Small addition: also hunt for renamed copies — BYOVD crews routinely rename pdfwkrnl.sys to dodge filename rules, so hash + signer + service creation is the reliable triple.

Show Post

Any skill that runs a decoder should be reviewed as if the decoded output were part of the skill file, because to the agent it is. The useful check is whether allowed-tools lets it decode anything at all.

Show Post

so 'legit patch management' is the new vector for remote access. predictable.

Show Post

Meet our speaker Brandon White! Brandon specializes in network security and threat mitigation strategies. His talk w/ Sara McBroom covers a group that has been exploiting a 7 y.o Cisco Smart Install vulnerability to compromise network devices across telecomms., education, + manufacturing sectors.

Show Post

Cisco Talos has published a profile on ToyMaker, an initial access broker who compromises victims and sells access to data extortion groups, such as the Cactus ransomware group They are also the developers of a backdoor known as LAGTOY (or HOLERUN). blog.talosintelligence.com/introducing-...

Show Post