The Curious Engineer

All blogs / Security

LevelBlue SpiderLabs Blog

levelblue.com/blogs/spiderlabs-blog

The security community's go-to destination for technical breakdowns of the latest threats, critical vulnerability disclosures and cutting-edge research.

SecurityWindows internals

’15’20’25
Posts
1,685 from 22 Sep 2011 to 30 Oct 2026
Posting
weekly (115 in the last year)
Kind
company blog
Feed
https://www.levelblue.com/blogs/spiderlabs-blog/rss.xml

Latest

October 2026

  1. BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits
  2. LevelBlue TTP Briefing Q3 2026: Trusted Access Fuels Data Theft
  3. Learn More
  4. Securing the Software Development Lifecycle and Supply Chain in an AI-Forward World
  5. PHP2Shell: Critical RCE Vulnerabilities Affect a Large Majority of Web Servers
  6. Exploitarium: Inside the Archive Behind the Mass 0-Day Drop July 21, 2026 | Serhii Melnyk Coordinated vulnerability disclosures operate on a straightforward premise: the ... Read More
  7. Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts
  8. LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses July 23, 2026 Explore the latest tactics, techniques, and procedures (TTPs) our incident ... Read More
  9. Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign
  10. LegacyHive: Hunting Windows Profile Initialization Abuse Through Offline Registry Manipulation July 27, 2026 | Serhii Melnyk and Timmy Lister Following GreenPlasma, YellowKey and MiniPlasma, as well as RoguePlanet and ... Read More
  11. Filling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands
  12. Release the RAVEN: An Offensive Reconnaissance and Attack Tool on Vulnerable Elasticsearch Nodes July 29, 2026 | Karl Biron You have almost certainly interacted with Elasticsearch today. The search bar ... Read More
  13. TIKTOUK: Tracing a WordPress Credential Collection Toolkit
  14. Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems August 04, 2026 | Nikita Kazymirskyi In light of the water-sector activity described below, we've increased ... Read More

September 2026

  1. Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators
  2. Release the RAVEN: First Contact August 05, 2026 | Karl Biron You are mid-engagement. Nmap finishes its sweep and port 9200 lights up on a ... Read More
  3. Citrix NetScaler Zero-Day Exploited Globally
  4. Release the RAVEN: Exploiting the Cracks August 06, 2026 | Karl Biron In Part 1, we went from a single open port to a complete map of the target. ... Read More
  5. File Acquisition May Be Recorded as “FileAccessed” in Microsoft 365 (“M365”)
  6. Beyond ‘Fake Updates’: From Application Store-Themed Phishing to Large-Scale Distribution of ScreenConnect August 07, 2026 | King Orande and Cris Tomboc The LevelBlue OpsCTI Team recently identified a large-scale phishing campaign ... Read More
  7. Enumerating Users and MFA via Microsoft's Password Reset Portal
  8. CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain August 10, 2026 | Rodel Mendrez This post is the result of an investigation into a case we worked on, in which ... Read More
  9. Release the RAVEN: Kibana Under Siege August 13, 2026 | Karl Biron In Parts 1 and 2, every command targeted port 9200. Every exploit, every ... Read More
  10. The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains August 12, 2026 | Karla Agregado To stay ahead of evolving threats, LevelBlue utilizes a machine-learning-based ... Read More
  11. Release the RAVEN: Data Heist and Persistence August 14, 2026 | Karl Biron We have access through port 9200. We have code execution through port 5601. ... Read More

August 2026

  1. Release the RAVEN: Destruction and Discipline August 18, 2026 | Karl Biron In Part 4, we stole every document from every index, planted a rogue superuser ... Read More
  2. Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking August 19, 2026 | Serhii Melnyk and Timmy Lister Following GreenPlasma, YellowKey and MiniPlasma, RoguePlanet and GreatXML, and ... Read More
  3. Energy Disruption in UK Critical Infrastructure and the Growing OT Cyber Threat August 25, 2026 | Nikita Kazymirskyi A cyber incident affecting a small UK electricity generator in July 2026 ... Read More
  4. Still Circling: Inside the Operator Behind Blind Eagle's GitHub Loader August 28, 2026 | Serhii Melnyk This is a collaborative follow-up to our original post, developed jointly with ... Read More
  5. Expanding the Attack Surface: Analyzing Nightmare-Eclipse's Latest PoCs September 09, 2026 | Serhii Melnyk and Timmy Lister In our previous blog, we explored a series of disclosures from the leak persona ... Read More
  6. One Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed September 16, 2026 | Serhii Melnyk and Timmy Lister (Edit - Sept 17, 2026): The originally released PoC had issues that broke ... Read More

