Arzleck

Consultor de Seguridad, o algo asi =/

[VECERT Analyzer @VECERTRadar]

🚨 STRATEGIC CYBER INTELLIGENCE ALERT: ACTIVE INTRANET COMPROMISE AND CREDENTIAL EXPOSURE — REMSA S.A. (ARGENTINA) 🇦🇷

⚠️ THE "DARK-NOTES" GROUP EXPLOITS THE SALTA ENERGY AND MINING PORTAL USING SQLi EVASION TECHNIQUES

Through perimeter monitoring of cybercriminal dissemination channels and data exfiltration linked to the DARK-NOTES campaign, the active intrusion and exposure of the intranet portal of Recursos Energéticos y Mineros de Salta, S.A. (REMSA) (remsa .gob.ar), a publicly traded company with majority state ownership that manages energy and mining resources in the province of Salta, Argentina, was detected on May 27, 2026.

The attack has been attributed to the DARK-NOTES campaign threat actor, operating under the alias Azazel_A-01. Unusually and concerningly, the attacker distributed a 7-minute, 10-second demonstration video (approximately 60 MB) documenting the exploitation process step by step. In their communications, the actor describes the compromise in a mocking tone, comparing the security of the state infrastructure to "a Hack The Box (HTB) machine" due to the ease of exploitation via SQL injection (SQLi).

🎯 Affected Entity: Salta Energy and Mining Resources S.A.

👤 Threat Actor: DARK-NOTES

📂 Volume and Evidence Exposed:

Screenshot of the "People" table with detailed demographic data.

Screenshot of the system's "Users" list with administrative profiles.

A 7:10-minute proof-of-concept (PoC) video detailing the technical intrusion.

⚙️ Incident Type: Successful SQL Injection (SQLi), Intranet Compromise, Exposure of Billing and Human Resources Data.

📊 TECHNICAL ANALYSIS AND CRIMINAL TACTICS (TTPs)

The video and graphical samples released by the attacker expose severe flaws in the web application's security design and reveal the evasion methodology used:

💻 Web Application Firewall (WAF) Bypass:

The attacker indicates having exploited the intranet's input parameter using the automated tool SQLmap, applying advanced signature evasion tactics.

Techniques detailed by the actor: Use of tamper scripts such as `--tamper=space2comment` (which replaces whitespace in queries with block comments `//` to confuse the WAF) and the addition of controlled time delays (`--delay`) to avoid automatic blocking based on the rate of suspicious requests.

🗄️ Compromise of the Administrative Panel (REMSA Intranet):

"People" Table: Exposes columns with Document Type IDs (IdTipoDoc), Document Numbers (Doc), Supply/Cadastre Identification Number (NIS/Cadastro), Detailed Address, Contact Phone Number, and Email Address of clients, contractors, and citizens.

"Users" Table: Exposes the list of accounts with access to the system, including users such as admin, invoices, claims, HR, and specific employee profiles, ready for brute-force attacks or credential stuffing.

🛡️ MITIGATIONS AND PREVENTIVE RECOMMENDATIONS

🔒 Query Sanitization and Code Patching: REMSA developers must implement mandatory parameterized queries (Prepared Statements) in all portal data entries to completely eradicate the SQL injection vulnerability. WAF security signatures must be updated to block requests containing common SQLmap encoding and tamper sequences.

⚠️ General Credential Rotation: Force the immediate reset of all passwords for the accounts listed in the user module (e.g., admin, invoices, HR), and thoroughly audit the financial transfer audit logs in the "Purchases and Payments" module to confirm whether receiving bank accounts have been altered.

⚡ MONITORING AND EVALUATION

🌐 Intelligence System: https://t.co/wk9bZJ2Nli

🛡️ Quickly assess your website's security with: https://t.co/YnDw1QjN9c

#CyberSecurity #DataBreach #Argentina #REMSA #MiningSecurity #DARKNOTES #Azazel #SQLi #WAFBypass #FinancialFraud #ThreatIntelligence #CyberAlert #VECERT #Infosec #Unverified

[Dark Web Informer @DarkWebInformer]

1/2‼️🇦🇷 Banco Central de la República Argentina, IOMA, and GDEBA allegedly breached: credit scoring, affiliate records, and government PDF documents exposed

A threat actor claims to have leaked data tied to Banco Central de la República Argentina (BCRA), Instituto de Obra Médico Asistencial de la Provincia de Buenos Aires (IOMA), and Gobierno de la Provincia de Buenos Aires (GDEBA). The actor alleges the exposed material includes credit scoring data, IOMA affiliate and patient records, address and identity-related fields, and hundreds of government PDF documents.

