CERT/CSIRT - Head of Cyber Defence Tweets are my own and do not represent my employer.🇯🇪
Jersey
Joined January 2012
- Tweets15.4K
- Following2.9K
- Followers1.1K
- Likes12.5K
Cyberkryption retweeted
🚨 Windows Privilege Escalation Mindmap 🪟🔥
🔥 Telegram: t.me/hackinarticles
✴️ Twitter: xitter.cf/hackinarticles
Stop memorizing random commands.
Start following a methodology. 🎯
This mindmap covers the most common Windows PrivEsc attack paths:
🔓 AlwaysInstallElevated
⚙️ Unquoted Service Paths
🛠️ Weak Service Permissions
📂 Weak Registry Permissions
⏰ Scheduled Tasks
🖥️ Startup Applications
🔑 Stored Credentials
👤 Token Impersonation
💥 Kernel Exploits
🖨️ PrintNightmare
🧩 SeBackupPrivilege
🎭 SeImpersonatePrivilege
🐞 SeDebugPrivilege
👑 SeTakeOwnershipPrivilege
…and much more!
📚 Learn Windows PrivEsc visually.
⭐ Star & Bookmark:
github.com/Ignitetechnologie…
♻️ Repost to help the cybersecurity community.
#Windows #PrivilegeEscalation #CyberSecurity #OSCP #RedTeam #Pentesting #EthicalHacking
Cyberkryption retweeted
We examined artifacts left behind by attackers during the recent Citrix #NetScaler compromises. Many were already covered by existing generic THOR rules, including rules we've shipped for years.
One script matched SUSP_Linux_Downloader_Jul20_1. That rule dates back to 2020, more than six years ago(!). The script also matched SUSP_Bash_Jul26.
The recovered webshells matched these existing generic rules:
- SUSP_WEBSHELL_PHP_Encoded_Jun21_1
- SUSP_Eval_Base64_Indicators_Feb22_1
- EXT_WEBSHELL_PHP_Generic_Eval
- EXT_WEBSHELL_PHP_OBFUSC_3
- EXT_WEBSHELL_PHP_Generic
- EXT_WEBSHELL_PHP_Gzinflated
- EXT_WEBSHELL_PHP_Dynamic_Big
Some of those webshell rules are in THOR Lite, too (EXT_*)
This is POST-EXPLOITATION DETECTION. We didn't need to know which zero-day got the attacker in to recognize what they left behind.
A scan could have flagged these artifacts from day one, before the exploited vulnerabilities were public. The rules were already there.
Scan your edge devices regularly. Daily, where practical. Use THOR via SSHFS or scheduled file collection for THOR Thunderstorm.
Don't wait for the next advisory to start looking
Why THOR detects what others miss
nextron-systems.com/2025/06/…
For the last two days, our Research Team has been looking into the recently disclosed Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 and building detection coverage to help identify compromised systems.
The new THOR Preview signature set currently includes:
- EXPL_CVE_2026_88772_POC_Sep26
Detects artifacts related to the public CVE-2026-88772 PoC
- LOG_SUSP_EXPL_CVE_2026_88771_Sep26
Detects potential CVE-2026-88771 exploitation traces in NetScaler logs
- WEBSHELL_CSS_PassThrough_Sep26
Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise
We also released a new IOC set:
- NetScaler ADC suspicious file artifacts
It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories.
The Preview signatures are already available with:
./thor-util update --sigdev
We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers.
Details:
nextron-systems.com/2026/09/…
And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here:
nextron-systems.com/2023/07/…
Cyberkryption retweeted
Cybersecurity X accounts worth following (Part 2):
1. @SwiftOnSecurity — Windows security
2. @briankrebs — Cybercrime research
3. @troyhunt — Breaches & HIBP
4. @thegrugq — OPSEC & tradecraft
5. @cyb3rops — Detection engineering
6. @mikko — Malware research
7. @_JohnHammond — CTFs & malware
8. @NahamSec — Bug bounty & recon
9. @LiveOverflow — Technical hacking
10. @HackingDave — Red teaming
11. @harmj0y — Active Directory
12. @_wald0 — BloodHound & AD
13. @enigma0x3 — Windows security
14. @gentilkiwi — Mimikatz & Windows
15. @_RastaMouse — Red team tools
16. @SpecterOps — AD security
17. @TrustedSec — Red team research
18. @BishopFox — Offensive security
19. @Horizon3Attack — Exploit research
20. @Synacktiv — Offensive research
21. @TheDFIRReport — Incident reports
22. @sans_isc — Threat intelligence
23. @HuntressLabs — Threat research
24. @13CubedDFIR — DFIR training
25. @EricRZimmerman — DFIR tools
26. @Velocidex — Digital forensics
27. @SigmaHQ — Detection rules
28. @hakluke — Bug bounty tools
29. @codingo_ — Pentesting & recon
30. @EdOverflow — Security research
31. @filedescriptor — Bug hunting
32. @orange_8361 — Exploit research
33. @InsiderPhD — Security education
34. @pentest_swissky — Payloads & pentesting
35. @Hacker0x01 — Bug bounty
36. @bugcrowd — Bug bounty programs
37. @intigriti — Bug bounty programs
38. @GossiTheDog — Vulnerability analysis
39. @malwrhunterteam — Malware hunting
40. @hasherezade — Malware analysis
41. @taviso — Vulnerability research
42. @IntelTechniques — OSINT
43. @CISAgov — Security advisories
44. @MITREattack — ATT&CK framework
45. @BlackHatEvents — Security research & conferences
Save this list. Build your cybersecurity feed with signal, not noise.
