2013–2026

2026 102

October 2026

1. 30 OctBlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits
2. 28 OctLevelBlue TTP Briefing Q3 2026: Trusted Access Fuels Data Theft
3. 26 OctLearn More
4. 22 OctSecuring the Software Development Lifecycle and Supply Chain in an AI-Forward World
5. 22 OctPHP2Shell: Critical RCE Vulnerabilities Affect a Large Majority of Web Servers
6. 22 OctExploitarium: Inside the Archive Behind the Mass 0-Day Drop July 21, 2026 | Serhii Melnyk Coordinated vulnerability disclosures operate on a straightforward premise: the ... Read More
7. 20 OctInside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts
8. 20 OctLevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses July 23, 2026 Explore the latest tactics, techniques, and procedures (TTPs) our incident ... Read More
9. 7 OctInside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign
10. 7 OctLegacyHive: Hunting Windows Profile Initialization Abuse Through Offline Registry Manipulation July 27, 2026 | Serhii Melnyk and Timmy Lister Following GreenPlasma, YellowKey and MiniPlasma, as well as RoguePlanet and ... Read More
11. 5 OctFilling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands
12. 5 OctRelease the RAVEN: An Offensive Reconnaissance and Attack Tool on Vulnerable Elasticsearch Nodes July 29, 2026 | Karl Biron You have almost certainly interacted with Elasticsearch today. The search bar ... Read More
13. 1 OctTIKTOUK: Tracing a WordPress Credential Collection Toolkit
14. 1 OctReview of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems August 04, 2026 | Nikita Kazymirskyi In light of the water-sector activity described below, we've increased ... Read More

September 2026

1. 30 SepCitrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators
2. 30 SepRelease the RAVEN: First Contact August 05, 2026 | Karl Biron You are mid-engagement. Nmap finishes its sweep and port 9200 lights up on a ... Read More
3. 29 SepCitrix NetScaler Zero-Day Exploited Globally
4. 29 SepRelease the RAVEN: Exploiting the Cracks August 06, 2026 | Karl Biron In Part 1, we went from a single open port to a complete map of the target. ... Read More
5. 24 SepFile Acquisition May Be Recorded as “FileAccessed” in Microsoft 365 (“M365”)
6. 24 SepBeyond ‘Fake Updates’: From Application Store-Themed Phishing to Large-Scale Distribution of ScreenConnect August 07, 2026 | King Orande and Cris Tomboc The LevelBlue OpsCTI Team recently identified a large-scale phishing campaign ... Read More
7. 23 SepEnumerating Users and MFA via Microsoft's Password Reset Portal
8. 23 SepCNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain August 10, 2026 | Rodel Mendrez This post is the result of an investigation into a case we worked on, in which ... Read More
9. 17 SepRelease the RAVEN: Kibana Under Siege August 13, 2026 | Karl Biron In Parts 1 and 2, every command targeted port 9200. Every exploit, every ... Read More
10. 16 SepThe Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains August 12, 2026 | Karla Agregado To stay ahead of evolving threats, LevelBlue utilizes a machine-learning-based ... Read More
11. 9 SepRelease the RAVEN: Data Heist and Persistence August 14, 2026 | Karl Biron We have access through port 9200. We have code execution through port 5601. ... Read More

August 2026

1. 28 AugRelease the RAVEN: Destruction and Discipline August 18, 2026 | Karl Biron In Part 4, we stole every document from every index, planted a rogue superuser ... Read More
2. 25 AugCloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking August 19, 2026 | Serhii Melnyk and Timmy Lister Following GreenPlasma, YellowKey and MiniPlasma, RoguePlanet and GreatXML, and ... Read More
3. 19 AugEnergy Disruption in UK Critical Infrastructure and the Growing OT Cyber Threat August 25, 2026 | Nikita Kazymirskyi A cyber incident affecting a small UK electricity generator in July 2026 ... Read More
4. 18 AugStill Circling: Inside the Operator Behind Blind Eagle's GitHub Loader August 28, 2026 | Serhii Melnyk This is a collaborative follow-up to our original post, developed jointly with ... Read More
5. 14 AugExpanding the Attack Surface: Analyzing Nightmare-Eclipse's Latest PoCs September 09, 2026 | Serhii Melnyk and Timmy Lister In our previous blog, we explored a series of disclosures from the leak persona ... Read More
6. 13 AugOne Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed September 16, 2026 | Serhii Melnyk and Timmy Lister (Edit - Sept 17, 2026): The originally released PoC had issues that broke ... Read More

July 2026

1. 21 JulANALYST REPORT 2026 Gartner® Guide for Outsourced Managed Security Services
2. 20 JulHacking Hotels via Smart Stationary Bikes: How Unsecured Gym Equipment Can Lead to RCE April 29, 2026 | John Lopez Internet of Things (IoT) systems in hospitality environments are often ... Read More
3. 17 JulInside Vect Ransomware-as-a-Service April 30, 2026 | SpiderLabs Researcher Vect ransomware, a new group that emerged in January 2026, has recently begun ... Read More
4. 16 JulLevelBlue TTP Briefing Q1 2026: Trust Abuse Exposes Weaknesses May 05, 2026 Explore the latest trends, techniques, and procedures (TTPs) our incident ... Read More
5. 13 JulUnmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication May 07, 2026 | Mahadev Joshi LevelBlue’s Security Services issues Threat Analysis reports to inform on ... Read More
6. 9 JulA Closer Look at The Gentlemen’s Alleged Leak May 18, 2026 | Arthur Erzberger Executive Summary Read More
7. 9 JulThreat Analysis: Backdoored Electron Apps Evading Defenses May 08, 2026 | Michael Morose This Threat Analysis report is part of the “Purple Team Series” in which the ... Read More
8. 6 JulYellowKey and GreenPlasma: Two New Windows Zero-Days Unveiled May 19, 2026 | James Ballantyne Two novel Windows zero-day vulnerabilities dubbed YellowKey, which bypasses ... Read More
9. 4 JulRoguePlanet and GreatXML

June 2026

1. 30 JunTwo Approaches for Offensive Testing of AI Systems: Architecture-led AI Application Penetration Test and Threat-led AI Red Team Assessment May 27, 2026 | Sarath Nair Artificial intelligence (AI) is changing the shape of the application attack ... Read More
2. 25 JunSapphire Sleet Targets macOS in Multi-Stage Intrusion Campaign May 28, 2026 | Maor Gabay We recently observed a multi-stage macOS intrusion campaign conducted by the ... Read More
3. 24 JunThe Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP June 03, 2026 | Jose Martin In Brazil, Nota Fiscal eletrônica (NF-e) is the everyday name for an official ... Read More
4. 23 JunYellowKey and MiniPlasma Attack Chains
5. 23 JunSpiderLabs
6. 18 JunClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery June 04, 2026 | King Orande and Cris Tomboc The LevelBlue OpsIntel CTI team examined the latest version of the ClickFix ... Read More
7. 17 JunmacOS ClickFix Social Engineering Campaigns June 04, 2026 | Maor Gabay Overview Read More
8. 15 JunThe Device Code Phishing Tsunami: What We’re Seeing in the Wild June 09, 2026 | John Kevin Adriano With contributions from Cris Tomboc. Read More
9. 9 JunReversing NVIDIA’s CVE-2026-24190: How a Kernel Flaw Put Enterprise AI Clusters and Workstations at Risk June 15, 2026 | Alon Bancic Executive Summary: Bypassing Boundaries in Enterprise AI Infrastructure Read More
10. 4 JunOperation FlutterBridge: The FlutterShell macOS Backdoor June 18, 2026 | Maor Gabay Identified through macOS endpoint monitoring, the CL-CRI-1089 cluster, ... Read More
11. 3 JunLokiBot After a Decade: An Analysis of a Recent LokiBot Campaign June 24, 2026 | Dawid Nesterowicz In Norse mythology, Loki, the god of mischief, has powerful and deceptive ... Read More

May 2026

1. 28 MayNovel Java-Based QuimaRAT Targets Windows, macOS, and Linux June 25, 2026 | Chen Aviani and Nikita Kazymirskyi Remote access trojans (RATs) are legacy threats that continue to evolve ... Read More
2. 27 MayAn Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails June 30, 2026 | Hajime Takai Key points LevelBlue has identified two distinct attack vectors associated with ... Read More
3. 22 MayAsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign July 02, 2026 | Fernando Martinez Sidera Over the past two weeks, LevelBlue SpiderLabs has been tracking an active ... Read More
4. 19 MayFrom Phishing to Persistence: A CrySome RAT Infection Chain Analysis July 06, 2026 | Sean Shirley and Kyle Sopt During a recent security alert, the LevelBlue MDR SOC successfully triaged and ... Read More
5. 18 MayOpen Sourcing Our Most Advanced Linux Security Engine: owLSM July 09, 2026 We at LevelBlue company have decided to do something for the community, with ... Read More
6. 8 MayHiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor July 09, 2026 | Nathaniel Morales The LevelBlue Managed Threat Research team investigated a security alert in a ... Read More
7. 7 MayMitigating New Vulnerabilities with owLSM July 13, 2026 Following the successful launch of owLSM, our first open-source project with ... Read More
8. 5 MayClickFix on macOS: Blockchain-Powered Infostealer Hidden Inside Compromised Websites July 16, 2026 | Rodel Mendrez You're browsing a legitimate small business website. Before the page loads, a ... Read More

April 2026

1. 30 AprStill Circling: Blind Eagle's Toolkit Keeps Evolving July 17, 2026 | Serhii Melnyk In June 2025, LevelBlue SpiderLabs published Tracing Blind Eagle to Proton66, ... Read More
2. 29 AprLegacyHive: Nightmare-Eclipse’s Latest Zero-Day Drop with a Stripped PoC July 20, 2026 | Pauline Bolaños Vexed researcher Nightmare-Eclipse (aka Chaotic Eclipse, Dead Eclipse, and ... Read More
3. 20 AprStealerium Unmasked: Inside a Multi-Lure, Multi-Stage Stealer Campaign February 11, 2026 | Bernard Bautista In this investigation, we tracked a malware spam campaign that ultimately ... Read More
4. 17 AprHow ClickFix Opens the Door to Stealthy StealC Information Stealer February 12, 2026 | Rodel Mendrez This analysis examines a complete attack chain targeting Windows systems ... Read More
5. 13 AprPwning Malware with Ninjas and Unicorns February 16, 2026 | Cade Wriglesworth During a DFIR engagement, LevelBlue was asked to assist with reverse ... Read More
6. 10 AprPhishing with OAuth Redirect February 18, 2026 | Federico Cedolini The LevelBlue SpiderLabs team identified phishing emails in January 2026 that ... Read More
7. 9 AprOperation Epic Fury: From Regional Escalation to Global Cyber Risk March 03, 2026 | LevelBlue SpiderLabs In light of escalating geopolitical tensions involving the United States, ... Read More
8. 9 AprFrom Shadow IT to GhostOps: The Rise of Unauthorized AI Agents in the Enterprise February 24, 2026 | Grant Hutchons If you have worked in enterprise IT for long enough, you have lived through the ... Read More
9. 3 AprLevelBlue SpiderLabs Breaks Down the Role of Cyber Operations Taken in the Iran Crisis March 04, 2026 | Gal Romano As combat operations that began on February 28 with joint US-Israeli strikes on ... Read More

March 2026

1. 31 MarBeware the ClickFix Trap: REMCOS RAT Hiding in “Helpful” PUAs March 09, 2026 | Hema Loganathan Cybereason GSOC has observed a notable increase in infections involving REMCOS ... Read More
2. 30 MarDiscover and Exploit: Memory Corruption in CUPS (CVE-2025-61915) March 05, 2026 | Ariel Silver CVE-2025-61915 is a stack based out-of-bound write bug in CUPS. An unauthorized ... Read More
3. 27 MarEpic Fury Update: Stryker Attack Highlights Handala's Shift from Espionage to Disruption March 12, 2026 | Arthur Erzberger On March 11, 2026, the medical technology vendor Stryker disclosed a global ... Read More
4. 24 MarWeaponizing Safe Links: Abuse of Multi-Layered URL Rewriting in Phishing Attacks March 12, 2026 | John Kevin Adriano In 2024, threat actors were already abusing URL rewriting mechanisms in ... Read More
5. 23 MarHow LevelBlue OTX and Cybereason XDR Detected a North Korea-Linked Remote IT Worker March 17, 2026 | Tue Luu Talk about dodging the insider threat from hell. From August 15 to 25, 2025, ... Read More
6. 20 MarKongTuke: A King Among Threat Groups March 18, 2026 This blog is the latest in a series that delves into the deep research ... Read More
7. 19 MarFake CAPTCHA Campaign: Inside a Multi-Stage Stealer Assault March 19, 2026 | Shabtay Barel, Serhii Melnyk, Rodel Mendrez This report expands LevelBlue’s ongoing investigation into a multi-stage ... Read More
8. 18 Mar“Say My Name”: How MioLab is building MacOS Stealer Empire March 20, 2026 | Mark Tsipershtein and Evgeny Ananin As Apple computer’s market share continues to grow, threat actors are ... Read More
9. 17 MarTracing a Multi-Vector Malware Campaign: From VBS to Open Infrastructure March 23, 2026 | Sean Shirley Recently LevelBlue SpiderLabs initiated an investigation into a multi-stage ... Read More
10. 12 MarThe Value of Microsoft Security Copilot: SCU Billing and Why Agent Design Matters March 27, 2026 | David Broggy Most organizations start by using Microsoft Copilot the way it looks in demos: ... Read More
11. 12 MarAzure ServiceBus WebSockets as a C2 Channel March 24, 2026 | Stuart White In offensive security, the ability to blend seamlessly with legitimate traffic ... Read More
12. 11 MarUsing RF Power Levels to Defeat MAC Address Randomization Enabling Passive Device Tracking March 31, 2026 | Tom Neaves I came up with a theory (based on science) that it may be possible to passively ... Read More
13. 9 MarMajor Supply Chain Compromise in the Popular axios npm Package April 03, 2026 | Karl Sigler On March 30, 2026, two malicious versions of the widely used axios HTTP client ... Read More
14. 5 MarErr-Hiding and Seek: How ErrTraffic v3 Leverages EtherHiding in ClickFix Campaign April 09, 2026 | King Orande and Cris Tomboc The LevelBlue SpiderLabs team examined the latest version of ErrTraffic, which ... Read More
15. 4 MarAxios NPM Package Supply Chain Compromise Leads to RAT Deployment April 09, 2026 | Mahadev Joshi and Sho Kishimoto Cybersecurity Expert Q&A Which execution chain enables malicious Axios npm ... Read More
16. 3 MarTrojanized CPUID HWMonitor Installer Delivers Fileless .NET Payload via Obfuscated IPv6 Scriptlet April 10, 2026 | Sean Shirley Overview Recent reporting has identified a trojanized version of the CPUID ... Read More

February 2026

1. 24 FebWhy Attackers Are Bypassing Phishing Emails and Targeting Identity Instead April 13, 2026 | Jamie Mamroe One of the fastest growing initial access techniques we are seeing right now is ... Read More
2. 18 FebRedSun and the Expanding Risk Window: Why Microsoft Defender Patching Can’t Wait April 17, 2026 A newly disclosed zero-day vulnerability, dubbed RedSun, is raising fresh ... Read More
3. 16 FebGo With the Flow: Abusing OAuth Device Code Flow April 20, 2026 | Jakub Wiewiorski In early 2026, phishing attacks are still among the top contributors to the ... Read More
4. 12 FebA Closer Look at the Novel and Stealthy KarstoRAT Malware April 21, 2026 | Chen Aviani For almost three decades now, threat actors have used remote access trojans ... Read More
5. 11 FebCrypto Drainers as a Converging Threat: Insights into Emerging Hybrid Attack Ecosystems April 23, 2026 | Serhii Melnyk, King Orande, Cris Tomboc, Sean Shirley LevelBlue SpiderLabs’ Cyber Threat Intelligence Team continues to observe a ... Read More
6. 10 FebPublic Sector Ransomware Attacks Relentlessly Continue October 22, 2025 In 2025, 36 years after the first ransomware attack was recorded, actors ... Read More
7. 5 FebBolstering Cybersecurity Resilience in the Public Sector October 29, 2025 With digital transformation continuing unabated, the prevalence of legacy ... Read More
8. 4 FebThreat Intelligence News from LevelBlue SpiderLabs November 2025 November 01, 2025 November 2025 Read More
9. 3 FebScattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand November 04, 2025 | Serhii Melnyk Trustwave SpiderLabs’ Cyber Threat Intelligence team is tracking the emergence ... Read More

January 2026

1. 30 JanSharpParty: Process Injection in C# November 11, 2025 | Will Rabb This article also appears on the Stroz Friedberg, A LevelBlue Company, blog ... Read More
2. 30 JanThe Cat's Out of the Bag: A 'Meow Attack' Data Corruption Campaign Simulation via MAD-CAT November 07, 2025 | Karl Biron In 2024, I published Feline Hackers Among Us? (A Deep Dive and Simulation of ... Read More
3. 29 JanMicrosoft Issues Emergency Patch for Windows Server Update Services RCE Vulnerability CVE-2025-59287 November 14, 2025 | Fernando Martinez LevelBlue Labs is tracking a severe vulnerability in Windows Server Update ... Read More
4. 26 JanSpiderLabs IDs New Banking Trojan Distributed Through WhatsApp November 19, 2025 | Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi LevelBlue SpiderLabs researchers have recently identified a banking Trojan we ... Read More
5. 23 JanHandala's Latest Publication Targets Israeli High-Tech Specialists November 26, 2025 | Arthur Erzberger The Handala hacker group has recently published a list of Israeli high-tech and ... Read More
6. 15 JanSha1-Hulud: The Second Coming of The New npm GitHub Worm December 03, 2025 | Karl Sigler Sha1-Hulud is back with a new evolution of its supply-chain attack that targets ... Read More
7. 14 JanThreat Intelligence News from LevelBlue SpiderLabs December 2025 December 12, 2025 LevelBlue SpiderLabs is the threat intelligence unit of LevelBlue and includes ... Read More
8. 13 JanA Rising Tide of Threats: The Offshore Energy Industry’s Threat Landscape December 12, 2025 Key Findings: Read More
9. 6 JanLevelBlue SpiderLabs: SQL Injection in Orkes Conductor: CVE-2025-66387 December 18, 2025 | Tim Stamopoulos LevelBlue SpiderLabs has discovered a vulnerability in the Orkes Conductor ... Read More

2025 90

December 2025

1. 22 DecHoliday Fraud 2025: Gift Card Schemes Exploiting Seasonal Shopping December 19, 2025 | Serhii Melnyk Children with a vision of a huge payout from Santa Claus are not the only ones ... Read More
2. 19 DecA 2025 Threat Trends Analysis December 22, 2025 | Andrea Martinez and Peter Connolly As 2025 winds down and cruises into the holiday season, it’s a good time to ... Read More
3. 18 DecThreat Intelligence News from LevelBlue SpiderLabs January 2026 January 06, 2026 January 2026 Read More
4. 12 DecPreparing for the AI Job Market: A Security Professional's Roadmap January 14, 2026 | David Broggy Every now and then, LevelBlue SpiderLabs diverts a bit from its normal course ... Read More
5. 12 DecBEC Email Trends: Attacks up 15% in 2025 January 13, 2026 | Katrina Udquin Business Email Compromise (BEC) is a sophisticated form of phishing attack in ... Read More
6. 3 DecNi8mare on Automation Street: When Workflows Turn Into an Attack Path January 15, 2026 | Nikita Kazymirskyi CVE-2026-21858 (Ni8mare) is a maximum-severity vulnerability in self-hosted n8n ... Read More

November 2025

1. 26 NovCVE-2009-0556: The 2009 PowerPoint Bug that Refuses to Die January 23, 2026 | Messiah Dela Cruz In 2009, LevelBlue Vice President of Security Research Ziv Mador and Cristian ... Read More
2. 19 NovThe Hard Lessons Learned by Analyzing Education Sector Cyberattacks January 26, 2026 In the last quarter of 2025, LevelBlue SpiderLabs used telemetry from the ... Read More
3. 14 NovScenario 3: SOC/SIEM Takes in and Summarizes Windows Events (Log Files) January 29, 2026 | Tom Neaves In September last year I penned this blog Rogue AI Agents In Your SOCs and ... Read More
4. 11 Nov19 Shades of LockBit5.0, Inside the Latest Cross-Platform Ransomware’s Newest Leaked Samples: Part 1 January 30, 2026 | Mark Tsipershtein, Evgeny Ananin, Nikita Kazymirskyi This three-part blog series presents an analysis of 19 samples of a ... Read More
5. 7 NovLockBit 5.0 Introduces New Features: ChaCha20 Encryption, Stealthy Installation, and Anti-Analysis to Target Windows, Linux, and ESXi Environments January 30, 2026 | SpiderLabs Researcher The prolific LockBit ransomware-as-a-service (RaaS) group shows its dedication ... Read More
6. 4 NovThe Godfather of Ransomware? Inside DragonForce’s Cartel Ambitions February 03, 2026 | Mark Tsipershtein and Evgeny Ananin The Cybereason, A LevelBlue Company, Threat Intelligence Team conducted an ... Read More
7. 1 Nov19 Shades of LockBit5.0, Inside the Latest Cross-Platform Ransomware’s Newest Leaked Samples: Part 2 February 04, 2026 | Mark Tsipershtein, Evgeny Ananin, Nikita Kazymirskyi In the first part of our LockBit 5.0 series, where we analyzed 19 samples of ... Read More

October 2025

1. 29 Oct19 Shades of LockBit5.0, Inside the Latest Cross-Platform Ransomware’s Newest Leaked Samples: Part 3 February 05, 2026 | Alexander Sevtsov, Chen Aviani In the first two parts of our LockBit 5.0 series, we provided a comprehensive ... Read More
2. 22 OctNotepad-Plus Fuss: Notepad++ Supply Chain Attack Analysis February 10, 2026 | King Orande LevelBlue SpiderLabs’ Cyber Threat Intelligence Team investigated the ongoing ... Read More
3. 15 OctThe Attack Vector: Database Triggers as Persistence Mechanisms June 24, 2025 | Jose Tozo Organizations often assume that restoring a backup to a patched environment ... Read More
4. 3 OctDire Wolf Strikes: New Ransomware Group Targeting Global Sectors June 24, 2025 | Nathaniel Morales Dire Wolf is a newly emerged ransomware group first observed in May 2025 and ... Read More
5. 1 OctTrustwave SpiderLabs’ 2025 Risk Radar Report: Technology Sector June 25, 2025 Explore key insights from Trustwave SpiderLabs' latest report on securing tech ... Read More

September 2025

1. 30 SepTracing Blind Eagle to Proton66 June 27, 2025 | Serhii Melnyk LevelBlue SpiderLabs has assessed with high confidence that the threat group ... Read More
2. 26 SepThreat Intelligence News from LevelBlue SpiderLabs July 2025 July 01, 2025 July 2025 Read More
3. 24 SepThe Breach Beyond the Runway: Cybercriminals Targeted Qantas Through a Trusted Partner July 04, 2025 | Nikita Kazymirskyi On July 3, 2025, Qantas confirmed in an update statement that a cyber incident ... Read More
4. 18 SepKAWA4096’s Ransomware Tide: Rising Threat With Borrowed Styles July 16, 2025 | Nathaniel Morales and John Basmayor KAWA4096, a ransomware whose name includes "Kawa", the Japanese word for ... Read More
5. 9 SepUnmasking Malicious APKs: Android Malware Blending Click Fraud and Credential Theft July 18, 2025 | Serhii Melnyk Malicious APKs (Android Package Kit files) continue to serve as one of the most ... Read More
6. 5 SepNo Tell Motel: Trustwave Exposes the Secrets of Dark Web Travel Agencies July 21, 2025 | Nikita Kazymirskyi Dark web travel agencies remain a persistent niche in the cybercrime ecosystem. ... Read More

August 2025

1. 28 AugUsing SQLmap to Dig for Sensitive Data in SQL Databases July 22, 2025 | Karl Biron In our latest report Data Pirates' Toolkit (Leveraging SQLmap for Unearthing ... Read More
2. 27 AugIn-The-Wild Exploitation of CVE-2025-53770 and CVE-2025-53771: Technical Details and Mitigation Strategies July 23, 2025 | Serhii Melnyk Two critical zero-day vulnerabilities in the Microsoft SharePoint Server ... Read More
3. 14 AugThreat Intelligence News from LevelBlue SpiderLabs August 2025 August 01, 2025 August 2025 Read More
4. 13 AugUnderstanding DocumentDB’s Network Security Trade-Offs: The VPC Challenge August 05, 2025 | Selam Gebreananeya AWS DocumentDB by default is securely isolated within a VPC, unreachable from ... Read More
5. 8 AugEchoes in the Shell: Legacy Tooling Behind Ongoing SharePoint ‘ToolShell’ Exploitation August 08, 2025 | Serhii Melnyk, Cris Tomboc and King Orande The Trustwave SpiderLabs CTI team began correlating telemetry from multiple ... Read More
6. 5 AugWhen Hackers Call: Social Engineering, Abusing Brave Support, and EncryptHub’s Expanding Arsenal August 13, 2025 | Nathaniel Morales and Nikita Kazymirskyi LevelBlue SpiderLabs researchers have recently identified an EncryptHub ... Read More
7. 1 AugHow Researchers Collect Indicators of Compromise August 14, 2025 | Messiah Dela Cruz As security researchers, we actively monitor the latest CVEs and their publicly ... Read More

