TechnSecurity

Cyber security & Red Team & bug bounty

[Yusuf Can Çakır @Yusufcancakiir]

A full-scale municipal data breach and active Sliver C2 operation have been uncovered. The attacker used multiple implants communicating over mTLS with 43.157.204[.]73:8888 and c2.ashveil[.]org:8888, leveraging ECC certificates with codenames like OBJECTIVE_CHANNEL, SPIRITUAL_WOMEN, COMMERCIAL_CONVERSATION. On a compromised Windows host, Mimikatz extracted NTLM hashes for Administrator and several other accounts. TeamViewer 15.80.4 was fully backdoored via exfiltration of PermanentPassword, CertificateKey, PK/SK blobs, and SRP identifier while Always_Online was set to 1. AnyDesk device-id cache, stored RDP credentials, and router panels (TP-Link, ZTE) were also harvested. Internal scanning of the 10.160.197[.]0/24 range identified an Oracle database server at 10.160.197[.]88:1521 (SID newdhmos) accessed with hardcoded credentials lucence:otsdba. The full database was dumped, exposing 103,892 associate records containing full names, IBANs, AMKA social security numbers, tax IDs, monthly salaries, addresses, and contact details. Additionally, 1,390 employee records and 13,667 payroll entries were exfiltrated. Live API keys for the Greek transparency portal Diavgeia (6212_4 / 17DD357783BED4EF01A6CB) and the GSIS tax authority service manage_afe (L00011242L01450HKTWHXZNW87SH7P7H3FE / 0BD72E7B87FCDCEF0ED6, running on 10.160.197[.]88:7575) were stored in plaintext. Financial data shows 137,064 e-payment transactions totaling €341,748.13, with 92 payments already processed in 2025.

The operator's OPSEC is critically broken. The entire Sliver database is backed up via a shell script to github[.]com/serverops-admin/sliver using a hardcoded personal access token: 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. The repo ballooned from 365 MB to 634 MB in one day, indicating continuous exfiltration. Git config reveals the email feiyue@hermes[.]local and alias "绯月 FeiYue", granting full access to the attacker's GitHub account and a rare attribution window.

#ThreatIntel #Sliver #C2 #DataBreach #Oracle #Greece #OpSecFail #Infosec

[st8le̤̤̤̤̤̤̤̤̤̤ss @st8less]

CVE-2026-60206 | CVSS 9.9
Oracle WebLogic SAML Auth Bypass PoC

https://t.co/IqUgdjPdr1

[Clandestine @akaclandestine]

GitHub - nikaiw/VMkatz: Extract Windows credentials directly from VM memory snapshots and virtual disks · GitHub https://t.co/vy6A9RiuhJ

[Tom Dörr @tom_doerr]

APK Studio is an open-source IDE for reverse-engineering Android application packages. Built on Qt6, it allows you to decompile, recompile, sign, and install APKs, featuring a built-in code editor and automatic installation of tools like Apktool, JADX, and ADB.

https://t.co/EOV8nmRPtR

[7h3h4ckv157 @7h3h4ckv157]

Atlantis Android 📍

Capture HTTP/HTTPS traffic from Android apps and send to Proxyman for debugging.

Credit/Source: https://t.co/bIQv3UBBXF

[The Hacker @theprocracker]

BruteForce Snapchat Password - The Hacker

[Zero Day Engineering @zerodayalpha]

⚡️ VMware just released a critical security update for ESXi hypervisor suite (VMSA-2026-0006).

Two attack vectors:

1. Remote attack on vCenter –
CVE-2026-59309: auth bypass via network access
CVE-2026-59310: directory traversal RCE

An exploit would allow control of entire ESXi infrastructure.

2. A VM-escapable set of two bugs –
CVE-2026-59310: vmxnet3 OOBW
CVE-2026-41703: core OOBR

These are likely chainable to break out of VM and achieve code execution on hypervisor OS, as a privileged guest OS user.

Diffing and exploiting (1) is straightforward and should be patched promptly.