#CyberSecurity #BugBounty #EthicalHacking #InfoSec #Pentesting #RedTeam #BlueTeam #DFIR #OSINT #ThreatIntel
Cyberkryption retweeted
Lost my phone at the office and spent 30 minutes turning the place over. Find My was disabled by MDM.
Out of ideas, I asked Claude how I could find it. It suggested tracking the Bluetooth signal strength, then wrote me a meter in about a minute.
I walked around watching the number climb. Found it.
Apparently you can just make the tool you need now.
Code: github.com/ben-z/findphone
Cyberkryption retweeted
Giveaway time!
Up for grabs is 3 free tickets to our “Attacking AI” live course!
Repost and like to enter!
arcanum-sec.com/training/att…
Cyberkryption retweeted
5 months …
Proofpoint uncovered that Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) was exploiting a previously unknown vulnerability against Zimbra mailservers for at least five months during 2025, until the issue was patched with CVE-2025-66376. proofpoint.com/us/blog/threa…
Cyberkryption retweeted
htaccess easiest hotfix
xitter.cf/0xcoincock/status/2078…
Having trouble updating WordPress just to patch the wp2shell vulnerability?
Just add this to the top of your .htaccess:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/batch/v1/?$ [NC,OR]
RewriteCond %{QUERY_STRING} (^|&)rest_route=/batch/v1/?(&|$) [NC]
RewriteRule ^ - [F,L]
</IfModule>
How to check if your site is vulnerable?
Open:
your-site-dot-com/wp-json/batch/v1
If it returns 403 Forbidden, your site is protected.
Cyberkryption retweeted
I use Cloudflare on all of my WordPress sites. Their hotfix doesn't work, so I patched it manually by modifying the .htaccess file
xitter.cf/0xcoincock/status/2078…
Having trouble updating WordPress just to patch the wp2shell vulnerability?
Just add this to the top of your .htaccess:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/batch/v1/?$ [NC,OR]
RewriteCond %{QUERY_STRING} (^|&)rest_route=/batch/v1/?(&|$) [NC]
RewriteRule ^ - [F,L]
</IfModule>
How to check if your site is vulnerable?
Open:
your-site-dot-com/wp-json/batch/v1
If it returns 403 Forbidden, your site is protected.
Cyberkryption retweeted
I reported a pre auth RCE in Wordpress - it can be exploited with no preconditions, patch your instances!
slcyber.io/research-center/w…
Cyberkryption retweeted
INTEL DROP
🚨 Tracking multiple IP's possibly performing targeted exploitation against Fortinet devices.
213.177.179.28
213.177.179.33
213.177.179.36
213.177.179.41
Other IP's in the range Brute-force + scanning:
213.177.179.62 / 213.177.179.79 / 213.177.179.80 / 213.177.179.91 — brute-force
213.177.179.12 / 213.177.179.27 / 213.177.179.61 / 213.177.179.88 / 213.177.179.97 / 213.177.179.101 —scanners
#TotalInsights #Fortinet #ThreatIntel
Cyberkryption retweeted
Want to learn AI / LLM Security Assessment? Don't have the money for a training?
Here are 🎯SEVENTY ONE🎯 FREE LLM security labs that we have curated for you!
Like and share! (Link Below)
<3 from @arcanuminfosec
Cyberkryption retweeted
CI/CDのペンテストに関する知識つけたいなと思って良い教材がないか調べてたら、CTF形式で学べるcicd-goatをみつけた👀
Docker上で動くので、手元にDocker環境があればサクッと遊べていい感じ。
github.com/cider-security-re…
Cyberkryption retweeted
We are happy to announce the release of Trace Labs OSINT VM 2026.05! This version migrates the build process to Debian 13 instead of Kali. There are VirtualBox and VMWare downloads as well. Read all about it at github.com/tracelabs/tlosint…
#TraceLabs #OSINT
Cyberkryption retweeted
If you need some RSS feeds for cyber stuff check this out:
github.com/mr-r3b00t/cyber_r…
Cyberkryption retweeted
Urgent Security Alert:
Mistral AI npm packages compromised in the ongoing Mini Shai-Hulud supply chain attack.
Affected versions:
@mistralai/mistralai v2.2.2, 2.2.3, 2.2.4
@mistralai/mistralai-azure v1.7.1–1.7.3
@mistralai/mistralai-gcp v1.7.1–1.7.3
If you or your CI/CD pipeline recently installed any of these, treat your environment as fully compromised.
Immediate action: Rotate npm tokens, GitHub PATs, cloud credentials, and all secrets from a clean machine.
This is the same self-spreading worm (linked to TeamPCP) that just hit 80+ TanStack packages with millions of weekly downloads.
Cyberkryption retweeted
Yay! Microsoft is working on removing PowerShell v2 from Windows, and making PS7 default on Windows!
#PSConfEU
Dive deep into what’s new since Windows Server 2025 GA, including Hotpatching, failover clustering improvements, native NVMe storage, networking protections, and identity enhancements. xitter.cf/i/broadcasts/1qJVmQlBA…
Cyberkryption retweeted
the official OpenSearch client for Node.js has also been compromised
🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading.
Newly confirmed compromised artifacts:
@opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads)
mistralai: 2.4.6 on PyPI
guardrails-ai: 0.10.1 on PyPI
additional @squawk/* packages on npm
guardrails-ai 0.10.1 executes malicious code on import. On Linux, it downloads git-tanstack[.]com/transformers.pyz, writes it to /tmp/transformers.pyz, and runs it with python3 without integrity verification.
The git-tanstack.com domain displayed a message signed “With Love TeamPCP,” along with: “We've been online over 2 hours now stealing creds
Regardless I just came to say hello :^)”
The page also linked to a YouTube video and you can probably guess which one.
