Luis Rocha

[CERT Polska @CERT_Polska_en]

‼️At the end of last year, there was a series of coordinated attacks in Polish cyberspace.

📌Today, our team is publishing a report describing the technical analysis of these events. We show the scheme of operation and the tools used by the attackers.

➡️https://t.co/A7EuPsL12h

[R136a1 @TheEnergyStory]

This blog post provides an in-depth analysis of #Turla's #Kazuar v3 loader and how it tries to slip past modern defenses:

• Sideloading via MFC satellite DLLs
• Control flow redirection trick (+ POC)
• Patchless ETW and AMSI bypasses (+ POC)
• Extensive COM usage for registry, file and folder operations (+ partial POC)
• Strings encryption (+ IDAPython decryption script)
• Including IOCs and Yara rules

https://t.co/FK8uAq9iyK

[The Hacker's Choice (@[email protected]) @hackerschoice]

THC Release: 🎄Smallest SSHD backdoor🎄

- Does not add any new file
- Survives apt-update
- Does not use PAM or authorized_keys

Just SSHD trickery....adds one line only.

More at https://t.co/zVCLwmbXv2 👌

[Ivan Velichko @iximiuz]

SSH Tunnels: Port Forwarding on steroids

Yesterday, we talked about Port Forwarding - an old networking trick that makes an endpoint accessible via a different address. Ports can be forwarded with socat & netcat, but there is a much more powerful and ubiquitous alternative: SSH.

[Phrack Zine @phrack]

At long last - Phrack 72 has been released online for your reading pleasure!

Check it out: https://t.co/R0PKIifRDA

[Sean Metcalf @PyroTek3]

If you have Active Directory Certificate Services (ADCS) in your environment, run Locksmith now!

In Active Directory Security Assessments, we have found critical security issues in *most* ADCS configurations.

The great thing about Locksmith is that it doesn't just highlight the security issues in your ADCS environment, but also provides the command to remediate it!

If you're a pentester/red teamer, Locksmith is great for you to provide remediation recommendations to your customers.

https://t.co/vvtBeeMLuR

#ActiveDirectorySecurityTip

[Sean Metcalf @PyroTek3]

The domain Kerberos service account, KRBTGT (https://t.co/T3WOILdFs8), is an important account since it is used to sign & encrypt Kerberos tickets. The account is disabled and the password doesn't change except when moving from Windows 2000/2003 to Windows Server 2008 (or newer).

This is a highly privileged account and if an attacker can gain knowledge of the account's password hash (or password), they can create forged Kerberos tickets (aka Golden Tickets: https://t.co/WMvjSOIpwm).

Most AD forests have this account lingering with old passwords. The KRBTGT account stores two passwords, the current one and the previous one and checks them both to validate Kerberos tickets. This means that to ensure that the KRBTGT passwords are fully changed, the password must be changed twice. If an attacker can capture a DC backup that is as old as one of the KRBTGT account passwords (say 15 years), then they can compromise the environment even if the backup is 15 years old!

We can use the "msds-keyversionnumber" attribute to determine how many times the KRBTGT password has changed. The formula n - 2 works to calculate how many times the password has changed. If this value is 2 it hasn't changed since it was originally set when the domain was created. If the value is 9, then it has changed 7 times (9 - 2 = 7).
Sometimes this value is very large, like 100003. In that case we just use the last digit (3) to calculate the number of times it has changed: n - 2 = 1, so it has changed 1x.

We recommend changing the password once, then waiting at least a week, and then changing the password again. When you set the password, a process on the DC actually changes the KRBTGT password to a fully random password.

PowerShell code to report on the KRBTGT account for the current domain:
$DomainKRBTGTAccount = Get-ADUser 'krbtgt' -Server $DomainDC -Properties DistinguishedName,'msds-keyversionnumber',Created,PasswordLastSet
$DomainKRBTGTAccount | Select DistinguishedName,Created,PasswordLastSet,'msds-keyversionnumber' | Format-Table -AutoSize

#ActiveDirectorySecurityTip

[Sean Metcalf @PyroTek3]

Want to detect Kerberoasting with no false positives?