July 2026

  1. ANALYST REPORT 2026 Gartner® Guide for Outsourced Managed Security Services
  2. Hacking Hotels via Smart Stationary Bikes: How Unsecured Gym Equipment Can Lead to RCE April 29, 2026 | John Lopez Internet of Things (IoT) systems in hospitality environments are often ... Read More
  3. Inside Vect Ransomware-as-a-Service April 30, 2026 | SpiderLabs Researcher Vect ransomware, a new group that emerged in January 2026, has recently begun ... Read More
  4. LevelBlue TTP Briefing Q1 2026: Trust Abuse Exposes Weaknesses May 05, 2026 Explore the latest trends, techniques, and procedures (TTPs) our incident ... Read More
  5. Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication May 07, 2026 | Mahadev Joshi LevelBlue’s Security Services issues Threat Analysis reports to inform on ... Read More
  6. A Closer Look at The Gentlemen’s Alleged Leak May 18, 2026 | Arthur Erzberger Executive Summary Read More
  7. Threat Analysis: Backdoored Electron Apps Evading Defenses May 08, 2026 | Michael Morose This Threat Analysis report is part of the “Purple Team Series” in which the ... Read More
  8. YellowKey and GreenPlasma: Two New Windows Zero-Days Unveiled May 19, 2026 | James Ballantyne Two novel Windows zero-day vulnerabilities dubbed YellowKey, which bypasses ... Read More
  9. RoguePlanet and GreatXML

June 2026

  1. Two Approaches for Offensive Testing of AI Systems: Architecture-led AI Application Penetration Test and Threat-led AI Red Team Assessment May 27, 2026 | Sarath Nair Artificial intelligence (AI) is changing the shape of the application attack ... Read More
  2. Sapphire Sleet Targets macOS in Multi-Stage Intrusion Campaign May 28, 2026 | Maor Gabay We recently observed a multi-stage macOS intrusion campaign conducted by the ... Read More
  3. The Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP June 03, 2026 | Jose Martin In Brazil, Nota Fiscal eletrônica (NF-e) is the everyday name for an official ... Read More
  4. YellowKey and MiniPlasma Attack Chains
  5. SpiderLabs
  6. ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery June 04, 2026 | King Orande and Cris Tomboc The LevelBlue OpsIntel CTI team examined the latest version of the ClickFix ... Read More
  7. macOS ClickFix Social Engineering Campaigns June 04, 2026 | Maor Gabay Overview Read More
  8. The Device Code Phishing Tsunami: What We’re Seeing in the Wild June 09, 2026 | John Kevin Adriano With contributions from Cris Tomboc. Read More
  9. Reversing NVIDIA’s CVE-2026-24190: How a Kernel Flaw Put Enterprise AI Clusters and Workstations at Risk June 15, 2026 | Alon Bancic Executive Summary: Bypassing Boundaries in Enterprise AI Infrastructure Read More
  10. Operation FlutterBridge: The FlutterShell macOS Backdoor June 18, 2026 | Maor Gabay Identified through macOS endpoint monitoring, the CL-CRI-1089 cluster, ... Read More
  11. LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign June 24, 2026 | Dawid Nesterowicz In Norse mythology, Loki, the god of mischief, has powerful and deceptive ... Read More