July 2025

1. 23 JulMalicious Screen Connect Campaign Abuses AI-Themed Lures for Xworm Delivery August 27, 2025 | Bolesław Szołtysik, Chris Tomboc, Serhii Melnyk During a recent Advanced Continual Threat Hunt (ACTH) investigation, the ... Read More
2. 22 JulUnraveling Phishing Campaigns Flagged by Trustwave’s URL Scanner August 28, 2025 | Karla Agregado In recent months, Trustwave SpiderLabs, A LevelBlue Company, saw a significant ... Read More
3. 21 JulRogue AI Agents In Your SOCs and SIEMs – Indirect Prompt Injection via Log Files September 05, 2025 | Tom Neaves AI agents (utilizing LLMs and RAG) are being used within SOCs and SIEMS to both ... Read More
4. 18 JulSalesloft Drift Supply Chain Attack Affects Hundreds of Businesses September 09, 2025 | Karl Sigler Trustwave's Security & Compliance Team is aware of the Salesloft ... Read More
5. 16 JulShades of Red: Redefining the Use of Red Flags in Cybersecurity and Insurance September 18, 2025 | William Evers, Mudit Singhania, Scott Swanson In cybersecurity, several related but divergent meanings have been ascribed to ... Read More
6. 4 JulUS Secret Service Blocks Massive Telecom Attack in New York September 24, 2025 | Karl Sigler The Secret Service’s takedown in New York shines a light on a type of threat ... Read More
7. 3 JulREDCap: Multiple Cross-Site Scripting (XSS) Vulnerabilities September 26, 2025 | Harold Zang REDCap, developed by Vanderbilt University, is a secure platform designed for ... Read More
8. 1 JulFrom Folding to Folded: Hacking High Volume Mailer Machines September 30, 2025 | John Jackson The Quadient DS-700iQ is a high-volume folder-inserter machine designed for ... Read More

June 2025

1. 27 JunThreat Intelligence News from LevelBlue SpiderLabs, October 2025 October 01, 2025 October 2025 Read More
2. 25 JunNotepad++ DLL Hijacking (CVE-2025-56383): CVSS 8.4 or CVSS 0.0? October 03, 2025 A vulnerability on a popular source-code editor has been recently released ... Read More
3. 24 JunThe F5 BIG-IP Source Code Breach October 17, 2025 | Karl Sigler On August 9, F5 discovered that multiple systems were compromised by what it is ... Read More
4. 24 JunData in the Dark: The Public Sector on the Dark Web October 15, 2025 The dark web serves as a refuge for threat actors to gather intel, trade ... Read More
5. 18 JunDNSForge – Relaying with Force March 12, 2025 | Apurva Goenka Introducing a new attack mode for greater flexibility and customization. Read More
6. 1 JunFort Knox for Your Data: How Elasticsearch X-Pack Locks Down Your Cluster – Part 1 March 19, 2025 | Karl Biron Picture this: an always-awake, never-tired, high-speed librarian that instantly ... Read More

May 2025

1. 28 MayWhy Principle of Least Privilege Matters More Than Ever in a World of Backdoored Large Language Models (LLMs) March 24, 2025 | Tom Neaves The concept of “principle of least privilege” has been around for a long time. ... Read More
2. 28 MayFort Knox for Your Data: How Elasticsearch X-Pack Locks Down Your Cluster – Part 2 March 20, 2025 | Karl Biron In Part 1 of Fort Knox for Your Data: How Elasticsearch X-Pack Locks Down Your ... Read More
3. 23 MayTrustwave SpiderLabs Threat Review: Alleged Oracle Compromise March 25, 2025 | Nikita Kazymirskyi and Karl Sigler On March 20, a relatively unknown user on Breach Forums posted the allegation ... Read More
4. 21 MayBabuk2 Bjorka: The Evolution of Ransomware for ‘Data Commoditization’ April 01, 2025 | John Basmayor An investigation that started with a tip from one of our threat intel sources ... Read More
5. 21 May2025 Trustwave Risk Radar Report: Healthcare Sector: Key Risks and Defensive Measures March 26, 2025 Rising Cyber Threats in Healthcare – Discover the latest cybersecurity risks ... Read More
6. 16 MayThreat Intelligence News from LevelBlue SpiderLabs April 2025 April 01, 2025 April 2025 Read More
7. 6 MayInside Black Basta: Uncovering the Secrets of a Ransomware Powerhouse April 08, 2025 | Serhii Melnyk and Nikita Kazymirskyi In February 2025, the cybersecurity community witnessed an unprecedented leak ... Read More
8. 5 MayTycoon2FA New Evasion Technique for 2025 April 10, 2025 | Rodel Mendrez The Tycoon 2FA phishing kit has adopted several new evasion techniques aimed at ... Read More
9. 2 MayPixel-Perfect Trap: The Surge of SVG-Borne Phishing Attacks April 10, 2025 | Bernard Bautista and Kevin Adriano Ever thought an image file could be part of a cyber threat? The LevelBlue ... Read More
10. 1 MayProton66 Part 1: Mass Scanning and Exploit Campaigns April 14, 2025 | Pawel Knapczyk, Dawid Nesterowicz Trustwave SpiderLabs continuously tracks a range of malicious activities ... Read More

April 2025

1. 29 AprMaximizing Value: How Companies and Pentesters Can Achieve More Together April 15, 2025 | Elijah Seymour, Rohit Kapur, Stephen Komal, Mark Stanislav (Fullstory) A closer look at the collaborative efforts between Stroz Friedberg and ... Read More
2. 21 AprProton66 Part 2: Compromised WordPress Pages and Malware Campaigns April 17, 2025 | Pawel Knapczyk, Dawid Nesterowicz Earlier this year SpiderLabs observed an increase in mass scanning, credential ... Read More
3. 17 AprAgent In the Middle – Abusing Agent Cards in the Agent-2-Agent (A2A) Protocol To ‘Win’ All the Tasks April 21, 2025 | Tom Neaves I think you’ll agree with me that growth in the AI landscape is pretty full-on ... Read More
4. 15 AprYet Another NodeJS Backdoor (YaNB): A Modern Challenge April 29, 2025 | Reegun Jayapaul During an Advanced Continual Threat Hunt (ACTH) investigation conducted in ... Read More
5. 14 AprThreat Intelligence News from LevelBlue SpiderLabs May 2025 May 01, 2025 May 2025 Read More
6. 10 AprBring Your Own Installer: Bypassing EDR Through Agent Version Change Interruption May 05, 2025 | John Ailes and Tim Mashni Bring Your Own Installer is a technique which can be used by threat actors to ... Read More
7. 10 AprA Deep-Rooted Infestation: How the ILOVEYOU Bug Continues its Legacy in Modern Worms May 02, 2025 | Pauline Bolaños A quarter century ago, a former computer science student from the Philippines ... Read More
8. 8 AprLights Out and Stalled Factories: Using M.A.T.R.I.X to Learn About Modbus Vulnerabilities May 06, 2025 | Karl Biron Let’s explore the critical role of Modbus in energy and manufacturing systems, ... Read More
9. 1 AprStorm-0558 and the Dangers of Cross-Tenant Token Forgery May 21, 2025 | Damian Archer Modern cloud ecosystems often place a single identity provider in charge of ... Read More
10. 1 AprGuarding Against Dependency Attacks: Essential Strategies for Modern Application Development May 16, 2025 | Damian Archer Dependency management is one of the biggest challenges in modern software ... Read More

March 2025

1. 26 MarHospitality Under Attack: New Trustwave Report Highlights Cybersecurity Challenges in 2025 May 21, 2025 As the summer travel season approaches, travelers worldwide are busy booking ... Read More
2. 25 MarThe Blind Spots of Multi-Agent Systems: Why AI Collaboration Needs Caution May 23, 2025 | Muhammad Ahmad Multi-agent systems (MAS) are reshaping industries from IT services to ... Read More
3. 24 MarPhaaS the Secrets: The Hidden Ties Between Tycoon2FA and Dadsec's Operations May 28, 2025 | Cris Tomboc and King Orande Phishing-as-a-Service (PhaaS) platforms have significantly reshaped the ... Read More
4. 20 MarSecurely Adopting Digital Assets and Web3 May 28, 2025 | Lynn Burns Digital assets are an emerging technology, and cybersecurity risk management ... Read More
5. 19 MarThreat Intelligence News from LevelBlue SpiderLabs June 2025 June 01, 2025 June 2025 Read More
6. 12 MarThe Digital Front Line: Israel and Iran Turn the Internet into a Covert Combat Zone June 18, 2025 | Arthur Erzberger The Israel-Iran conflict is barely a week old, but the security repercussions ... Read More
7. 7 MarCVE-2024-11477: 7-Zip Flaw Allows Remote Code Execution November 27, 2024 | Pauline Bolaños On November 20th, 2024, Zero Day Initiative (ZDI) researchers disclosed a ... Read More
8. 6 MarRockstar 2FA Phishing-as-a-Service (PaaS): Noteworthy Email Campaigns November 27, 2024 | Diana Solomon and John Kevin Adriano Welcome to the second part of our investigation into the Rockstar kit, please ... Read More
9. 5 MarThreat Intelligence News from LevelBlue SpiderLabs December 2024 December 01, 2024 December 2024 Read More
10. 1 MarUnveiling the Dark Side: Common Attacks and Vulnerabilities in Industrial Control Systems December 04, 2024 | Zsolt Olah Introduction to Industrial Cybersecurity. Industrial control systems are ... Read More

February 2025

1. 26 FebEmerging Risks in Third-Party AI Solutions and How to Help Address Them December 04, 2024 | Scott Swanson and Kris Kimmerle As the cyber threat landscape changes due the introduction of new threat ... Read More
2. 25 FebWhen User Input Lines Are Blurred: Indirect Prompt Injection Attack Vulnerabilities in AI LLMs December 10, 2024 | Tom Neaves It was a cold and wet Thursday morning, sometime in early 2006. There I was ... Read More
3. 21 FebParsing Jenkins Configuration Files for Forensics and Fun December 12, 2024 | Julia Paluch A new parsing tool for Jenkins® configuration files from Stroz Friedberg ... Read More
4. 20 FebEmail Bombing: Why You Need to be Concerned December 18, 2024 | Phil Hay Over the last few months, the topic of email bombing has been brought to our ... Read More
5. 18 FebThreat Intelligence News from LevelBlue SpiderLabs January 2025 January 01, 2025 January 2025 Read More
6. 10 FebThe State of Magecart: A Persistent Threat to E-Commerce Security January 09, 2025 | Rodel Mendrez Trustwave SpiderLabs first blogged about Magecart back in 2019; fast forward ... Read More
7. 4 FebThe Database Slayer: Deep Dive and Simulation of the Xbash Malware January 14, 2025 | Karl Biron In the world of malware, common ransomware schemes aim to take the data within ... Read More
8. 1 FebCVE-2024-55591: Fortinet FortiOS/FortiProxy Zero Day January 14, 2025 In late November and December 2024, Arctic Wolf observed evidence of a mass ... Read More

January 2025

1. 27 JanThe New Face of Ransomware: Key Players and Emerging Tactics of 2024 January 21, 2025 | Serhii Melnyk As we step into 2025, the high-impact, financially motivated ransomware ... Read More
2. 22 JanLevelBlue SpiderLabs 2025 Risk Radar Report: Energy and Utilities Sector January 22, 2025 The energy sector plays a crucial role in national security by ensuring the ... Read More
3. 21 JanCracking the Giant: How ODAT Challenges Oracle, the King of Databases January 27, 2025 | Karl Biron In the past decade, Oracle Database (Oracle DB) has reigned supreme in the ... Read More
4. 14 JanBeyond the Chatbot: Meta Phishing with Fake Live Support February 04, 2025 | Mike Casayuran and John Kevin Adriano In a previous Trustwave SpiderLabs’ blog, we explored how cybercriminals ... Read More
5. 14 JanThreat Intelligence News from LevelBlue SpiderLabs February 2025 February 01, 2025 February 2025 Read More
6. 9 JanParsing ESXi Logs for Incident Response with QELP February 10, 2025 | Phalgun Kulkarni Threat actors frequently target ESXi servers to disrupt business environments ... Read More
7. 1 JanThe Rise of Email Marketing Platforms for Business Email Compromise Attacks February 18, 2025 | Maria Katrina Udquin In a statistical report published in September 2024 by the Federal Bureau of ... Read More

2024 116

December 2024

1. 18 DecThe Russia-Ukraine Cyber War Part 1: Three Years of Cyber Warfare February 20, 2025 | Pawel Knapczyk and Nikita Kazymirskyi As the third anniversary of the start of the Russia-Ukraine war approaches, ... Read More
2. 12 DecWe’re All in This Together: The Case for Purple Teaming February 21, 2025 | Aidan Barrington Why should you consider a purple team? What can you gain from it, and how do ... Read More
3. 10 DecThe Russia-Ukraine Cyber War Part 2: Attacks Against Government Entities, Defense Sector, and Human Targets February 25, 2025 | Pawel Knapczyk and Nikita Kazymirskyi In the first part of Trustwave SpiderLabs’ Russia-Ukraine war blog series, we ... Read More
4. 4 DecThreat Intelligence News from LevelBlue SpiderLabs March 2025 March 01, 2025 March 2025 Read More
5. 4 Dec2025 Trustwave Risk Radar Report: Top Cyber Threats Targeting the Manufacturing Sector February 26, 2025 2025 Trustwave Risk Radar Report Unveils Top Cyber Threats to Manufacturing: ... Read More
6. 1 DecThe Russia-Ukraine Cyber War Part 3: Attacks on Telecom and Critical Infrastructure March 05, 2025 | Pawel Knapczyk and Nikita Kazymirskyi This post is the third part of our blog series that tackles the Russia-Ukraine ... Read More

November 2024

1. 27 NovThe Russia-Ukraine Cyber War Part 4: Development in Group Attributions for Russian State Actors March 07, 2025 | Pawel Knapczyk and Nikita Kazymirskyi This is the final installment of Trustwave SpiderLabs Russia-Ukraine digital ... Read More
2. 27 NovA Deep Dive into Strela Stealer and how it Targets European Countries March 06, 2025 | Dawid Nesterowicz Infostealers have dominated the malware landscape due to the ease of threat ... Read More
3. 20 NovResurgence of a Fake Captcha Malware Campaign March 12, 2025 | Reegun Jayapaul During an Advanced Continual Threat Hunt (ACTH) investigation in early February ... Read More
4. 13 NovUnveiling "sedexp": A Stealthy Linux Malware Exploiting udev Rules August 19, 2024 | Zachary Reichert Stroz Friedberg identified a stealthy malware, dubbed “sedexp,” utilizing Linux ... Read More
5. 11 NovExposed and Encrypted: Inside a Mallox Ransomware Attack August 27, 2024 | Bernard Bautista Recently, a client enlisted the support of Trustwave to investigate an ... Read More
6. 11 NovThe Willy Wonka World of Application Security Defenses August 26, 2024 | David Broggy One doesn’t have to be a magician to understand how to track the hundreds, if ... Read More
7. 1 NovYour Money or Your Data: Ransomware Readiness Planning September 02, 2024 | David Broggy Today’s blog installment brings us to the end of our 30-week journey that ... Read More
8. 1 NovThreat Intelligence News from LevelBlue SpiderLabs September 2024 September 01, 2024 September 2024 Read More

October 2024

1. 29 OctHypervisor Development in Rust for Security Researchers (Part 1) September 06, 2024 In the ever-evolving field of information security, curiosity and continuous ... Read More
2. 21 OctDNSForge – Responding with Force September 09, 2024 | Apurva Goenka Introducing DNSForge, a novel attacker tactic for responding to name resolution ... Read More
3. 18 OctExploring an Experimental Windows Kernel Rootkit in Rust September 09, 2024 Around two years ago, memN0ps took the initiative to create one of the first ... Read More
4. 17 OctTrustwave SpiderLabs Research: 20% of Ransomware Attacks in Financial Services Target Banking Institutions September 10, 2024 The 2024 Trustwave Risk Radar Report: Financial Services Sector underscores the ... Read More
5. 8 OctDistributed Denial of Truth (DDoT): The Mechanics of Influence Operations and The Weaponization of Social Media September 13, 2024 | Jose Tozo With the US election on the horizon, it’s a good time to explore the concept of ... Read More
6. 1 OctBypassing EDR through Retrosigned Drivers and System Time Manipulation September 13, 2024 | Zachary Reichert The Retrosigned Driver EDR Bypass is a novel modification of a technique ... Read More

September 2024

1. 30 SepSpam With A Political Twist: Fraudsters Are Exploiting The Election Season September 17, 2024 | Katrina Udquin The US election is less than 70 days away and threat actors are busy crafting ... Read More
2. 26 SepWhy Do Criminals Love Phishing-as-a-Service Platforms? September 23, 2024 | Rodel Mendrez Phishing-as-a-Service (PaaS) platforms have become the go-to tool for ... Read More
3. 25 SepHTML Smuggling: How Blob URLs are Abused to Deliver Phishing Content September 24, 2024 | Mike Casayuran HTML smuggling techniques have been around for quite some time. A previous ... Read More
4. 24 SepShedding Light on Election Deepfakes September 25, 2024 | Pauline Bolaños Contrary to popular belief, deepfakes — AI-crafted audio files, images, or ... Read More
5. 23 SepWhat We Know So Far About Zero-Day CUPS Vulnerabilities: CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177 September 30, 2024 On September 26, 2024, security researcher Simone Margaritellidisclosed the ... Read More
6. 17 SepThreat Intelligence News from LevelBlue SpiderLabs October 2024 October 01, 2024 October 2024 Read More
7. 13 SepFeline Hackers Among Us? (A Deep Dive and Simulation of the Meow Attack) October 17, 2024 | Karl Biron Introduction In the perpetually evolving field of cybersecurity, new threats ... Read More
8. 13 SepPronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader October 08, 2024 | Cris Tomboc and King Orande Trustwave's Threat Intelligence team has discovered a new malware dubbed ... Read More
9. 10 SepHow Threat Actors Conduct Election Interference Operations: An Overview October 18, 2024 | Pauline Bolaños The major headlines that arose from the three most recent US presidential ... Read More
10. 9 Sep2024 Trustwave Risk Radar Report: Cyber Threats to the Retail Sector October 29, 2024 As the holiday shopping season approaches, the 2024 Trustwave Risk Radar ... Read More
11. 9 SepHooked by the Call: A Deep Dive into The Tricks Used in Callback Phishing Emails October 21, 2024 | Katrina Udquin Introduction Previously, Trustwave SpiderLabs covered a massive fake order spam ... Read More
12. 6 SepNgioweb Remains Active 7 Years Later November 01, 2024 | Fernando Martinez Executive Summary Seven years after its first appearance, the proxy server ... Read More
13. 2 SepThreat Intelligence News from LevelBlue SpiderLabs November 2024 November 01, 2024 November 2024 Read More
14. 1 SepOptimizing Your Cyber Resilience Strategy Through CISO and CRO Connectivity November 11, 2024 | Jenifer White Visek Combining forces between the Chief Information Security Officer and the Chief ... Read More

August 2024

1. 27 AugThe Mounted Guest EDR Bypass November 11, 2024 | Colin Meek The Mounted Guest EDR Bypass is a tactic used in cyber attacks to evade ... Read More
2. 26 AugLessons from a Honeypot with US Citizens’ Data November 13, 2024 | Radoslaw Zdonczyk and Nikita Kazymirskyi Prior to last week’s US Presidential Election, the Trustwave SpiderLabs team ... Read More
3. 19 AugRockstar 2FA: A Driving Force in Phishing-as-a-Service (PaaS) November 26, 2024 | Diana Solomon and John Kevin Adriano Trustwave SpiderLabs has been actively monitoring the rise of ... Read More
4. 19 AugSecure Access Service Edge: Another Multi-Tool for the SOC June 17, 2024 | David Broggy Over the years, several security defense architectures have merged into a ... Read More
5. 16 AugFare Thee Well ModSecurity: End-of-Life and Last Commercial Rules Update for June 2024 June 20, 2024 A Fourteen-Year Journey Comes to an End In June 2010, Trustwave acquired Breach ... Read More
6. 16 AugLevelBlue Labs Discovers Highly Evasive, New Loader Targeting Chinese Organizations June 19, 2024 | Fernando Dominguez Executive Summary LevelBlue Labs recently discovered a new highly evasive ... Read More
7. 15 AugScanning the Matrix: SIEM Best Practices June 24, 2024 | David Broggy (A thought from The Matrix: Neo likely used a SIEM before he took the red pill ... Read More
8. 12 AugAtlas Oil: The Consequences of a Ransomware Attack June 25, 2024 | Arthur Erzberger Overview Atlas Oil, a major player in the oil and fuel distribution industry, ... Read More
9. 6 AugProfessional Services Sector Under Attack - Trustwave SpiderLabs Report 2024 June 26, 2024 Recent research by Trustwave SpiderLabs, detailed in their newly published ... Read More
10. 5 AugClockwork Blue: Automating Security Defenses with SOAR and AI July 01, 2024 | David Broggy It’s impractical to operate security operations alone, using manual human ... Read More
11. 1 AugThreat Intelligence News from LevelBlue SpiderLabs July 2024 July 01, 2024 July 2024 Read More

July 2024

1. 31 JulThe Underdog of Cybersecurity: Uncovering Hidden Value in Threat Intelligence July 08, 2024 | David Broggy Threat Intelligence, or just TI, is sometimes criticized for possibly being ... Read More
2. 30 JulNetwork Isolation for DynamoDB with VPC Endpoint July 09, 2024 | Selam Gebreananeya DynamoDB is a fully managed NoSQL database service offered by Amazon Web ... Read More
3. 29 JulTips for Optimizing Your Security Operations Framework July 15, 2024 | David Broggy Building an effective Security Operations framework that provides the right ... Read More
4. 29 JulFacebook Malvertising Epidemic – Unraveling a Persistent Threat: SYS01 July 15, 2024 The Trustwave SpiderLabs Threat Intelligence team's ongoing study into how ... Read More
5. 22 JulUsing AWS Secrets Manager and Lambda Function to Store, Rotate and Secure Keys July 16, 2024 | Sally Gebreananeya When working with Amazon Web Services (AWS), we often find that various AWS ... Read More
6. 19 JulResponding to the CrowdStrike Outage: Implications for Cyber and Technology Professionals July 19, 2024 This client alert provides an overview of the current global IT outage that is ... Read More
7. 19 JulTrustwave Rapid Response: CrowdStrike Falcon Outage Update July 19, 2024 Trustwave is proactively assessing and monitoring our clients who may have been ... Read More
8. 16 JulCloudy with a Chance of Hackers: Protecting Critical Cloud Workloads July 22, 2024 | David Broggy If you've been following along with David's posts, you'll have noticed a ... Read More
9. 15 JulAdopt an AI Approach with Confidence, for CISOs and CIOs July 29, 2024 | Scott Swanson and Kris Kimmerle This article provides an AI adoption approach for technology leaders chartered ... Read More
10. 15 JulKnowing your Enemy: Situational Awareness in Cyber Defenses July 29, 2024 | David Broggy Most homeowners know that a lock is a good idea as a basic defense against ... Read More
11. 9 JulMultiple Cross-Site Scripting (XSS) Vulnerabilities in REDCap (CVE-2024-37394, CVE-2024-37395, and CVE-2024-37396) July 30, 2024 | Hamza Hussain Trustwave SpiderLabs uncovered multiple stored cross-site scripting (XSS) ... Read More
12. 8 JulSYS01 Infostealer and Rilide Malware Likely Developed by the Same Threat Actor July 31, 2024 Drawing on extensive proprietary research, Trustwave SpiderLabs believes the ... Read More
13. 1 JulSentinels of Ex Machina: Defending AI Architectures August 05, 2024 | David Broggy The introduction, adoption, and quick evolution of generative AI has raised ... Read More
14. 1 JulThreat Intelligence News from LevelBlue SpiderLabs August 2024 August 01, 2024 August 2024 Read More

June 2024

1. 26 JunHijacked: How Cybercriminals Are Turning Anti-Virus Software Against You August 06, 2024 | Fernando Dominguez Executive Summary LevelBlue Labs has identified a new evolution in the toolset ... Read More
2. 25 JunThe Art of Deception: Turning the Tables on Attackers with Active Defenses August 12, 2024 | David Broggy Once an attacker enters your network, one of their first actions will be to try ... Read More
3. 24 JunTrustwave Rapid Response: Mitigate Windows TCP/IP RCE Vulnerability (CVE-2024-38063) August 15, 2024 Microsoft has disclosed a critical (CVSS 9.8) TCP/IP remote code execution ... Read More
4. 20 JunCommand Injection and Path Traversal in StoneFly Storage Concentrator August 16, 2024 | David Glenn Baylon CVE-2024-30213, CVE-2024-31947: Blind Operating System Command Injection and ... Read More
5. 19 JunDeep Dive and Simulation of a MariaDB RCE Attack: CVE-2021-27928 August 16, 2024 | Karl Biron In early 2021, a new vulnerability, identified as CVE-2021-27928, was ... Read More
6. 17 JunThe Bug Stops Here: Using DevSecOps Workflows for Pest-Free Applications August 19, 2024 | David Broggy Developers and cybersecurity have an interesting relationship. Developers have ... Read More
7. 10 JunCost Management Tips for Cyber Admins March 11, 2024 | David Broggy As anyone who has filled out an expense report can tell you, cost management is ... Read More
8. 5 JunUkrainian Intelligence Claims Successful Compromise of the Russian Ministry of Defense March 12, 2024 | Arthur Erzberger On March 4, 2024, the Telegram channel of the Main Directorate of Intelligence ... Read More
9. 4 JunCybersecurity Documentation Essentials March 18, 2024 | David Broggy This is Part 3 in my ongoing project to cover 30 cybersecurity topics in 30 ... Read More
10. 3 JunTrustwave SpiderLabs: Artificial Intelligence Playing a Prime Role in BEC and Phishing Attacks March 20, 2024 Criminals have historically been quick to embrace cutting-edge technology for ... Read More

May 2024

1. 20 MayEvaluating Your Security Posture: Security Assessment Basics March 25, 2024 | David Broggy This is Part 4 in my ongoing project to cover 30 cybersecurity topics in 30 ... Read More
2. 20 MayThe Inevitable Threat: AI-Generated Email Attacks Delivered to Mailboxes March 19, 2024 | Katrina Udquin Generative AI exploded in popularity not too long ago but its influence on text ... Read More
3. 14 MayAgent Tesla's New Ride: The Rise of a Novel Loader March 25, 2024 | Bernard Bautista Malware loaders, critical for deploying malware, enable threat actors to ... Read More
4. 13 MayWhy We Should Probably Stop Visually Verifying Checksums March 27, 2024 | Tom Neaves Hello there! Thanks for stopping by. Let me get straight into it and start ... Read More
5. 6 MayZero Trust Essentials April 01, 2024 | David Broggy This is Part 5 in my ongoing project to cover 30 cybersecurity topics in 30 ... Read More

