Daniel Dean

[Steven Lim @0x534c]

🚨 Threat Alert: A newly registered domain, 𝘁𝗲𝗮𝗺𝘀-𝗼𝗻𝗹𝗶𝗻𝗲[.]𝗰𝗼𝗺, created just 𝟰 𝗱𝗮𝘆𝘀 𝗮𝗴𝗼, is actively mimicking the full Microsoft Teams login and user interface.
​
At the time of analysis, 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿 𝗿𝗲𝗽𝗼𝗿𝘁𝗲𝗱 𝘇𝗲𝗿𝗼 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻𝘀, so don't rely solely on endpoint protection. Consider proactively adding this domain to your tenant's block list and web filtering policies immediately.
​
#threathunting #threatdetection 🫡

[Darthtech @Darthtech_]

Anthropic opened its strongest cyber models to more vetted teams, including tests of interbank systems.

Not a breach. A preview. If a vendor turns that on inside the bank, the permission is the control.

[Darthtech @Darthtech_]

Korean banks were hit through loan-broker and sales-support side doors. AI may have sped it up. The door was already there.

If a vendor agent can see the loan file, the model is not the control. The permission is.

[Darthtech @Darthtech_]

A coding agent sent local secrets because it could read untrusted context and it already had the keys.

Prompt injection is the trigger. Standing access is the breach.

No full fix for the first. Default-deny is the fix for the second.

[Darthtech @Darthtech_]

Prompt injection that matters: a lead form tells the agent what to do.

Salesforce patched SalesBleed. The pattern is still the risk. If the agent can read untrusted text and act with a staffer’s access, the form is the exploit.

[Daniel Dean @firstgreendean]

Been there. I recommend processing the stress so you can get back to content that you enjoy making.

Getting a quality routine helped me a ton. Consistent sleep, eating well, and physical activity that relieves stress. For me, these tend to change my perspective. Tasks suddenly go from insurmountable to just another thing I can break down into smaller pieces and enjoy tackling again. YMMV.

[Sami Laiho @samilaiho]

WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and
Shared Memory
https://t.co/5Pd0zbsijj

[Sami Laiho @samilaiho]

CISA Releases Six Industrial Control Systems Advisories
URL: https://t.co/NxRG5q2uZj
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8

[BleepingComputer @BleepinComputer]

Dell asks admins to patch max severity CSM flaws as soon as possible
https://t.co/JIZkpMV3jf

https://t.co/JIZkpMV3jf

[Sami Laiho @samilaiho]

https://t.co/k7T4wSdJRq

[Darthtech @Darthtech_]

FortiMail zero-day, already exploited. No click required.

If the mail gateway is the front door, patch is step one. Checking what ran before the patch is step two.

[Sami Laiho @samilaiho]

Critical vulnerability in WatchGuard Endpoint Security
URL: https://t.co/k2lD88C5qI
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.3

[Sami Laiho @samilaiho]

Vulnerabilities in WatchGuard Fireware OS
URL: https://t.co/j9KQpOc273
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.2

[Darthtech @Darthtech_]

TeamViewer: five high-severity fixes. Worst one can bypass session permissions and potentially run code.

Not exploited yet. Update to 15.82.

Yesterday the RMM was fake.

Today the real one still needs a version check.

[Daniel Dean @firstgreendean]

@Darthtech_

[Darthtech @Darthtech_]

ClickFix is back inside ChatGPT-search lures.

Google → fake page → paste the “fix” → trojan.

No exploit.

If the paste can run, the delivery mechanism does not matter.

[Darthtech @Darthtech_]

New RAT: fake Microsoft Store page → RMM tools → hijacked PC.

No exploit required.

If unapproved remote-support software can run, the second stage is already paid for.

Default-deny is the control. Alerts are the autopsy.

[Darthtech @Darthtech_]

CISA added two Citrix NetScaler RCE bugs to KEV over the weekend. Already exploited.

If that’s how staff get in after 5, patch this week.

Then ask what ran inside if the box was hit first.

Gateway last Friday. Citrix this Monday. Same question.

[Darthtech @Darthtech_]

CISA deadline today: two Check Point gateway/VPN and management flaws already exploited.

If that box is how staff get in after hours, patch is step one.

Forensic look is step two.

“Can unapproved tools run inside if the gateway was owned?” is still the question.

[Darthtech @Darthtech_]

ClickFix doesn’t need malware.
It needs permission to run.

Fake “verify” page → staffer pastes PowerShell → ransomware.

Training won’t catch every paste.
Default-deny will.

If the Run dialog can execute whatever a webpage copied, the exam question writes itself.