[Coffin @lostsec_]

You can also use Shodan's Certificate Transparency (CT) API to enumerate a target's subdomains directly from the https://t.co/b8sFqTyruD database.
https://t.co/6vL6HjRSmi

/api/v1/domain/{domain} ~returns the certificates that match a domain

/api/v1/domain/{domain}/hostnames ~returns all hostnames associated with a domain

[ɐpnH @AlAssaf_H]

Windows Push Notifications Use-After-Free CVE-2026-42978 Proof-of-Content and Research

https://t.co/neHOp2OXQt

[Smukx.E @5mukx]

Hidden Infrastructure Exposed: @anyrun_app Reveals Hijacked Gov Websites Delivering Malware

TLDR:- A deep dive into PhantomEnigma shows how attackers weaponized trusted .gov.br infrastructure, rotated C2s, helping the operation to stay hidden.

Blog:- https://t.co/2duvqYs7mA

[Yusuf Can Çakır @Yusufcancakiir]

Found an active, full-featured C2 / Browser-in-the-Middle (BiTM) + Infostealer infrastructure exposed at 194.59.30.195:8000 (public IP 20.248.121.116, domain https://t.co/xHjfCoNIE7). This isn't just a phishing page - it's a remote browser takeover toolkit designed to steal credentials, session cookies, and financial data in real time.

The Attack Chain: Victims land on client.html, which streams live DOM snapshots from the attacker-controlled server inside an invisible iframe. The victim sees a perfect replica of their target site (Gmail, Chase, PayPal, Microsoft, etc.). Every interaction (clicks, scrolls, keystrokes) is relayed to the server, executed on a real Playwright browser instance, and the updated page is streamed back. The victim is never interacting with the legitimate site; they're inside a fully transparent proxy.

Stealth & Evasion: The server runs with headless=False and stealth_mode=True - launching visible Chrome instances (via Xvfb on Linux) to evade headless detection used by anti-bot systems like Cloudflare and Akamai. Desktop resolution is set to 4K (3840x2160) to perfectly mimic high-end user workstations.

Brand Impersonation: The client includes a massive built-in library of 150+ brand logos and color palettes (Google, Apple, Yahoo, Amazon, all major banks). When a victim navigates to a target URL, the loading screen dynamically mirrors the exact official branding, building instant trust before the fake page loads.

Credential & Financial Theft: The injected JavaScript actively hunts for sensitive fields targeting ssn, card, cvv, password, and email. The developers left a comment in the code: // FIX: Show FULL password value - no masking. Every password and credit card detail is captured in plain text and logged to data/key.json on the server.

Telegram & Proxy Exfiltration with Hardcoded Secrets: The server integrates a Telegram bot for instant exfiltration - bot token and chat ID are hardcoded directly in https://t.co/Bloj7CYIUA. Premium residential proxy credentials for Decodo and Oxylabs are also embedded in plain text, allowing the operator to bypass geo-restrictions while exposing their own paid infrastructure.

Infrastructure & OPSEC Failures: Admin credentials are hardcoded (batman123 pattern). XOR encryption uses a static key. Cloudflare Tunnel is built-in for public exposure. The server supports hidden_session=true - a flag that keeps certain victims invisible in the admin panel, allowing covert monitoring.

IOCs: 194.59.30.195:8000 | 20.248.121.116 | https://t.co/xHjfCoNIE7 | /admin | wss:///ws & /admin | data/key.json (keystrokes) | profiles/ (stolen cookies/history) | persistent_links.json (backdoor access links). Hardcoded admin credentials present. Telegram bot configured for exfiltration.

This is a low-skill codebase with high-impact criminal potential. The operator left multiple hardcoded secrets in plain text. Block the IPs immediately, monitor for profiles/ directory artifacts, and enforce phishing-resistant MFA.

