Security Joes

AI-Powered MDR & Incident Response ☂️

[Security Joes @SecurityJoes]

While Supply Chain hits hard, Incident Response teams should strive for developing tools to assist dev teams to harden their endpoints.

#Vaultify is one of them. Visit our new website, download the tool and clean your machine from secrets sprawl and NHI threats. ITS OPEN-SOURCE

[Ido Naor 🇮🇱 @IdoNaor1]

Today we launched another version of #Vaultify to keep helping devs secure their endpoints

A website is now live with more information -
https://t.co/GE3yGaM4Nt

Anti-Supply-Chain-Attacks ���

[Security Joes @SecurityJoes]

Bitlocker ransomware attacks might just went out of business...

[impulsive @weezerOSINT]

I just reverse engineered the YellowKey BitLocker bypass

Microsoft shipped code that checks for a flag called "FailRelock" in every Windows 11 recovery image. When it's set to 1, after recovery unlocks your BitLocker drive, it never relocks it. All you need is a USB stick.

This code only exists in the recovery environment. Not in normal Windows. They left an entire debug testing framework in production.

[Ido Naor 🇮🇱 @IdoNaor1]

Releasing Vaultify, an open-source tool that hunts secrets in your machine and lets you vault all in one click.

https://t.co/Veu1QeKK57

- Local only
- Includes BYOAI to assist in quick remediation & FP detection
- Vaults secrets using 1Pass CLI or other vaults

[Security Joes @SecurityJoes]

The domino effect that turned defensive infrastructure into part of the blast radius:

Our latest research, by Diogo Machado, shows how the DigiCert incident cascaded into Microsoft Defender behavior and exposed the fragility of modern trust chains.

https://t.co/tPB69cwkrm

[Security Joes @SecurityJoes]

JOES in Cancun, Mexico 🌴🇲🇽🏖️
What an amazing adventure!

[Security Joes @SecurityJoes]

AI observability is now critical as OpenClaw’s adaptability accelerates.

Researchers are actively exploring this shift and strengthening defenses around OpenClaw.

We’re releasing new detection capabilities for the EDR/XDR tools we use daily

https://t.co/h9wIKswONa

[Security Joes @SecurityJoes]

🚨 New Blogpost is Out!!

Over 50 GitHub accounts, and several LinkedIn accounts as well, were involved in a massive Lazarus fake hiring attack, dubbed as "LazarOps" by the security joes incident response team.

Read the full blog at - https://t.co/FODjNuPnix

[Security Joes @SecurityJoes]

Our first LATAM regional meetup took place in São Paulo, Brazil! 🇧🇷
Threat Researchers from across the region came together to connect and have fun.
Check out the Dinner in the Sky video!

Obrigado, Brasil! Estamos só começando. 🇧🇷🔥

[Security Joes @SecurityJoes]

🎙️ Following our live podcast launch…
🚀 CloudCastle is now officially live on GitHub!

🙏 To everyone who joined us live — thank you!
💙 Let us know how you’re using CloudCastle.

#CloudCastle #SecurityJoes #AWSIR #ThreatHunting #OpenSource #CybersecurityTools

[Security Joes @SecurityJoes]

🚨 We’re going live in 1 hour! (18:00 IL)

We’re launching CloudCastle, live on air, and talking about how it was built,
Why it matters, and how you can start building your own tools too.

🎙️ Save your spot now — last chance to register:
https://t.co/AJcyAQv44y

[Security Joes @SecurityJoes]

🚨 New blog from Security Joes!
Weaponizing Windows Drivers: A Hacker’s Guide for Beginners
Explore how attackers exploit vulnerable drivers (BYOVD) & how defenders can stay ahead.

📖 Read now - https://t.co/fXOk07XDTL

[Security Joes @SecurityJoes]

Podcast Behind The Scenes - Take 2🎬😂
Join us, July 15 2025 at 18 PM Israel Time.
(Not July 16!!)
Register here: https://t.co/zr85NDjxRX

#שער_ריק #its_the_15 #AI #security_joes #incident_response

[Security Joes @SecurityJoes]

Join us as we release CloudCastle - CSPM for everyone, for free.

In this podcast-
1. Why CloudCastle
2. Code overview
3. DIY tips
4. AMA session with our CEO @IdoNaor1, who coded the tool single-handedly

Host: Sr. IR, Eilay Y.

#XJOES
https://t.co/cN3JEIusTW

[Security Joes @SecurityJoes]

🚨 Crowdstrike-Deploy v1.3 is here!

Our team continues to give back to the DFIR community with tools that solve real problems.💪

🛠️ Deploy Fast, Defend Faster.
Check it out on Security Joes GitHub: https://t.co/TJUyoT24tW

https://t.co/RqVj9RQ2t7

[Security Joes @SecurityJoes]

A recently patched sandbox escape in Google Chrome (CVE-2025-2783, CVSS 8.3) was exploited in-the-wild by a threat actor tracked as TaxOff, leading to the deployment of a custom multithreaded backdoor named Trinper.

👉 For help, visit https://t.co/aq8HgdA8Xh

[Security Joes @SecurityJoes]

Veeam has just released a critical patch addressing a remote code execution (RCE) flaw in its Backup & Replication software. Tracked as CVE-2025-23121, this vulnerability carries a CVSS score of 9.9, underscoring its severity.

Need help? https://t.co/aq8HgdA8Xh

[Security Joes @SecurityJoes]

🚨 XSS Attack Hits CoinMarketCap – Exposes SDLC Security Gaps 🔐
June 20, 2025: CoinMarketCap was targeted by a front-end XSS attack via a compromised homepage image executed a malicious remote API call. The result? A fake wallet pop-up prompting users to "verify" their wallets.

[Security Joes @SecurityJoes]

Two newly disclosed vulnerabilities could let attackers escalate privileges to root on default installations of major Linux distributions — including Ubuntu, Fedora, Debian, and openSUSE.

🛡️ Let’s talk https://t.co/BLjQF3JlQW

#Linux #CyberSecurity #LPE #Vulnerability #PatchNow

[Security Joes @SecurityJoes]

🧠 Technical Details
Google’s Threat Intelligence Group has identified a cyberattack campaign, UNC6040, targeting companies in Europe and the Americas. Attackers are deceiving employees into installing a modified version of Salesforce’s Data Loader.
👉 https://t.co/aq8HgdA8Xh

[Security Joes @SecurityJoes]

🧬 Catena Loader - Memory-Only Malware Campaign
Attack Flow:

Fake VPN/browser installers with signed decoys
Shellcode in .ini files → reflective DLL injection
Memory-only payloads + delayed persistence

👉 https://t.co/BLjQF3JlQW

#ThreatHunting #Malware #CyberSecurity #DFIR