▸ Actor: Skull1172
▸ Sector: Government / Healthcare / Financial Records
▸ Type: Database Leak
▸ Records: 32M+ BCRA records, 1M+ IOMA records, and 903+ PDFs
▸ Country: Argentina
▸ Date: 15/05/2026

Compromised data:

▪ BCRA-related credit scoring and financial screening records allegedly totaling more than 32M entries
▪ IOMA affiliate and patient records allegedly including identity, membership, contact, and health-plan related data
▪ GDEBA government document archives containing hundreds of PDF files
▪ Personal identifiers and tax-related fields allegedly including DNI and CUIT-type records
▪ Address, phone, email, birth date, and membership status fields linked to exposed sample records
▪ Administrative portal screenshots and document archive previews shared as proof of access

Stop guessing what's redacted. Subscribers see everything → https://t.co/281Qjc6WSh

[Cristian Borghello @SeguInfo]

Han comprometido el repo de TRIVY y enviaron una actualización maliciosa a Github.
La versión Brew de Trivy estuvo comprometida durante horas y, si tienen instalada la versión 0.69.4, deben hacer un downgrade a su versión anterior.

https://t.co/1Qoa9whO1e
https://t.co/r89t3r00l1

[Huntress @HuntressLabs]

RMM abuse surged 277% last year, making up nearly a quarter of the incidents we observed. (Huntress 2026 Cyber Threat Report).

Not because people don't care.

Because these tools are trusted by default.

Attackers noticed.

And built a playbook around it. 🧵

[4sysops @4sysops]

Microsoft end-of-support products in 2026: Windows, Office, Exchange, SharePoint, PowerShell, .NET, Azure services
https://t.co/cYTC8LSbYF

[Daniel Bradley @DanielatOCN]

Microsoft have now limited domains returned from the Autodiscover endpoint, impacting 𝐎𝐒𝐈𝐍𝐓 tools > https://t.co/FVK8aUyrVC

A blow to security peeps, but a win for defenders. Previously, you could make an 𝐮𝐧𝐚𝐮𝐭𝐡𝐞𝐧𝐭𝐢𝐜𝐚𝐭𝐞𝐝 request to Autodiscover and return a full list of all domains in any Microsoft Entra tenant. Now, it only returns the specific domain you query...

Personally, I used this enumeration technique as a sales tool; some used it as part of their red-teaming toolkit... These actors would query a tenant to identify poorly configured domains, which could then be used to launch malicious email campaigns or worse. Now, that loophole is closed 💙

#Microsoft #Entra #OSINT

[André Baptista @0xacb]

DMARC can reveal more domains associated with a target.

https://t.co/IOZqvIUCEX<target-domain> allows you to find domains using the same DMARC record. Check it out ���

There's also a python tool: https://t.co/MgbyS42HSn

[Sean Metcalf @PyroTek3]

The domain Kerberos service account, KRBTGT (https://t.co/T3WOILdFs8), is an important account since it is used to sign & encrypt Kerberos tickets. The account is disabled and the password doesn't change except when moving from Windows 2000/2003 to Windows Server 2008 (or newer).

This is a highly privileged account and if an attacker can gain knowledge of the account's password hash (or password), they can create forged Kerberos tickets (aka Golden Tickets: https://t.co/WMvjSOIpwm).

Most AD forests have this account lingering with old passwords. The KRBTGT account stores two passwords, the current one and the previous one and checks them both to validate Kerberos tickets. This means that to ensure that the KRBTGT passwords are fully changed, the password must be changed twice. If an attacker can capture a DC backup that is as old as one of the KRBTGT account passwords (say 15 years), then they can compromise the environment even if the backup is 15 years old!

We can use the "msds-keyversionnumber" attribute to determine how many times the KRBTGT password has changed. The formula n - 2 works to calculate how many times the password has changed. If this value is 2 it hasn't changed since it was originally set when the domain was created. If the value is 9, then it has changed 7 times (9 - 2 = 7).
Sometimes this value is very large, like 100003. In that case we just use the last digit (3) to calculate the number of times it has changed: n - 2 = 1, so it has changed 1x.

We recommend changing the password once, then waiting at least a week, and then changing the password again. When you set the password, a process on the DC actually changes the KRBTGT password to a fully random password.