April 2024

1. 29 AprPhishing Deception - Suspended Domains Reveal Malicious Payload for Latin American Region April 05, 2024 | Karla Agregado Recently, we observed a phishing campaign targeting the Latin American region. ... Read More
2. 22 AprCVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway April 12, 2024 UPDATE: Palo Alto Networks confirmed on Tuesday (4/16) that disabling device ... Read More
3. 22 AprCNAPP, CSPM, CIEM, CWPP – Oh My! April 08, 2024 | David Broggy We all know the cybersecurity industry loves its acronyms, but just because ... Read More
4. 17 AprThe Secret Cipher: Modern Data Loss Prevention Solutions April 15, 2024 | David Broggy This is Part 7 in my ongoing project to cover 30 cybersecurity topics in 30 ... Read More
5. 16 AprCracking Into Password Requirements April 16, 2024 | Ethan Wilkins This blog post discusses new hashcat rule sets designed to crack passwords with ... Read More
6. 15 AprFake Dialog Boxes to Make Malware More Convincing April 17, 2024 | Ram Prakash Let’s explore how SpiderLabs created and incorporated user prompts, ... Read More
7. 12 AprEDR – The Multi-Tool of Security Defenses April 22, 2024 | David Broggy This is Part 8 in my ongoing project to cover 30 cybersecurity topics in 30 ... Read More
8. 8 AprThe Invisible Battleground: Essentials of EASM April 22, 2024 | David Broggy Know your enemy – inside and out. External Attack Surface Management tools are ... Read More
9. 5 AprProtecting Zion: InfoSec Encryption Concepts and Tips April 29, 2024 | David Broggy This is Part 9 in my ongoing project to cover 30 cybersecurity topics in 30 ... Read More
10. 1 AprGuardians of the Gateway: Identity and Access Management Best Practices May 06, 2024 | David Broggy This is Part 10 in my ongoing project to cover 30 cybersecurity topics in 30 ... Read More

March 2024

1. 27 MarHow to Create the Asset Inventory You Probably Don't Have May 13, 2024 | David Broggy This is Part 12 in my ongoing project to cover 30 cybersecurity topics in 30 ... Read More
2. 25 MarImportant Security Defenses to Help Your CISO Sleep at Night May 20, 2024 | David Broggy This is Part 13 in my ongoing project to cover 30 cybersecurity topics in 30 ... Read More
3. 25 Mar2024 Public Sector Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies May 14, 2024 Trustwave SpiderLabs’ 2024 Public Sector Threat Landscape: Trustwave Threat ... Read More
4. 20 MarCyber Exterminators: Monitoring the Shop Floor with OT Security June 03, 2024 | David Broggy Pressure is increasing on manufacturers to monitor their shop floors for ... Read More
5. 19 MarThreat Advisory: Snowflake Data Breach Impacts Its Clients June 04, 2024 Executive Summary On May 20, 2024, Live Nation discovered and disclosed an ... Read More
6. 18 MarFake Advanced IP Scanner Installer Delivers Dangerous CobaltStrike Backdoor June 05, 2024 | Rodel Mendrez During a recent client investigation, Trustwave SpiderLabs found a malicious ... Read More
7. 12 MarThe Sentinel’s Watch: Building a Security Reporting Framework June 10, 2024 | David Broggy Imagine being on shift as the guard of a fortress. Your job is to identify ... Read More
8. 11 MarDUALITY Part II - Initial Access and Tradecraft Improvements June 14, 2024 | Faisal Tameesh This blog post discusses tradecraft improvements and how the same pipeline can ... Read More
9. 6 MarBehind the scenes: JaskaGO's coordinated strike on macOS and Windows December 18, 2023 | Ofer Caspi Executive summary In recent developments, a sophisticated malware stealer ... Read More
10. 4 MarSearch & Spoof: Abuse of Windows Search to Redirect to Malware June 11, 2024 | Bernard Bautista LevelBlue SpiderLabs has detected a sophisticated malware campaign that ... Read More
11. 4 MarInstagram Phishing Targets Backup Codes December 20, 2023 | Diana Solomon Recently, we noticed another strain of Instagram “Copyright Infringement” ... Read More
12. 1 MarSurfing the Tidal Waves of HR-Themed Spam Emails December 21, 2023 | Katrina Udquin Threat actors constantly improve their tactics and are always on the hunt for ... Read More

February 2024

1. 26 FebHunting for Android Privilege Escalation with a 32 Line Fuzzer December 22, 2023 | Maksymilian Motyl LevelBlue SpiderLabs tested a couple of Android OS-based mobile devices to ... Read More
2. 22 FebTop 10 SpiderLabs Blog Posts of 2023 December 27, 2023 The Top 10 Trustwave SpiderLabs’ blogs in 2023 reflected the cybersecurity ... Read More
3. 20 FebFueling Chaos: Hacker Group Grinds 70% of Iran's Gasoline System to a Halt January 02, 2024 | Arthur Erzberger The Iranian government has made the claim that a cyber threat group, identified ... Read More
4. 12 FebAsyncRAT loader: Obfuscation, DGAs, decoys and Govno January 05, 2024 | Fernando Martinez Executive summary LevlBlue Labs has identified a campaign to deliver AsyncRAT ... Read More
5. 6 FebCVE-2023-50916: Authentication Coercion Vulnerability in Kyocera Device Manager January 08, 2024 | Jordan Hedges Overview of Authentication Coercion Vulnerability Read More
6. 5 FebTrustwave Transfers ModSecurity Custodianship to the Open Worldwide Application Security Project (OWASP) January 09, 2024 After serving as its steward for over a decade, Trustwave has agreed to ... Read More
7. 1 Feb(Response) Splitting Up Reverse Proxies To Reach Internal Only Paths January 11, 2024 | Tom Neaves When I’m carrying out security research into a thing, I generally don’t like to ... Read More

January 2024

1. 29 JanTypes of Social Engineering Attacks used to Gain Internal Network Access January 16, 2024 | Zak Willsallen Social engineering is a technique commonly used by adversaries to manipulate ... Read More
2. 26 JanBeyond the Facade: Unraveling URL Redirection in Google Services January 17, 2024 | Mike Casayuran In the murky waters of cyber threats, one tactic has steadily gained wide ... Read More
3. 25 JanRemote Desktop Event Log Analysis: Variations In Logging For Event ID 1029 January 22, 2024 | Sergey Gorbov This blog covers Stroz Friedberg’s novel research and analysis of Remote ... Read More
4. 25 JanApache ActiveMQ Vulnerability Leads to Stealthy Godzilla Webshell January 18, 2024 | Rodel Mendrez Trustwave has observed a surge in attacks exploiting vulnerabilities in Apache ... Read More
5. 22 JanThe dark side of 2023 Cybersecurity: Malware evolution and Cyber threats January 25, 2024 | Fernando Martinez In the ever-evolving cybersecurity landscape, 2023 witnessed a dramatic surge ... Read More
6. 18 JanTrustwave SpiderLabs Detects Spike in Greatness Phishing Kit Attacks on Microsoft 365 Users January 25, 2024 | Bernard Bautista Trustwave SpiderLabs is tracking a spike in usage of the Greatness phishing kit ... Read More
7. 17 JanSpoofing 802.11 Wireless Beacon Management Frames with Manipulated Power Values Resulting in Denial of Service for Wireless Clients January 26, 2024 | Tom Neaves This is another one of those blog posts from me about how I independently ... Read More
8. 16 JanTrusted Domain, Hidden Danger: Deceptive URL Redirections in Email Phishing Attacks January 29, 2024 | Kevin Adriano In this ever-evolving landscape of cyberthreats, email has become a prime ... Read More
9. 11 JanTrustwave SpiderLabs Guide: Jailbreaking Apple iOS 17 and Above February 01, 2024 | Therese Mendoza PLEASE NOTE: Jailbreaking any phone has the potential to permanently damage ... Read More
10. 9 JanDissection Of Makop Ransomware Group February 05, 2024 | Aishwarya Desai This blog post outlines attack patterns identified across Makop ransomware ... Read More
11. 8 JanTrustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising February 06, 2024 During an Advanced Continual Threat Hunt (ACTH) investigation that took place ... Read More
12. 5 JanDUALITY: Advanced Red Team Persistence Through Self-Reinfecting DLL Backdoors for Unyielding Control February 12, 2024 | Faisal Tameesh This blog post introduces the concept of DUALITY, which is a methodology and ... Read More
13. 2 JanBreakdown of Tycoon Phishing-as-a-Service System February 20, 2024 | Rodel Mendrez Just weeks after Trustwave SpiderLabs reported on the Greatness ... Read More

2023 83

December 2023

1. 27 DecTrustwave SpiderLabs: Insights and Solutions to Defend Educational Institutions Against Cyber Threats February 22, 2024 Security teams responsible for defending educational institutions at higher ... Read More
2. 22 DecWelcome to Adventures in Cybersecurity: The Defender Series February 26, 2024 | David Broggy I’m happy to say I’m done chasing Microsoft certifications (AZ104/AZ500/SC100), ... Read More
3. 21 DecHunting For Integer Overflows In Web Servers March 01, 2024 | Tom Neaves Allow me to set the scene and start proceedings off with a definition of an ... Read More
4. 20 DecCloud Architecture, Frameworks and Benchmarks March 04, 2024 | David Broggy At any point in your cloud security journey, you should consider practical ... Read More
5. 18 DecResurgence of BlackCat Ransomware March 06, 2024 | Reegun Jayapaul Updated March 8: Based on our experience, we believe that BlackCat's claim of ... Read More
6. 6 DecProxyNation: The dark nexus between proxy apps and malware August 16, 2023 | Ofer Caspi Executive summary LevelBlue Labs researchers recently discovered a massive ... Read More
7. 5 DecBEC Trends: Payroll Diversion Dominates and Sneaky Multi-Persona Attacks Emerge August 24, 2023 | Maria Katrina Udquin Business Email Compromise (BEC) remains a lucrative threat vector for ... Read More

November 2023

1. 15 NovThe Evolution of Persistent Threats: From Chernobyl to BlackLotus August 30, 2023 | Jose Tozo In this blog post, we will explore how the computer security landscape has ... Read More
2. 15 NovThink Before You Scan: The Rise of QR Codes in Phishing August 29, 2023 | Mike Casayuran QR Codes, the square images that contain coded information that can be scanned ... Read More
3. 9 NovThreat-Loaded: Malicious PDFs Never Go Out of Style August 31, 2023 | Bernard Bautista Introduction In the realm of cybersecurity, danger hides where we least expect ... Read More
4. 7 NovA Bucket of Phish: Attackers Shift Tactics with Cloudflare R2 Public Buckets September 06, 2023 | Karla Agregado In our previous blog, we found a lot of phishing and scam URLs abusing ... Read More

October 2023

1. 17 OctLevelBlue SpiderLabs Releases Actionable Cybersecurity Intelligence for the Hospitality Industry September 07, 2023 The LevelBlue SpiderLabs team conducted a multi-month investigation into the ... Read More
2. 14 OctThe Evolution of Phishing Campaigns September 11, 2023 | Rachel Kang In 2022, phishing was responsible for more than half of the incidents ... Read More
3. 13 OctFinancially Motivated Criminal Group Targets Telecom, Technology & Manufacturing September 20, 2023 | Stroz Friedberg DFIR This client advisory provides an overview of techniques and tactics attributed ... Read More
4. 13 OctStealthy VBA Macro Embedded in PDF-like Header Helps Evade Detection September 20, 2023 | Rodel Mendrez In the ever-evolving landscape of malware threats, threat actors are ... Read More
5. 13 OctTo OSINT and Beyond! September 13, 2023 | Medz Barao Open-Source Intelligence (OSINT) can be valuable for an organization and ... Read More
6. 11 OctMultiple Command and Control (C2) Frameworks During Red Team Engagements September 21, 2023 | Philip Pieterse When conducting Red Team engagements, more than one Command and Control (C2) ... Read More
7. 10 OctAmazon (AWS) S3 Bucket Take Over September 27, 2023 | Medz Barao Let’s try something a bit different and take a look at some of Trustwave ... Read More
8. 7 OctBehind the Invite: The Rise of Google Group Fake Order Fraud Emails August 25, 2023 | Maria Katrina Udquin and John Kevin Adriano As the world shifted into remote work and distant learning during the pandemic ... Read More

September 2023

1. 27 SepPatch Tuesday, October 2023 October 10, 2023 | Jeannette Dickens Hale Halloween is arriving and with it, Trustwave’s return to Patch Tuesday reports. Read More
2. 21 Sep2023 Financial Services Sector Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies October 11, 2023 Cyberattacks striking the financial services industry are more prevalent, ... Read More
3. 20 SepHTTP/2 Rapid Reset October 13, 2023 | Medz Barao A recent vulnerability tracked as Rapid Reset (CVE-2023-44487) in the HTTP/2 ... Read More
4. 20 SepUnveiling the CAPTCHA Escape: The Dance of CAPTCHA Evasion Using TOR October 13, 2023 | Medz Barao In this era, threat actors have proven to be tireless in their pursuit of ... Read More
5. 13 SepFlash Loan Attacks: A Case Study October 13, 2023 | Eric Rafaloff This blog post explains how flash loans work, their history, and their role in ... Read More
6. 11 SepA SIMple Attack: A Look into Recent SIM Swap Attack Trends October 14, 2023 | Natasha Vij and Victoria Nyktas Stroz Friedberg has observed an uptick in SIM swapping across multiple ... Read More
7. 7 SepHidden Data Exfiltration Using Time, Literally October 17, 2023 | Tom Neaves I was looking at my watch last week and my attention was moved towards the ... Read More
8. 6 SepPwning Electroencephalogram (EEG) Medical Devices by Default November 07, 2023 | John Jackson Overall Analysis of Vulnerability Identification – Default Credentials Leading ... Read More

August 2023

1. 31 AugDetecting “Effluence”, An Unauthenticated Confluence Web Shell November 09, 2023 | Zachary Reichert Discovering Effluence, a unique web shell accessible on every page of an ... Read More
2. 30 AugThe 2023 Retail Services Sector Threat Landscape: A Trustwave Threat Intelligence Briefing November 15, 2023 The annual holiday shopping season is poised for a surge in spending, a fact ... Read More
3. 29 AugRestricted Admin Mode – Circumventing MFA On RDP Logons November 15, 2023 | Apurva Goenka This blog post demonstrates the use of Restricted Admin mode to circumvent MFA ... Read More
4. 25 AugOverview of the Cyberwarfare used in Israel – Hamas War December 05, 2023 | SpiderLabs Researcher On October 7, 2023, the Palestinian organization Hamas launched the biggest ... Read More
5. 24 AugTrustwave SpiderLabs Report: LockBit 3.0 Ransomware Vs. the Manufacturing Sector December 06, 2023 As the manufacturing sector continues its digital transformation, Operational ... Read More
6. 16 AugHoneypot Recon: MySQL Malware Infection via User-Defined Functions (UDF) December 14, 2023 | Radek Zdonczyk In the vast world of cybersecurity, as technologies evolve, so do the methods ... Read More
7. 8 AugRendezvous with a Chatbot: Chaining Contextual Risk Vulnerabilities May 11, 2023 | Abeer Banerjee Ignoring the little stuff is never a good idea. Anyone who has pretended that ... Read More
8. 3 AugAbusing Time-Of-Check Time-Of-Use (TOCTOU) Race Condition Vulnerabilities in Games, Harry Potter Style May 16, 2023 | Tom Neaves I feel I need to clarify, for legal reasons, that this is nothing to do with ... Read More
9. 2 AugWhen User Impersonation Features In Applications Go Bad May 18, 2023 | Tom Neaves A user impersonation feature typically allows a privileged user, such as an ... Read More

July 2023

1. 30 JulFrom Response To Request, Adding Your Own Variables Inside Of GraphQL Queries For Account Take Over May 23, 2023 | Tom Neaves For those wondering what GraphQL is… Read More
2. 27 JulMicrosoft Encrypted Restricted Permission Messages Deliver Phishing May 24, 2023 | Phil Hay, Rodel Mendrez Over the past few days, we have seen phishing attacks that use a combination of ... Read More
3. 25 JulAnalyzing the NTC Vulkan Leak: What it Says About Russia's Cyber Capabilities May 25, 2023 | Arthur Erzberger Information disclosed in the leaked NTC Vulkan papers allows us to investigate ... Read More
4. 20 JulSeroXen RAT for sale May 30, 2023 | Fernando Martinez This blog was jointly written with Alejandro Prada and Ofer Caspi. Read More
5. 13 JulHunting For Password Reset Tokens By Spraying And Using HTTP Pipelining May 30, 2023 | Tom Neaves As is tradition with my blog posts, let’s start off a definition of what HTTP ... Read More
6. 11 JulTrustwave Action Response: Zero Day Exploitation of MOVEit (CVE-2023-34362) June 02, 2023 | Karl Sigler Update - June 16, 2023: The second vulnerability mentioned in the June 12 ... Read More
7. 5 JulFrom Admin to AdminPlusPlus: Breaking Out of Sandboxed Applications Through Recon, Being Brave and Abusing SSO Domain Account Mappings June 08, 2023 | Tom Neaves I've been pentesting applications for nearly two decades now and throughout ... Read More

June 2023

1. 27 JunTrustwave Action Response: Zero Day Vulnerability in Barracuda Email Security Gateway Appliance (ESG) (CVE-2023-2868) June 09, 2023 | SpiderLabs Researcher On May 19, 2023, Barracuda Networks identified a remote command injection ... Read More
2. 20 JunHoneypot Recon: Global Database Threat Landscape June 13, 2023 | Radoslaw Zdonczyk In today's digital era, the importance of securing databases cannot be ... Read More
3. 16 JunNew Burp Suite Extension: BlazorTrafficProcessor July 20, 2023 | Will Rabb Pentesting web applications that use Blazor server comes with unique ... Read More
4. 15 JunBrute-forcing ButterflyMX Virtual Keys and Hacking Time Limits June 15, 2023 | Robert Foggia Recently, I discovered two vulnerabilities in the ButterflyMX system which were ... Read More
5. 15 JunKillNet, Anonymous Sudan, and REvil Unveil Plans for Attacks on US and European Banking Systems June 15, 2023 | SpiderLabs Researcher In a recent development, Russian hackers have declared their intention to ... Read More
6. 13 JunHoneypot Recon: MSSQL Server – Database Threat Overview '22/'23 June 20, 2023 | Radoslaw Zdonczyk, Mariusz Siedlecki Introduction In a constantly connected world, protecting sensitive data in what ... Read More
7. 9 JunSNAPPY: Detecting Rogue and Fake 802.11 Wireless Access Points Through Fingerprinting Beacon Management Frames June 27, 2023 | Tom Neaves Read More
8. 8 JunIt’s Raining Phish and Scams – How Cloudflare Pages.dev and Workers.dev Domains Get Abused July 11, 2023 | Karla Agregado As they say, when it rains, it pours. Recently, we observed more than 3,000 ... Read More
9. 2 JunCybersecurity in the Healthcare Industry: Trustwave SpiderLabs Report July 13, 2023 | SpiderLabs Researcher In their latest report titled "Cybersecurity in the Healthcare Industry: ... Read More

May 2023

1. 30 MayHealthcare Threat Landscape 2022-2023: Common TTPs Used by Top Ransomware Groups Targeting the Healthcare Sector July 27, 2023 | Serhii Melnyk , Greg Monson The healthcare sector has been under constant threat from cybercriminals due to ... Read More
2. 30 MayModSecurity v3: DoS Vulnerability in Four Transformations (CVE-2023-38285) July 25, 2023 | SpiderLabs Researcher ModSecurity is an open-source Web Application Firewall (WAF) engine maintained ... Read More
3. 25 MayHoneypot Recon: New Variant of SkidMap Targeting Redis July 30, 2023 | Radoslaw Zdonczyk Intro Since Redis is becoming increasingly popular around the world, we decided ... Read More
4. 24 MayDarkGate Keylogger Analysis: masterofnone August 02, 2023 | Zachary Reichert Aon’s Stroz Friedberg Incident Response Services encountered a group utilizing ... Read More
5. 23 MayNew Rilide Stealer Version Targets Banking Data and Works Around Google Chrome Manifest V3 August 03, 2023 | Pawel Knapczyk, Wojciech Cieslak LevelBlue SpiderLabs discovered a new version of the Rilide Stealer extension ... Read More
6. 19 MayHoneypot Recon: Enterprise Applications Honeypot - Unveiling Findings from Six Worldwide Locations July 05, 2023 | Pawel Knapczyk, Wojciech Cieslak To obtain a better perspective of attacks worldwide, LevelBlue has implemented ... Read More
7. 18 MayWormGPT and FraudGPT – The Rise of Malicious LLMs August 08, 2023 | Arthur Erzberger As technology continues to evolve, there is a growing concern about the ... Read More
8. 16 MayGootloader: Why your Legal Document Search May End in Misery August 10, 2023 | Rodel Mendrez Introduction Recently, we’ve seen a noticeable surge in malware cases linked to ... Read More
9. 11 MayMac systems turned into proxy exit nodes by AdLoad August 10, 2023 | Fernando Martinez AdLoad malware is still infecting Mac systems years after its first appearance ... Read More

April 2023

1. 26 AprTrustwave Action Response: Zero-Day Vulnerability in Citrix ADC (CVE-2022-27518) December 15, 2022 | SpiderLabs Researcher On Tuesday, December 13, a joint announcement from the United States NSA and ... Read More
2. 19 AprMeta-Phish: Facebook Infrastructure Used in Phishing Attack Chain December 15, 2022 | Karla Agregado, Michael Casayuran Meta has two of the largest social media platforms today, Facebook and ... Read More
3. 13 AprSCL -1: The Dangerous Side of Safe Senders December 16, 2022 | Julia Paluch and John Ailes Stroz Friedberg has observed threat actors leveraging Safe Senders, a feature ... Read More
4. 4 AprMalicious Macros Adapt to Use Microsoft Publisher to Push Ekipa RAT December 21, 2022 | Wojciech Cieslak After Microsoft announced this year that macros from the Internet will be ... Read More
5. 4 AprChatGPT: Emerging AI Threat Landscape December 20, 2022 | Damian Archer ChatGPT has been available to the public since November 30, 2022. Since then, ... Read More

March 2023

1. 31 Mar2022 Year in Review: Ransomware January 05, 2023 | Greg Monson With 2022 having just ended, let's take a look back at the year in ransomware. ... Read More
2. 30 MarCVE-2022-43704 - Capture-Replay Vulnerability in Sinilink XY-WFT1 Thermostat January 12, 2023 | Victor Hanna Trustwave SpiderLabs has found a vulnerability in the Sinilink XY-WFT1 Remote ... Read More
3. 29 MarSliver C2 Leveraged by Many Threat Actors January 19, 2023 | Cybereason Global SOC and Incident Response Team What you need to know about this attack framework before it replaces Cobalt ... Read More
4. 23 MarAgentVX and Taurus February 03, 2023 | Zachary Reichert In 2021, Stroz Friedberg Incident Response Services team (Stroz Friedberg) ... Read More
5. 23 MarVulnerability Causing Deletion of All Users in CrushFTP Admin Area February 02, 2023 | Jean Calvin Mugabo During a recent penetration test, Trustwave SpiderLabs researchers discovered a ... Read More
6. 9 MarMoney Lover App Vulnerability Exposes Personal Info February 07, 2023 | Troy Driver An information disclosure vulnerability has been identified in Money Lover, a ... Read More
7. 8 MarBypassing MFA: A Forensic Look at Evilginx2 Phishing Kit February 10, 2023 | Carly Battaile Recently, Stroz Friedberg Incident Response Services encountered an increase in ... Read More
8. 8 MarHTML Smuggling: The Hidden Threat in Your Inbox February 09, 2023 | Bernard Bautista, Diana Lopera Last October, LevelBlue SpiderLabs blogged about the use and prevalence of HTML ... Read More

February 2023

1. 16 FebNetwork Map NMAP Meets ChatGPT February 16, 2023 | Dhervesh Singh We’ve now seen a number of different use cases for ChatGPT from marketing, ... Read More
2. 10 FebA Noteworthy Threat: How Cybercriminals are Abusing OneNote – Part 2 March 08, 2023 | Bernard Bautista In part one, we examined how threat actors abuse a OneNote document to install ... Read More
3. 9 FebA Noteworthy Threat: How Cybercriminals are Abusing OneNote – Part 1 March 08, 2023 | Bernard Bautista Introduction Threat actors are taking advantage of Microsoft OneNote's ability ... Read More
4. 7 FebOneNote Spear-Phishing Campaign March 09, 2023 | Reegun Jayapaul Trustwave SpiderLabs “noted” in Part 1 and Part 2 of our OneNote research that ... Read More
5. 3 FebBlackGuard stealer extends its capabilities in new variant March 23, 2023 | Ofer Caspi LevelBlue Labs researchers have discovered a new variant of BlackGuard stealer ... Read More
6. 2 FebChatGPT: The Right Tool for the Job? March 23, 2023 | Dustin Dugal Jose Tozo Since it was first released to the public late last year, ChatGPT has ... Read More

January 2023

1. 19 Jan2023 Tax Scam Emails Exposed: Unmasking Deceptive Trends March 29, 2023 Tax season is a busy time of year for taxpayers and threat actors. Consumers ... Read More
2. 12 JanAnonymous Sudan: Religious Hacktivists or Russian Front Group? March 30, 2023 | SpiderLabs Researcher The Trustwave SpiderLabs research team has been tracking a new threat group ... Read More
3. 5 JanTrustwave Action Response: Supply Chain Attack Using 3CX PABX Software March 31, 2023 | Karl Sigler Overview On March 29, a massive supply chain compromise in 3CX software ... Read More

