@malmoeb@hackerkartellet Hi Stephan,
I know its been a while since this was posted, but found it through Asger, and wanted to share that i've dug a but more into the tool and described the functionality here: https://t.co/luG2MYPsey
During an active ransomware case, we observed a threat actor silently install CodeMeter Runtime 8.20 from a user's temp directory and abuse it for local privilege escalation (CVE-2025-47809). Haven't seen this before, pretty neat.
https://t.co/wxEAyjD3KM
Credential Guard was supposed to end credential dumping. It didn't.
@bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.
Read for more ⤵️ https://t.co/mYPHg1mTKj
🧪 Microsoft has just rolled out a new addition to their logs, called Linkable token identifiers, which will help with tracing user sessions across most of their M365 services.
https://t.co/cN5N8QuvSJ
Was responding to a customer noticing outbound RDP connections originating from their DCs. After a few hours we noticed that MS Defender for Identity was present on the DCs, which we started digging further into, and found this in their documentation. Is this common knowledge?
Interesting phishing campaign delivering XWorm RAT.
Infection chain:
Phishing email --> User redirected to fake https://t.co/tlvImjSPlZ site --> Tricked to go through CAPTCHA with opening Win +R and pasting their clipboard --> Leads to mshta.exe downloading XWorm RAT
#xworm
The TA was also utilizing NtSetValueKey native API to create a hidden auto run key for persistence. This is throws an error when displayed in regedit or Velociraptor. But opening with registry explorer reveals the key.