Cole Vanlandingham

n00b | Hacker Stuff | Cyber Stuff | Blue Team Stuff YouTube Chanel:

[Cole Vanlandingham @Cole_Van_]

For 2023 I'm creating my own CyberLabz Attack range. Still building everything out in my free time. Having the ability to VPN, simulate attacks, use different C2s, and capture all the data with Security Onion is pretty cool. Stay tuned!

[Cole Vanlandingham @Cole_Van_]

@UK_Daniel_Card That dog don't hunt.

[hashkitten @hash_kitten]

Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - https://t.co/iuU0yiYJBT

[Elastic Security Labs @elasticseclabs]

TELEPUZ is a new modular malware spreading via CLICKFIX-VIDAR chains. Elastic Security Labs is tracking it.

Active since late April 2026. The delivery path: ClickFix social engineering tricks users into running a PowerShell command that downloads a VIDAR Go variant, which then fetches a lightweight stager and the main TELEPUZ payload.

The core DLL communicates over WebSockets and pulls additional modules from C2 on demand:
Keylogger
Stealer
Web injector: intercepts browser sessions via CDP and WebDriver BiDi, with default configs targeting financial form fields like IBANs

36 commands. Indirect syscalls. AMSI and ETW patching. NTDLL unhooking. Multiple UAC bypasses.

Still in active development: the shellcode injection command returns a TODO placeholder.

C2 infrastructure is small (2 domains), but fallback methods include Telegram channels, Steam profiles, DNS records, and a Polygon smart contract that doubles as a kill switch.

New builds hit VirusTotal daily. The C2 footprint is small, but this thing is moving fast for something that started 2 months ago.

Full technical analysis: https://t.co/TTKETmNUwB

[Doug Burks @dougburks]

🚨 SO-CRATES 2.0 is LIVE! 🔥

Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus just leveled up.

New in v2.0:
• Brand new Hacker Mode 👀
• One-click “Delete all previous analyses”
• Fresh favicon + polish

PCAP • Logs • Files | Suricata + YARA + Sigma | Sankey diagrams, transcripts, hexdumps & more.

Let’s catch some hackers!

Secret tip: There’s a hidden way to unlock full Hacker Mode… type the right number and see what happens 😏

Who’s spinning this up first? Drop your screenshots or findings below 👇

#Cybersecurity #DFIR #ThreatHunting #BlueTeam #OpenSource #HackerMode

[Scott Ullrich @sullrich]

I co-founded pfSense. For the last year I've been building its successor.

If you run pfSense today, you already know the reasons to look around: development you can't influence, a CE edition that feels like an afterthought, FreeBSD driver roulette on modern hardware, and a config workflow where one bad apply on a remote box means a drive.

nfSensei is my answer. Built from scratch in Rust, on Linux, and designed around the things pfSense users actually complain about.

Your config.xml imports. There's an importer that reads your pfSense config, shows you exactly what maps over and what needs attention, then applies it. You don't start from zero.

You can't brick it from the couch. Changes stage as a candidate, diff before apply, validate through the real engines before anything is written, and auto-roll-back if you don't confirm in time. If a config ever fails at boot, the box falls back to the last good one on its own.

The hardware works. Linux base means modern NICs and drivers just work — and the fast path compiles your rules to XDP at 40Gbps.

Automation is native, not scraped. Everything the UI does is a documented API call — about 1,140 of them, with a built-in explorer. Your Ansible finally gets a real interface.

The VPNs are current. WireGuard, IPsec, Tailscale, and self-hosted mesh — your own control plane, your keys — plus post-quantum key exchange where it counts.

The experimental stuff has its own wing. Thirty-plus Labs features behind toggles: WAN bonding that fuses multiple cheap uplinks through a $5 VPS into one resilient pipe, per-flow SLA telemetry with tamper-evident audit chains, GeoDNS that steers traffic by live RTT and load, application-aware QoS, config push to a whole fleet of remote nodes, and an AI assistant on the box that reads your actual interfaces and logs using local models. Toggles are per-browser and can't touch your running config — flip things on, break them, tell me about it. Oh, and there is much more to mention here!

Self-hosted, on your hardware, no cloud account, no subscription.

It's NOW IN ACTIVE BETA (previously alpha) with about 40 testers, and bug reports typically get fixed in days. I want more people who know what pfSense does well and can tell me exactly where nfSensei falls short.

If you are interested in testing please email me: [email protected]. Tell me about your pfSense setup and I'll get you access.

Note: Affiliates and employees of Netgate are not invited.

[Elastic Security Labs @elasticseclabs]

We tracked a new activity cluster targeting Mexican banking customers.

Elastic Security Labs discovered REF6045, an operator-assisted banking fraud campaign targeting customers of Mexican banks, fintechs, and cryptocurrency platforms through ClickFix fake-CAPTCHA lures.

The operation exhibits a reliance on AI-generated code and suffers from significant operational security (OPSEC) failures that exposed their infrastructure and their toolkit.