May 2026

  1. Novel Java-Based QuimaRAT Targets Windows, macOS, and Linux June 25, 2026 | Chen Aviani and Nikita Kazymirskyi Remote access trojans (RATs) are legacy threats that continue to evolve ... Read More
  2. An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails June 30, 2026 | Hajime Takai Key points LevelBlue has identified two distinct attack vectors associated with ... Read More
  3. AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign July 02, 2026 | Fernando Martinez Sidera Over the past two weeks, LevelBlue SpiderLabs has been tracking an active ... Read More
  4. From Phishing to Persistence: A CrySome RAT Infection Chain Analysis July 06, 2026 | Sean Shirley and Kyle Sopt During a recent security alert, the LevelBlue MDR SOC successfully triaged and ... Read More
  5. Open Sourcing Our Most Advanced Linux Security Engine: owLSM July 09, 2026 We at LevelBlue company have decided to do something for the community, with ... Read More
  6. Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor July 09, 2026 | Nathaniel Morales The LevelBlue Managed Threat Research team investigated a security alert in a ... Read More
  7. Mitigating New Vulnerabilities with owLSM July 13, 2026 Following the successful launch of owLSM, our first open-source project with ... Read More
  8. ClickFix on macOS: Blockchain-Powered Infostealer Hidden Inside Compromised Websites July 16, 2026 | Rodel Mendrez You're browsing a legitimate small business website. Before the page loads, a ... Read More

April 2026

  1. Still Circling: Blind Eagle's Toolkit Keeps Evolving July 17, 2026 | Serhii Melnyk In June 2025, LevelBlue SpiderLabs published Tracing Blind Eagle to Proton66, ... Read More
  2. LegacyHive: Nightmare-Eclipse’s Latest Zero-Day Drop with a Stripped PoC July 20, 2026 | Pauline Bolaños Vexed researcher Nightmare-Eclipse (aka Chaotic Eclipse, Dead Eclipse, and ... Read More
  3. Stealerium Unmasked: Inside a Multi-Lure, Multi-Stage Stealer Campaign February 11, 2026 | Bernard Bautista In this investigation, we tracked a malware spam campaign that ultimately ... Read More
  4. How ClickFix Opens the Door to Stealthy StealC Information Stealer February 12, 2026 | Rodel Mendrez This analysis examines a complete attack chain targeting Windows systems ... Read More
  5. Pwning Malware with Ninjas and Unicorns February 16, 2026 | Cade Wriglesworth During a DFIR engagement, LevelBlue was asked to assist with reverse ... Read More
  6. Phishing with OAuth Redirect February 18, 2026 | Federico Cedolini The LevelBlue SpiderLabs team identified phishing emails in January 2026 that ... Read More
  7. Operation Epic Fury: From Regional Escalation to Global Cyber Risk March 03, 2026 | LevelBlue SpiderLabs In light of escalating geopolitical tensions involving the United States, ... Read More
  8. From Shadow IT to GhostOps: The Rise of Unauthorized AI Agents in the Enterprise February 24, 2026 | Grant Hutchons If you have worked in enterprise IT for long enough, you have lived through the ... Read More
  9. LevelBlue SpiderLabs Breaks Down the Role of Cyber Operations Taken in the Iran Crisis March 04, 2026 | Gal Romano As combat operations that began on February 28 with joint US-Israeli strikes on ... Read More