PowerShell code to report on the KRBTGT account for the current domain:
$DomainKRBTGTAccount = Get-ADUser 'krbtgt' -Server $DomainDC -Properties DistinguishedName,'msds-keyversionnumber',Created,PasswordLastSet
$DomainKRBTGTAccount | Select DistinguishedName,Created,PasswordLastSet,'msds-keyversionnumber' | Format-Table -AutoSize

#ActiveDirectorySecurityTip

[Arzleck @arzleck]

@el_faldu clasico, pero es mas barato asi jajaja...peliate con el robot que no te dice ni soluciona nada :P

[Rachel Tobac @RachelTobac]

LinkedIn is now using everyone's content to train their AI tool -- they just auto opted everyone in.
I recommend opting out now (AND that orgs put an end to auto opt-in, it's not cool)
Opt out steps: Settings and Privacy > Data Privacy > Data for Generative AI Improvement (OFF)

[Germán Fernández @1ZRR4H]

🚨 Campaña activa de #Metamorfo aka #Casbaneiro dirigida a España y Argentina.

"HA RECIBIDO SU COMPROBANTE FISCAL DIGITAL"
Enviado desde: facturas17@contab[.]tech

Para España 🇪🇸
1.- hxxps://short[.]gy/nkT7dz
2.- hxxp://familysinaloa[.]website/a12/
3.- hxxp://149.100.158.179/es/digital.html
4.- hxxp://38.54.20.180/avbs/index.php?va
+ https://t.co/T8aXpH8q52

Para Argentina 🇦🇷
1.- hxxps://short[.]gy/cMhYOS
2.- hxxp://facturacionmovistar[.]tech/ar22/
3.- hxxp://149.100.158.179/ar/digital.html
4.- hxxp://38.54.20.180/arvbs/index.php?va
+ https://t.co/JQ5z3OVLGb

Luego descarga .RAR con archivo tipo "FACTURAgzneih0__Ikb_(295).PDF.vbs" que al ejecutar conecta hacia:

5.- hxxp://dftssa.3utilities[.]com/03/17
6.- hxxps://www.dropbox[.]com/scl/fi/2vz7jktyvpx62tlnl6ag2/m.zip?rlkey=zppa4iy6pzyhsu94kuxf9ytdy&dl=1 ↓
7.- hxxps://ambjulio.com/a/08/150822/up/up
8.- hxxp://38.54.20.180/nv/index.php
9.- hxxp://193.203.190.217/a/08/150822/au/logs/index.php?CHLG

Al menos 9 saltos en la cadena de infección 😂

[+] Muestras: https://t.co/pIZmqP8uIg

[vx-underground @vxunderground]

We would like to express our condolences to Blue Teamers.

Microsoft has announced Microsoft Excel will now support Python.

More information: https://t.co/LutCzlYc0x

[Olaf Hartong @olafhartong]

#Sysmon 15 is out and brings a new event type, FileExecutableDetected, which allows for much more detection opportunities.

I've wrote up some of my thoughts on what this feature brings and where it could be even better in this blog post https://t.co/duc6z64vnp

[Thomas Roccia 🤘 @fr0gger_]

🔍If you are looking for a comprehensive overview of the current #3CX supply chain attack, I created a diagram that shows the attack flow!💥I'll update as soon as the analysis progresses. Stay tuned for the MacOS edition! #cybersecurity #infosec #supplychainattack #3CXpocalypse

[John Hammond @_JohnHammond]

Today I got a notification on my phone that YouTube had sent me a copyright report, claiming one of my videos violated copyright and my channel was going to receive a strike.

Except, my video didn't violate copyright. And YouTube didn't really send me a copyright report.

[Olaf Hartong @olafhartong]

Sysmon 14.0 has been just released by @Sysinternals . Sporting a new feature that will now allow it to start having prevention features. The new Event ID is 27 and is called FileBlockExecutable.

I've written a short blog with some more details.

https://t.co/b1CjJVvXm0

#sysmon

[Shubham Sharma @Shubham_pen]

Best of AWS Cheat Sheet

#infosec #cybersecurity #pentesting #oscp #informationsecurity #hacking #cissp #redteam #technology #DataSecurity #CyberSec #Hackers #tools #bugbountytips #Linux #websecurity #Network #NetworkSecurity #cybersecurityawareness #AWS #awscloud

[LetsDefend @LetsDefendIO]

SPF vs DKIM for SOC analysts

[LetsDefend @LetsDefendIO]

Cheat sheet for CISO

[Cristian Borghello @SeguInfo]

Este 👇es el motivo por el cual NO hay que buscar un página web en G e ingresar al primer enlace.
Y, también es un buen motivo para probar otro buscador ☺️ como @startpage y @DuckDuckGo.
Los anuncios y la invasión a la privacidad apestan.