2022 74

December 2022

1. 21 DecRilide: A New Malicious Browser Extension for Stealing Cryptocurrencies April 04, 2023 | Pawel Knapczyk, Wojciech Cieslak Trustwave SpiderLabs uncovered a new strain of malware that it dubbed Rilide, ... Read More
2. 20 DecDeobfuscating the Recent Emotet Epoch 4 Macro April 04, 2023 | Rodel Mendrez, Joshua Deacon In early March, one of the notorious botnets, Emotet, resumed its spamming ... Read More
3. 16 DecDissecting Buffer Overflow Attacks in MongoDB April 19, 2023 | Bilal Siddiqui Towards the end of 2020, a new vulnerability in MongoDB was found and ... Read More
4. 15 DecWhy It’s Important to Change Default Credentials May 03, 2023 | Dhervesh Singh Security best practice guidelines always call for changing default passwords as ... Read More
5. 15 DecWindows Search Index: The Forensic Artifact You’ve Been Searching For April 26, 2023 | Phalgun Kulkarni and Julia Paluch The Windows Search index is a useful artifact for Incident Response ... Read More
6. 8 DecDecade Retrospective: The State of Vulnerabilities July 18, 2022 | Shrijin Srinivasan Alex Rothacker Decade Retrospective: The State of Vulnerabilities The Spanish philosopher ... Read More
7. 7 DecWant To Become A Red Teamer? This Is What You Need To Know July 25, 2022 | Idan Ron Everyone loves buzz words, no? Red team is the newest (well... not that new) ... Read More
8. 1 DecThe Price Cybercriminals Charge for Stolen Data August 03, 2022 | Trustwave SpiderLabs For the price of a Starbuck’s Caramel Frappuccino Grande and a cheese Danish, ... Read More
9. 1 DecIPFS: The New Hotbed of Phishing July 28, 2022 | Karla Agregado, Katrina Udquin A few months ago, we reported on an interesting site called the Chameleon ... Read More

November 2022

1. 30 NovCVE-2023-29383: Abusing Linux chfn to Misrepresent /etc/passwd April 13, 2023 | Tom Neaves A little bit of background for those not familiar with chfn… Read More
2. 23 NovRundll32: The Infamous Proxy for Executing Malicious Code August 09, 2022 | Cybereason Blue Team Today, we are going to dwell on a Microsoft tool, the infamous rundll32.exe, ... Read More
3. 22 NovOverview of the Cyber Weapons Used in the Ukraine - Russia War August 18, 2022 | Pawel Knapczyk Observing the ongoing conflict between Russia and Ukraine, we can clearly see ... Read More
4. 18 NovOracle SBC: Multiple Security Vulnerabilities Leading to Unauthorized Access and Denial of Service August 23, 2022 | Harold Zang Oracle Communications Session Border Controller (SBC) is one of the most ... Read More
5. 10 Nov2022 Trustwave SpiderLabs Telemetry Report August 24, 2022 | Jason Villaluna As organizations go about their regular routine of finding and adding new ... Read More
6. 4 NovCrypto miners’ latest techniques August 29, 2022 | Fernando Martinez Executive summary Crypto miners are determined in their objective of mining in ... Read More

October 2022

1. 27 OctShikitega - New stealthy malware targeting Linux September 06, 2022 | Ofer Caspi Executive summary LevelBlue Labs has discovered a new malware targeting ... Read More
2. 20 OctRetaliation by the Pro-Russian Group KillNet September 14, 2022 | SpiderLabs Researcher At the beginning of the Russia-Ukraine conflict, KillNet - a Russian cybergang ... Read More
3. 13 OctCVE-2022-37461: Two Reflected XSS Vulnerabilities in Canon Medical’s Vitrea View September 29, 2022 | Jordan Hedges, Avery Warddhana Overview During a penetration test, Trustwave Spiderlabs’ researchers, Jordan ... Read More
4. 6 OctPost-Exploitation Persistent Email Forwarder in Outlook Desktop October 05, 2022 | Abi Waddell There is an exploitation method that can automatically forward emails CC’d to ... Read More
5. 6 OctTrustwave Action Response: Zero Day Vulnerabilities in Microsoft Exchange Server 2013, 2016, and 2019 October 02, 2022 | SpiderLabs Researcher Update Oct. 4: Microsoft released Security Update Guides for these two ... Read More
6. 5 OctHTML File Attachments: Still A Threat October 06, 2022 | Rodel Mendrez Introduction This past month, Trustwave SpiderLabs observed that HTML ... Read More
7. 2 OctAmazon Web Services: Exploring the Cost of Exfil October 06, 2022 | Andre Maccarone and John Ailes Using a free and easily accessible tool for Amazon Web Services ("AWS"), ... Read More

September 2022

1. 29 SepModSecurity Request Body Parsing: Recent Bypass Issues October 13, 2022 | Trustwave SpiderLabs Overview ModSecurity is an open-source web application firewall (WAF) engine ... Read More
2. 14 SepArchive Sidestepping Self-Unlocking Password-Protected RAR October 20, 2022 | Bernard Bautista, Diana Lopera Trustwave SpiderLabs’ spam traps have identified an increase in threats ... Read More
3. 6 SepInsta-Phish-A-Gram October 27, 2022 | Homer Pacag Following Trustwave SpiderLabs’ blog on social media-themed phishing on ... Read More

August 2022

1. 29 AugDenial of Service and RCE in OpenSSL 3.0 (CVE-2022-3786 and CVE-2022-3602) November 04, 2022 | Karl Sigler Overview On November 1 the OpenSSL Project released patches addressing the ... Read More
2. 24 AugDevelopment of the Ukrainian Cyber Counter-Offensive November 10, 2022 | SpiderLabs Researcher Overview Russia’s military incursion against Ukraine began on February 24, ... Read More
3. 23 AugAutomating RDS Security Via Boto3 (AWS API) November 18, 2022 | Selam Gebreananeya When it comes to security in AWS, there is the shared responsibility model for ... Read More
4. 18 AugEvolution of the SOC – From the Dark Ages to Enlightenment, shifting to an agile threat informed cyber defense program November 22, 2022 | Kory Daniels Evolution of the SOC – From the Dark Ages to Enlightenment, shifting to an ... Read More
5. 9 AugKillnet Claims Attacks Against Starlink, Whitehouse.gov, and United Kingdom Websites November 23, 2022 | SpiderLabs Researcher Pro-Russian threat actor group Killnet claims to have launched DDoS attacks ... Read More
6. 3 Aug‘Tis the Season for Online Shopping and Phishing Scams December 01, 2022 | SpiderLabs Researcher The 2022 holiday shopping season is here. Retailers’ discounts are kicking off ... Read More

July 2022

1. 28 JulBypassing 2FA Authentication with Evilginx2 December 01, 2022 | Shrijin Srinivasan Due to the increasing number of cyberattacks, particularly zero days, ... Read More
2. 25 JulGoing Mobile: BEC Attacks Are Moving Beyond Email December 07, 2022 | Maria Katrina Udquin Recently, we’ve noticed an increase in user reports of SMS-based Business Email ... Read More
3. 18 JulTrojanized OneNote Document Leads to Formbook Malware December 08, 2022 | Rodel Mendrez, Phil Hay, Diana Lopera Cybercriminals have long used Microsoft documents to pass along malware and ... Read More
4. 6 JulBypassing MFA: A Pentest Case Study March 11, 2022 | Adeeb Shah When a company implements multifactor authentication, the organization is ... Read More
5. 6 JulDark Web Insights: Evolving Cyber Tactics Aim to Impact the Russia-Ukraine Conflict March 03, 2022 | Ziv Mador Update: March 9: Additional phishing emails have been sighted by Trustwave ... Read More

June 2022

1. 28 JunA Simple Guide to Getting CVEs Published March 14, 2022 | Adeeb Shah Bobby Cooke We were once newcomers to the security research field and one of the most ... Read More
2. 17 JunThe Attack of the Chameleon Phishing Page March 16, 2022 | Homer Pacag Recently, we encountered an interesting phishing webpage that caught our ... Read More
3. 10 JunDissecting a Phishing Campaign with a Captcha-based URL March 22, 2022 | Karla Agregado In today’s environment, much of the population are doing their banking or ... Read More
4. 9 JunTrustwave’s Action Response: The Lapsus$ Hacker Group Shows Us the Importance of Securing the Digital Supply Chain March 23, 2022 | Trustwave SpiderLabs Update March 24: This blog has been updated to reflect the new information ... Read More
5. 8 JunVidar Malware Launcher Concealed in Help File March 24, 2022 | Diana Lopera Appending a malicious file to an unsuspecting file format is one of the tricks ... Read More
6. 7 JunCyber Attackers Leverage Russia-Ukraine Conflict in Multiple Spam Campaigns March 25, 2022 | Trustwave SpiderLabs The Trustwave SpiderLabs email security team has been monitoring the ongoing ... Read More
7. 3 JunJava Spring vulnerabilities April 07, 2022 | Fernando Martinez This blog was written jointly with Eduardo Ocete. Executive summary Several ... Read More
8. 3 JunTrustwave’s Action Response: CVE-2022-22965 and CVE-2022-22963 March 31, 2022 | SpiderLabs Researcher Update 4/1: This blog was updated to reflect the release of IDS and ModSecurity ... Read More

May 2022

1. 26 MayStormous: The Pro-Russian, Clout Hungry Ransomware Gang Targets the US and Ukraine April 29, 2022 | Trustwave SpiderLabs May 2 Stormous update: The Trustwave SpiderLabs team has noted Stormous’ ... Read More
2. 26 MayTough Times for Ukrainian Honeypot? April 15, 2022 | Radoslaw Zdonczyk Intro We've recently been inundated with news of increased cyberattacks and a ... Read More
3. 19 MayAnalysis on recent wiper attacks: examples and how wiper malware works May 02, 2022 | Fernando Martinez Executive summary 2022 has experienced an increase in the number of wiper ... Read More
4. 13 MayTrustwave’s Action Response: F5 BIG-IP Vulnerability (CVE-2022-1388) May 11, 2022 | SpiderLabs Researcher Trustwave SpiderLabs is tracking a new critical-rated vulnerability ... Read More
5. 11 MayPwnFox - An IDOR Hunter's Best Friend May 13, 2022 | Adeeb Shah Maybe I’m a bit late to the game on this one, but I recently discovered PwnFox ... Read More
6. 2 MayInteractive Phishing: Using Chatbot-like Web Applications to Harvest Information May 19, 2022 | Adrian Perez Phishing website links are commonly delivered via email to their respective ... Read More

April 2022

1. 29 AprRapidly evolving IoT malware EnemyBot now targeting Content Management System servers and Android devices May 26, 2022 | Ofer Caspi Executive summary LevelBlue Labs™ has been tracking a new IoT botnet dubbed ... Read More
2. 15 AprGrandoreiro Banking Malware Resurfaces for Tax Season May 26, 2022 | Bernard Bautista LevelBlue SpiderLabs in early April observed a Grandoreiro malware campaign ... Read More
3. 7 AprTrustwave's Action Response: Microsoft zero-day CVE-2022-30190 (aka Follina) June 03, 2022 | SpiderLabs Researcher Update June 7 - In the event of a compromise related to the Follina ... Read More

March 2022

1. 31 MarTrustwave's Action Response: Atlassian Confluence CVE-2022-26134 June 03, 2022 | SpiderLabs Researcher Updated June 5 - Atlassian issued a fix for CVE-2022-30190 for versions 7.4.17, ... Read More
2. 25 MarCommand Injection in Multiple Snap One Araknis Networks Products June 07, 2022 | Howard McGreehan CVE-2021-40144, CVE-2021-40844, CVE-2021-42661: Command Injection ... Read More
3. 24 MarNot all "Internet Connections" are Equal June 08, 2022 | John Anderson People commonly think that any “Internet Connection” is exactly the same, or ... Read More
4. 23 MarTrustwave's Action Response: More MSDT Fallout with “Dogwalk” June 09, 2022 | SpiderLabs Researcher A zero-day vulnerability has been re-disclosed that is very similar to the ... Read More
5. 22 MarModBus 101: One Protocol to Rule the OT World June 10, 2022 | Victor Hanna Ever wondered how large-scale power plants monitor or control the myriad of ... Read More
6. 16 MarThe Importance of White-Box Testing: A Dive into CVE-2022-21662 June 17, 2022 | Adeeb Shah I want to take some time to explain the importance of using a white-box ... Read More
7. 14 MarInteractive Phishing Mark II: Messenger Chatbot Leveraged in a New Facebook-Themed Spam June 28, 2022 | Katrina Udquin Facebook Messenger is one of the most popular messaging platforms in the world, ... Read More
8. 11 MarCommand Injection and Buffer Overflow in Multiple Sharp NEC Displays July 06, 2022 | Howard McGreehan CVE-2021-20698, CVE-2021-20699: Command Injection and Buffer Overflow ... Read More
9. 3 MarCVE-2022-29593- Authentication Bypass by Capture Replay (Dingtian-DT-R002) July 06, 2022 | Victor Hanna In the OT space it is increasingly common to see devices that are used to ... Read More

February 2022

1. 25 FebHow Lack of Awareness and Clinging to the Past Threaten Your Networks September 09, 2021 | John Anderson The security landscape is always changing. New features are coming out all the ... Read More
2. 24 FebMissing Critical Vulnerabilities Through Narrow Scoping September 16, 2021 | John Anderson The typical process when scoping a penetration test is to get a list of targets ... Read More
3. 8 FebBlackByte Ransomware – Pt 2. Code Obfuscation Analysis October 15, 2021 | Rodel Mendrez, Lloyd Macrohon In Part 1 of our BlackByte ransomware analysis, we covered the execution flow ... Read More
4. 8 FebA Handshake with MySQL Bots October 14, 2021 | Radoslaw Zdonczyk Edge Services It’s well known that we just don’t put services or devices on the ... Read More
5. 4 FebBlackByte Ransomware – Pt. 1 In-depth Analysis October 15, 2021 | Rodel Mendrez, Lloyd Macrohon Please click here for Part 2 Read More

January 2022

1. 27 JanCVE-2021-1825: Inadequate Input Encoding in WebKit October 25, 2021 | Alex Camboe In August 2020, Stroz Friedberg discovered and reported to Apple an issue ... Read More
2. 26 JanLevelBlue Labs finds new Golang malware (BotenaGo) targeting millions of routers and IoT devices with more than 30 exploits November 11, 2021 | Ofer Caspi Executive summary LevelBlue Labs™ has found new malware written in the open ... Read More
3. 26 JanCrypKey License Service Allows Privilege Escalation November 04, 2021 | Martin Rakhmanov Overview CrypKey (https://www.crypkey.com/) is a third-party licensing service ... Read More
4. 26 JanIntroducing D-Modem: A software SIP modem October 29, 2021 | Dan Bastone Connect to dialup modems over VoIP using SIP, no modem hardware required. Read More
5. 26 JanCode similarity analysis with r2diaphora October 27, 2021 | Fernando Dominguez Executive summary Binary diffing, a technique for comparing binaries, can be a ... Read More
6. 21 JanModSecurity DoS Vulnerability in JSON Parsing (CVE-2021-42717) November 24, 2021 | Trustwave SpiderLabs ModSecurity is an open-source WAF engine maintained by Trustwave. This blog ... Read More
7. 13 JanLaw Enforcement Collaboration Has Eastern-European Cybercriminals Questioning Whether There Is A Safe Haven Anymore December 08, 2021 | Trustwave SpiderLabs Through the active Dark Web research that Trustwave SpiderLabs conducts for its ... Read More

2021 69

December 2021

1. 23 DecGlobal outbreak of Log4Shell December 16, 2021 | Santiago Cortes Executive summary Log4Shell is a high severity vulnerability (CVE-2021-44228) ... Read More
2. 23 DecTrustwave's Action Response: Multiple Log4j Zero-Day Vulnerabilities December 10, 2021 | SpiderLabs Researcher Updates: Dec. 29: Updated to cover three additional CVEs: CVE-2021-4104, ... Read More
3. 16 DecHoliday shopping? Get an amazing 75% discount offer? A case study on evaluating a special holiday sale December 23, 2021 | Ofer Caspi Executive summary Malicious actors always try to be creative and find new ways ... Read More
4. 10 DecCOVID-19 Phishing Lure to Steal and Mine Cryptocurrency December 23, 2021 | Bernard Bautista Recently, we observed a malware spam campaign leveraging the current COVID-19 ... Read More
5. 8 DecDecrypting Qakbot’s Encrypted Registry Keys January 13, 2022 | Lloyd Macrohon, Rodel Mendrez Since the return of the Qakbot Trojan in early September 2021, especially ... Read More

November 2021

1. 24 NovDark Web Recon: Cybercriminals Fear More Law Enforcement Action in the Wake of the REvil Takedown January 21, 2022 | Ziv Mador In the wake of the takedown of the REvil/Sodinokibi ransomware gang by the ... Read More
2. 11 NovLevelBlue Threat Hunting Guide: Identifying PwnKit (CVE-2021-4034) Exploitation January 26, 2022 | Reegun Jayapaul The Trustwave Threat Hunting team has authored a practical guide to help the ... Read More
3. 4 NovBotenaGo strikes again - malware source code uploaded to GitHub January 26, 2022 | Ofer Caspi Executive summary In November 2021, LevelBlue Labs™ first published research on ... Read More

October 2021

1. 29 OctTrustwave Action Response: Polkit Privilege Escalation Vulnerability - PwnKit (CVE-2021-4034) January 26, 2022 | SpiderLabs Researcher Summary of Trustwave Actions (updated 1/26/2022): Trustwave security and ... Read More
2. 27 OctCVE-2020-0696 - Microsoft Outlook Security Feature Bypass Vulnerability January 27, 2022 | Reegun Jayapaul Summary: During an investigation of a malware campaign, I discovered that ... Read More
3. 25 OctServiceNow - Username Enumeration Vulnerability (CVE-2021-45901) February 04, 2022 | Victor Hanna During a recent engagement Trustwave SpiderLabs discovered a vulnerability ... Read More
4. 15 OctMicrosoft 365: Identifying Mailbox Access February 08, 2022 | Rachel Kang Stroz Friedberg's testing and investigations into incidents in Microsoft’s ... Read More
5. 15 OctFrom Stored XSS to Code Execution using SocEng, BeEF and elFinder CVE-2021-45919 February 08, 2022 | John Jackson Summary A stored cross-site scripting vulnerability, tracked as CVE-2021-45919, ... Read More
6. 14 OctTrustwave’s Action Response: Russia-Ukraine Crisis – Defending Your Organization From Geopolitical Cybersecurity Threats February 24, 2022 | SpiderLabs Researcher Feb. 28 Update: The latest economic sanctions imposed upon Russia could inspire ... Read More

September 2021

1. 16 SepBlackCat ransomware February 25, 2022 | Santiago Cortes LevelBlue Labs™ is writing this report about recently created ransomware ... Read More
2. 9 SepYours Truly, Signed AV Driver: Weaponizing an Antivirus Driver February 26, 2022 | Eduardo Mattos and Rob Homewood In 2021, Stroz Friedberg observed novel indicators of compromise (IOCs) and a ... Read More

August 2021

1. 27 AugPatch Tuesday, May 2021 May 11, 2021 | Karl Sigler May's Patch Tuesday is upon us and probably the most surprising thing about the ... Read More
2. 23 AugExploitation of Sharepoint 2016: Simple Things Matter – Case Study May 18, 2021 | Lukasz Wierzbicki Sharepoint is generally used as an intranet site, to share news and other ... Read More
3. 10 AugCVE-2021-31166: RCE in Microsoft HTTP.sys May 21, 2021 | Bryant Smith In the May 2021 Microsoft update, Microsoft patched an HTTP.sys vulnerability ... Read More
4. 6 AugAWS IAM security explained May 24, 2021 | Fernando Martinez Executive summary AWS Policies are a key foundation in good cloud security, but ... Read More
5. 5 AugWeb Applications and Internal Penetration Tests May 25, 2021 | Bruno Oliveira Until recently, I really didn't care about web applications on an internal ... Read More
6. 2 AugHuawei LTE USB Stick E3372: From File Overwrite to Code Execution June 02, 2021 | Martin Rakhmanov In today's world, more and more devices are connected to the Internet for ... Read More

July 2021

1. 21 JulMalware hosting domain Cyberium fanning out Mirai variants June 14, 2021 | Fernando Martinez Executive summary LevelBlue Labs has observed the Mirai variant botnet, known ... Read More
2. 21 JulPatch Tuesday, June 2021 June 08, 2021 | Karl Sigler Summer is officially here and with it June's Patch Tuesday. This is a ... Read More
3. 13 JulThousands of Vulnerable VMWare vCenter Servers Still Publicly Exposed (CVE-2021-21985, CVE-2021-21986) June 14, 2021 | Jason Villaluna Background On May 25th, 2021, VMWare released patches to address ... Read More
4. 8 JulDarkside RaaS in Linux version June 22, 2021 | Ofer Caspi Executive summary LevelBlue Labs recently analyzed the Linux version of the ... Read More
5. 7 JulYet Another Archive Format Smuggling Malware June 24, 2021 | Diana Lopera The use of novel disk image files to encapsulate malware distributed via spam ... Read More
6. 6 JulSolarwinds Serv-U 15.2.3 Share URL XSS (CVE-2021-32604) July 06, 2021 | Victor Kahan Sometimes when pen-testing a large network you come across a few exposed web ... Read More
7. 6 JulREvil’s new Linux version July 01, 2021 | Fernando Martinez This blog was jointly authored with Ofer Caspi. Read More
8. 6 JulCyber Secure Select: Protecting High-Net-Worth Individuals June 28, 2021 | Faisal Tameesh A behind the scenes look at an Executive Vulnerability Assessment. Read More
9. 1 JulSolarwinds Serv-U 15.2.3 Share URL XSS (CVE-2021-32604) July 06, 2021 | Victor Kahan Sometimes when pen-testing a large network you come across a few exposed web ... Read More

June 2021

1. 28 JunUnauthenticated XXE in Multiple Mitsubishi Electric Air Conditioner Control Systems July 06, 2021 | Howard McGreehan CVE-2021-20595: Unauthenticated XXE affecting multiple Mitsubishi Electric Air ... Read More
2. 24 JunDiving Deeper Into the Kaseya VSA Attack: REvil Returns and Other Hackers Are Riding Their Coattails July 07, 2021 | Rodel Mendrez, Nikita Kazymirskyi On, July 2nd, a massive ransomware attack was launched against roughly 60 ... Read More
3. 22 JunModSecurity v3 and URI Fragments July 08, 2021 | Martin Vierula ModSecurity is an open-source WAF engine maintained by Trustwave. This blog ... Read More
4. 14 JunVulnerability in ON24 Plugin for macOS Shares More Than Just Your Screen July 21, 2021 | Martin Rakhmanov ON24 presenter mode requires you to install a plugin that is used to share your ... Read More
5. 14 JunPatch Tuesday, July 2021 July 13, 2021 | Karl Sigler We're a little over halfway through the year now as July's Patch Tuesday is ... Read More
6. 8 JunNew sophisticated RAT in town: FatalRat analysis August 02, 2021 | Ofer Caspi This blog was written by Ofer Caspi and Javi Ruiz. Read More
7. 2 JunTelegram Self-Destruct? Not Always August 05, 2021 | Reegun Jayapaul Summary Secret-Chats in Telegram use end-to-end encryption, which is meant for ... Read More

May 2021

1. 25 MaySQL Injection in WordPress Plugins: ORDER and ORDER BY as Overlooked Injection Points August 06, 2021 | Martin Vierula Trustwave SpiderLabs recently undertook a survey of some 100 popular WordPress ... Read More
2. 25 MayCompromising a Network Using an "Info" Level Finding July 21, 2021 | John Anderson Anyone who has ever read a vulnerability scan report will know that scanners ... Read More
3. 24 MayPatch Tuesday, August 2021 August 10, 2021 | Karl Sigler Here we are in August and it's Patch Tuesday once more. It's another light ... Read More
4. 21 MayPRISM attacks fly under the radar August 23, 2021 | Fernando Dominguez LevelBlue SpiderLabs has recently discovered a cluster of Linux ELF executables ... Read More
5. 18 MayCobalt Strike Configuration Extractor and Parser August 27, 2021 | Noah Rubin Cobalt Strike Beacons continue to be the norm for persistence, lateral ... Read More
6. 11 MayTeamTNT with new campaign aka "Chimaera" September 08, 2021 | Ofer Caspi Executive summary LevelBlue Labs™ has discovered a new campaign by threat group ... Read More
7. 4 MayScamming from the Cloud December 16, 2020 | Dr. Fahim Abbasi Cybercriminals are leveraging reputable cloud services to relay scam email ... Read More

April 2021

1. 22 AprD-Link: Multiple Security Vulnerabilities Leading to RCE December 17, 2020 | Harold Zang On the 30th of October, D-Link published a support announcement and released a ... Read More
2. 13 AprTrustwave’s Action Response To the FireEye Data Breach & SolarWinds Orion Compromise December 31, 2020 | Trustwave SpiderLabs UPDATES This blog post was updated March 17 to include information on new ... Read More
3. 8 AprPhishing the Holiday Season January 04, 2021 | Homer Pacag Yes! It’s that time of the year again! The time for celebrating our traditions, ... Read More
4. 1 AprA Trump Sex Video? No, It's a RAT! January 06, 2021 | Diana Lopera While reviewing our spam traps, a particular campaign piqued our interest ... Read More

March 2021

1. 29 MarMalware using new Ezuri memory loader January 07, 2021 | Ofer Caspi This blog was written by Ofer Caspi and Fernando Martinez of LevelBlue Labs Read More
2. 25 MarMicrosoft Teams and Skype Logging Privacy Issue January 11, 2021 | Reegun Jayapaul Description: This blog post focuses on the privacy issues that Microsoft Teams ... Read More
3. 15 MarPatch Tuesday, January 2021 January 12, 2021 | Karl Sigler The first Patch Tuesday of 2021 is here and the year is starting out lighter ... Read More
4. 11 MarA Global Perspective of the SideWinder APT January 13, 2021 | Tom Hegel LevelBlue Labs has conducted an investigation on the adversary group publicly ... Read More
5. 9 MarTeamTNT delivers malware with new detection evasion tool January 27, 2021 | Ofer Caspi Executive Summary LevelBlue Labs™ has identified a new tool from the TeamTNT ... Read More
6. 8 MarAPT X – Process Hollowing January 27, 2021 | Faisal Tameesh A detailed walkthrough of the process hollowing injection technique. Read More