March 2026

  1. Beware the ClickFix Trap: REMCOS RAT Hiding in “Helpful” PUAs March 09, 2026 | Hema Loganathan Cybereason GSOC has observed a notable increase in infections involving REMCOS ... Read More
  2. Discover and Exploit: Memory Corruption in CUPS (CVE-2025-61915) March 05, 2026 | Ariel Silver CVE-2025-61915 is a stack based out-of-bound write bug in CUPS. An unauthorized ... Read More
  3. Epic Fury Update: Stryker Attack Highlights Handala's Shift from Espionage to Disruption March 12, 2026 | Arthur Erzberger On March 11, 2026, the medical technology vendor Stryker disclosed a global ... Read More
  4. Weaponizing Safe Links: Abuse of Multi-Layered URL Rewriting in Phishing Attacks March 12, 2026 | John Kevin Adriano In 2024, threat actors were already abusing URL rewriting mechanisms in ... Read More
  5. How LevelBlue OTX and Cybereason XDR Detected a North Korea-Linked Remote IT Worker March 17, 2026 | Tue Luu Talk about dodging the insider threat from hell. From August 15 to 25, 2025, ... Read More
  6. KongTuke: A King Among Threat Groups March 18, 2026 This blog is the latest in a series that delves into the deep research ... Read More
  7. Fake CAPTCHA Campaign: Inside a Multi-Stage Stealer Assault March 19, 2026 | Shabtay Barel, Serhii Melnyk, Rodel Mendrez This report expands LevelBlue’s ongoing investigation into a multi-stage ... Read More
  8. “Say My Name”: How MioLab is building MacOS Stealer Empire March 20, 2026 | Mark Tsipershtein and Evgeny Ananin As Apple computer’s market share continues to grow, threat actors are ... Read More
  9. Tracing a Multi-Vector Malware Campaign: From VBS to Open Infrastructure March 23, 2026 | Sean Shirley Recently LevelBlue SpiderLabs initiated an investigation into a multi-stage ... Read More
  10. The Value of Microsoft Security Copilot: SCU Billing and Why Agent Design Matters March 27, 2026 | David Broggy Most organizations start by using Microsoft Copilot the way it looks in demos: ... Read More
  11. Azure ServiceBus WebSockets as a C2 Channel March 24, 2026 | Stuart White In offensive security, the ability to blend seamlessly with legitimate traffic ... Read More
  12. Using RF Power Levels to Defeat MAC Address Randomization Enabling Passive Device Tracking March 31, 2026 | Tom Neaves I came up with a theory (based on science) that it may be possible to passively ... Read More
  13. Major Supply Chain Compromise in the Popular axios npm Package April 03, 2026 | Karl Sigler On March 30, 2026, two malicious versions of the widely used axios HTTP client ... Read More
  14. Err-Hiding and Seek: How ErrTraffic v3 Leverages EtherHiding in ClickFix Campaign April 09, 2026 | King Orande and Cris Tomboc The LevelBlue SpiderLabs team examined the latest version of ErrTraffic, which ... Read More
  15. Axios NPM Package Supply Chain Compromise Leads to RAT Deployment April 09, 2026 | Mahadev Joshi and Sho Kishimoto Cybersecurity Expert Q&A Which execution chain enables malicious Axios npm ... Read More
  16. Trojanized CPUID HWMonitor Installer Delivers Fileless .NET Payload via Obfuscated IPv6 Scriptlet April 10, 2026 | Sean Shirley Overview Recent reporting has identified a trojanized version of the CPUID ... Read More

February 2026

  1. Why Attackers Are Bypassing Phishing Emails and Targeting Identity Instead April 13, 2026 | Jamie Mamroe One of the fastest growing initial access techniques we are seeing right now is ... Read More
  2. RedSun and the Expanding Risk Window: Why Microsoft Defender Patching Can’t Wait April 17, 2026 A newly disclosed zero-day vulnerability, dubbed RedSun, is raising fresh ... Read More
  3. Go With the Flow: Abusing OAuth Device Code Flow April 20, 2026 | Jakub Wiewiorski In early 2026, phishing attacks are still among the top contributors to the ... Read More
  4. A Closer Look at the Novel and Stealthy KarstoRAT Malware April 21, 2026 | Chen Aviani For almost three decades now, threat actors have used remote access trojans ... Read More
  5. Crypto Drainers as a Converging Threat: Insights into Emerging Hybrid Attack Ecosystems April 23, 2026 | Serhii Melnyk, King Orande, Cris Tomboc, Sean Shirley LevelBlue SpiderLabs’ Cyber Threat Intelligence Team continues to observe a ... Read More
  6. Public Sector Ransomware Attacks Relentlessly Continue October 22, 2025 In 2025, 36 years after the first ransomware attack was recorded, actors ... Read More
  7. Bolstering Cybersecurity Resilience in the Public Sector October 29, 2025 With digital transformation continuing unabated, the prevalence of legacy ... Read More
  8. Threat Intelligence News from LevelBlue SpiderLabs November 2025 November 01, 2025 November 2025 Read More
  9. Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand November 04, 2025 | Serhii Melnyk Trustwave SpiderLabs’ Cyber Threat Intelligence team is tracking the emergence ... Read More

