Cyber_Sec

I will never get bored of cyber security and international politics.

[Cyber_Sec @cyberworm199]

Just reposting

[Cyber_Sec @cyberworm199]

@Snowden Israel should known this attack and they intentionally closed their eyes for a reason to invade Iran

[Dark Web Intelligence @DailyDarkWeb]

🇪🇸 Alleged Exposure Impacts Spanish Football Federation Coaching Platform

A threat actor claims to have discovered a misconfigured Firebase deployment affecting https://t.co/xogYnfCv31, the official coaching academy platform of the Royal Spanish Football Federation (RFEF).

According to the forum post:

* The actor claims a publicly accessible Firebase Storage bucket exposed approximately 504 files (around 182 MB) without authentication.
* The exposed files allegedly include student documents, profile photos, invoices, and scans of Spanish national identity cards (DNI), including both front and back images.
* The actor also claims to have enumerated 113,681 Firebase Authentication user IDs through a publicly accessible Realtime Database endpoint.
* The post attributes the exposure to misconfigured cloud storage and database permissions rather than exploitation of a software vulnerability.

Analyst Note: These claims have not been independently verified. If accurate, the incident would highlight the continued risk posed by cloud storage misconfigurations, particularly where identity documents and sensitive user files are stored without proper access controls.

#DDW #Intelligence #DarkWeb #Spain

[HawkTrace @hawktrace]

🚨Windows Admin Center Remote Code Execution🚨

CVE-2026-56196
CVE-2026-58631

https://t.co/2phkLWNZsY

https://t.co/ccBO27dQVj

[Kerry Burgess @KerryBurgess]

I can scarcely believe this. I'm hoping it's AI, but I'll be cheering for England anyway...

[Sana Mohamed 🇪🇬❤️ @moh25915981]

التشكيلة الاساسية لمنتخب الأرجنتين : 10 لاعبين و ميسي و الحكم 😂😂

[BleepingComputer @BleepinComputer]

🚨 Microsoft just released its largest Patch Tuesday ever.

🩹 570 vulnerabilities fixed
🔥 3 zero-days (2 actively exploited)
💻 141 remote code execution flaws

Microsoft recently warned larger Patch Tuesdays were coming as it uses AI to help discover more security flaws before attackers do.

➡️See full report: https://t.co/54Kxatd2WK

[Legendary Sports Report @LegendaryNewz]

🚨 BREAKING: An American hip-hop rapper has released a diss track titled “WHISTLE MAFIA” protesting alleged FIFA and referee bias toward Argentina and Messi. 😳🎵🎶

[Sana Mohamed 🇪🇬❤️ @moh25915981]

سخرية الأجانب من تحكيم مباراة سويسرا و الارجنتين الجزء الاول 😁

احلي حاجة لما عملوا الحكم بينفخ الكرة عشان تدخل جول للأرجنتين 😁😂

[Abraham @Abraham_Abrahub]

Vazou a footage da final da Copa 2026🐷

No fim, os porcos erguem a taça.
Encardida de lama, do jeito que foi conquistada.

Marca aquele teu amigo que acha que a FIFA tá limpa.

Salva pra rever e 👉 segue @abrahubstudio pra aprender.

[Enzra Miller @Enzramiller]

Argentina 🇦🇷 vs England 🏴󠁧󠁢󠁥󠁮󠁧󠁿

[H0rm0natt0ressiPessi➐🇺🇲 @h0rm0natt0ressi]

Messi está yendo a casa de infantino para hablar de cómo robarán a Inglaterra.

[Mariana Oliveira @marioliveirain]

A Argentina virou a chacota dessa Copa do Mundo kkkkkkkkk

[📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中 @MalwareBibleJP]

商用C2フレームワーク「Nighthawk」の開発元MDSecが、EDR回避の実装手法をリリースノートやブログ記事として無料公開しています。sleep中のビーコン暗号化、コールスタック偽装、indirect-syscall、LLVM難読化、UEFI改変によるSecure-Boot回避まで、複数年にわたる研究が個別記事で追える構成です。

防御側にとっては「商用C2がどの検知ポイントをどう回避しているか」を攻撃者の視点から確認できる資料群として読めます。

【要点の整理】

・2026年3月公開のUEFI研究では、Dell製ファームウェアイメージをフラッシュレベルで改変し、BIOS設定画面に痕跡を残さずSecure-Bootを無効化する手法を解説。OS起動より前に制御を取るブートキットの前提となる技術。

・2025年10月公開の「Function-Peekaboo」は、LLVMの中間表現（IR）を使い、関数が呼ばれた瞬間だけ復号して実行後に再暗号化するself-masking関数をコンパイル時に生成する手法。静的解析やメモリ上のYARAスキャンを構造的に回避する設計。

・「Nighthawk」C2の各リリースノート（0.1〜0.3.3）では、タイマーベースのsleep-obfuscation（休止中にビーコンを暗号化しメモリスキャンを回避）、カーネルのスレッド検査時にもアンバックトメモリが現れないコールスタック偽装、CET（Control-flow-Enforcement-Technology）のシャドウスタックとの互換対応、indirect-syscallによるEDRユーザーモードフックの回避などが、リリースごとの改良として文書化されているとの整理。