February 2021

1. 24 FebCloudy with a Chance of Persistent Email Access January 29, 2021 | Partha Alwar, Carly Battaile and Alex Parsons How an advanced threat group leveraged Microsoft Azure to gain persistent ... Read More
2. 12 FebPatch Tuesday, February 2021 February 09, 2021 | Karl Sigler February is here and with it comes a relatively light Patch Tuesday. Only 56 ... Read More
3. 12 FebFull System Control with New SolarWinds Orion-based and Serv-U FTP Vulnerabilities February 03, 2021 | Martin Rakhmanov Updates: This blog post was updated Feb. 9 to include Proof-of-Concept (PoC) ... Read More
4. 9 FebThe Many Roads Leading To Agent Tesla February 12, 2021 | Rodel Mendrez, Diana Lopera Agent Tesla is a common Remote Access Trojan (RAT) discovered in 2014. This ... Read More
5. 3 FebFinding More IDORs – Tips and Tricks February 12, 2021 | Max Corbridge A collection of useful tips, tricks, and techniques for discovering IDORs. Read More

January 2021

1. 29 JanOffice 365 Best Practices: 7 Steps to Mitigating Business Email Compromise February 24, 2021 | Carly Battaile, Alex Parsons and Miranda Skar Microsoft’s Office 365 is an increasingly popular email solution for ... Read More
2. 27 JanPatch Tuesday, March 2021 March 09, 2021 | Karl Sigler The March Patch Tuesday is here and it's been an unfortunately busy month for ... Read More
3. 27 JanTrustwave's Action Response to the Microsoft Exchange Server Zero-Day Vulnerabilities and Attacks March 08, 2021 | Trustwave SpiderLabs UPDATES Read More
4. 13 JanImage File Trickery Part II: Fake Icon Delivers NanoCore March 11, 2021 | Diana Lopera The .zipx file extension is used to denote that the ZIP archive format is ... Read More
5. 12 JanHAFNIUM, China Chopper and ASP.NET Runtime March 15, 2021 | Joshua Deacon The recent Microsoft Exchange Server zero-day exploits (CVE-2021-26855, ... Read More
6. 11 JanFrom Creative Password Hashes to Administrator: Gone in 60 Seconds (Or Thereabouts) March 25, 2021 | Tom Neaves Picture the scene, you’re on an application penetration test (as a normal user) ... Read More
7. 7 JanYou Just Received 25k USD in Your BTC Account! A Practical Phishing Defense Tutorial March 29, 2021 | Jakub Adamczyk From time to time, we all receive some unexpected messages. Either through ... Read More
8. 6 JanElevate Yourself to Admin in Umbraco CMS 8.9.0 (CVE-2020-29454) April 01, 2021 | Jonathan Yarema Umbraco version 8.9.0 (also seen in 8.6.3) has a privilege escalation issue in ... Read More
9. 4 JanHTML Lego: Hidden Phishing at Free JavaScript Site April 08, 2021 | Homer Pacag This blog investigates an interesting phishing campaign we encountered ... Read More

2020 100

December 2020

1. 31 DecPatch Tuesday, April 2021 April 13, 2021 | Karl Sigler April's Patch Tuesday is upon us and it is showering us with patches for a ... Read More
2. 17 DecAll Your Databases Belong To Me! A Blind SQLi Case Study April 22, 2021 | Andreas Georgiou “All your base are belong to us”, Zero game 1992 Read More
3. 16 DecPingback: Backdoor At The End Of The ICMP Tunnel May 04, 2021 | Lloyd Macrohon, Rodel Mendrez Introduction In this post, we analyze a piece of malware that we encountered ... Read More
4. 11 DecvBulletin Remote Code Execution (CVE-2020-7373) August 18, 2020 | Manuel Nader Last week, security researcher Amir Etemadieh (aka Zenoflex) disclosed that ... Read More
5. 10 DecClose, but no Ragnar August 19, 2020 | Daniel Spicer and Partha Alwar Stroz Friedberg Incident Response Services has observed Ragnar Locker use ... Read More
6. 8 DecFrom SSRF to Compromise: Case Study August 20, 2020 | Liam Somerville Overview I think every penetration tester has a story about the one that got ... Read More
7. 8 DecIBM Db2 Shared Memory Vulnerability (CVE-2020-4414) August 20, 2020 | Martin Rakhmanov I’ve recently blogged about a shared memory vulnerability in Cisco WebEx ... Read More
8. 1 DecSpiderLabs Capture the Flag 2020 Results August 21, 2020 | Radoslaw Zdonczyk, Charles Hamilton Read More

November 2020

1. 19 NovRATs and Spam: The Node.JS QRAT August 24, 2020 | Diana Lopera The Qua or Quaverse Remote Access Trojan (QRAT) is a Java-based RAT that can be ... Read More
2. 14 NovBlackhole Exploit Kit v2 September 14, 2020 | Daniel Chechik A few days ago a new version of THE most common exploit kit was released. ... Read More
3. 10 NovModSecurity Regular Expressions and Disputed CVE-2020-15598 September 14, 2020 | SpiderLabs Researcher ModSecurity is an open-source Web Application Firewall (WAF) engine maintained ... Read More

October 2020

1. 22 OctEvasive URLs in Spam September 17, 2020 | Dr. Fahim Abbasi This post is part one of a two part series. You can read part two here. Read More
2. 21 OctNetwork Detection for ZeroLogon CVE-2020-1472 September 30, 2020 | Bryant Smith ZeroLogon has quickly become popular and well known because of multiple proofs ... Read More
3. 21 OctHijacking a Domain Controller with Netlogon RPC aka Zerologon: CVE-2020-1472 September 17, 2020 | Jason Villaluna, Shrijin Srinivasan On September 14th, researchers at security firm Secura published a white paper ... Read More
4. 15 OctEvasive URLs in Spam: Part 2 October 01, 2020 | Diana Lopera A URL can be completely valid, yet still misleading. In this blog, we will ... Read More
5. 14 OctInto Defray October 08, 2020 | Daniel Spicer Stroz Friedberg provides a look into the techniques and patterns of the ... Read More
6. 13 OctSAP ASE Information Leaks: CVE-2020-6295 and CVE-2020-6317 September 24, 2020 | Martin Rakhmanov Introduction Today I'd like to discuss two information disclosure ... Read More
7. 8 OctPatch Tuesday, October 2020 October 14, 2020 | Karl Sigler October's Patch Tuesday is upon us and with it comes patches for 102 CVEs. This ... Read More
8. 1 OctGoldenSpy Chapter 4: GoldenHelper Malware Embedded in Official Golden Tax Software October 15, 2020 | Brian Hussey Directly preceding GoldenSpy, another malware family was used to covertly ... Read More

September 2020

1. 30 SepMassive US Voters and Consumers Databases Circulate Among Hackers October 21, 2020 | Ziv Mador Voting in the U.S. elections started recently and there is a real concern over ... Read More
2. 24 SepBad Neighbors Can Break Windows (CVE-2020-16898) October 21, 2020 | Shrijin Srinivasan On October 13th, 2020, Microsoft released a patch for a critical vulnerability ... Read More
3. 17 SepAttacking SCADA Part II: Vulnerabilities in Schneider Electric EcoStruxure Machine Expert and M221 PLC November 10, 2020 | Seok Min Lim This is part 2 of a two-part series. You can read part 1 here. Read More
4. 17 SepGoldenSpy Chapter 5 : Multiple GoldenSpy Uninstaller Variants Discovered October 22, 2020 | Reegun Jayapaul Summary: Trustwave identified a significant malicious campaign on mandatory tax ... Read More
5. 14 SepGO SMS Pro Vulnerable to Media File Theft November 19, 2020 | Richard Tan The GO SMS Pro application is a popular messenger app with over 100 million ... Read More
6. 14 SepSee ya in S3! November 14, 2020 | Mary Braden Murphy Stroz Friedberg has unique insight on how attackers attempt to cover their ... Read More

August 2020

1. 24 AugGO SMS Pro Vulnerable to File Theft: Part 2 December 01, 2020 | Karl Sigler Last week we released an advisory about an SMS app called GO SMS Pro. Media ... Read More
2. 21 AugAttacking SCADA Part III: Hardcoded Salt in Schneider Electric EcoStruxure Machine Expert (CVE-2020-28214) December 08, 2020 | Seok Min Lim This is part three of our Schneider Electric series. You can read part one here ... Read More
3. 20 AugInsecure Communication in WinZip 24 Could Lead to Malware December 10, 2020 | Martin Rakhmanov Overview During observation of WinZip 24 network communications, I've noticed ... Read More
4. 20 AugPatch Tuesday, December 2020 December 08, 2020 | Karl Sigler December's Patch Tuesday is here and, typical for the end of the year, it's a ... Read More
5. 19 AugTrustwave’s Action Response To the FireEye Data Breach December 11, 2020 | Trustwave SpiderLabs Update With the new information and developments released by FireEye, we have ... Read More
6. 18 AugMagic Home Pro Mobile Application Authentication Bypass (CVE-2020-27199) December 15, 2020 | Victor Hanna Overview With the prevalence of IoT devices flooding the mainstream ... Read More
7. 11 AugPatch Tuesday, May 2020 May 13, 2020 | Karl Sigler May's Patch Tuesday includes patches for 111 unique CVEs. Of those CVEs 17 are ... Read More
8. 5 AugExploring Solidity’s Model Checker May 13, 2020 | Eric Rafaloff This blog post aims to be an exploration of how Solidity’s model checker works, ... Read More

July 2020

1. 28 JulAzure Web App Service For Offensive Operations May 14, 2020 | Stephan Borosh In this blog, I will be covering how to use Azure App Services for offensive ... Read More
2. 23 JulVaccine for COVID-19 and Other Scams on the Dark Web May 19, 2020 | SpiderLabs Researcher Our attempts to investigate the underground and document some of what’s going ... Read More
3. 22 JulPhishing in a Bucket: Utilizing Google Firebase Storage May 21, 2020 | Dr. Fahim Abbasi Credential phishing is a real threat that's targeting organizations globally. ... Read More
4. 14 JulSecuring SSH: What To Do and What Not To Do May 22, 2020 | Ed Williams An Uptick in Activity Over the last week we've seen the compromise of a number ... Read More
5. 11 JulSystem Takeover Through New SAP ASE Vulnerabilities June 03, 2020 | Martin Rakhmanov For the last several years there have been relatively few security patches for ... Read More
6. 3 JulCompromising Android Applications with Intent Manipulation June 09, 2020 | Therese Mendoza As a mobile app tester, I have encountered numerous varied vulnerabilities. ... Read More
7. 2 JulCisco WebEx Memory for the Taking: CVE-2020-3347 June 18, 2020 | Martin Rakhmanov Overview Due to the global pandemic of COVID-19, there’s been an explosion of ... Read More
8. 2 JulPatch Tuesday, June 2020 June 09, 2020 | Karl Sigler June's Patch Tuesday has crept upon us and while our minds may be elsewhere, ... Read More
9. 1 JulTrickBot Disguised as COVID-19 Map June 18, 2020 | Diana Lopera Cybercriminals are continuously exploiting the Coronavirus (COVID-19) pandemic. ... Read More

June 2020

1. 30 JunThe Golden Tax Department and the Emergence of GoldenSpy Malware June 22, 2020 | Brian Hussey Trustwave SpiderLabs has discovered a new malware family, dubbed GoldenSpy, ... Read More
2. 30 JunCopy-Paste Threat Actor in the Asia Pacific Region June 19, 2020 | Reegun Jayapaul Summary Australian Prime Minister Australian Prime Minister Scott Morrison ... Read More
3. 25 JunPillowmint: FIN7’s Monkey Thief June 20, 2020 | Rodel Mendrez In this blog, we take an in-depth technical look at Pillowmint malware samples ... Read More
4. 22 JunAdventures in ATM Hacking June 30, 2020 | Bruno Oliveira Intro Before this pandemic, Neil Burrows and myself (Bruno Oliveira) from ... Read More
5. 20 JunGoldenSpy: Chapter Two – The Uninstaller June 30, 2020 | Brian Hussey On June 25, 2020 Trustwave SpiderLabs published research showing that the ... Read More
6. 19 JunPhishINvite with Malicious ICS Files July 01, 2020 | Diana Lopera In an earlier blog entitled “Phishing in the Cloud”, we outlined that threat ... Read More
7. 18 JunStill Scanning IP Addresses You’re Doing it Wrong July 02, 2020 | John Anderson The traditional approach to a vulnerability scan or penetration test is to find ... Read More
8. 18 JunGoldenSpy Chapter 3: New and Improved Uninstaller July 02, 2020 | Brian Hussey Background: On June 25th, Trustwave SpiderLabs published our research on a ... Read More
9. 9 JunInjecting Magecart into Magento Global Config July 11, 2020 | Peter Evans, Rodel Mendrez At the beginning of June 2020, we were contacted about a breach of a website ... Read More
10. 9 JunHackers Leverage Cloud Platforms to Spread Phishing Under the Radar July 03, 2020 | Simon Kenin During April, amid the Covid-19 pandemic, Perception-Point wrote about a ... Read More
11. 3 JunPatch Tuesday, July 2020 July 14, 2020 | Karl Sigler July's Patch Tuesday is here with another large list of CVEs. It includes 20 ... Read More

May 2020

1. 22 MayLockscreen Ransomware Phishing Leads To Google Play Card Scam July 22, 2020 | Homer Pacag Email scammers always seem to invent new ways of trickery to gain cash from ... Read More
2. 21 MayASUS Router Vulnerable to Fake Updates and XSS (CVE-2020-15498 & CVE-2020-15499) July 23, 2020 | Martin Rakhmanov Recently ASUS patched two issues I discovered in the RT-AC1900P router firmware ... Read More
3. 19 MayAre You Really Scanning What You Think July 28, 2020 | John Anderson In a previous post we explored the importance of scanning hostnames instead of ... Read More
4. 14 MayMicrosoft Teams Updater Living off the Land August 05, 2020 | Reegun Jayapaul Introduction During this global pandemic COVID-19 situation, there has been an ... Read More
5. 13 MayPatch Tuesday, August 2020 August 12, 2020 | Karl Sigler August's Patch Tuesday is here with 120 CVEs patched. That includes 100 rated ... Read More
6. 13 MayPlaydate with Bots: Microsoft SQL Honeypots August 11, 2020 | Vladimir Zakharevich A good way to keep an eye on attackers and get insight on their techniques and ... Read More
7. 7 MayPerls of Wisdom: Responding to NetScaler CVE-2019-19781 February 13, 2020 | Noah Rubin and Erik Iker On December 17, 2019, Citrix announced a vulnerability affecting NetScaler ... Read More
8. 1 MayPhishing in the Cloud February 19, 2020 | Dr. Fahim Abbasi, Phil Hay Credential phishing is one of the leading threats faced by organizations today. ... Read More

April 2020

1. 17 AprWindows Debugging and Exploiting Part 4: NTQuerySystemInformation March 02, 2020 | Bruno Oliveira Introduction Hello again! We are back with more Windows internals and it's time ... Read More
2. 17 AprRATs Wrapped and Hidden in PNG February 27, 2020 | Diana Lopera The Remote Access Tool (RAT) is one of the malware types we often encounter ... Read More
3. 15 AprMonster Lurking in Hidden Excel Worksheet March 05, 2020 | Rodel Mendrez A recent blog by Didier Steven’s showed how malicious Excel 4 macros can be ... Read More
4. 14 AprMore Excel 4.0 Macro MalSpam Campaigns March 11, 2020 | Diana Lopera In light of the recent blog by my colleague Rodel Mendrez, we looked back at ... Read More
5. 14 AprPatch Tuesday March 2020 March 10, 2020 | Karl Sigler Today marks Microsoft's March Patch Tuesday. While it may not be on the top of ... Read More
6. 10 AprModSecurity Award Nominations and the Challenges of Open Source March 12, 2020 | SpiderLabs Researcher In the hustle and bustle of everyday work life we tend to look at the current ... Read More
7. 8 AprPersistent Cross-Site Scripting, the MSSQL Way March 12, 2020 | Jonathan Yarema Overview If you save wide Unicode brackets (i.e. ＜＞) into a char or varchar ... Read More
8. 3 AprSharepoint vulnerability exploited in the wild March 26, 2020 | Chris Doman The CVE-2019-0604 (Sharepoint) exploit and what you need to know LevelBlue Labs ... Read More
9. 3 AprSMBGhost CVE-2020-0796 a Critical SMBv3 RCE Vulnerability March 16, 2020 | Karl Sigler Overview Last week Microsoft announced that there was a buffer overflow ... Read More

March 2020

1. 31 MarSIEM and security monitoring for Kubernetes explained March 27, 2020 | Ashley Graves Photo by chuttersnap on Unsplash Read More
2. 31 MarWould You Exchange Your Security for a Gift Card? March 26, 2020 | Alejandro Baca, Rodel Mendrez UPDATED March 27, 2020 Read More
3. 27 MarThe Power of Community to Fight COVID-19 Cyber Threats April 03, 2020 | Amy Pace Cybercriminals are taking advantage of the fear and uncertainty surrounding the ... Read More
4. 27 MarCOVID-19 Malspam Activity Ramps Up March 31, 2020 | Joshua Deacon, Homer Pacag, Rodel Mendrez, Phil Hay Back in February, we reported on two Coronavirus-themed phishing emails. But ... Read More
5. 26 MarWindows Debugging and Exploiting Part 5 SMBGhost CVE-2020-0796 Technical Review April 03, 2020 | Bruno Oliveira Introduction Hi everyone, how are you? I know the times are strange but we ... Read More
6. 26 MarAn In-depth Look at MailTo Ransomware, Part One of Three March 31, 2020 | Joshua Deacon, Lloyd Macrohon In February, an Australian transportation company called Toll Group was hit by ... Read More
7. 16 MarAn In-depth Look at MailTo Ransomware, Part Two of Three April 08, 2020 | Joshua Deacon, Lloyd Macrohon Overview In Part One of this series, we discussed how MailTo ransomware ... Read More
8. 12 MarSlack phishing attacks using webhooks April 14, 2020 | Ashley Graves Background Slack is a cloud-based messaging platform that is commonly used in ... Read More
9. 12 MarAn In-depth Look at MailTo Ransomware, Part Three of Three April 10, 2020 | Joshua Deacon, Lloyd Macrohon Overview In Part One of this series, we discussed how MailTo ransomware ... Read More
10. 11 MarPatch Tuesday, April 2020 April 14, 2020 | Karl Sigler April's Patch Tuesday is here and Microsoft is patching 113 CVEs this month. ... Read More
11. 10 MarCOVID-19 Themed BEC Scams April 15, 2020 | Dr. Fahim Abbasi Business email compromise (BEC) also known as CEO fraud has undoubtedly become ... Read More
12. 5 MarExcel Malspam: Password Protected … Not! April 17, 2020 | Diana Lopera Early March of this year, we blogged about multiple malspam campaigns utilizing ... Read More
13. 2 MarRed Team Case Study: Bypassing CloudFlare WAF for Successful OGNL Injection April 17, 2020 | Faisal Tameesh Bypassing CloudFlare's WAF to exploit an OGNL injection vulnerability in a red ... Read More

February 2020

1. 27 FebCombatting Social Engineering Is Not Just A Compliance Requirement May 01, 2020 | Carl Sue Having a well designed and tested social engineering training program for an ... Read More
2. 19 FebAttacking SCADA: Vulnerabilities in Schneider Electric SoMachine and M221 PLC (CVE-2017-6034 and CVE-2020-7489) May 07, 2020 | Seok Min Lim Introduction SCADA/OT security has been a growing concern for quite some time. ... Read More
3. 13 FebA HIPAA Compliance Checklist May 11, 2020 | Tawnya Lancaster Five steps to ensuring the protection of patient data and ongoing risk ... Read More
4. 13 FebA Call for Cooler Heads November 08, 2019 | Trustwave SpiderLabs One of the unfortunate parts of a business like ours is when disputes arise ... Read More
5. 11 FebFingerprinting FreeBSD OS Versions using OpenSSH November 14, 2019 | Manuel Nader In the past, we’ve described how to fingerprint Ubuntu OS Version using ... Read More
6. 4 FebCVE-2019-15652: SatLink VSAT Vulnerabilities November 21, 2019 | Robert Foggia Back in May of this year, I discovered a few vulnerabilities in the SatLink ... Read More
7. 4 FebFake Windows Update Spam Leads to Cyborg Ransomware and Its Builder November 19, 2019 | Diana Lopera Recently, fake Microsoft Windows Update emails were spammed with the following ... Read More
8. 4 FebWindows Debugging & Exploiting Part 2 - WinDBG 101 November 18, 2019 | Bruno Oliveira Introduction Hello again! After our previous post about the environment setup, ... Read More

January 2020

1. 21 JanTime Windows for Penetration Testing November 22, 2019 | Albert Campa Often when penetration tests are scheduled, it will be requested that testing ... Read More
2. 20 JanIntroducing Password Cracking Manager: CrackQ December 04, 2019 | Daniel Turner Today we are releasing CrackQ, a queuing system to manage password cracking ... Read More
3. 17 JanCVE-2019-1429: (Another) Microsoft Internet Explorer 0-Day December 05, 2019 | SpiderLabs Researcher November’s Patch Tuesday from Microsoft included a patch for yet another ... Read More
4. 16 JanSCshell: Fileless Lateral Movement Using Service Manager December 09, 2019 | Charles Hamilton During red team engagements, lateral movement in a network is crucial. In ... Read More
5. 14 JanTyposquatting in Python Repositories December 13, 2019 | Radoslaw Zdonczyk Python's popularity is amazing and constantly growing. For the first time, ... Read More
6. 14 JanPatch Tuesday, December 2019 December 10, 2019 | Karl Sigler December's Patch Tuesday is upon us, and, as in years gone by, it's a rather ... Read More
7. 9 JanUndressing the REvil December 20, 2019 | Rodel Mendrez Contributors: Lloyd Macrohon and Rodel Mendrez Read More
8. 9 JanAnyone Can Check for Magecart with Just the Browser December 18, 2019 | Michael Yuen In the past, there have been plenty of articles and blog posts recommending the ... Read More
9. 2 JanLeveraging Disk Imaging Tools to Deliver RATs December 23, 2019 | Joshua Deacon, Diana Lopera, Fahim Abbasi This year we observed a notable uptick in disc imaging software (like .ISO) ... Read More

2019 83

December 2019

1. 23 DecUsing the InterPlanetary File System For Offensive Operations January 02, 2020 | Stephan Borosh Introduction In this blog post, I intend to provide some insight into using the ... Read More
2. 20 DecTechnical Analysis of an Active Cryptomining Worm by LevelBlue Labs January 09, 2020 | Fernando Dominguez This blog post provides an overview of the LevelBlue Labs™ technical analysis ... Read More
3. 18 DecWindows Debugging & Exploiting Part 3: WinDBG Time Travel Debugging January 09, 2020 | Bruno Oliveira Introduction Hi, my fellow friends! How are you? Hopefully, you had a terrific ... Read More
4. 17 DecWork From Home: The New New and What To Do May 11, 2020 | Ed Williams Here at SpiderLabs, we take the security of all our clients extremely ... Read More
5. 13 DecModSecurity v3.0.4 Released! January 14, 2020 | SpiderLabs Researcher It is a pleasure to announce the release of ModSecurity version 3.0.4 ... Read More
6. 10 DecPatch Tuesday, January 2020 January 14, 2020 | Karl Sigler Happy 2020! Microsoft is helping you celebrate the new decade with patches for ... Read More
7. 9 DecCitrix ADC/Netscaler - CVE-2019-19781 January 16, 2020 | Bryant Smith The Citrix vulnerability (CVE-2019-19781) was first identified in December of ... Read More
8. 5 DecWindows CryptoAPI Spoofing Vulnerability - CVE-2020-0601 January 17, 2020 | Karl Sigler One of the most notable vulnerabilities patched during Microsoft's first Patch ... Read More
9. 4 DecModSecurity Denial of Service Details - CVE-2019-19886 January 20, 2020 | Trustwave SpiderLabs ModSecurity is an open-source WAF engine maintained by Trustwave. As a lively ... Read More

November 2019

1. 22 NovMicrosoft Internet Explorer Remote Code Execution 0-Day (CVE-2020-0674) January 21, 2020 | SpiderLabs Researcher 2020 is not starting out quietly for Microsoft, it seems. After the first Patch ... Read More
2. 21 NovWhy should you use correlation rules on top of traditional signatures? February 04, 2020 | Javier Ruiz The LevelBlue Labs team is in charge of writing correlation rules and releasing ... Read More
3. 19 NovReversing (and Recreating) Cryptographic Secrets Found in .NET Assemblies Using Python February 04, 2020 | Tom Neaves Picture the scene - you’re on a penetration test, somehow you’ve got hold of a ... Read More
4. 18 NovCVE-2020-2551: Unauthenticated RCE In Oracle WebLogic February 04, 2020 Unauthenticated Remote Code Execution in IIOP protocol via Malicious JNDI ... Read More
5. 14 NovPatch Tuesday February 2020 February 11, 2020 | Karl Sigler February's Patch Tuesday is here and brings with it patches for 98 CVEs. These ... Read More
6. 8 NovMultiple Phishing Attacks Discovered Using the Coronavirus Theme February 13, 2020 | Homer Pacag It’s out there in the newspaper, social media, and television headlines. The ... Read More
7. 5 NovExecuting Code Using Microsoft Teams Updater July 08, 2019 | Charles Hamilton Red Teamers like to hunt for new methods of code execution through “legitimate” ... Read More

