Israel G

. ..: I love solve problems for which there is no obvious answer

[Israel G @ipartner_]

Team 1nf0s3c with @jhtt89 at #RealCTF thanks to
@smigalin Solving WarnUp Social DDoS & working on Script-Kiddie 1

https://t.co/lFpxS6ZSJy

[Nicolas Krassas @Dinosn]

Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft https://t.co/yNaDHYh3OP

[DirectoryRanger @DirectoryRanger]

ShareHound: Mapping rights of network shares using bloodhound OpenGraph, by @podalirius_
https://t.co/7wIce883Mv

[Gray Hats @the_yellow_fall]

Group-IB unmasks the Phoenix System: a PhaaS platform using rogue cell towers and live-dashboards to bypass MFA across 2,500+ domains. Read the full report.

#PhoenixSystem #PhaaS #CyberSecurity #Smishing #InfoSec #GroupIB #MFABypass #FraudAlert #TechNews
https://t.co/aBN4nW5v5B

[zack0x01 @zack0x01_]

“CVE-2026-31431” just dropped… and it reportedly allows root access on pretty much any Linux version 😳

If that holds up, that’s absolutely wild.

[Daniel Lunghi @thehellu]

We investigated a CN #APT that targeted multiple governments and companies with government contracts in Asia. In half of the targets we found a second group with different malware toolkit but sharing the infection vector and some post-exploitation tools https://t.co/IN12VBv5k4

[Unit 42 @Unit42_Intel]

Obfuscated #WebSocket backdoors are injecting credit card skimmers into hundreds of compromised websites. The payload sends stolen card information back to attacker's C2 domains. Details at: https://t.co/3UIzhZXYCv

[Vivek | Cybersecurity @VivekIntel]

🧠 Betterleaks — Secret Detection Tool

Find exposed secrets (API keys, passwords, tokens)

• Advanced regex + CEL-based filtering
• Validates secrets via HTTP (checks if active)
• Reduces false positives (token + context filtering)
• Fast parallel scanning (git, files, stdin)
• Cross-platform, lightweight binary

https://t.co/7B1y6h3Yhg

⚠️ For secure code auditing & DevSecOps
#CyberSecurity #AppSec #OSINT

[YungBinary @YungBinary]

TRU sees python-based backdoors regularly, often varying in functionality, though they often share the same obfuscator.

Here's an example w/ capabilities like screenshot, download, upload, and arbitrary command execution - C2s aren't detected in VT.

C2:
87.120.186[.]229
149.248.78[.]202

[Dark Web Intelligence @DailyDarkWeb]

🏦 Threat actor ‘MDGhost’ is advertising an alleged dataset containing 4 million U.S. financial service records associated with Visa-branded cardholders.

The actor claims the dataset includes names, addresses, phone numbers, emails, and partial card-related metadata.

At this time, there is no evidence suggesting a direct compromise of Visa infrastructure. The listing may represent aggregated third-party marketing, brokered, or previously exposed consumer data.

Status: Unverified — underground forum claim.”

#DataBreach #CyberSecurity #ThreatIntel #DarkWeb #Fraud #OSINT

[PT SWARM @ptswarm]

🧑‍🚒 Our researcher Mikhail Sukhov shares his knowledge and experience in analyzing FreeIPA environments.

He also introduces his new tool, IPAHound 💪

Go ’n see the details ➡️ https://t.co/6n4FYzrDvN

[Panos Gkatziroulis 🦄 @ipurple]

🗣️ One more SIGMA dropped + 🏹 Threat Hunting Query about a cross-session activation technique that abuses the IHxHelpPaneServer COM Object.
If you would like to receive such content, feel free to join our discord.
⏰ Invite Duration: 24H
📨 https://t.co/qHrvae1h58

[Dark Web Intelligence @DailyDarkWeb]

🚔 A threat actor is claiming to possess and leak data allegedly with INTERPOL systems and infrastructure.

The actor refers to the dataset as “complete INTERPOL data,” but has not publicly provided sufficient technical evidence or verifiable samples to substantiate the claim at this time.

Due to the sensitivity of the claim, the authenticity, scope, and origin of the alleged data remain unverified.

#DDW #INTERPOL #CyberSecurity #DataLeak #ThreatIntel #InfoSec #DarkWeb

[Clandestine @akaclandestine]

GitHub - samftggr/VEN0m-Ransomware: Demonstrate how a signed driver can bypass defenses to deploy ransomware on Windows 11 with advanced AV and UAC evasion techniques. · GitHub https://t.co/bMPcb44YVI

[Gray Hats @the_yellow_fall]

Darktrace uncovers a new DDoS botnet hijacking Jenkins servers to target game servers. Protect your CI/CD pipeline from specialized gaming-layer attacks.

#JenkinsBotnet #GamingSecurity #DDoS #InfoSec #CyberAttack #Darktrace #DevSecOps
https://t.co/TOZxW0P0Vv

[DirectoryRanger @DirectoryRanger]

Detection of Kerberos Golden Ticket Attacks via Velociraptor #DFIR
https://t.co/U7VpgLsjbj

[Panos Gkatziroulis 🦄 @ipurple]

Earlier this year, I wrote about 6x different emulation techniques used by threat actors that silence EDR agents and detection strategies for each one.
The diagram of the most common technique using WFP Filters:
🖊️ https://t.co/pWiUCh1Uy2

[Samir @SBousseaden]

++ Existing Elastic SIEM rules that looks exactly for RMM behavior drift vs just RMM existence (I may blog some other tricks to spot susp RMM use 😃) :

First time seen SceenConnnect sever parsed from cmdline
https://t.co/DOfYvQcEHT

Multi-RMM by host:
https://t.co/5b0mn6vt1O

[Aircorridor @_aircorridor]

Privilege Escalation: Getting Started with the Pack2TheRoot (CVE-2026-41651) Vulnerability to Escalate Privileges

In this article, we will explore how this vulnerability appears, how it can be exploited, and how you can defend against it.
https://t.co/fpZYBZBaPb
@three_cube