Security stuff maker
Germany
Joined June 2015
- Tweets1.4K
- Following104
- Followers39
- Likes226
Lubo Nistor retweeted
Automation blueprints for Red Team & Pentest, Blue Team (SOC/DFIR/TI), Application Security (AppSec/DevSecOps), and Platform/General Security — all using n8n.
github.com/CyberSecurityUP/n…
Lubo Nistor retweeted
ADCS Attack Techniques Cheatsheet
docs.google.com/spreadsheets…
Lubo Nistor retweeted
If you like VPN exploits as much as us, you're going to love this course Zeroshi is bringing to @_ringzer0!
Marco will walk students into opening up edge devices for research, mapping their attack surface, finding vulns and building full exploit chains.
ringzer0.training/countermea…
Lubo Nistor retweeted
🚀 Open-sourcing MCP Security Hub
A growing collection of MCP servers bringing security tools to AI assistants
Nmap, Ghidra, Nuclei, SQLMap, Hashcat... and we're just getting started
Contribute your favorite tools 🛠️
⭐ github.com/FuzzingLabs/mcp-s…
Lubo Nistor retweeted
This blog post examines the growing threat of destructive "bricking" attacks on Operational Technology (OT) devices, using the December 29, 2025, coordinated cyber attacks on Poland's electric grid as a case study.
Hitachi Energy Relion 650 Series IEDs (protection relays):
Exploited default FTP credentials to delete critical files → causing a "soft brick" (device fails to boot properly, loses remote/local access).
Similar to a previously disclosed CVE-2024-8036 in ABB equipment (Hitachi acquired ABB's power grids division).
Hitachi Energy RTU560:
Accessed via default web credentials.
Uploaded malicious firmware (bypassing secure update checks in older versions).
Resulted in a "hard brick" with an infinite bootloop due to corrupted entry-point code on the ARM-based processor.
Mikronika RTUs:
Compromised via SSH with default root credentials.
Filesystem completely wiped.
Moxa NPort 6000 Series (serial-to-IP converters):
Default web credentials used to factory reset, change passwords, and set unreachable IPs (disruptive but not fully bricked).
midnightblue.nl/blog/have-yo…
#sandworm
In the renewable energy sector, an attack targeted at least 30 wind and solar farms in Poland. The attack resulted in a loss of communication between the facilities and distribution system operators (DSOs), but it did not affect ongo‑ing electricity generation.
#IOCs #APT #Wiper
CERT Polska Energy Sector Incident Report 2025
github.com/blackorbird/APT_R…
#Sandworm DynoWiper update: Technical analysis and attribution
welivesecurity.com/en/eset-r…
dragos 2025 poland attack report
github.com/blackorbird/APT_R…
Lubo Nistor retweeted
WSL2 is a powerful attacker hideout because it runs as a separate Hyper-V VM, and defenders rarely monitor it.
Daniel Mayer explains how attackers pivot into WSL2 and what it took to build tooling that works across WSL2 versions.
Read more ⤵️ ghst.ly/45fPUma
Lubo Nistor retweeted
Security Detections MCP - github.com/MHaggis/Security-…
An MCP (Model Context Protocol) server that lets LLMs query a unified database of Sigma, Splunk ESCU, Elastic, and KQL security detection rules.
Lubo Nistor retweeted
SMB3 Linux Kernel Server (ksmbd) exploitation. 3-parts series by @Doyensec
Part 1: blog.doyensec.com/2025/01/07…
Part 2: blog.doyensec.com/2025/09/02…
Part 3: blog.doyensec.com/2025/10/08…
#infosec
Lubo Nistor retweeted
NTLM reflection attacks can be used to compromise Active Directory domains even with SMB signing if systems aren’t fully patched
depthsecurity.com/blog/using…
Lubo Nistor retweeted
New Blog: Based on his talk at Black Hat, @0xTriboulet discusses integrating Windows AI/ML APIs into Cobalt Strike’s workflows and presents proof-of-concept implementations for AI-augmented post-exploitation capabilities in Cobalt Strike.
ow.ly/8hSO50WWTSW
Lubo Nistor retweeted
Got access to an AWS infrastructure during your RedTeam and you don't know how to do access persistence other than just adding an AccessKey ? 🫤
Step up your game with new TTPs ! 🫡
From IAM modification to lambda hijacking, 1001 ways to keep access !
riskinsight-wavestone.com/en…
Lubo Nistor retweeted
An unexpected journey into Microsoft Defender's signature World
retooling.io/blog/an-unexpec…
Lubo Nistor retweeted
Just a reminder that this stream is today at 6PM PT!
Please join me on the next @offby1security stream with guest Eugene Lim (@spaceraccoonsec ) on 4-Sept at 6PM PT for a session on "0-day Hunting Strategy!" This will be a great session for those interested in vulnerability research! Note the time at 6PM PT
youtube.com/watch?v=dMt2qyGH…
Lubo Nistor retweeted
DLL Sideloading for Initial Access – Red Team Operator's Guide 🔥 (new article)
print3m.github.io/blog/dll-s…
- finding software to backdoor
- finding DLL and function to backdoor
- legit software backdooring
- OPSEC considerations
#redteam #infosec #malware #security
Lubo Nistor retweeted
A huge list of interesting Azure Sentinel hunting queries to give you some inspiration for your next purple team.
github.com/Azure/Azure-Senti…
Lubo Nistor retweeted
Silent Harvest: Extracting Windows Secrets Under the Radar, by @haider_kabibo
sud0ru.ghost.io/silent-harve…
Lubo Nistor retweeted
In about an hour I’ll present my talk I’m in your logs now, deceiving your analysts and blinding your EDR at #BHUSA25 @BlackHatEvents in Islander E/I. Come and hang out!
Lubo Nistor retweeted
Slides of the @WEareTROOPERS #TROOPERS25 'AD & Entra ID Security' track have been published. Just click on the individual talks in the agenda.
Day 1 troopers.de/troopers25/agend…
Day 2 troopers.de/troopers25/agend…
Lubo Nistor retweeted
🚨 A new Linux backdoor named Plague hid in plain sight for a year—undetected by every antivirus.
It hacks PAM to silently hijack SSH logins and wipe all traces.
The worst part? No antivirus flagged it. Not one.
How it works ↓ thehackernews.com/2025/08/ne…
Lubo Nistor retweeted
''NativeDump: Stealthy LSASS Dumping Tool Bypasses EDRs Using Only NTAPIs''
#infosec #pentest #redteam #blueteam
meterpreter.org/nativedump-s…