October 2019

1. 23 OctPatch Tuesday, July 2019 July 09, 2019 | Karl Sigler Patch Tuesday for July is here and after the massive release in June, the 77 ... Read More
2. 18 Oct“Sexfavor” Email Scam Delivers Danabot July 09, 2019 | Diana Lopera Sextortion has been a widely used theme in spam campaigns since Q1 of 2018. ... Read More
3. 15 OctHardcoded Credentials in Uniguest Kiosk Software Lead to API Compromise July 11, 2019 | Adrian Pruteanu If you've traveled at all within North America, you've likely at some point ... Read More
4. 8 OctHQL Injection Exploitation in MySQL July 18, 2019 | Olga Barinova Are you familiar with an HQL injection exploitation? Chances are you’re not. ... Read More

September 2019

1. 30 SepBreaking Smart [Bank] Statements July 25, 2019 | Manuel Nader Context In Mexico, it’s possible to receive your monthly bank statement via ... Read More
2. 27 SepHiding PHP Code in Image Files Revisited July 26, 2019 | Rodel Mendrez Over five years ago, we published a blog detailing how a webshell’s backdoor ... Read More
3. 26 SepSanDisk SSD Dashboard Vulnerabilities: CVE-2019-13466 & CVE-2019-13467 July 31, 2019 | Martin Rakhmanov While recently upgrading my laptop with a new Solid State Drive (SSD), I ... Read More
4. 25 SepAttackSurfaceMapper - Automate and Simplify the OSINT Process August 07, 2019 | Andreas Georgiou [+] Introduction: Read More
5. 24 SepTrustwave Wins the Threat Indicator Top Contributor Award from Microsoft August 12, 2019 | Ziv Mador Over the years, cyber-attacks have become widespread and increasingly ... Read More
6. 18 SepHyper-V’s Guest/Host Attack Surface: A Quick Look August 20, 2019 | Drew Noel An overview of Hyper-V’s guest/host communications and attack surface. Read More
7. 18 SepPatch Tuesday, August 2019 August 13, 2019 | Karl Sigler The August Patch Tuesday is here ringing in patches for a massive 97 CVEs. ... Read More
8. 11 SepDigging Deep into Magecart Malware Part II September 04, 2019 | Rodel Mendrez Magecart is the name given to notorious groups of hackers that target online ... Read More
9. 10 SepLord EK: A New Exploit Kit with an Ambitious Name September 06, 2019 | Nikita Kazymirskyi After a bit of a lull in the world of exploit kits, a new exploit kit by the ... Read More
10. 6 SepMultiple Vulnerabilities in Comba and D-Link Routers September 10, 2019 | Karl Sigler Overview There are five new credential leaking vulnerabilities discovered and ... Read More
11. 4 SepPatch Tuesday, September 2019 September 11, 2019 | Karl Sigler For September 2019, Microsoft is releasing 78 CVEs. Of these CVEs, 17 are rated ... Read More

August 2019

1. 20 AugGetting Started With Azure DevOps September 18, 2019 | Stephan Borosh Recently, I set out to find a simple solution to manage the building of all my ... Read More
2. 13 AugRemote Code Execution and other Vulnerabilities in WS_FTP Server September 18, 2019 | Dan Bastone and Devon Greene CVE-2019-12143, CVE-2019-12144, CVE-2019-12145, CVE-2019-12146: Multiple ... Read More
3. 12 AugMicrosoft Internet Explorer Remote Code Execution 0-Day (CVE-2019-1367) September 24, 2019 | SpiderLabs Researcher Microsoft released an out-of-band patch for a 0-day vulnerability in Internet ... Read More
4. 7 AugTracking the Chameleon Spam Campaign September 25, 2019 | Dr. Fahim Abbasi In this blog, we draw attention to a persistent high-volume spam campaign that ... Read More

July 2019

1. 31 JulDigital Canaries in a Coal Mine: Detecting Enumeration with DNS and AD September 26, 2019 | Stephan Borosh Introduction A fundamental part of any network is the Domain Name Service ... Read More
2. 26 JulDocuments with IRM Password Protection Lead to Remcos RAT September 27, 2019 | Diana Lopera Documents attached to emails are commonly used as the initial vector to deliver ... Read More
3. 25 JulChaining Low/Info Level Vulnerabilities for Pwnage September 30, 2019 | Liam Somerville Chained Critical Everyone gets critical. It’s part of our vernacular: ... Read More
4. 18 JulPatch Tuesday, October 2019 October 08, 2019 | Karl Sigler Microsoft’s security update for the month of October is one of the lightest ... Read More
5. 11 JulMessing with Azorult Part 1: Malware Breakdown October 15, 2019 | Rodel Mendrez In this blog series, we dive into an information stealing Trojan called Azorult ... Read More
6. 9 JulWindows Debugging & Exploiting Part 1 - Environment Setup October 23, 2019 | Bruno Oliveira Introduction In this blog series, I will try to set some base knowledge for ... Read More
7. 9 JulMessing with Azorult Part 2: Command and Control October 18, 2019 | Rodel Mendrez As we mentioned in our earlier blog, Azorult is very popular in the underground ... Read More
8. 8 JulDouble Loaded Zip File Delivers Nanocore November 05, 2019 | Diana Lopera Most malware sent via emails is packaged in archives such as ZIP, RAR, and 7z ... Read More

June 2019

1. 11 JunMalware Xeroing in on Cloud Accounting Customers February 14, 2019 | Dr. Fahim Abbasi We witnessed a sophisticated phishing campaign on 16th August 2017, targeting ... Read More

May 2019

1. 14 MayStealing Money by Asking for It: Business Email Compromise via Altered Invoices February 14, 2019 | Phil Hay We are seeing more reports from organizations being targeted by what could be ... Read More
2. 2 MayDigging Deep Into Magecart Malware February 21, 2019 | Rodel Mendrez Last week, one of my SpiderLabs colleagues was working on a PCI forensic triage ... Read More

April 2019

1. 25 AprBangladesh Embassy Website in Cairo Compromised February 27, 2019 | Nikita Kazymirskyi In the world of Phishing emails, we often see schemes which involve enticing ... Read More
2. 22 AprDetecting Malicious Behavior by Unmasking WebSockets March 04, 2019 | Bryant Smith WebSockets allow a single TCP connection to have full duplexing communications. ... Read More
3. 22 AprSheepl 2.0: Automating People for Red and Blue Tradecraft March 04, 2019 | Matt Lorentzen When I first released Sheepl 0.1 in September 2018 as part of a talk, I wanted ... Read More
4. 22 AprAttacker Tracking Users Seeking Pakistani Passport March 04, 2019 | SpiderLabs Researcher A few days ago we encountered a breach on a Pakistani government site which was ... Read More
5. 15 AprQRCode Used in Extortion Spam Campaign March 07, 2019 | Homer Pacag Sextortion is a form of sex-themed exploitation via email where victims are ... Read More
6. 11 AprPatch Tuesday, March 2019 March 12, 2019 | Karl Sigler This month's Patch Tuesday brings with it four advisories and patches for 64 ... Read More
7. 9 AprCVE-2018-19386: Reflected XSS in SolarWinds Database Performance Analyzer March 21, 2019 | Jacob Wilkin Just a short post from me today, bringing you a pretty simple Cross-Site ... Read More
8. 9 AprBEC Payroll Scam: Your Salary is Mine! March 13, 2019 | Dr. Fahim Abbasi Con men have been exploiting human psychology since the dawn of time. Equipped ... Read More
9. 8 AprThe odd case of a Gh0stRAT variant March 25, 2019 | James Quinn This is a guest post by independent security researcher James Quinn. This will ... Read More
10. 5 AprRemote Code Execution In BlogEngine.NET March 28, 2019 | Dustin Cobb CVE-2019-6714: RCE via path traversal in BlogEngine.NET 3.3.6.0. Read More
11. 4 AprFake CIA Sextortion Scam Uses SatoshiBox April 04, 2019 | Diana Lopera Another round of sextortion scam emails with a pdf attachment were pushed out ... Read More

March 2019

1. 28 MarSpammed PNG file hides LokiBot April 05, 2019 | Phil Hay, Rodel Mendrez Contributing authors: Phil Hay, Rodel Mendrez Read More
2. 25 MarEmotet lives another day using Fake O2 invoice notifications April 08, 2019 | Dr. Fahim Abbasi We witnessed a widespread phishing campaign targeting O2 customers, that ... Read More
3. 21 MarPatch Tuesday, April 2019 April 09, 2019 | Karl Sigler Along with "Spring Showers" up here in the Northern Hemisphere, April also ... Read More
4. 13 MarAuthenticated Arbitrary Command Execution on PostgreSQL 9.3 > Latest April 09, 2019 | Jacob Wilkin EDIT (9.April.2019): We have applied for a retraction of CVE-2019-9193 ... Read More
5. 12 MarLocky Part 1: Lukitus Spam Campaigns and Their Love for Game of Thrones April 11, 2019 | Nicholas Ramos Back in August 2017, Trustwave Spiderlabs reported a spam campaign that ... Read More
6. 7 MarUnauthenticated Remote Code Execution In Kentico CMS April 15, 2019 | Manoj Cherukuri CVE-2019-10068: RCE as Administrator via deserialization vulnerability in ... Read More
7. 4 Mar“Don’t Mine Me” – Coinhive April 22, 2019 | Anat Davidi What's worse than annoying ads on a website? Crypto Miner on a website! Read More
8. 4 MarVAT Return with a Vengeance April 22, 2019 | Dr. Fahim Abbasi Scam Overview Her Majesty's Revenue & Customs (HMRC) is the UK department ... Read More
9. 4 MarFake Power and Broadband Utility Bills serve Banking Trojans to Aussies April 22, 2019 | Dr. Fahim Abbasi In our previous blog we highlighted how a group of scammers were targeting ... Read More

February 2019

1. 27 FebAnnouncing the 2019 Trustwave Global Security Report April 25, 2019 Today we released our 2019 Global Security Report. The report is based on the ... Read More
2. 21 FebReversing Gh0stRAT part 2: the DDOS-ening May 02, 2019 | James Quinn This is a guest post James Quinn, a SOC analyst from Binary Defense. Read More
3. 14 FebPatch Tuesday, June 2019 June 11, 2019 | Karl Sigler For June's Patch Tuesday, Microsoft is releasing four advisories and patches ... Read More
4. 14 FebPatch Tuesday, May 2019 May 14, 2019 | Karl Sigler May's Patch Tuesday is here and brings with it patches for 79 CVEs. Twenty-two ... Read More
5. 13 FebHacker's Wish Come True After Infecting Visitors of Make-A-Wish Website With Cryptojacking November 19, 2018 | Simon Kenin After coming back from a vacation, the first thing to do is catch up with what ... Read More
6. 12 FebDemystifying Obfuscation Used in the Thanksgiving Spam Campaign November 26, 2018 | Rodel Mendrez During Thanksgiving week, we noticed this quite unusual XML-format MS Office ... Read More
7. 11 FebModSecurity v3.0.3: What To Expect November 27, 2018 | Felipe "Zimmerle" Costa At precisely 155 commits ahead of the latest version, ModSecurity version 3.0.3 ... Read More
8. 8 FebSheepl : Automating People for Red and Blue Tradecraft November 27, 2018 | Matt Lorentzen Whilst there is a wealth of information out there about how to build ... Read More
9. 7 FebMicrosoft Patch Tuesday, November 2018 November 27, 2018 | Karl Sigler The second to last Patch Tuesday of 2018 is here with patches for 55 CVEs. This ... Read More
10. 6 FebExploring and Modifying Android and Java Applications for Security Research November 27, 2018 | Martin Rakhmanov Sometimes pentesters and security researchers need to modify existing Java ... Read More
11. 6 FebTaking Advantage of AJAX for Account Enumeration November 27, 2018 | Manuel Nader Context AJAX stands for Asynchronous JavaScript And XML. It’s a set of web ... Read More

January 2019

1. 31 JanDecoding Hancitor Malware with Suricata and Lua November 27, 2018 | Bryant Smith Many types of malware send and receive data via HTTP. They may either be ... Read More
2. 23 JanScavenger: Post-Exploitation Tool for Collecting Vital Data December 05, 2018 | Philip Pieterse ‘Scavenger’ - definition [noun]: a person who searches for and collects ... Read More
3. 23 JanAnnouncing ModSecurity version 2.9.3 December 05, 2018 | Victor Hora We are happy to announce ModSecurity version 2.9.3! Read More
4. 22 JanMagecart - An overview and defense mechanisms December 06, 2018 | Victor Hora Summary This blog post offers insight into Magecart and offers advice on how to ... Read More
5. 21 JanMicrosoft Patch Tuesday, December 2018 December 11, 2018 | Karl Sigler The last Patch Tuesday of 2018 is here and we are easing into the New Year with ... Read More
6. 8 JanHacking Online Coupons December 18, 2018 | Lena Frid We all shop online. How many times, just before placing an online order, have ... Read More

2018 68

December 2018

1. 20 DecRise of the Webminers December 19, 2018 | Oren Mashal About a year ago webminers began to appear on more and more websites. It was ... Read More
2. 19 DecKernel Buffer Overflow in Trusteer Rapport for MacOS December 20, 2018 | Neil Kettle Trustwave recently reported a Kernel based vulnerability in a driver bundled ... Read More
3. 18 DecPatch Tuesday, January 2019 January 08, 2019 | Karl Sigler Historically January has been a relatively light month for Patch Tuesday, but ... Read More
4. 11 DecSpam Masters of Extortion, Illusion and Evasion January 21, 2019 | Dr. Fahim Abbasi In 2018 we saw a rise in sextortion scams in which cyber-criminals notified ... Read More
5. 6 DecOverview of Meltdown and Spectre January 22, 2019 | SpiderLabs Researcher You have probably heard the news of new vulnerabilities that affect most major ... Read More
6. 5 DecUsing IPv6 to Bypass Security January 23, 2019 | SpiderLabs Researcher Introduction Read More
7. 5 DecLiving off the LAN January 23, 2019 | Alejandro Baca When an attacker uses tools native to the operating system it is referred to as ... Read More

November 2018

1. 27 NovWowza Streaming Engine Manager Directory Traversal And Local File Inclusion February 11, 2019 | Sean Melia CVE-2018-19365: Root local file inclusion in Wowza SRM 4.7.4.01. Read More
2. 27 NovMoney Laundering: Washing Your Greens in the Underground - Part 3 of 3 February 08, 2019 | SpiderLabs Researcher “Not having to worry about money is almost like not having to worry about ... Read More
3. 27 NovLifesize Team, Room, Passport & Networker Remote OS Command Injection February 07, 2019 | Simon Kenin While working on various vulnerability research projects, I encountered ... Read More
4. 27 NovSextortion Scam Now With Malicious Downloader February 06, 2019 | Diana Lopera Sextortion scams were a hit campaign last year and are continuing in 2019 with ... Read More
5. 27 NovSextortion Scam Now With Malicious Downloader February 06, 2019 | Diana Lopera Sextortion scams were a hit campaign last year and are continuing in 2019 with ... Read More
6. 27 NovLatest Flash 0-Day (CVE-2018-15982) Leaves its Office Doc Friend Behind January 31, 2019 | SpiderLabs Researcher CVE-2018-15982 is the Flash 0day that was patched by Adobe at the beginning of ... Read More
7. 26 NovPatch Tuesday, February 2019 February 12, 2019 | Karl Sigler With today's Patch Tuesday for February, things are back to normal with patches ... Read More
8. 19 NovPassword Protected Word Document Delivers HERMES Ransomware February 13, 2019 | SpiderLabs Researcher Evading AV detection is part of a malware author's routine in crafting spam ... Read More

October 2018

1. 22 OctMapping Social Media with Facial Recognition: A New Tool for Penetration Testers and Red Teamers August 08, 2018 | Jacob Wilkin Performing intelligence gathering is a time-consuming process, it typically ... Read More
2. 22 OctCVE-2018-2892 - Kernel Level Privilege Escalation in Oracle Solaris July 24, 2018 | Neil Kettle Trustwave recently discovered a locally exploitable issue in all current ... Read More
3. 22 OctMalicious SettingContent now Delivered Through PDF July 23, 2018 Recently, a proof-of-conceptemerged on how the filetype SettingContent can be ... Read More
4. 22 OctDanaBot Riding Fake MYOB Invoice Emails July 16, 2018 | Dr. Fahim Abbasi Authors: Dr. Fahim Abbasi and Diana Lopera Read More
5. 22 OctPatch Tuesday, July 2018 July 10, 2018 | Karl Sigler July's Patch Tuesday is here with patches for 53 CVEs and the standard roll up ... Read More
6. 22 OctWeb Application Security-ModSecurity Commercial Rules, Update for June 2018 June 30, 2018 Overview for rules released by Trustwave SpiderLabs in November for ModSecurity ... Read More
7. 18 OctPatch Tuesday, August 2018 August 14, 2018 | Karl Sigler Patch Tuesday, August 2018 Read More
8. 9 OctMalspam Campaign Targets Banks Using Microsoft Publisher August 17, 2018 | Homer Pacag It's very unusual for malware authors to utilize publishing software like ... Read More

September 2018

1. 27 SepAlina: Following The Shadow Part 1 August 18, 2018 | Josh Grunzweig Last I spoke with you, I went into the details of a family of Point of Sale ... Read More
2. 13 SepBank Malspam Revisited August 22, 2018 | Phil Hay Last week we wrote about some malicious spam containing Microsoft Publisher ... Read More
3. 4 SepCVE-2018-8006: XSS in Apache ActiveMQ August 24, 2018 | Bruno Oliveira A cross site scripting (XSS) vulnerability exists in Apache ActiveMQprior to ... Read More

August 2018

1. 31 AugOracle Critical Patch Update July 2018 and Security Alert for CVE-2018-3110 August 27, 2018 | Vladimir Zakharevich On July 17th 2018 Oracle released Critical Patch Update (CPU) in accordance ... Read More
2. 30 AugFirework: Leveraging Microsoft Workspaces in a Penetration Test August 30, 2018 Overview WCX files can be used to configure a Microsoft Workplace on a system ... Read More
3. 27 AugDrupal Cache Poisoning SA-CORE-2018-005 August 31, 2018 (Analysis by Lena Frid, Bar Menachem and Victor Hora) Read More
4. 24 AugCVE-2018-16962: Webroot SecureAnywhere macOS Kernel Level Memory Corruption September 13, 2018 | Neil Kettle Trustwave recently discovered a locally exploitable issue in the macOS version ... Read More
5. 22 AugCredential Leak Flaws in Windows PureVPN Client September 27, 2018 Using a VPN (Virtual Private Network) can bring many advantages, particularly ... Read More
6. 18 AugMicrosoft Patch Tuesday, October 2018 October 09, 2018 | Karl Sigler October's Patch Tuesday is here and with it come patches for 49 CVEs and a ... Read More
7. 17 AugThe Underground Job Market – Part 2 of 3 October 18, 2018 | SpiderLabs Researcher "Leave your ego at the door every morning, and just do some truly great work. ... Read More
8. 14 AugTWSL2011-004: Cross-Site Scripting Vulnerability in ZyXEL ZyWALL 70 Firewall October 22, 2018 | Josh Grunzweig The SpiderLabs team at Trustwave published a new advisory today, which details ... Read More
9. 8 AugUnderground Code of Honor – Part 1 of 3 October 22, 2018 | SpiderLabs Researcher "We are all honorable men here, we do not have to give each other assurances as ... Read More

July 2018

1. 24 JulWD My Cloud EX2 Serves Your Files to Anyone October 22, 2018 | Martin Rakhmanov Western Digital's My Cloud is a popular storage/backup device that lets users ... Read More
2. 23 JulUnpatched Remote Code Execution in Reprise License Manager October 22, 2018 During a recent penetration testing engagement, I came across a particularly ... Read More
3. 20 JulCUPS Local Privilege Escalation And Sandbox Escapes July 11, 2018 | Dan Bastone CVE-2018-4180, CVE-2018-4182, CVE-2018-4183, CVE-2018-6553, CVE-2018-4181: ... Read More
4. 17 JulPatch Tuesday, September 2018 September 04, 2018 | Karl Sigler September's Patch Tuesday is here with patches for 61 CVEs and two roll up ... Read More
5. 16 JulSingHealth Data Breach – An Analytical Perspective October 22, 2018 Executive Summary On July 20th 2018, the Singapore authorities announced1 that ... Read More
6. 11 JulRed Alert v2.0: Misadventures in Reversing Android Bot Malware October 22, 2018 | Rodel Mendrez (Analysis by Rodel Mendrez and Lloyd Macrohon) Read More
7. 10 Jul10 Years On – A Look Back at MS08-067 October 23, 2018 | Trustwave SpiderLabs It has been ten years since the release of MS08-067. Unlike many of the other ... Read More

June 2018

1. 30 JunDOH! DNS Over HTTPS Poses Possible Risks to Enterprises October 26, 2018 | David Middlehurst Introduction David Middlehurst of Trustwave SpiderLabs presented at the first ... Read More
2. 12 JunCHM Badness Delivers a Banking Trojan December 18, 2017 | Rodel Mendrez Like good old Microsoft Office Macros, Compiled HTML (CHM) Help files have been ... Read More
3. 12 JunSneaky .BAT File Leads to Spoofed Banking Page December 13, 2017 | Nicholas Ramos If you thought using BAT files was an old hat, think again. While monitoring ... Read More
4. 1 JunBrickerBot mod_plaintext Analysis December 19, 2017 | Simon Kenin A week ago, the author of BrickerBot claimed that they retired and published ... Read More

May 2018

1. 24 MayMicrosoft Patch Tuesday, January 2018 January 09, 2018 Happy 2018 everyone! January's Patch Tuesday will ease you into the new year ... Read More
2. 15 MayModSecurity Version 3.0 Announcement January 10, 2018 | Felipe "Zimmerle" Costa libModSecurity aka ModSecurity version 3.0 is out there. libModSecurity starts ... Read More
3. 10 MayModSecurity - News and Commercial Rules Update January 23, 2018 | Victor Hora Over the past few months there has been a lot going on with ModSecurity. There ... Read More
4. 8 MayInspecting Encrypted Network Traffic with JA3 February 01, 2018 | Bryant Smith Part of our job as security researchers is keeping up with new tools and ... Read More

April 2018

1. 27 AprMultiple Vulnerabilities in WD MyCloud February 01, 2018 | Martin Rakhmanov While performing security research on personal storage I found some ... Read More
2. 18 AprMultiple Vulnerabilities in NETGEAR Routers February 07, 2018 | Martin Rakhmanov Last year I discovered multiple vulnerabilities in NETGEAR products. Now that ... Read More
3. 11 AprMass MikroTik Router Infection – First we cryptojack Brazil, then we take the World? February 12, 2018 | Simon Kenin On July 31st , just after getting back to the office from my talk at RSA Asia ... Read More
4. 10 AprMicrosoft Patch Tuesday, February 2018 February 13, 2018 February's Patch Tuesday is here and after the light January, it's back with ... Read More

March 2018

1. 26 MarFlash Zero Day (CVE-2018-4878) February 13, 2018 | Karl Sigler A zero day Flash exploit caught targeting South Korean users was announced by ... Read More
2. 13 MarAdvanced Deception with BEC Fraud Attacks February 14, 2018 | Dr. Fahim Abbasi Background Business Email Compromise (BEC) email fraud, also known as "CEO ... Read More

February 2018

1. 21 FebMulti-Stage Email Word Attack Without Macros February 14, 2018 | Homer Pacag Malware authors often distribute malware through code macros in Microsoft ... Read More
2. 14 FebPatch Tuesday, March 2018 March 13, 2018 | Karl Sigler March is coming in like a lion with this Patch Tuesday. The release patches 73 ... Read More
3. 14 FebFake ASIC Renewal Spam Delivers Malware to Australian Companies February 21, 2018 | Dr. Fahim Abbasi The Australian Securities and Investment Commission (ASIC) is an independent ... Read More
4. 13 FebPatch Tuesday, April 2018 April 10, 2018 | Karl Sigler April's Patch Tuesday didn't let up much compared to March. Overall April ... Read More
5. 13 FebCrypter-as-a-Service Helps jRAT Fly Under The Radar March 26, 2018 | Rodel Mendrez (Contributor: Dr. Fahim Abbasi and Phil Hay) Read More
6. 12 FebAll Your Base64 Are Belong To Us – Dynamic vs. Static Analysis of Web Content April 11, 2018 | Simon Kenin I recently encountered an interesting phishing scheme when reviewing telemetry ... Read More
7. 7 FebJolokia Vulnerabilities – RCE & XSS April 18, 2018 | Olga Barinova CVE-2018-1000130, CVE-2018-1000129: Remote Code Execution via JNDI injection ... Read More
8. 1 FebPatch Tuesday, May 2018 May 08, 2018 | Karl Sigler May's Patch Tuesday is here and it looks like these monthly releases have ... Read More
9. 1 Feb'Drupalgeddon2' Recent Developments April 27, 2018 | Victor Hora Drupal, the popular Content Management System, (might) have seen better days. ... Read More

January 2018

1. 23 JanCVE-2018-1000136 - Electron nodeIntegration Bypass May 10, 2018 | Brendan Scarvell A few weeks ago, I came across a vulnerability that affected all current ... Read More
2. 10 JanCVE-2018-8174 and Forcing Internet Explorer Exploits May 15, 2018 | Karl Sigler A zero day exploit was discovered targeting trade agencies and other related ... Read More
3. 9 JanBreakdown of the EFAIL Email Vulnerabilities May 24, 2018 | Phil Hay hullabaloo [huhl-uh-buh-loo], noun, plural hullabaloos. Read More