#Infosec #Malware #C2 #Keylogger #BiTM #ThreatIntel #CyberSecurity #OpSecFail

[Co11ateral @co11ateral]

SCADA Hacking & Security - Water Towers

A while ago we published a series on SCADA hacking and security, where we showed different industrial control systems

This is just one example, showing how an unprotected system allowed to take full control of water towers. The biggest problems remain outdated and vulnerable systems, poor network segmentation and credential reuse. Fixing these issues significantly improves the security of critical infrastructure

https://t.co/Jj1YtDwbWf

@three_cube @_aircorridor

[Clandestine @akaclandestine]

GitHub - KONDORDEVSECURITYCORP/c2Telegram: 🔴 LLM-driven Telegram C2 PoC — Unit42 2026 threat intel. Codeless malware operations via Telegram Bot + Groq/Llama NL command translation. Authorized security research only. · GitHub https://t.co/WkRQquZfoX

[Tom Dörr @tom_doerr]

IMSI-catcher uses an SDR receiver to instantly identify the IMSI numbers, brands, and operators of cellphones around you without manually decoding raw GSM traffic.

https://t.co/gnTjAivHAV

[Florian Roth ⚡️ @cyb3rops]

CertiGhost (CVE-2026-54121) deserves much more attention than it is getting right now, from my point of view.

In a common/default AD CS setup, a low-privileged domain user can create a rogue machine account, trick the CA into issuing a certificate with the identity of a Domain Controller, authenticate as that DC via PKINIT, gain replication access and basically compromise the whole domain.

So if you run on-prem Active Directory with AD CS and your CA is still unpatched, an ordinary domain user may currently have a path to the highest privileges in your domain.

Patch it, obviously, or apply the temporary mitigation. But if you patched only recently, the harder and from my point of view more important question is: did someone already exploit it?

A patch closes the hole. It does not unfuck a domain that was already compromised.

I put a list of things I would check in the first reply.

Overview:
https://t.co/NHaJD5hlFi

Technical details:
https://t.co/ucGrc2SLbJ

PoC:
https://t.co/nvWARPtmso

Microsoft advisory:
https://t.co/kYoXWRKTyz

Temporary mitigation:
https://t.co/hVOHBYO5hD

[7h3h4ckv157 @7h3h4ckv157]

Offensive PowerShell for Red Teamer with Defense Evasion Techniques

Resource/Credit: https://t.co/223ORlufyM

[Clandestine @akaclandestine]

GitHub - RedByte1337/GraphSpy: Initial Access and Post-Exploitation Tool for Entra ID and M365 with a browser-based GUI · GitHub https://t.co/qXZont7wo1

[Jokker @0xJokker]

Te comparto 15 sitios web que parecen ''ilegales'' pero son perfectamente legales

1. https://t.co/Mh4I74I7V2 — Descarga cualquier video de redes sociales

2. https://t.co/WOcO4jnBIS — Elimina tu presencia de cualquier sitio web

3. https://t.co/ND3LTgJuud — Accede a cualquier pagina web antigua o borrada

4. https://t.co/DmVwY1uHIc — Mas de 100 herramientas gratuitas en un solo sitio

5. https://t.co/qmMySUOoy9 — Correo electronico temporal con un clic

6. https://t.co/3B4fsHdEpF — Millones de libros y PDFs gratuitos

7. https://t.co/R0LFvzmpB7 — Asistente de IA para articulos de investigacion

8. https://t.co/BzVhxqqY01 — Mas de 70.000 libros clasicos gratuitos

9. https://t.co/IVPdPhDG0A — Localiza donde ver cualquier pelicula o serie

10. https://t.co/5F4hZHsYfj — Verifica si tus cuentas han sido hackeadas

11. https://t.co/nhkpmWnw3G — Mapea articulos de investigacion de forma visual

12. https://t.co/K8wcx0Wl10 — Comprime imagenes gratis sin perder calidad

13. https://t.co/1lUCGVvzp0 — Photoshop gratis online

14. https://t.co/5uVRA3AkwS — Resuelve problemas matematicos al instante

15. https://t.co/FpMt05wUoA — Rastrea vuelos en tiempo real en todo el mundo

Todo legal. Todo gratis

Guardalo antes de que se te olvide 🔖

[ThreatWire @ThreatWire_]

🚨 A public PoC has been released for CVE-2026-49176, a Windows WalletService privilege escalation vulnerability.

Full technical details are now public. Patch affected Windows systems immediately.

🔗 https://t.co/oxhXTMtPEZ

#Windows #LPE #CVE #CyberSecurity