The toolkit gives operators a full fraud workflow from:
•Vishing overlay: lock the screen behind a fake bank warning
•Browser redirect: paste a phishing URL via automated keystrokes
•Clipboard swap: replace CLABE or card numbers mid-transfer
•Remote access: install Remote Utilities for hands-on takeover

Research by @k33b0i and @soolidsnakee.

Full analysis from Elastic Security Labs: https://t.co/a1mxxU6N1m

[Security Onion @securityonion]

HAPPY BIRTHDAY TO US!

Today marks the twelfth birthday of Security Onion Solutions -- a dozen years of providing training, support, and other services on top of the free and open Security Onion platform. Here's to many more!

[TryHackMe @tryhackme]

Free live session tomorrow ! Watch a real prompt injection attack, start to finish ⚡️https://t.co/bExKttfYU9

[Doug Burks @dougburks]

Thanks to everyone who came out to the SO-CRATES presentation at last night's Augusta ISSA meeting!

It was a great crowd and I enjoyed the discussion.

If you missed it, be sure to check out our super quick online demo and our github repo! (links below)

[Elastic Security Labs @elasticseclabs]

Your SOC tools don't talk to your dev tools. Your detection engineers write rules in one place and investigate in another.

Live on June 17, we're demoing autonomous investigation workflows and security operations running inside Claude, Cursor, and Copilot.

One week to go. Register now: https://t.co/f3bk2NABBt

[Elastic @elastic]

Stop building dummy data to test Elasticsearch.

Kibana ships three production-quality sample datasets. One click to install, dashboards included:

- Sample eCommerce orders: customer transactions, product categories, revenue by region
- Sample flight data: airline routes, ticket prices, delay metrics, geographic maps
- Sample web logs: HTTP requests, response codes, geoIP, error rates

Each one comes with pre-built visualizations and a full dashboard out of the box.
Open Kibana, go to Integrations, search Sample Data, click Install.

Real data. Real dashboards. No setup required.

[Doug Burks @dougburks]

🚀Introducing SO-CRATES 1.0 — Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!

SO-CRATES is a single container image for analyzing pcap files, log files, and binary files. It was formerly known as OhMyPCAP.

Here's what you can do with SO-CRATES:
✅analyze pcap files and then review Suricata alerts, metadata, and extracted files
✅import log files and then review Sigma alerts and the original log entries
✅import binary files and then review YARA matches and file metadata

All of this runs in a single Docker/Podman container — perfect for air-gapped environments, malware analysis, incident response, threat hunting, forensics & teaching.

Who’s trying it out? Drop a ❤️ and reply with your main use case!

#DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma

@Suricata_IDS @lennyzeltser @chrissanders88 @sansforensics @TomLawrenceTech

[Samir @SBousseaden]

very cool research! it triggers an existing Elastic Defend behavior detection

[Doug Burks @dougburks]

Nice article!

I grabbed the url for the 2026-01-31 MTA PCAP and threw it into OhMyPCAP. That's definitely a fun pcap!

You might want to check out OhMyPCAP as it gives you:
- pcap analysis (alerts and metadata)
- file extraction
- file alerts via yara
- file metadata via exiftool

Check it out at https://t.co/lYhedmAnuU

[Elastic @elastic]

Agent handoffs, tool calls, real-world enrichment. Running live against an actual incident.

[Elastic @elastic]

Building a dashboard mid-investigation means losing the thread you were pulling.

Open the editor, pick indices, configure panels, wire up ES|QL queries.

That's ten minutes of context switching before you've answered a single question.

Kibana skips that now.
• Describe what you need in plain language.
• The agent explores your indices, generates ES|QL, picks chart types, and lays out the panels.

Everything stays in your conversation until you save it.
Then it becomes a first-class Kibana object your team can open and edit.

Already viewing one? The agent attaches automatically.
Ask why a metric spiked, add a comparison panel, break it down by region: all inline.

Available as a technical preview in Elastic 9.4

[Elastic @elastic]

Save for later.

[Elastic @elastic]

🧵 The Elasticsearch Agent Builder Hackathon asked developers to build agents that solve real operational problems.

Each builder started with a concrete, costly problem and built a system that reasons through it, not one that just queries it.

• PHAROS: a four-agent pharmacovigilance system that detects drug safety signals, generates regulatory paperwork, and fires alerts in under 60 seconds.

• Gauntlet: an adversarial testing framework where a mocking agent intercepts your primary agent's tool calls and stress-tests it to find failure points, getting smarter every run.

• Duplicate Detection Agent: built for Kenya's HIV testing infrastructure, it scanned 1,010 records across 59 facilities and surfaced 131 duplicates that previously took weeks to catch manually.

Congrats to Prajwal Sutar, Kavish Sathia, and Fredrick Kioko.

Read how each one was built: https://t.co/YSojF4AazA

All projects are open source. Reply with each winner below.

[Samir @SBousseaden]

Azure activity logs do not capture the actual executed command via VM RunCommand. On the target VM, all spawned processes run under S-1-5-18/root, without user attribution. Using ES|QL, however, we can correlate Endpoint and AAD logs to bridge this gap:

https://t.co/ig9IwVVlWQ