January 2026

  1. SharpParty: Process Injection in C# November 11, 2025 | Will Rabb This article also appears on the Stroz Friedberg, A LevelBlue Company, blog ... Read More
  2. The Cat's Out of the Bag: A 'Meow Attack' Data Corruption Campaign Simulation via MAD-CAT November 07, 2025 | Karl Biron In 2024, I published Feline Hackers Among Us? (A Deep Dive and Simulation of ... Read More
  3. Microsoft Issues Emergency Patch for Windows Server Update Services RCE Vulnerability CVE-2025-59287 November 14, 2025 | Fernando Martinez LevelBlue Labs is tracking a severe vulnerability in Windows Server Update ... Read More
  4. SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp November 19, 2025 | Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi LevelBlue SpiderLabs researchers have recently identified a banking Trojan we ... Read More
  5. Handala's Latest Publication Targets Israeli High-Tech Specialists November 26, 2025 | Arthur Erzberger The Handala hacker group has recently published a list of Israeli high-tech and ... Read More
  6. Sha1-Hulud: The Second Coming of The New npm GitHub Worm December 03, 2025 | Karl Sigler Sha1-Hulud is back with a new evolution of its supply-chain attack that targets ... Read More
  7. Threat Intelligence News from LevelBlue SpiderLabs December 2025 December 12, 2025 LevelBlue SpiderLabs is the threat intelligence unit of LevelBlue and includes ... Read More
  8. A Rising Tide of Threats: The Offshore Energy Industry’s Threat Landscape December 12, 2025 Key Findings: Read More
  9. LevelBlue SpiderLabs: SQL Injection in Orkes Conductor: CVE-2025-66387 December 18, 2025 | Tim Stamopoulos LevelBlue SpiderLabs has discovered a vulnerability in the Orkes Conductor ... Read More

December 2025

  1. Holiday Fraud 2025: Gift Card Schemes Exploiting Seasonal Shopping December 19, 2025 | Serhii Melnyk Children with a vision of a huge payout from Santa Claus are not the only ones ... Read More
  2. A 2025 Threat Trends Analysis December 22, 2025 | Andrea Martinez and Peter Connolly As 2025 winds down and cruises into the holiday season, it’s a good time to ... Read More
  3. Threat Intelligence News from LevelBlue SpiderLabs January 2026 January 06, 2026 January 2026 Read More
  4. Preparing for the AI Job Market: A Security Professional's Roadmap January 14, 2026 | David Broggy Every now and then, LevelBlue SpiderLabs diverts a bit from its normal course ... Read More
  5. BEC Email Trends: Attacks up 15% in 2025 January 13, 2026 | Katrina Udquin Business Email Compromise (BEC) is a sophisticated form of phishing attack in ... Read More
  6. Ni8mare on Automation Street: When Workflows Turn Into an Attack Path January 15, 2026 | Nikita Kazymirskyi CVE-2026-21858 (Ni8mare) is a maximum-severity vulnerability in self-hosted n8n ... Read More

November 2025

  1. CVE-2009-0556: The 2009 PowerPoint Bug that Refuses to Die January 23, 2026 | Messiah Dela Cruz In 2009, LevelBlue Vice President of Security Research Ziv Mador and Cristian ... Read More
  2. The Hard Lessons Learned by Analyzing Education Sector Cyberattacks January 26, 2026 In the last quarter of 2025, LevelBlue SpiderLabs used telemetry from the ... Read More
  3. Scenario 3: SOC/SIEM Takes in and Summarizes Windows Events (Log Files) January 29, 2026 | Tom Neaves In September last year I penned this blog Rogue AI Agents In Your SOCs and ... Read More
  4. 19 Shades of LockBit5.0, Inside the Latest Cross-Platform Ransomware’s Newest Leaked Samples: Part 1 January 30, 2026 | Mark Tsipershtein, Evgeny Ananin, Nikita Kazymirskyi This three-part blog series presents an analysis of 19 samples of a ... Read More
  5. LockBit 5.0 Introduces New Features: ChaCha20 Encryption, Stealthy Installation, and Anti-Analysis to Target Windows, Linux, and ESXi Environments January 30, 2026 | SpiderLabs Researcher The prolific LockBit ransomware-as-a-service (RaaS) group shows its dedication ... Read More
  6. The Godfather of Ransomware? Inside DragonForce’s Cartel Ambitions February 03, 2026 | Mark Tsipershtein and Evgeny Ananin The Cybereason, A LevelBlue Company, Threat Intelligence Team conducted an ... Read More
  7. 19 Shades of LockBit5.0, Inside the Latest Cross-Platform Ransomware’s Newest Leaked Samples: Part 2 February 04, 2026 | Mark Tsipershtein, Evgeny Ananin, Nikita Kazymirskyi In the first part of our LockBit 5.0 series, where we analyzed 19 samples of ... Read More

