Tag: ACTIVE DIRECTORY

Hands-On Walkthrough: Microsegmentation For all Users, Workloads and Devices by Elisity
Summary: Elisity offers an innovative identity-based microsegmentation solution that addresses the challenges of traditional segmentation methods, particularly in healthcare and manufacturing sectors. By leveraging existing network infrastructure, it simplifies policy management and enhances security without requiring extensive hardware investments.

Threat Actor: Cybercriminals | cybercriminals Victim: Healthcare Organizations | healthcare organizations

Key Point :

Elisity’s Virtual Edge allows for microsegmentation without new hardware, using lightweight virtual connectors.…
Read More
Product Review: How Reco Discovers Shadow AI in SaaS
Summary: The rise of shadow AI poses significant security risks as employees use unauthorized AI tools without IT oversight, potentially exposing sensitive company data. Reco offers a solution to detect and manage these shadow AI applications within organizations.

Threat Actor: Shadow AI Users | shadow AI users Victim: Organizations | organizations

Key Point :

Shadow AI refers to unauthorized use of AI tools within organizations, increasing data security risks.…
Read More
The Feed 2025-01-09
This article explores various cyber threats, including voice phishing by the “Crypto Chameleon” group, exploitation of vulnerabilities in Kerio Control and Ivanti Connect Secure VPN, and North Korean hackers targeting cryptocurrency wallets through fake job interviews. The rise of ransomware among state-sponsored APT groups is also highlighted, indicating a troubling trend in modern cyber threats.…
Read More
Ivanti Flaw CVE-2025-0282 Actively Exploited, Impacts Connect Secure and Policy Secure
Summary: Ivanti has reported a critical security vulnerability (CVE-2025-0282) affecting its products, which is currently being actively exploited, allowing unauthenticated remote code execution. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate patching.

Threat Actor: UNC5337 | UNC5337 Victim: Ivanti | Ivanti

Key Point :

CVE-2025-0282 is a stack-based buffer overflow with a CVSS score of 9.0, affecting multiple Ivanti products.…
Read More
MirrorFace: Unmasking the Chinese Cyber Espionage Group Targeting Japan
Summary: The Japanese National Police Agency has issued a warning about ongoing cyberattacks attributed to the MirrorFace group, which has targeted critical sectors in Japan since 2019. Their sophisticated techniques and campaigns pose significant risks to national security and advanced industries.

Threat Actor: MirrorFace (Earth Kasha) | MirrorFace Victim: Japanese National Police Agency | Japanese National Police Agency

Key Point :

MirrorFace has conducted three major cyberattack campaigns targeting government, academia, media, and advanced industries.…
Read More
How initial access brokers (IABs) sell your users’ credentials
Summary: Initial Access Brokers (IABs) are cybercriminals who infiltrate corporate networks and sell stolen access to other attackers, functioning like high-tech locksmiths. Their operations have become increasingly efficient, posing significant risks to organizations through compromised credentials.

Threat Actor: Initial Access Brokers (IABs) | Initial Access Brokers Victim: Various organizations | Amazon Web Services, Geico, ADT

Key Point :

IABs operate like legitimate businesses, offering tiered pricing and customer support for stolen access.…
Read More
ADFS – Living in the Legacy of DRS
This article explores the legacy of Active Directory Federation Services (ADFS) in the context of Device Registration Services (DRS) and OAuth2. It highlights the ongoing relevance of ADFS despite Microsoft’s push towards Entra ID, delving into ADFS internals, OAuth2 integration, device authentication methods, and potential attack vectors.…
Read More
Hunting SVR: Russian Foreign Intelligence Service Exploiting JetBrains TeamCity CVE Globally
The article discusses the ongoing cyber operations of the Russian Foreign Intelligence Service (SVR), particularly their exploitation of JetBrains TeamCity CVE-2023-42793 to target technology companies globally. The SVR’s tactics include host reconnaissance, DLL execution, and data exfiltration techniques. The article highlights the potential risks posed by the SVR’s access to software developers’ networks and outlines various Sigma Rules for threat hunting.…
Read More

Summary: Recent developments in cybersecurity reveal significant vulnerabilities in trusted software like browser extensions and voice assistants, exposing sensitive user data to malicious actors. This week’s focus highlights the ongoing risks associated with digital convenience and the importance of vigilance in online activities.

