Packet Ninjas

We break into things. Legally. Penetration testing, continuous security validation, and the hard truths your risk register isn't telling you.

[Packet Ninjas @packetninjas]

Attackers are routing malware through Google's DoubleClick domain because they know tools won't flag it. Not a breach, just an attacker who understands your defenses better than you'd like. That's the gap offensive security testing exists to close.
🥷#PacketNinjas #Cybersecurity

[Packet Ninjas @packetninjas]

Red Hat confirmed it. Supply chain compromise across multiple npm packages under the redhat-cloud-services namespace.

If those packages are in your dependencies, assume they're compromised until proven otherwise.
RHSB-2026-006. 🥷

#PacketNinjas #Cybersecurity #Infosec

[International Cyber Digest @IntCyberDigest]

🚨 UPDATE: Red Hat has now published RHSB-2026-006 confirming the supply chain compromise affecting multiple npm packages under the redhat-cloud-services namespace.

[Packet Ninjas @packetninjas]

Having security and having confidence in your security program are two different things.

79% of frontline managers say they were breached last year. Only 65% of C-suite leaders agree. That gap is where the real problem lives. 🥷

#PacketNinjas #Cybersecurity #Infosec

[Packet Ninjas @packetninjas]

Silent Ransom Group doesn't hack through your firewall. They walk through your front door. FBI FLASH alert confirms operatives are physically entering law firms posing as IT support to exfiltrate data.
100+ attacks. 38 firms leaked. 🥷

#PacketNinjas #Cybersecurity

[Packet Ninjas @packetninjas]

Charter's 42 million record breach started with a phone call. A phone call that compromised one Microsoft Entra account and opened the door to the entire Salesforce database.
A pentest that thinks like an attacker looks for exactly this. 🥷
#PacketNinjas #Cybersecurity #Infosec

[Packet Ninjas @packetninjas]

@USATGroup Worth adding, each of these comes with a cyber tail. Conflict escalation, shipping issues, & public health emergencies all spike state-sponsored & opportunistic TA activity. If your physical security posture is being tested this week, your digital attack surface probably is too.

[Packet Ninjas @packetninjas]

48,185 CVEs published in 2025 and only 54% of critical vulnerabilities actually got fixed.

Detection isn't the hard part anymore. Proving the risk and validating the fix is. Most programs are optimized for the wrong objective. 🥷

#PacketNinjas #Cybersecurity #Infosec

[Packet Ninjas @packetninjas]

Today we remember the men and women who gave everything in service to this country.

Thank you to those who sacrificed and to their loved ones who supported them.

No more words needed.

🇺🇸 #MemorialDay #PacketNinjas

[Packet Ninjas @packetninjas]

58 seconds after publication. That's how fast malicious packages are live and in the wild before anyone knows. 34 packages. 384 versions.

Your dependencies are part of your attack surface.

🥷 #PacketNinjas #Cybersecurity #Infosec

[Socket @SocketSecurity]

🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.​io.

Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems.

TrapDoor targets #crypto, #DeFi, AI, and security developers, stealing wallets, SSH keys, cloud credentials, GitHub tokens, browser data, env vars, and API keys.

Socket detected releases with a median detection time of 5 minutes, 27 seconds. The fastest detection occurred 58 seconds after publication.

[Packet Ninjas @packetninjas]

The 2026 Verizon DBIR is out. Vulnerability exploitation just overtook credential theft as the top breach vector.

AI is accelerating the window from disclosure to active attack. The point-in-time testing model wasn't built for this. 🥷

#PacketNinjas #DBIR2026 #Cybersecurity

[Packet Ninjas @packetninjas]

Attackers don't exploit vulnerabilities, they exploit paths.
A phishing email. An over-permissioned account. A misconfig that connects to something it shouldn't.

None of it critical on its own. All of it a breach when chained together.🥷

#PacketNinjas #Cybersecurity #Infosec

[Packet Ninjas @packetninjas]

No malware. No exploits. Just one compromised cloud identity and legitimate admin tools. Storm-2949 walked straight through.

This is the attack your scanner won't catch.

🥷 #PacketNinjas #Cybersecurity #Infosec

[Microsoft Threat Intelligence @MsftSecIntel]

A sophisticated and multi-layered attack by the threat actor tracked by Microsoft as Storm-2949 demonstrates how a single compromised cloud identity could lead to a full-scale organizational breach. https://t.co/s1MMx0fI4L

Relying on social engineering and abusing legitimate administrative tools, Storm-2949 moved laterally across cloud resources and endpoints without using traditional malware, quietly exfiltrating large volumes of sensitive data.

This stealthy attack underscores the importance of strong identity protections, least-privilege access, and unified visibility across environments. Read the latest Microsoft Defender Research blog for guidance on detecting and containing multi-stage attacks before they escalate.

[Packet Ninjas @packetninjas]

@USATGroup Those same soft targets believe they won't be victim to a cyber-attack as well...

[Packet Ninjas @packetninjas]

Most scanners give you a list. FumaScan gives you the path an attacker would actually take.

Continuous testing, attack chain mapping, and remediation verification between your annual engagements, not instead of them.

https://t.co/qWdaOueP9p 🥷

#FumaScan #PacketNinjas

[Packet Ninjas @packetninjas]

A compromised PyPI package with a 1-in-6 chance of running rm -rf / on Israeli and Iranian systems.
Country-aware logic. Geo-fenced destruction. And yes, it skips Russian language environments.

Install the language pack. We're not joking. 🥷 #PacketNinjas #Cybersecurity

[LaurieWired @lauriewired]

the most low-effort / high reward thing you can do for security is installing the Russian language pack

(not even joking, it's ridiculous how often that prevents execution)

[Packet Ninjas @packetninjas]

Your pentest passed. That was 364 days ago.

The average breach in 2024 went undetected for 258 days.

The annual test tells you where you stood. Not where you stand.

#PacketNinjas #Cybersecurity 🥷

[Packet Ninjas @packetninjas]

CVE-2026-31431 dropped yesterday. Root on every Linux distro since 2017. No disk writes. Reboots wipe the evidence.
One of the most significant Linux kernel exploits we've seen in years. 🥷

#PacketNinjas #Cybersecurity #Infosec

[Packet Ninjas @packetninjas]

Compliance ≠ security.
Severity ≠ exploitability.
Point-in-time testing is obsolete.

Unpopular opinions? Maybe. But they're worth a read. Check out our LI for more.

[Packet Ninjas @packetninjas]

We've been busy breaking into things. Legally.

Packet Ninjas is back on X so expect threat intel, hard truths about your attack surface, & the occasional reminder your annual pentest isn't enough.

Feel free to follow & if you're not sure your defenses hold up - reach out.🥷

[Packet Ninjas @packetninjas]

We uncovered a vulnerability in a recent network assessment that may sound innocuous enough. That poses the question: to #debug or not to debug when in production?
https://t.co/h7V20m5zZU