・ServiceNowのMIDサーバーを経由したNTLMリレー攻撃（2025年3月）など、C2フレームワークの機能以外にも実務的なレッドチーム手法の記事がブログ上に公開されている構成。

商用C2の回避実装が具体的にどのAPIを避け、どのメモリ状態を隠し、どの検知経路を塞いでいるかが文書化されているため、EDRのアラートロジックやメモリスキャンの死角を点検する際の参照先として活用できます。

詳細は以下を参照：
https://t.co/WNi7YkvGVB
https://t.co/T1qNenHx6t
https://t.co/6MZFarxN40
https://t.co/xGbJrZuZDZ

(※可能な範囲でファクトチェックは実施済なものの、元記事の精度依存や速報・要約の性質上漏れもありうるため、正確な情報は一次情報を直接参照のこと)

[BleepingComputer @BleepinComputer]

New CrashStealer malware poses as Apple crash reporting tool
https://t.co/ptHWsUMBpl

https://t.co/ptHWsUMBpl

[BleepingComputer @BleepinComputer]

New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released
https://t.co/QBhbw5nPqN

https://t.co/QBhbw5nPqN

[Co11ateral @co11ateral]

Miniplasma (Windows unpatched LPE)

CVE-2020-17103 apparently was not patched or the patch was reversed, regardless this the PoC for an LPE in cldflt.sys used to spawn a SYSTEM shell. Success rate may vary since it's a race condition

https://t.co/Lc2ie8FXXp

#windows

[Dark Web Informer @DarkWebInformer]

🚨 Nightmare Eclipse just released another vulnerability called MiniPlasma

GitHub: https://t.co/oySBY1X8ke

CVE: CVE-2020-17103 which is a high-severity elevation of privilege vulnerability in the Windows Cloud Files Mini Filter Driver that allows an attacker to gain elevated, unauthorized access to a targeted system

[vx-underground @vxunderground]

Yippie

Two new Microsoft Windows 0days. The exploits have cool and badass mysterious names to be extra spoopy

- GreenPlasma: Windows CTFMON Arbitrary Section Creation Elevation of Privileges Vulnerability
- YellowKey: Bitlocker Bypass Vulnerability

https://t.co/VaWFtW5lFi

[Haifei Li @HaifeiLi]

CVE-2026-40361 (https://t.co/CNZKI1aKWG), patched today, is a critical 0-click UAF/RCE bug in Microsoft Outlook that I discovered back in Q1. You definitely want to patch this sooner rather than later.

The danger of such 0-click bugs in Outlook is that they are triggered as soon as the victim reads or previews the email - no clicking of links or attachments is required. Since the bugs reside in Outlook's email rendering engine, it is difficult to mitigate or block (though specifically setting Outlook to render emails only in plain text format is a valid mitigation).

Fun fact about the discovery: after the discovery of the #BadWinmail bug a decade ago, I wanted to run an experiment in Q1 to see if I could find another 0-click RCE in Outlook. The result? It wasn't easy — I even built a dedicated system for it — but I eventually found this one. :)

To understand why such bugs are so critical, check out the #BadWinmail video demo I released a decade ago: https://t.co/DBhE5sWGDH. They share the same attack vector (though #BadWinmail was a working exploit, while this one was a PoC). Essentially, anyone could compromise a CEO or CFO just by sending an email. The threat perfectly bypasses enterprise firewalls and is delivered directly to the inbox. Furthermore, note that Outlook (Classic) lacks an application sandbox, making this attack vector even more dangerous.

Regarding defense and detection: if you are concerned about Outlook 0-click 0-days, my EXPMON system (https://t.co/NKqtbTEmVW) provides cutting-edge detection against such advanced threats. When I designed the original system in 2020/2021, I developed this functionality specifically considering the impact of #BadWinmail. The system accepts .eml or .msg formats, and email samples are deeply tested within an Outlook sandbox. For enterprise users, emails can be "dumped" from the mail server, and EXPMON can be deployed in a private network. Contact me for more details.

P.S. I just noted that the title of the Microsoft Security Update (https://t.co/CNZKI1aKWG) lists this as a Microsoft Word bug, which may or may not be entirely accurate. I demonstrated this bug to MSRC by showing that it works in a real, live Outlook + Exchange Server environment. My bet is that because the bug resides in wwlib.dll — a shared DLL used heavily by both Outlook and Word — it likely affects both Outlook (via email) and Word (via a document file). Regardless of the title, it is a genuine Outlook 0-click RCE.

#CVE-2026-40361 #PatchTuesday #Outlook #0click #EmailSecurity #EnterpriseSecurity #expmon #ThreatIntel #ExploitDetection

[striga @striga_ai]

PoCs for Apache Tomcat Unauth RCE (CVE-2026-34486) and Apache httpd Pre-auth RCE (CVE-2026-23918) are now public on our Github.

Tomcat exploit is fully reliable. httpd chain works in a controlled lab setup with a known info leak.

https://t.co/D3dg5iTuwP
https://t.co/2zyr1ds4Mo