2017 78

December 2017

1. 19 DecBreaking Randomness In The Ethereum Universe [Part 1] June 01, 2018 | Elliot Ward This article focuses on generating random numbers on-chain and what the ... Read More
2. 18 DecPatch Tuesday, June 2018 June 12, 2018 | Karl Sigler For June's Patch Tuesday Microsoft is patching 50 CVEs and releasing 2 ... Read More
3. 13 DecAdobe Flash Player 0-Day (CVE-2018-5002) June 12, 2018 | SpiderLabs Researcher An Adobe advisory regarding a zero-day vulnerability in Adobe Flash Player was ... Read More
4. 12 DecPetya From The Wire: Detection using IDPS July 13, 2017 | Bryant Smith Most malware that traverses a network do so with specific indicators, some of ... Read More
5. 1 DecModSecurity Web Application Firewall - Commercial Rules Update (1) July 13, 2017 | SpiderLabs Researcher We have released new commercial rules for ModSecurity Web Application Firewall ... Read More

November 2017

1. 22 NovSpammed JScript Phones Home To Download NemucodAES And Kovter July 25, 2017 | Nicholas Ramos Contributed by: Gerald Carsula, Rodel Mendez and Nicholas Ramos Read More
2. 17 NovTale of the Two Payloads – TrickBot and Nitol August 04, 2017 | Rodel Mendrez A couple of weeks ago, we observed the Necurs botnet distributing a new malware ... Read More
3. 14 NovMicrosoft Patch Tuesday, August 2017 August 08, 2017 August's Patch Tuesday brings with it a relatively light month closing holes in ... Read More
4. 6 NovChip Off the Old EMV August 08, 2017 | Shawn Kanady Recently, Jason Knowles of ABC 7's I-Team asked us, "What is the security risk ... Read More

October 2017

1. 31 OctAnnouncing ModSecurity version 2.9.2 August 09, 2017 | Felipe "Zimmerle" Costa We recently released ModSecurity version 2.9.2. The release contains a number ... Read More
2. 26 OctModSecurity Web Application Firewall - Commercial Rules Update (2) August 22, 2017 | Victor Hora We have released new commercial rules for ModSecurity Web Application Firewall ... Read More
3. 18 OctNecurs Unleashed “Locky diablo” from Hell August 23, 2017 | Nicholas Ramos Over two days in early August (the 8th and 9th), amidst of the active ... Read More
4. 12 OctCuckoo Linux Subsystem: Some Love for Windows 10 August 25, 2017 | Gerald Carsula I normally use Linux for my malware analysis lab machine. But, recently, I got ... Read More
5. 10 OctThe Spam, JavaScript and Ransomware Triangle August 29, 2017 | Dr. Fahim Abbasi Authors: Dr. Fahim Abbasi and Nicholas Ramos Read More
6. 9 OctModSecurity version 3.0.0 first release candidate August 30, 2017 | Victor Hora Recently we announced the first release candidate for libModSecurity (also as ... Read More

September 2017

1. 27 SepLinux Based Inter-Process Code Injection Without Ptrace (2) September 05, 2017 | Rory McNamara This article shows a technique to inject code into a Linux process without ... Read More
2. 15 SepModSecurity Web Application Firewall - Commercial Rules Update (3) September 14, 2017 | Victor Hora We have released new commercial rules for ModSecurity Web Application Firewall ... Read More
3. 14 SepIntroducing Burplay, A Burp Extension for Detecting Privilege Escalations September 15, 2017 | SpiderLabs Pen Testing LAC The seventh entry on the most recent OWASP Top 10 release (from 2013, due to ... Read More
4. 5 SepReviewing Ethereum Smart Contracts September 27, 2017 | Eric Rafaloff This article examines the similarities between traditional code review and ... Read More

August 2017

1. 30 AugPost-Soviet Bank Heists: A Hybrid Cybercrime Study October 09, 2017 Today we are publishing a SpiderLabs Advanced Threat Report that details a ... Read More
2. 29 AugMicrosoft Patch Tuesday, October 2017 October 10, 2017 October is here and brings with it patches for 62 CVEs and a handful of ... Read More
3. 25 AugLocky Part 2: As the Seasons Change so is Locky October 12, 2017 | Homer Pacag It's that time of year when the seasons are changing. The Northern Hemisphere ... Read More
4. 23 AugModSecurity Web Application Firewall - Commercial Rules Update(4) October 18, 2017 | Victor Hora We have recently released new commercial rules for ModSecurity Web Application ... Read More
5. 22 AugAn Easy Introduction to Steganography October 26, 2017 | Jesus Olguin Some time ago, a person reached out to Trustwave to get answers regarding some ... Read More
6. 16 AugUNC Path Injection with Microsoft Access June 24, 2019 | Stephan Borosh Introduction Steve Borosh is a Principal Security Consultant for Trustwave and ... Read More
7. 16 AugSpiderLabs Radio for the week of November 10, 2014 November 15, 2014 In this episode: Read More
8. 9 AugThe Complexity amidst Simplicity: Exploiting the MS Office DDE Feature October 31, 2017 | Nicholas Ramos Albert Einstein once said, "Out of Complexity, Find Simplicity" but it also ... Read More
9. 8 AugMicrosoft Patch Tuesday, November 2017 November 14, 2017 It's that time of the month again for Microsoft updates. November's Patch ... Read More
10. 8 AugDenial of Service Vulnerability in Brother Printers November 06, 2017 A vulnerability in the web front-end of Brother printers (called Debut) allows ... Read More
11. 4 AugHelping to Secure your PostgreSQL Database November 17, 2017 | Christopher Bielinski When big high-tech companies like Apple, Red Hat and Cisco use PostgreSQL in ... Read More

July 2017

1. 25 JulUsing Buildroot for Security Research of IoT and Other Embedded Systems November 22, 2017 | Martin Rakhmanov These days many vendors, like IoT vendors, use Linux running on top of ARM CPU ... Read More
2. 13 JulMicrosoft Patch Tuesday, December 2017 December 12, 2017 Today marks the last Microsoft Patch Tuesday of 2017 and, with only 34 CVEs ... Read More
3. 13 JulSimplifying Password Spraying December 01, 2017 | Jacob Wilkin As a penetration tester, attaining Windows domain credentials are akin to ... Read More
4. 11 JulProtecting Yourself from MongoDB Ransomware March 29, 2017 | Christopher Bielinski In the realm of malware, ransomware has been king for the last few years, ... Read More
5. 10 JulAnd Then? Where is the Risk with Steganography? March 30, 2017 | Jesus Olguin In the previous posts, Steganography... what is that? and Steganalysis, the ... Read More

June 2017

1. 29 JunMicrosoft Patch Tuesday, April 2017 April 11, 2017 | SpiderLabs Researcher April Patch Tuesday is here and, like the change of the seasons, this release ... Read More
2. 29 JunUnderstanding and Discovering Open Redirect Vulnerabilities April 10, 2017 | SpiderLabs Researcher One of the most common and largely overlooked vulnerabilities by web developers ... Read More
3. 28 JunMultiple Vulnerabilities in Avast Antivirus April 25, 2017 | Martin Rakhmanov Last year I decided to do some security research on an antivirus product. Avast ... Read More
4. 27 JunCarbanak Continues To Evolve: Quietly Creeping into Remote Hosts April 28, 2017 | James Antonakos Introduction Read More
5. 21 JunAirachnid: Web Cache Deception Burp Extender May 09, 2017 | Johan Snyman Introduction Read More
6. 19 JunMicrosoft Patch Tuesday, May 2017 May 09, 2017 | SpiderLabs Researcher Microsoft is releasing 56 CVEs for the May 2017 Patch Tuesday today. This ... Read More
7. 16 JunThe WannaCry Ransomware Campaign May 13, 2017 | Karl Sigler By now you have likely heard about the WannaCry (aka WannaCrypt) ransomware ... Read More
8. 14 JunWannaCry: We Want to Cry May 15, 2017 | Phil Hay Contributors: Phil Hay, Rodel Mendrez, Gerald Carsula, Nicholas Ramos, Homer ... Read More
9. 13 JunWannaCry: We Want to Cry May 15, 2017 | Phil Hay For the last few days the WannaCry ransomware event created mayhem, where ... Read More
10. 2 JunAdvanced Malware Detection with Suricata Lua Scripting May 18, 2017 | Bryant Smith Normal IDPS signatures using either Snort or Suricata have quite a few options ... Read More
11. 2 JunTheShadowBrokers Babytalk Translation May 16, 2017 TheShadowBrokers have just released a blog post (written in a child-like style ... Read More

May 2017

1. 31 MayURSNIF is Back Riding a New Wave of Spam May 19, 2017 | Nicholas Ramos The infamous data-stealing URSNIF malware has done it again and it's here to ... Read More
2. 19 MayNecurs Recurs May 31, 2017 | Homer Pacag The Necurs botnet, which was responsible for millions of malicious spam ... Read More
3. 18 MayFakeGlobe and Cerber Ransomware: Sneaking under the radar while WeCry June 02, 2017 | Nicholas Ramos Recently, we observed a constant influx of spam that distributes two ransomware ... Read More
4. 16 MayThe WannaCry Impact on Databases Trustwave Database Security Knowledgebase Special Update 5.15 June 02, 2017 | Lolita Chandra WannaCry is a network worm that exploits a vulnerability in Microsoft's ... Read More
5. 15 MayKOVTER and CERBER on a One-Two Punch using Fake Delivery Notification June 14, 2017 | Nicholas Ramos We previously outlined a spam campaign that delivered FAKEGLOBE and CERBER ... Read More
6. 15 MayMicrosoft Patch Tuesday, June 2017 June 13, 2017 | SpiderLabs Researcher For the June 2017 Patch Tuesday Microsoft is releasing 97 CVEs, nearly double ... Read More
7. 13 MayModSecurity Web Application Firewall - Commercial Rules Update June 16, 2017 | SpiderLabs Researcher We have just released new commercial rules for ModSecurity Web Application ... Read More
8. 9 MayModSecurity version 3: Fuzzing as part of the QA June 21, 2017 | Felipe "Zimmerle" Costa The stability of any given project is often tracked by its maturity, which is ... Read More
9. 9 MayMinimalist Alina PoS Variant Starts Using SSL June 19, 2017 | Rodel Mendrez More than four years ago, we published a series of blogs discussing in-depth ... Read More

April 2017

1. 28 AprThe Petya/NotPetya Ransomware Campaign June 27, 2017 | SpiderLabs Researcher This is an ongoing, emerging story and may be updated after posting. Read More
2. 25 Apr0-Day Alert: Your Humax WiFi Router Might Be In Danger June 28, 2017 | SpiderLabs Pen Testing LAC Over the years WiFi Routers have been notoriously susceptible to simple ... Read More
3. 11 AprElephone P9000 Lock Screen Lockout Bypass June 29, 2017 | Jacob Wilkin Brute force attacks against smartphones are not usually a viable attack vector. ... Read More
4. 10 AprPetya Ransomware: A glimpse of the past, the present, and the future June 29, 2017 | Nicholas Ramos Ransomware seem to be the trend now and this type of malware will no doubt ... Read More

March 2017

1. 30 MarA Computational Complexity Attack against Racoon and ISAKMP Fragmentation July 10, 2017 | Neil Kettle Trustwave recently reported a remotely exploitable computational complexity ... Read More
2. 29 MarMicrosoft Patch Tuesday, July 2017 July 11, 2017 July's Patch Tuesday brings patches for 54 CVEs, nearly half the number patched ... Read More
3. 16 MarOWASP ModSecurity CRS Version 3.0 RC2 Released October 19, 2016 | Chaim Sanders The OWASP Core Rule Set (CRS) is an Open Source project run by the Open Web ... Read More
4. 15 MarBopup Communications Server Remote Buffer Overflow Vulnerability November 04, 2016 | Neil Kettle Trustwave recently discovered a remotely exploitable issue in all current ... Read More
5. 15 MarAbout SAP Adaptive Server Enterprise dbcc import_sproc SQL injection vulnerability (CVE-2016-7402) October 20, 2016 | Martin Rakhmanov This vulnerability was introduced in SAP Adaptive Server Enterprise 16.0 SP02 ... Read More
6. 14 MarOWASP Core Rule Set 3.0.0 (Final) release November 11, 2016 | Chaim Sanders The OWASP Core Rule Set (CRS) team is excited to announce the immediate ... Read More
7. 1 MarNew Carbanak / Anunak Attack Methodology November 14, 2016 | SpiderLabs Researcher In the last month Trustwave was engaged by multiple hospitality businesses for ... Read More

February 2017

1. 10 FebA Backdoor in Skype for Mac OS X December 12, 2016 | SpiderLabs Pen Testing LAC Trustwave recently reported a locally exploitable issue in the Skype Desktop ... Read More
2. 8 FebMicrosoft Patch Tuesday, December 2016 December 13, 2016 | SpiderLabs Researcher December's Patch Tuesday is here to greet you with the pleasant tidings of ... Read More
3. 3 FebRaiding the Piggy Bank: Webshell Secrets Revealed December 19, 2016 | James Antonakos Introduction Read More
4. 2 FebSteganalysis, the Counterpart of Steganography December 22, 2016 | Jesus Olguin In my last blog post I discussed the art of embedding secret messages in any ... Read More

January 2017

1. 30 JanTerror Exploit Kit? More like Error Exploit Kit January 09, 2017 | Simon Kenin Q: What does it take to create a simple, yet fully functioning exploit kit? Read More
2. 27 JanOperation Grand Mars: a comprehensive profile of Carbanak activity in 2016/17 January 18, 2017 | SpiderLabs Researcher The Trustwave SpiderLabs team has been actively tracking a malicious campaign ... Read More
3. 27 JanMicrosoft Patch Tuesday, January 2017 January 10, 2017 | SpiderLabs Researcher It's everyone's favorite Patch Tuesday, January's Patch Tuesday. Historically ... Read More
4. 23 JanIs ModSecurity’s SecRules Turing Complete? January 20, 2017 | Chaim Sanders Have you ever seen a rule for ModSecurity? They may look similar to the ... Read More
5. 20 JanTwo Privilege Escalation Vulnerabilities in McAfee Security Scan Plus January 23, 2017 | Martin Rakhmanov This post will discuss two separate Local Privilege Escalation vulnerabilities ... Read More
6. 18 JanCreating the ModSecurity v3 IDS connector as part of Google Summer of Code January 27, 2017 | Trustwave SpiderLabs A note from the Trustwave Spiderlabs ModSecurity team: Read More
7. 10 JanSVG Files Are Not As Benign As It May Seem January 27, 2017 | Rodel Mendrez Bad guys are getting quite creative trying to evade spam filters and antivirus ... Read More
8. 9 JanCVE-2017-5521: Bypassing Authentication on NETGEAR Routers January 30, 2017 | Simon Kenin Home routers are the first and sometimes last line of defense for a network. ... Read More

2016 61

December 2016

1. 22 DecUnderground Scams: Cutting the Head Off a Snake February 02, 2017 | Simon Kenin Shortly after publishing our post about Terror EK, "King Cobra" (a Twitter ... Read More
2. 19 DecDatabase Security Knowledgebase Update 5.11 February 03, 2017 | Lolita Chandra This month's update for Database Security Knowledgebase is now available. Read More
3. 13 DecUnauthenticated Backdoor Access in Unanet February 08, 2017 | Chaim Sanders The default configuration of the Unanet web application has a backdoor that can ... Read More
4. 12 DecHanz Ostmaster’s revenge: An SSL Validation issue February 10, 2017 | Chaim Sanders Why would I title a blog post with the name 'Hanz Ostmaster'? Don't worry, it's ... Read More

November 2016

1. 14 NovUndocumented Backdoor Account in DBLTek GoIP March 01, 2017 | Neil Kettle Trustwave recently reported a remotely exploitable issue in the Telnet ... Read More
2. 11 NovMicrosoft Patch Tuesday, March 2017 March 14, 2017 | SpiderLabs Researcher We knew that the Microsoft's Valentine's gift to cancel Patch Tuesday on ... Read More
3. 8 NovHey Buddy, Can You Spare a Log? Adventures in Log-Based Threat Hunting March 15, 2017 | James Antonakos A long time ago, in a blog far, far away (August 1, 2016: Slinging Hash: ... Read More
4. 4 NovDatabase Security Knowledgebase Update 5.12 March 15, 2017 | Lolita Chandra This month's update for Database Security Knowledgebase is now available. ... Read More

October 2016

1. 20 OctAuthentication and Encryption in PAS Web Shell Variant March 16, 2017 | Sachin Deodhar Introduction During a recent incident response case, we were tasked with ... Read More
2. 19 OctExploiting Privilege Escalation in Serv-U by SolarWinds March 22, 2017 | Leopold von Niebelschuetz-Godlewski I was recently working on an external network penetration test where I ... Read More
3. 12 OctAbout SAP ASE DSAM SQL Injection (CVE-2016-4013) May 11, 2016 | Martin Rakhmanov SAP introduced a new feature in SP02 for Adaptive Server Enterprise 16.0 that ... Read More
4. 11 OctEarlier Flaws Revisited: MS Office and PDF Combo Attack May 16, 2016 | Erwin Balunsat Recently, we came across a campaign spamming out emails containing both DOC and ... Read More

September 2016

1. 30 SepSuzy’s Phishing Season May 17, 2016 | Simon Kenin Although most SWG-related blogs talk about exploit kits and malicious code, ... Read More
2. 19 SepDigging in the Spam Folder June 03, 2016 | James Antonakos Introduction Unlike spam that appears in my real-world mailbox, the numerous ... Read More
3. 14 SepZero Day Auction for the Masses June 09, 2016 | SpiderLabs Researcher UPDATE: The seller once again lowered their price on the 6th of June to ... Read More
4. 13 SepLinux Kernel ROP - Ropping your way to # (Part 1) June 10, 2016 | Vitaly Nikolenko Kernel ROP In-kernel ROP (Return Oriented Programming) is a useful technique ... Read More
5. 2 SepMicrosoft Patch Tuesday, June 2016 June 14, 2016 | SpiderLabs Researcher June's Patch Tuesday doesn't hold many surprises and is similar to the past ... Read More

August 2016

1. 15 AugLinux Kernel ROP - Ropping your way to # (Part 2) June 22, 2016 | Vitaly Nikolenko Introduction In Part 1 of this tutorial, we have demonstrated how to find ... Read More
2. 8 AugAbout Lenovo Solution Center 3.3.002 Vulnerabilities (CVE-2016-5249) June 23, 2016 | Martin Rakhmanov After patching set of issues reported by Trustwave SpiderLabs last month, ... Read More
3. 7 AugPoSeidon Adventures in Memory June 24, 2016 | Shawn Kanady Background Read More
4. 4 AugCEO Fraud Scams and How to Deal With Them at the Email Gateway June 28, 2016 | Phil Hay Email scams known as "CEO Fraud" are very common right now. They are a type of ... Read More
5. 2 AugMalware Authors Adopt CEO Fraud Techniques June 29, 2016 | Erwin Balunsat CEO Fraud scams, a type of Business Email Compromise (BEC), have gained ... Read More
6. 1 AugMicrosoft Patch Tuesday, November 2016 November 08, 2016 | SpiderLabs Researcher The November Patch Tuesday is here and it's a big one with 14 bulletins ... Read More
7. 1 AugMicrosoft Patch Tuesday, July 2016 July 12, 2016 | SpiderLabs Researcher July's Patch Tuesday is here and brings with it five bulletins rated Critical ... Read More
8. 1 AugHow I Cracked a Keylogger and Ended Up in Someone's Inbox July 01, 2016 | Rodel Mendrez It all started from a spam campaign. Figure 1 shows a campaign we picked up ... Read More

July 2016

1. 12 JulDenial of Service: A Survival Guide August 01, 2016 | Yannick Bedard From Anonymous style SYN flooding to Application layer denial of service, ... Read More
2. 1 JulSlinging Hash: Speeding Cyber Threat Hunting Methodologies via Hash-Based Searching August 01, 2016 | James Antonakos The term "hash" is thrown around in casual IT conversation quite a bit ... Read More

June 2016

1. 29 JunSAP ASE file creation vulnerability (CVE-2016-6196) August 02, 2016 | Martin Rakhmanov Recently SAP released a patch for an Adaptive Server Enterprise vulnerability ... Read More
2. 28 JunTo Obfuscate, or not to Obfuscate August 04, 2016 | Eric Merritt Malware's goal is to bypass computer defenses, infect a target, and often ... Read More
3. 24 JunTurning Up The Heat on IoT: TRANE Comfortlink XL850 August 07, 2016 | Jeff Kitson The Internet of Things (IoT) continues to explode in the consumer market as ... Read More
4. 23 JunMicrosoft Patch Tuesday, August 2016 August 08, 2016 | SpiderLabs Researcher Today is August's Patch and with only 9 bulletins with 27 unique CVEs it's one ... Read More
5. 22 JunOWASP ModSecurity CRS Version 3.0 RC1 Released August 15, 2016 | Chaim Sanders Trustwave has been dedicated to supporting ModSecurity and the associated ... Read More
6. 14 JunSundown EK – Stealing Its Way to the Top September 02, 2016 | SpiderLabs Researcher Sundown is one of the newest Exploit Kits on the market these days, and like ... Read More
7. 10 JunMicrosoft Patch Tuesday, September 2016 September 13, 2016 | SpiderLabs Researcher September's Patch Tuesday is upon us and it's the biggest one so far this year. ... Read More
8. 9 JunNecurs – the Heavyweight Malware Spammer September 14, 2016 | Phil Hay Today we want to dwell upon a pesky botnet that goes by the name of Necurs, and ... Read More
9. 3 JunSteganography... what is that? September 19, 2016 | Jesus Olguin When people think about Information Security the first word that generally ... Read More

May 2016

1. 17 MayRIG's Facelift September 30, 2016 | Rami Kogan RIG EK has been in the headlines recently mainly because both EITEST and ... Read More
2. 16 MayMicrosoft Patch Tuesday, October 2016 October 11, 2016 | SpiderLabs Researcher October has arrived with seasonal changes and a new Microsoft Patch Tuesday. ... Read More
3. 11 MayDown the Rabbit Hole: Extracting Maliciousness from MSG Files Without Outlook October 12, 2016 | Rodel Mendrez Email As Infection Vector Read More
4. 10 MayEndless Evasion Racing Game December 27, 2015 | Rami Kogan In the past year we have been exploring the Magnitude Exploit Kit - one of the ... Read More
5. 10 May3-in-1 Malware Infection through Spammed JavaScript Attachments December 22, 2015 | Rodel Mendrez Recently we've observed a massive uptick of malicious spam with JavaScript ... Read More
6. 10 MayProtecting Your Sites from Apache.Commons Vulnerabilities December 21, 2015 Overview A few weeks ago, FoxGlove Security released this important blog post ... Read More

April 2016

1. 12 AprNeutrino Exploit Kit – One Flash File to Rule Them All December 28, 2015 | Daniel Chechik There's been a bit of talk about the Neutrino exploit kit lately, most of it ... Read More
2. 1 AprAn Overview of the Upcoming libModSecurity December 28, 2015 | Felipe "Zimmerle" Costa libModSecurity is a major rewrite of ModSecurity. It preserves the rich syntax ... Read More

March 2016

1. 25 MarModSecurity Python Bindings: Parsing ModSecurity rules from Python December 29, 2015 | Felipe "Zimmerle" Costa One of the good things about the next generation of ModSecurity, libModSecurity ... Read More
2. 22 MarAbout CVE-2015-8518: SAP Adaptive Server Enterprise Extended Stored Procedure Unauthorized Invocation January 07, 2016 | Martin Rakhmanov SAP released an update for SAP ASE 16.0 and 15.7 that addresses a serious ... Read More
3. 10 MarNeutrino Exploit Kit Not Responding – Bug or Feature? February 04, 2016 | Daniel Chechik A couple of weeks ago we were looking at some exploit kits in one of our lab ... Read More
4. 10 MarSending ModSecurity Logs to MySQL February 02, 2016 | Chaim Sanders Previous Work Read More
5. 10 MarMicrosoft Patch Tuesday, January 2016 January 12, 2016 | SpiderLabs Researcher It's a new year and with it comes a fresh batch of CVEs. As expected this ... Read More
6. 9 MarBase64 versus Plaintext Observations February 05, 2016 | Chaim Sanders Recently we have been working on the libmodsecurity project. As part of the ... Read More
7. 8 MarMicrosoft Patch Tuesday, February 2016 February 09, 2016 | Karl Sigler February Patch Tuesday is here with double the number of vulnerabilities that ... Read More
8. 8 MarAngler Exploit Kit – Gunning For the Top Spot February 08, 2016 | Rami Kogan They say that with great power comes great responsibility. In the world of ... Read More
9. 7 MarAngler Takes Malvertising to New Heights March 04, 2016 | SpiderLabs Researcher We have just discovered an advertising campaign that has been placing malicious ... Read More
10. 4 MarData Extraction via String Concatenation in a Blind SQL Injection Vulnerability March 07, 2016 Day One: In Which The Heavens Part, But Only Slightly A few weeks ago while ... Read More

February 2016

1. 9 FebMicrosoft Patch Tuesday, March 2016 March 08, 2016 | SpiderLabs Researcher Today is March's Patch Tuesday with 13 bulletins and 39 unique CVEs, which is ... Read More
2. 8 FebPoSeidon Completionist March 08, 2016 | Eric Merritt Introduction Most gamers have explored every nook and cranny of their favorite ... Read More
3. 5 FebMassive Volume of Ransomware Downloaders being Spammed March 09, 2016 | Rodel Mendrez We are currently seeing extraordinarily huge volumes of JavaScript attachments ... Read More
4. 4 FebTWSL2016-003: Sophos Anti-Virus Mac OS X Version Update File Unlinking Vulnerability March 10, 2016 | Martin Rakhmanov While researching inter-process communication on Mac OS X, I found a small ... Read More
5. 2 FebTWSL2016-005: Memory corruption in a third-party component: how to find what’s wrong March 10, 2016 | Martin Rakhmanov In continuation of this post: debugging-sap-ase-net-provider-issues/ Read More

January 2016

1. 12 JanTWSL2016-004: Multiple Cross-Site Scripting (XSS) Vulnerabilities in Magnolia CMS March 10, 2016 | Michael Yuen LevelBlue SpiderLabs published an advisory today in conjunction with Magnolia ... Read More
2. 7 JanEvery Tool in the Tool Box March 22, 2016 | Eric Merritt Introduction When I teach people about reverse engineering, I often hear the ... Read More

