthenticated takeover of on-premise SharePoint servers and has already been added to the CISA KEV Catalog. With a public exploit now available, the threat is immediate. We've just launched two new CTI Labs giving teams hands-on experience with this exact threat from both sides of the attack. 🛡️ Defensive Lab: For System Admins, SOC Analysts, Incident Responders, and Threat Hunters to practice detection and response: https://hubs.ly/Q03yNqNm0 ⚔️ Offensive Lab: For Red Teamers, Penetration Testers, and Threat Hunters to understand and execute the exploit chain: https://hubs.ly/Q03yNq5w0 Prepare your teams for the real world. Get hands-on with CVE-2025-53770 today. #CTI #SharePointRCE #CVE

92

5 commenti

✔️ Secure by design, secure by default. From procurement to patching, #NIS2 requires security across the full system lifecycle. 📘 #ENISA’s guide supports implementation of secure development practices, change control and vulnerability management. 🔗 https://lnkd.in/dBbj-Dfu

86

2 commenti

APIs are the backbone of modern software, enabling seamless communication between different systems. In the newly published #OWASP #APISecurity Top 10 (2023), critical vulnerabilities are highlighted that could jeopardize your applications. Key Highlights Include: - Broken Authentication - Unrestricted Resource Consumption - Server-Side Request Forgery (SSRF) https://lnkd.in/gDB6gZwb

29

1 commento

🚨 New #LockBit Variant Tagets ESXi and Linux: Critical Infrastructure at Risk. In September 2025, the LockBit group released LockBit 5.0, a new version of its #ransomware. The new variant introduces stronger obfuscation, flexible configurations, and advanced anti-analysis techniques. ⚠️ The most alarming development is the expansion to #Linux and #VMware ESXi, signaling a clear focus on server environments and critical infrastructure. Ransomware has shifted from targeting endpoints to directly disrupting core infrastructure. ❗️ A single intrusion can cause outages with severe financial and reputational impact. LockBit 5.0 comes in three builds, each optimized for its target OS. 🚨 VMware ESXi: The most critical new variant, a dedicated encryptor for hypervisors that can simultaneously disable all VMs on a host. Its CLI resembles the other builds but adds VM datastore and config targeting. See live execution: https://lnkd.in/eVy9fwfu 📌 Windows: Main variant. Runs with DLL reflection, supports both GUI and console, encrypts local and network files, removes VSS shadow copies, stops services, clears event logs, and drops ransom notes linking to live chat support. See live execution: https://lnkd.in/efDmAAUQ 📌 Linux: Console-based, replicates Windows functionality with mount point filters, post-encryption disk wiping, and anti-analysis checks such as geolocation restrictions and build expiry. See live execution: https://lnkd.in/erQugDNg 🔍 Use these TI Lookup search queries to enrich detection logic with live threat data: ESXi Lockbit 5.0: https://lnkd.in/ehTxKDS2 Linux Lockbit 5.0: https://lnkd.in/ekchCh39 Windows Lockbit 5.0: https://lnkd.in/e4mtH7bF 🚀 Strengthen resilience, protect business continuity through proactive security with #ANYRUN. #ExploreWithANYRUN #CybersecurityAwarenessMonth

99

1 commento

🚨 𝗜𝘀 𝗬𝗼𝘂𝗿 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗦𝗲𝗰𝘂𝗿𝗲? Active Directory (AD) remains one of the most targeted assets by cyber attackers. From privilege escalation to password spraying, a single overlooked configuration can lead to devastating breaches. Here are the Top 10 AD Attack Methods you should know about: 1️⃣ Kerberoasting 2️⃣ Password Spraying 3️⃣ Local Loop Multicast Name Resolution (LLMNR) 4️⃣ Pass-the-hash with Mimikatz 5️⃣ Default Credentials 6️⃣ Hard-coded Credentials 7️⃣ Privilege Escalation 8️⃣ LDAP Reconnaissance 9️⃣ BloodHound Reconnaissance 🔟 NTDS.dit Extraction Why this matters: AD attacks often go undetected until it’s too late. Regular audits, patching, and implementing strong authentication measures are crucial to prevent compromise. 💬 Which of these attack methods do you think is the hardest to defend against? Let’s discuss in the comments! 🔔 Follow e-Learn Cyber Security for more cybersecurity tips! #CyberSecurity #ActiveDirectory #ThreatHunting #IdentitySecurity #PrivilegeEscalation #PasswordSecurity #RedTeam

117

6 commenti