Threat Actor: Flax Typhoon (Chinese state-sponsored) | Flax Typhoon Victim: Cyberhaven | Cyberhaven

Key Point :

Dozens of Google Chrome extensions were found stealing sensitive data from 2.6 million devices.…
Read More

Summary: Microsoft recently patched two critical vulnerabilities in Active Directory’s LDAP, one of which (CVE-2024-49113) can cause denial-of-service attacks and crash multiple unpatched Windows servers. Experts warn that many organizations may still be vulnerable, emphasizing the need for immediate patching and protective measures.

Threat Actor: Unknown | unknown Victim: Organizations running Windows Servers | Organizations running Windows Servers

Key Point :

Two critical vulnerabilities in Active Directory’s LDAP were patched by Microsoft, with CVE-2024-49113 allowing for potential DoS attacks.…
Read More

### #ActiveDirectoryThreats #LDAPExploits #WindowsServerVulnerabilities

Summary: A critical vulnerability in Active Directory’s LDAP protocol, tracked as CVE-2024-49113, allows attackers to crash multiple unpatched Windows servers simultaneously, raising concerns about organizational vulnerabilities. Experts emphasize the urgency of patching systems to mitigate potential exploitation.

Threat Actor: Unknown | unknown Victim: Organizations running Windows Servers | organizations running Windows Servers

Key Point :

The vulnerability allows for denial-of-service attacks and potential remote code execution.…
Read More

### #DigitalDefense #ThreatIntelligence #CyberAwareness

Summary: This week’s cybersecurity update highlights significant threats and vulnerabilities impacting various sectors, emphasizing the need for vigilance and proactive measures to safeguard digital environments. Key developments include high-severity flaws, emerging malware, and notable cybercrime incidents involving threat actors.

Threat Actor: TraderTraitor | TraderTraitor Victim: DMM Bitcoin | DMM Bitcoin

Key Point :

High-severity PAN-OS flaw could lead to denial-of-service attacks on vulnerable devices.…
Read More

Volt Typhoon, a state-sponsored APT group linked to China, is known for sophisticated cyber espionage targeting critical infrastructure, especially in the U.S. Their tactics include exploiting vulnerabilities and using Living-off-the-Land techniques to evade detection. This article explores their operations, impact, and strategies for defense. #CyberSecurity #APT #VoltTyphoon

Keypoints :

Volt Typhoon is a state-sponsored APT group linked to Chinese cyber operations.…
Read More

### #CloudSecurity #OperationalDirective #SecureConfiguration

Summary: CISA has issued BOD 25-01, mandating federal civilian agencies to secure their cloud environments by implementing specific configuration baselines and assessment tools. This directive aims to mitigate risks associated with misconfigurations and enhance the security posture of federal networks.

Threat Actor: CISA | CISA Victim: Federal Civilian Executive Branch (FCEB) | Federal Civilian Executive Branch

Key Point :

Federal agencies must identify cloud tenants by February 21, 2025, and deploy SCuBA assessment tools by April 25, 2025.…
Read More

Credential-based attacks pose significant risks to organizations, leveraging weak credentials for unauthorized access. Picus Attack Path Validation (APV) helps identify and mitigate these vulnerabilities through automated penetration testing and credential harvesting simulations. #CyberSecurity #CredentialAttacks #PenetrationTesting

Keypoints :

Credential-based attacks exploit weak or misconfigured credentials for unauthorized access.…
Read More

Summary :

As the holiday season approaches, threat actors are exploiting people’s desires for deals and bonuses through malware and phishing campaigns. Recent activities include credential phishing and employment fraud, targeting individuals with deceptive messages. #HolidayScams #Phishing #CyberSecurity

Keypoints :

Increased malware and phishing campaigns during the holiday season.…
Read More

Summary :

Unit 42 researchers uncovered a phishing campaign targeting European companies, particularly in the automotive and chemical sectors, aiming to harvest Microsoft Azure credentials. The campaign peaked in June 2024, impacting around 20,000 users through malicious links and documents. #Phishing #CyberSecurity #CredentialHarvesting

Keypoints :

The phishing campaign targeted European companies, primarily in the automotive and chemical industries.…
Read More

Summary :

This article offers a comprehensive guide to detecting LDAP-based attacks, highlighting the challenges of distinguishing between benign and malicious activities. It discusses real-world examples of threat actors exploiting LDAP for lateral movement and critical asset enumeration, as well as effective detection strategies. #LDAPAttacks #CyberSecurity #ThreatDetection

Keypoints :

LDAP is commonly abused by threat actors for lateral movement and enumeration of critical assets in cyberattacks.…
Read More