.@Volexity’s latest blog post describes in detail how a Russian APT used a new attack technique, the “Nearest Neighbor Attack”, to leverage Wi-Fi networks in close proximity to the intended target, while the attacker was halfway around the world.
https://t.co/R3aKyrjVYR
#dfir
We are hiring! Come join @Volexity's Threat Detection team. This is a SOC-type role with purview across our customers to identify suspicious & malicious activity using our telemetry across network, EDR/AV, email, logs & more! Take a look! https://t.co/AJAFyOk64j
.@Volexity shares new observations following its discovery of CVE-2024-3400 + #0day exploitation of the GlobalProtect feature in Palo Alto Networks firewalls and offers guidance for detecting compromise.
More here: https://t.co/JXw0pZcE9D
#dfir#threatintel#memoryforensics
Our latest blog post details @Volexity's identification & incident response associated with the Palo Alto Networks GlobalProtect #0day vuln, assigned CVE-2024-3400, that the team found being exploited in the wild.
Read more here: https://t.co/cA7OctkRJW
#DFIR#ThreatIntel
Our team at @Volexity has identified a new 0day exploited in the wild. This time we caught a threat actor using an unauthenticated RCE in Palo Alto Networks GlobalProtect. It has been assigned CVE-2024-3400 and is covered in this @PaloAltoNtwks advisory https://t.co/JZIOPnavnX
cartography can be used to identify AWS privesc opportunities:
```
match(acc:AWSAccount)--(a:AWSPrincipal)--(p:AWSPolicy)--(st:AWSPolicyStatement{effect:"Allow"})
where "iam:CreatePolicyVersion" in st.action
return *
```
shows you targets that can create arbitrary policies.
"We are trapped in a sequential prison. We use sequential character strings to write sequential programs to control sequential computers. No wonder concurrency remains elusive. [...]
How might we help plan our escape?"
(Ivan Sutherland, 2011)
https://t.co/3uUpiDuZ55
Been spinning up #k8s clusters on @digitalocean with terraform to test out distributed training with https://t.co/Dd6Rclh87M
Can go from nothing to a full cluster running a workload in less than 10 minutes!
.@Volexity discovers zero-day exploit impacting all current versions of Atlassian Confluence Server and Data Center. Attackers deploy in-memory Java implant to evade detection. Read more in our latest blog post: https://t.co/aCSwnSUfj8 #DFIR#ThreatIntel#InfoSec
In the latest @volatility blog post, Memory Forensics R&D Illustrated: Detecting Mimikatz's Skeleton Key Attack, we walk through the #memoryforensics R&D process and develop a new #Volatility3 plugin to automatically analyze for abuse. https://t.co/TwkevZKdDB #dfir 1/2
eBPF comes to applications: BPF Memory Cache (BMC) is an eBPF memcached accelerator. Currently for GET requests over UDP. Promising work! Thanks @Orange https://t.co/Jj3raJZb7t https://t.co/jksSWEYH5S
I'm still learning to be a better boss and only look "good" when compared to other CEOs because the bar is so depressingly low.
Listen to your employees, trust them, reward them. They are responsible for a company's success - not CEOs.
I like the notion that burnout isn't necessarily working long hours, but rather having to give up things you love—whether that's spending time with family, reading, running, hiking, traveling, etc.
That definition also explains why lockdown is an unprecedented burnout catalyst.
.@USCERT_gov has released an Activity Alert addressing recently disclosed Microsoft Exchange vulnerabilities: https://t.co/ajRrTs3BZI This alert provides valuable information sourced from @Volexity blog + other sources. We urge all defenders to take a look! #dfir#ThreatIntel
Supply Chain compromise of #SolarWinds provides Dark Halo actor with unauthorized remote access to select targets. @Volexity has also observed this group using novel methods to bypass 2FA. New research just posted to our blog: https://t.co/qAuOPRJo1o #threatintel#dfir#infosec
In a major scientific breakthrough, the latest version of #AlphaFold has been recognised as a solution to one of biology's grand challenges - the “protein folding problem”. It was validated today at #CASP14, the biennial Critical Assessment of protein Structure Prediction (1/3)