Setup a honeypot account for detection following the guidance in this article:
https://t.co/2OjBvxbp6R

#ActiveDirectorySecurityTip

[Hex-Rays SA @HexRaysSA]

🧠 Reverse engineers, your lab just got smarter.

IDA Free 9.1 is now preinstalled in FLARE VM — @Mandiant 's open-source malware analysis environment.

➥ Lightweight static analysis with cloud decompilers
➥ One-click to launch IDA directly
➥ IDA Plugin ecosystem ready to go

Read more about the integration here: https://t.co/yhCulmGAtV

[Costin Raiu @craiu]

I've been looking at the leaked #Nobitex cryptocurrency exchange Source Code from Predatory Sparrow / Gonjeshke Darande (https://t.co/QphAbbfnhy and related configs) for the whole morning, here's my notes:

[Florian Roth ⚡️ @cyb3rops]

PoC Exploit for the NTLM reflection SMB flaw CVE-2025-33073

https://t.co/tkgfd5UnEp

[The Hacker's Choice (@[email protected]) @hackerschoice]

1-line "Living Off The Land" persistent DNS-reverse backdoor. (now added to https://t.co/zVCLwmbXv2).

[The Hacker's Choice (@[email protected]) @hackerschoice]

🍿THC member on camera. A first. 😅
30 years of hacking - a perspective and a reflection. 📺 👉 Keep Hacking 👈 The next 30 years of hacking start today. ❤️

[hasherezade @hasherezade]

I have a little X-mass gift for you all... #PEsieve 0.4.0 is out: https://t.co/eXE9fFAzAp

[Costin Raiu @craiu]

Here's the decrypted, 2nd stage dex payload of the Android Monokle spyware from this amazing story below: 3613a76be3c6f0d7f6108920cbd4bcedc4c9a4c3607136a747f77f3c099f7322 - on @virustotal: https://t.co/KK05Hq7YfY

[ESET Research @ESETresearch]

UPDATE: #ESETresearch was contacted by one of the possible authors of the Bootkitty bootkit, claiming the bootkit is a part of project created by cybersecurity students participating in Korea's Best of the Best (BoB) training program. 1/2
https://t.co/CZW6Mfm6bK

[CISA Cyber @CISACyber]

🚨@SophosXOps completed a 5-year investigation into People’s Republic of China-based groups targeting perimeter devices. Their report, revealing insights into PRC threat actor tactics, harnesses the power of #JCDC partnership to unite cyber defenders. 🙌 https://t.co/3DIPm1hTaP

[Costin Raiu @craiu]

Some of the details in this story are just crazy. For instance: "Sophos included in its “hotfix" for the hackers' intrusions additional code that would collect more data from customers' devices. That new data collection revealed that a single Sophos device registered in February of 2020 in Chengdu showed signs of early alterations similar to the Asnarök malware. [...] The company went so far as to track down and monitor the specific devices on which the hackers were testing their intrusion techniques, surveil the hackers at work, and ultimately trace that focused, years-long exploitation effort to a single network of vulnerability researchers in Chengdu, China."

[Andrew Case @attrc]

Our talk from @defcon is now available! In the presented research, we document every EDR bypass technique used in the wild along with how to detect it using new memory forensics techniques and @volatility plugins. Feedback appreciated!

https://t.co/fWD57fzchj

#DFIR

[Alessandro Di Carlo @samaritan_o]

🚨 #DFIRtips 🚨

Today, during an investigation, I found a registry key that proved to be extremely useful in identifying the execution of a malicious executable: HeapLeakDetection!

You can find it in the Software hive, specifically at HKLM\Software\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications.

This registry key is interesting because its subkeys refer to all the executables that have been detected by RADAR technology for real-time memory leak detection.

Each subkey has its own LastDetectionTime which tells us the last time a memory leak occurred and which executable was affected.

Even though it is not particularly well-known, this artifact could sometimes turn your investigation around, especially when the threat actor tries to erase their tracks by deleting the most common artifacts (Prefetch files, evtx logs, etc.)

[screenshots from my test machine]