October 2025

  1. 19 Shades of LockBit5.0, Inside the Latest Cross-Platform Ransomware’s Newest Leaked Samples: Part 3 February 05, 2026 | Alexander Sevtsov, Chen Aviani In the first two parts of our LockBit 5.0 series, we provided a comprehensive ... Read More
  2. Notepad-Plus Fuss: Notepad++ Supply Chain Attack Analysis February 10, 2026 | King Orande LevelBlue SpiderLabs’ Cyber Threat Intelligence Team investigated the ongoing ... Read More
  3. The Attack Vector: Database Triggers as Persistence Mechanisms June 24, 2025 | Jose Tozo Organizations often assume that restoring a backup to a patched environment ... Read More
  4. Dire Wolf Strikes: New Ransomware Group Targeting Global Sectors June 24, 2025 | Nathaniel Morales Dire Wolf is a newly emerged ransomware group first observed in May 2025 and ... Read More
  5. Trustwave SpiderLabs’ 2025 Risk Radar Report: Technology Sector June 25, 2025 Explore key insights from Trustwave SpiderLabs' latest report on securing tech ... Read More

September 2025

  1. Tracing Blind Eagle to Proton66 June 27, 2025 | Serhii Melnyk LevelBlue SpiderLabs has assessed with high confidence that the threat group ... Read More
  2. Threat Intelligence News from LevelBlue SpiderLabs July 2025 July 01, 2025 July 2025 Read More
  3. The Breach Beyond the Runway: Cybercriminals Targeted Qantas Through a Trusted Partner July 04, 2025 | Nikita Kazymirskyi On July 3, 2025, Qantas confirmed in an update statement that a cyber incident ... Read More
  4. KAWA4096’s Ransomware Tide: Rising Threat With Borrowed Styles July 16, 2025 | Nathaniel Morales and John Basmayor KAWA4096, a ransomware whose name includes "Kawa", the Japanese word for ... Read More
  5. Unmasking Malicious APKs: Android Malware Blending Click Fraud and Credential Theft July 18, 2025 | Serhii Melnyk Malicious APKs (Android Package Kit files) continue to serve as one of the most ... Read More
  6. No Tell Motel: Trustwave Exposes the Secrets of Dark Web Travel Agencies July 21, 2025 | Nikita Kazymirskyi Dark web travel agencies remain a persistent niche in the cybercrime ecosystem. ... Read More

August 2025

  1. Using SQLmap to Dig for Sensitive Data in SQL Databases July 22, 2025 | Karl Biron In our latest report Data Pirates' Toolkit (Leveraging SQLmap for Unearthing ... Read More
  2. In-The-Wild Exploitation of CVE-2025-53770 and CVE-2025-53771: Technical Details and Mitigation Strategies July 23, 2025 | Serhii Melnyk Two critical zero-day vulnerabilities in the Microsoft SharePoint Server ... Read More
  3. Threat Intelligence News from LevelBlue SpiderLabs August 2025 August 01, 2025 August 2025 Read More
  4. Understanding DocumentDB’s Network Security Trade-Offs: The VPC Challenge August 05, 2025 | Selam Gebreananeya AWS DocumentDB by default is securely isolated within a VPC, unreachable from ... Read More
  5. Echoes in the Shell: Legacy Tooling Behind Ongoing SharePoint ‘ToolShell’ Exploitation August 08, 2025 | Serhii Melnyk, Cris Tomboc and King Orande The Trustwave SpiderLabs CTI team began correlating telemetry from multiple ... Read More
  6. When Hackers Call: Social Engineering, Abusing Brave Support, and EncryptHub’s Expanding Arsenal August 13, 2025 | Nathaniel Morales and Nikita Kazymirskyi LevelBlue SpiderLabs researchers have recently identified an EncryptHub ... Read More
  7. How Researchers Collect Indicators of Compromise August 14, 2025 | Messiah Dela Cruz As security researchers, we actively monitor the latest CVEs and their publicly ... Read More

