Collaborate Disseminate
I recently came across an interesting phishing e-mail. At first glance, it looked like a ânormalâ phishing that tried to pass itself off as a message from one of the Czech banks asking account holders to update their informationâ¦
Continue reading Phishing e-mail that hides malicious link from Outlook users, (Wed, Jun 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 4th, 2025 https://isc.sans.edu/podcastdetail/9478, (Wed, Jun 4th)
Last week, Ryan Dewhurst disclosed an interesting and easily exploitable vulnerability in vBulltin. These days, bulletin boards are not quite as popular as they used to be, but they are still being used, and vBulletin is one of the most common commercially supported platforms to create a bulletin board. The vulnerability is remarkable as it exemplifies some common issues with patching and keeping your software up to date.
Continue reading vBulletin Exploits (CVE-2025-48827, CVE-2025-48828), (Tue, Jun 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 3rd, 2025 https://isc.sans.edu/podcastdetail/9476, (Tue, Jun 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 2nd, 2025 https://isc.sans.edu/podcastdetail/9474, (Mon, Jun 2nd)
For most system and network administrators, the free SSH client Putty has been their best friend for years! This tool was also (ab)used by attackers that deployed a trojanized version[1]. Microsoft had the good idea to include OpenSSH (beta version) in Windows 10 Fall Creators Update. One year later, it became a default component with Windows 10 version 1803. I remember the join of type for the first time “ssh” or “scp” in a cmd.exe! SSH is a very powerful tool that can be used in multiple ways, and it was de-facto categorized as a “LOLBIN”[2].
YARA 4.5.3 was released with 5 bugfixes.
While hunting, I found an interesting picture. It&#;x26;#;39;s a PNG file that was concatenated with two interesting payloads. There are file formats that are good candidates to have data added at the end of the file. PNG is the case because the file format specifications says:
Continue reading A PNG Image With an Embedded Gift, (Sat, May 31st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, May 30th, 2025 https://isc.sans.edu/podcastdetail/9472, (Fri, May 30th)
DShield honeypots &#;x26;#;x5b;1&#;x26;#;x5d; receive different types of attack traffic and the volume of that traffic can change over time. I&#;x26;#;39;ve been collecting data from a half dozen honeypots for a little over a year to make comparisons. This data includes:
Continue reading Usage of “passwd” Command in DShield Honeypots, (Fri, May 30th)