July 2025

  1. Malicious Screen Connect Campaign Abuses AI-Themed Lures for Xworm Delivery August 27, 2025 | Bolesław Szołtysik, Chris Tomboc, Serhii Melnyk During a recent Advanced Continual Threat Hunt (ACTH) investigation, the ... Read More
  2. Unraveling Phishing Campaigns Flagged by Trustwave’s URL Scanner August 28, 2025 | Karla Agregado In recent months, Trustwave SpiderLabs, A LevelBlue Company, saw a significant ... Read More
  3. Rogue AI Agents In Your SOCs and SIEMs – Indirect Prompt Injection via Log Files September 05, 2025 | Tom Neaves AI agents (utilizing LLMs and RAG) are being used within SOCs and SIEMS to both ... Read More
  4. Salesloft Drift Supply Chain Attack Affects Hundreds of Businesses September 09, 2025 | Karl Sigler Trustwave's Security & Compliance Team is aware of the Salesloft ... Read More
  5. Shades of Red: Redefining the Use of Red Flags in Cybersecurity and Insurance September 18, 2025 | William Evers, Mudit Singhania, Scott Swanson In cybersecurity, several related but divergent meanings have been ascribed to ... Read More
  6. US Secret Service Blocks Massive Telecom Attack in New York September 24, 2025 | Karl Sigler The Secret Service’s takedown in New York shines a light on a type of threat ... Read More
  7. REDCap: Multiple Cross-Site Scripting (XSS) Vulnerabilities September 26, 2025 | Harold Zang REDCap, developed by Vanderbilt University, is a secure platform designed for ... Read More
  8. From Folding to Folded: Hacking High Volume Mailer Machines September 30, 2025 | John Jackson The Quadient DS-700iQ is a high-volume folder-inserter machine designed for ... Read More

June 2025

  1. Threat Intelligence News from LevelBlue SpiderLabs, October 2025 October 01, 2025 October 2025 Read More
  2. Notepad++ DLL Hijacking (CVE-2025-56383): CVSS 8.4 or CVSS 0.0? October 03, 2025 A vulnerability on a popular source-code editor has been recently released ... Read More
  3. The F5 BIG-IP Source Code Breach October 17, 2025 | Karl Sigler On August 9, F5 discovered that multiple systems were compromised by what it is ... Read More
  4. Data in the Dark: The Public Sector on the Dark Web October 15, 2025 The dark web serves as a refuge for threat actors to gather intel, trade ... Read More
  5. DNSForge – Relaying with Force March 12, 2025 | Apurva Goenka Introducing a new attack mode for greater flexibility and customization. Read More
  6. Fort Knox for Your Data: How Elasticsearch X-Pack Locks Down Your Cluster – Part 1 March 19, 2025 | Karl Biron Picture this: an always-awake, never-tired, high-speed librarian that instantly ... Read More

May 2025

  1. Why Principle of Least Privilege Matters More Than Ever in a World of Backdoored Large Language Models (LLMs) March 24, 2025 | Tom Neaves The concept of “principle of least privilege” has been around for a long time. ... Read More
  2. Fort Knox for Your Data: How Elasticsearch X-Pack Locks Down Your Cluster – Part 2 March 20, 2025 | Karl Biron In Part 1 of Fort Knox for Your Data: How Elasticsearch X-Pack Locks Down Your ... Read More
  3. Trustwave SpiderLabs Threat Review: Alleged Oracle Compromise March 25, 2025 | Nikita Kazymirskyi and Karl Sigler On March 20, a relatively unknown user on Breach Forums posted the allegation ... Read More

Every year

2026 1022025 902024 1162023 832022 742021 692020 1002019 832018 682017 782016 612015 1162014 1752013 2112012 2372011 22