2015 116

December 2015

1. 29 DecTWSL2016-006: Multiple XSS Vulnerabilities reported for Zen Cart March 25, 2016 | Sriram Akurati Today Trustwave released a vulnerability advisory in conjunction with Zen Cart. ... Read More
2. 28 DecMicrosoft Patch Tuesday, April 2016 April 12, 2016 | SpiderLabs Researcher April is here and with it comes a new Patch Tuesday. This month Microsoft is ... Read More
3. 28 DecIntercepting SSL And HTTPS Traffic With mitmproxy and SSLsplit April 01, 2016 Looking for vulnerabilities in mobile applications and smart home devices ... Read More
4. 27 DecMicrosoft Patch Tuesday, May 2016 May 10, 2016 | SpiderLabs Researcher May's Patch Tuesday is here and brings with it 16 Bulletins with 51 unique ... Read More
5. 22 DecDatabase Security Knowledgebase Update 5.01 May 10, 2016 | Lolita Chandra This month's update for Database Security Knowledgebase is now available. Read More
6. 21 DecPrivilege Escalation Vulnerability In Lenovo Solution Center (CVE-2016-1876) May 10, 2016 | Martin Rakhmanov LevelBlue has reported several issues in Lenovo software in the past. Last week ... Read More
7. 18 DecAbout Two SAP Adaptive Server Enterprise (ASE) Extended Procedure Subsystem Vulnerabilities September 03, 2015 Recently SAP patched two important security issues in Adaptive Server ... Read More
8. 15 DecSpiderLabs Radio for the Week of August 31, 2015 September 06, 2015 In this week's episode: Read More
9. 8 DecLessons in Spam JavaScript Obfuscation Layers September 08, 2015 | Brian Bebeau Spammers seem to be adding layers of obfuscation to their malware attachments ... Read More
10. 7 DecMicrosoft Patch Tuesday, September 2015 September 08, 2015 Today marks Patch Tuesday for September and this month brings with it 12 ... Read More

November 2015

1. 17 NovSpiderLabs Radio for the Week of September 14, 2015 September 21, 2015 In this week's episode: Read More
2. 16 NovHOW TO: Setting up Encrypted Communications Channels in Oracle Database September 22, 2015 | Martin Rakhmanov In this article, I will explain how to set up an encrypted communications ... Read More
3. 10 NovJumping through the hoops: multi-stage malicious PDF spam September 30, 2015 | Phil Hay We've recently encountered a number of malicious spam messages with PDFs ... Read More
4. 10 NovQuaverse RAT: Remote-Access-as-a-Service September 23, 2015 | Rodel Mendrez ***UPDATE as of September 28, 2015 - see the bottom of this post for removal ... Read More
5. 8 NovSpiderLabs Radio for the Week of September 28, 2015 October 05, 2015 In this week's episode: Read More
6. 6 NovMicrosoft Patch Tuesday for October 2015 October 13, 2015 October's Patch Tuesday is upon us and with only six bulletins, it's one of ... Read More

October 2015

1. 26 OctAppDetectivePRO and DbProtect Knowledgebase Update 4.54 October 13, 2015 | SpiderLabs Researcher This month's update for our AppDetectivePRO and DbProtect Knowledgebase is now ... Read More
2. 26 OctZero-day in Magmi database client for popular e-commerce platform Magento targeted in the wild October 13, 2015 | Assi Barak We've observed HTTP requests associated with an exploit attempt on the Magento ... Read More
3. 25 OctHow To Decrypt Ruby SSL Communications with Wireshark October 19, 2015 Debugging a program that communicates with a remote endpoint usually involves ... Read More
4. 22 OctJoomla SQL Injection Vulnerability Exploit Results in Full Administrative Access October 22, 2015 | Asaf Orpani Trustwave SpiderLabs researcher Asaf Orpani has discovered an SQL injection ... Read More
5. 19 OctSpiderLabs Radio for the Week of October 19, 2015 October 25, 2015 Two separate SpiderLabs vulnerabilities released: Read More
6. 13 OctOracle Database 11.2 SQLi in XML index statistics processing (CVE-2015-4900) November 06, 2015 | Martin Rakhmanov In the October 2015 'Critical Patch Update' Oracle fixed a flaw in XML index ... Read More
7. 13 OctExploiting Padding Oracle To Gain Encryption Keys October 26, 2015 | Georg Chalupar Practical tricks on exploiting a padding oracle vulnerability. Read More
8. 13 OctAbout Lenovo System Update Vulnerabilities and CVE-2015-6971 October 26, 2015 | Martin Rakhmanov Over the past seven months, a number of vulnerabilities in Lenovo System Update ... Read More
9. 5 OctSpiderLabs Radio for the Week of November 2, 2015 - Final Episode November 08, 2015 In this week's episode: Read More

September 2015

1. 30 SepBOM Obfuscation in Spam November 10, 2015 | Phil Hay Spammers try all sorts of tricks to obfuscate, including trying to obfuscate ... Read More
2. 28 SepShining the Spotlight on Cherry Picker PoS Malware November 16, 2015 | Eric Merritt Introduction For the last five years Trustwave has been monitoring a threat ... Read More
3. 23 SepMicrosoft Patch Tuesday, November 2015 November 10, 2015 November's Patch Tuesday marks a return to business as usual. Where October was ... Read More
4. 22 SepNew Memory Scraping Technique in Cherry Picker PoS Malware November 17, 2015 | Eric Merritt Introduction Working primarily with point of sale malware, we regularly see the ... Read More
5. 21 SepAnother Brick in the FrameworkPoS December 07, 2015 | Eric Merritt Introduction FrameworkPoS is a well-documented family of malware that targets ... Read More
6. 8 SepMom Spies a Hack December 15, 2015 | Jonathan Yarema Have you ever wondered if all that informal training you do with your friends ... Read More
7. 8 SepMicrosoft Patch Tuesday, December 2015 December 08, 2015 The December Microsoft Path Tuesday is upon us and it does not bring any happy ... Read More
8. 6 SepDefender for IoT’s Firmware Analysis Tool is Exceptional December 18, 2015 | David Broggy One of my "pastimes," if you will, is to check out the features of various ... Read More
9. 3 SepJoomla 0-Day Exploited In the Wild (CVE-2015-8562) December 18, 2015 | Assi Barak A recent new 0-day in Joomla discovered by Sucuri (Sucuri Blog) has drawn a lot ... Read More

August 2015

1. 31 AugMalicious Macros Evades Detection by Using Unusual File Format May 27, 2015 | Rodel Mendrez A couple of months ago we observed an influx of XML spam attachments that were ... Read More
2. 24 AugAdventures in Social Engineering: The Evil Reference May 29, 2015 I recently completed a social engineering gig targeting four bank locations. ... Read More
3. 17 AugSpiderLabs Radio for the Week of May 25, 2015 May 29, 2015 In this week's episode: Read More
4. 11 AugChanges in Oracle Database 12c password hashes June 01, 2015 | Martin Rakhmanov Oracle has made improvements to user password hashes within Oracle Database ... Read More
5. 3 AugSpiderLabs Radio for the Week of June 1, 2015 June 08, 2015 In this week's episode: Read More
6. 3 AugNew Episode of Punkey PoS Malware Airs June 08, 2015 | Eric Merritt Reruns from the 1980s are all the rage these days, and like the sitcom it's ... Read More
7. 3 AugAppDetectivePRO and DbProtect Knowledgebase Update 4.50 June 04, 2015 | SpiderLabs Researcher This month's update for our AppDetectivePRO and DbProtect Knowledgebase is now ... Read More

July 2015

1. 30 JulTrustwave 2015 Global Security Report Available Now June 09, 2015 | Trustwave SpiderLabs Read More
2. 29 JulMicrosoft Patch Tuesday, June 2015 June 09, 2015 It's that time of the month again, Patch Tuesday for June! With only eight ... Read More
3. 20 JulSpiderLabs Radio for the Week of June 15, 2015 June 22, 2015 In this week's episode: Read More
4. 17 JulAttacking Ruby Gem Security with CVE-2015-3900 June 23, 2015 | Jonathan Claudius A Ruby gem is a standard packaging format used for Ruby libraries and ... Read More
5. 14 JulMalvertisement – A Nuclear EK Tale July 06, 2015 | Anat (Fox) Davidi Over the past couple of years delivering malware via advertisements, or ... Read More
6. 13 JulAppDetectivePRO and DbProtect Knowledgebase Update 4.51 July 07, 2015 | SpiderLabs Researcher This month's update for our AppDetectivePRO and DbProtect Knowledgebase is now ... Read More
7. 12 JulSpiderLabs Radio for the Week of Jul 6, 2015 July 13, 2015 In this week's episode we talk about the Hacking Team getting hacked. Read More
8. 8 JulA Flash Exploit (CVE-2015-5119) From the Hacking Team Leak July 08, 2015 ***Update July 12, 2015--It was recently discovered that Hacking Team possessed ... Read More
9. 7 JulMicrosoft Patch Tuesday July 2015 July 14, 2015 July's Patch Tuesday is here and brings with it a rather large 14 bulletins ... Read More
10. 6 JulSpiderLabs Radio for the Week of July 13, 2015 July 17, 2015 In this week's episode: Read More

June 2015

1. 23 JunFinding XSS Vulnerabilities More Quickly with Dynamic Contextual Analysis July 20, 2015 | Michael Yuen Cross-Site Scripting (XSS) has been around since the 1990s and countless ... Read More
2. 22 JunTsar Team Microsoft Office Zero Day CVE-2015-2424 July 29, 2015 | Rami Kogan After the publication of Flash and IE zero days following the Hacking Team ... Read More
3. 9 JunSpiderLabs Radio for the Week of July 27, 2015 August 03, 2015 In this week's episode: Read More
4. 9 JunUsername Enumeration against OpenSSH-SELinux with CVE-2015-3238 July 30, 2015 | Sebastien Macke I recently disclosed a low-risk vulnerability in Linux-PAM versions prior to ... Read More
5. 8 JunRIG Reloaded - Examining the Architecture of RIG Exploit Kit 3.0 August 03, 2015 | SpiderLabs Researcher A few months ago the RIG exploit kit took quite a hit when its source code was ... Read More
6. 8 JunSSH Weak Diffie-Hellman Group Identification Tool August 03, 2015 | Fabian Foerg Check SSH servers for weak Diffie-Hellman key exchange configurations. Read More
7. 4 JunMicrosoft Patch Tuesday for August 2015 August 11, 2015 Today marks Patch Tuesday for August. Almost identical to last month's list, ... Read More
8. 1 JunTwo Vulnerabilities Reported by SpiderLabs Fixed in Oracle Critical Patch Update July 2015 August 17, 2015 | Martin Rakhmanov In July, Oracle released a Critical Patch Update for multiple products ... Read More

May 2015

1. 29 MaySpiderLabs Radio for the Week of August 24, 2015 August 31, 2015 In this week's episode: Read More
2. 29 MaySpiderLabs Radio for the Week of August 17, 2015 August 24, 2015 In this week's episode: Read More
3. 27 MayDebugging SAP ASE .NET Provider Issues September 03, 2015 | Martin Rakhmanov I've recently been chasing a bug that made it impossible to call one built-in ... Read More
4. 26 MaySpiderLabs Radio for the Week of March 2, 2015 March 09, 2015 In this week's episode: Read More
5. 15 MayMicrosoft Patch Tuesday, March 2015 March 10, 2015 March comes in like a lion this Microsoft Patch Tuesday with 14 bulletins ... Read More
6. 12 MaySpiderLabs Radio for the Week of March 9, 2015 March 16, 2015 In this week's episode: Read More
7. 12 MayDumping LSA Secrets on NT5 x64 March 11, 2015 | Sebastien Macke The Bug On the x64 version of Windows 2003 or XP (kernel 5.2), almost every ... Read More
8. 8 MayTrustKeeper Scan Engine Update – March 18, 2015 March 18, 2015 | Jonathan Claudius The latest update to the TrustKeeper scan engine that powers our Trustwave ... Read More
9. 1 MayAbout SAP security notice 2113333 March 20, 2015 SAP published security notice 2113333 "Multiple SQL injection vulnerabilities ... Read More

April 2015

1. 30 AprDrupal Compromise Analysis Including Indicators of Compromise March 20, 2015 | Ryan Barnett I would like to thank fellow SpiderLabs Researcher Chaim Sanders and Dennis ... Read More
2. 28 AprSpiderLabs Radio for the Week of March 16, 2015 March 22, 2015 In this week's episode: Read More
3. 27 AprSpiderLabs Radio for the Week of March 23, 2015 March 30, 2015 In this week's episode: Read More
4. 26 AprWebLogic SSRF And XSS (CVE-2014-4241, CVE-2014-4210, CVE-2014-4242) March 30, 2015 | Toby Clarke CVE-2014-4241, CVE-2014-4210, and CVE-2014-4242: Server-Side Request Forgery ... Read More
5. 23 AprOWASP/WASC Distributed Web Honeypots Project Re-Launch - Seeking Participants March 31, 2015 | Ryan Barnett The SpiderLabs Research Team is proud to announce that we are officially ... Read More
6. 20 AprSpiderLabs Radio for the Week of March 30, 2015 April 06, 2015 In this week's episode: Read More
7. 17 AprSpiderLabs Radio for the Week of February 2, 2015 April 09, 2015 In this week's episode: Read More
8. 15 AprMicrosoft Patch Tuesday, April 2015 April 14, 2015 April's Microsoft Patch Tuesday has arrived with 11 bulletins including four ... Read More
9. 14 AprNew POS Malware Emerges - Punkey April 15, 2015 | Eric Merritt During a recent United States Secret Service investigation, Trustwave ... Read More
10. 9 AprSpiderLabs Radio for the Week of April 13, 2015 April 17, 2015 In this week's episode: Read More
11. 6 AprCryptowall and phishing delivered through JavaScript Attachments April 20, 2015 | Brian Bebeau While most emails with malicious attachments seem to be zipped Windows ... Read More

March 2015

1. 31 MarCVE-2014-6284 - 'Probe' login access vulnerability in SAP ASE April 23, 2015 The SpiderLabs team at Trustwave published a new advisory today which details ... Read More
2. 30 MarOpen Challenge: Ruby YAML.load(YOUR_STRING_HERE) == RCE? April 27, 2015 | Jonathan Claudius For some, the challenge may already be quite clear by the title of this post, ... Read More
3. 30 MarSpiderLabs Radio for the Week of April 20, 2015 April 26, 2015 In this week's episode it's all things RSA Conference. I'll be discussing two ... Read More
4. 22 MarSAP Adaptive Server Enterprise Vulnerabilities discussed @RSAC April 28, 2015 Last week I gave a talk at RSA USA 2015 on SAP Adaptive Server Enterprise ... Read More
5. 20 MarSpiderLabs Radio for the Week of April 27, 2015 May 01, 2015 In this week`s episode: Read More
6. 20 MarBedep trojan malware spread by the Angler exploit kit gets political April 30, 2015 | Rami Kogan We recently observed what seems to be a group of cybercriminals helping spread ... Read More
7. 18 MarSpiderLabs Radio for the Week of May 4, 2015 May 08, 2015 SpiderLabs Radio will be on hiatus this week so our host can catch up on the ... Read More
8. 16 MarMicrosoft Patch Tuesday, May 2015 May 12, 2015 May's Patch Tuesday is upon us and with it comes three Critical and eleven ... Read More
9. 11 MarAppDetectivePRO and DbProtect Knowledgebase Update 4.49 May 12, 2015 | SpiderLabs Researcher This month's update for our AppDetectivePRO and DbProtect Knowledgebase is now ... Read More
10. 10 MarSpiderLabs Radio for the Week of May 11, 2015 May 15, 2015 In this week's episode: Read More
11. 9 Mar[Honeypot Alert] Fritz!Box – Remote Command Execution Exploit Attempt May 26, 2015 Our web honeypots picked up some exploit attempts for a remote command ... Read More
12. 6 MarNo Country For Old Vulnerabilities December 31, 2014 | Robert Rowley Finding a common cross-site scripting vulnerability in Cisco's new IOS Software ... Read More
13. 6 MarBuilding my own personal password cracking box December 31, 2014 | Wendel Guglielmetti Henrique Since 2003, I've spent a majority of my workdays hacking systems. I've ... Read More

February 2015

1. 25 FebDeobfuscating Malicious Macros Using Python January 08, 2015 | Rodel Mendrez Over the past few weeks, we've observed cybercriminals spamming users, ... Read More
2. 23 FebSpiderLabs Radio for the Week of January 5, 2015 January 10, 2015 In this week's episode: Read More
3. 20 FebMicrosoft Patch Tuesday, January 2015 January 13, 2015 Happy New Year and welcome to the first Microsoft Patch Tuesday of 2015. This ... Read More
4. 19 FebSpiderLabs Radio for the Week of January 12, 2015 January 18, 2015 In this week's episode we discuss Responsible Vulnerability Disclosure in the ... Read More
5. 13 FebJSON Crypto Helper a Ruby-based Burp Extension for JSON Encryption/Decryption - Part I January 19, 2015 | Christophe De La Fuente Burp Suite is one of my favorite tools when performing security assessments of ... Read More
6. 12 FebA New Zero-Day of Adobe Flash is used by the Prevalent Angler Exploit Kit in the Wild January 22, 2015 Just yesterday, security researcher Kafeine discovered a zero-day vulnerability ... Read More
7. 12 FebJSON Crypto Helper a Ruby-based Burp Extension for JSON Encryption/Decryption - Part III January 21, 2015 | Christophe De La Fuente This is the third in a three-part series about how to write a simple Ruby ... Read More
8. 12 FebJSON Crypto Helper a Ruby-based Burp Extension for JSON Encryption/Decryption - Part II January 20, 2015 | Christophe De La Fuente This is the second post in a three-part series about how to write a simple Ruby ... Read More
9. 10 FebSpiderLabs Radio for the Week of January 19, 2015 January 25, 2015 In this week's episode: Read More
10. 6 FebSpiderLabs Radio for the Week of January 26, 2015 February 02, 2015 In this week's episode: Read More
11. 6 FebGHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) January 30, 2015 | Ryan Barnett A heap-based buffer overflow vulnerability in glibc (CVE-2015-0235) was ... Read More
12. 4 FebA New Zero-Day of Adobe Flash CVE-2015-0313 Exploited in the Wild February 03, 2015 | Ben Hayak Just yesterday Adobe announced a zero-day vulnerability in Adobe Flash Player ... Read More
13. 3 FebThe SpiderLabs blog will move to the Trustwave domain this week February 04, 2015 | Trustwave SpiderLabs In the coming days, the SpiderLabs blog will move-in to its new home within the ... Read More
14. 2 FebBamboo, Flexibility and Vulnerability Disclosure: Trustwave SpiderLabs’ Updated Guidelines February 06, 2015 | Karl Sigler Trustwave is proud to announce an updated vulnerability disclosure policy. In ... Read More

January 2015

1. 30 JanStealing RubyGems API Keys during Post Exploitation February 06, 2015 | Jonathan Claudius Between April and May of 2013, I presented at SOURCE Boston and THOTCON and ... Read More
2. 25 JanMicrosoft Patch Tuesday, February 2015 February 10, 2015 Today marks Microsoft's February Patch Tuesday release and it's a pretty big ... Read More
3. 22 JanRIG Exploit Kit Source Code Leak - The End or Just the Beginning of RIG? February 12, 2015 | Trustwave SpiderLabs Recently, source code for the RIG exploit kit was leaked. An independent ... Read More
4. 21 JanTWSL2015-001 and TWSL2015-002: New Advisories Affect IceWarp Mail Server and Magnolia CMS February 12, 2015 The SpiderLabs team at Trustwave published two new advisories today which ... Read More
5. 20 JanAnnouncing ModSecurity v2.9.0 Stable Release February 12, 2015 | Ryan Barnett The SpiderLabs Research - ModSecurity Team is proud to announce the stable ... Read More
6. 19 JanSpiderLabs Radio for the Week of February 9, 2015 February 13, 2015 In this week's episode: Read More
7. 18 JanAppDetectivePRO and DbProtect Knowledgebase Update 4.46 February 19, 2015 | Trustwave SpiderLabs This month's update for our AppDetectivePRO and DbProtect Knowledgebase is now ... Read More
8. 13 JanSpiderLabs Radio for the Week of February 16, 2015 February 20, 2015 Unfortunately there will be no SpiderLabs Radio podcast this week. I've ... Read More
9. 10 JanRIG Exploit Kit – Diving Deeper into the Infrastructure February 23, 2015 Following our previous blog post about the leaking of the RIG exploit kit's ... Read More
10. 8 Jan[Honeypot Alert] FHS Null Byte Attack (CVE-2014-6287) Attempts to Install DDoS Malware (Iptablex) February 25, 2015 | Ryan Barnett Our web honeypots picked up some exploit attempts for CVE-2014-6287 which is a ... Read More

2014 175

December 2014

1. 31 DecSpiderLabs Radio for the Week of February 23, 2015 March 06, 2015 In this week's episode: Read More
2. 31 DecAttackers concealing malicious macros in XML files March 06, 2015 | Rodel Mendrez XML files are harmless text files right? Wrong! The group behind the malicious ... Read More
3. 22 DecSpam Campaign Taking Advantage of Ebola Scare May Lead To Malware Infections October 22, 2014 | Rodel Mendrez Cybercriminals have inevitably taken advantage of the publicization of the ... Read More
4. 18 DecSpiderLabs Radio: October 22, 2014 October 25, 2014 In this episode: Read More
5. 18 DecPowerpoint Vulnerability (CVE-2014-4114) used in Malicious Spam October 23, 2014 Following last week's announcement of a zero-day vulnerability for PowerPoint ... Read More
6. 14 DecHacking a Reporter: UK Edition October 28, 2014 | SpiderLabs Researcher Over the summer, a U.K. journalist asked the Trustwave SpiderLabs team to ... Read More
7. 11 DecBitcoin Transaction Malleability Theory in Practice – Ruxcon Australia 2014 October 30, 2014 | Rami Kogan Two weeks ago we gave a talk at the Ruxcon 10 conference in Melbourne, ... Read More
8. 9 DecReflected File Download - A New Web Attack Vector October 30, 2014 | Oren Hafif PLEASE NOTE: As promised, I've published a full white paper that is now ... Read More
9. 8 DecSpiderLabs Radio for the week of October 27, 2014 November 01, 2014 In this episode: Read More
10. 8 DecSetting HoneyTraps with ModSecurity: Adding Fake Cookies October 31, 2014 | Ryan Barnett This blog post continues with the topic of setting " HoneyTraps" within your ... Read More
11. 7 DecSmuggler - An interactive 802.11 wireless shell without the need for authentication or association November 03, 2014 I've always been fascinated by wireless communications. The ability to launch ... Read More
12. 4 DecMicrosoft Advance Notification for November 2014 November 06, 2014 | Robert Foggia This coming Tuesday, November 11, Microsoft will publish their next security ... Read More

November 2014

1. 28 NovSpiderLabs Radio for the week of November 3, 2014 November 09, 2014 In this episode: Read More
2. 26 NovMicrosoft Patch Tuesday, November 2014 November 11, 2014 Compared to previous Microsoft Patch Tuesday's, November's is a pretty big one ... Read More
3. 24 NovSpiderLabs Radio for the week of November 17, 2014 November 22, 2014 In this episode: Read More
4. 22 NovMagnitude Exploit Kit Backend Infrastructure Insight - Part II November 24, 2014 | SpiderLabs Researcher Welcome back to another edition of "exposing Magnitude exploit-kit internals"! ... Read More
5. 15 NovModSecurity Advanced Topic of the Week: Detecting Malware with Fuzzy Hashing November 26, 2014 | Ryan Barnett We witnessed a sophisticated phishing campaign on 16th August 2017, targeting ... Read More
6. 11 NovSpiderLabs Radio for the week of November 24, 2014 November 28, 2014 SpiderLabs Radio is taking a hiatus this week to celebrate the Thanksgiving ... Read More
7. 9 NovMicrosoft Advance Notification for December 2014 December 04, 2014 | Robert Foggia Microsoft will publish the last scheduled security release of the year on ... Read More
8. 6 NovSpiderLabs Radio for the week of December 1, 2014 December 07, 2014 In this episode: Read More
9. 3 NovMagnitude Exploit Kit Backend Infrastructure Insight - Part III December 08, 2014 This is the fourth post in a four-part series about Magnitude (if you like, ... Read More
10. 1 NovCVE-2014-3797: Reflected XSS Vulnerability in VMware Virtual Center Appliance (vCSA) December 08, 2014 LevelBlue SpiderLabs published an advisory today in conjunction with VMWare for ... Read More

October 2014

1. 31 OctMicrosoft Patch Tuesday, December 2014 December 09, 2014 | SpiderLabs Researcher December's Microsoft Patch Tuesday is upon us and, hopefully, marks the last ... Read More
2. 30 OctSpiderLabs Radio for the week of December 8, 2014 December 14, 2014 In this episode: Read More
3. 30 OctNew Device Module (DM) update for Trustwave SIEM 1.2.1 now available December 11, 2014 | Jeff Pold Trustwave's most recent Device Module (DM), DM-22, is now available to ... Read More
4. 28 OctAnnouncing Net::TNS for Ruby – A Gem for Connecting to Oracle Databases December 18, 2014 | woodbusy For the security professional, working with Oracle Database can present ... Read More
5. 25 OctAlina POS malware 'sparks' off a new variant December 18, 2014 | Eric Merritt Alina is a well-documented family of malware used to scrape Credit Card (CC) ... Read More
6. 23 OctSigned Ruby Gems: A c7decrypt walk-through December 22, 2014 | Jonathan Claudius As someone who's responsible for a number of Ruby projects, both open-source ... Read More
7. 22 Oct[Honeypot Alert] Wordpress Wp Symposium 14.11 - Unauthenticated Shell Upload Exploit Attempt December 30, 2014 | Ryan Barnett Our web honeypots picked up some exploit attempts for the recently released ... Read More
8. 17 OctMicrosoft Patch Tuesday, October 2014 October 14, 2014 Today is the October Microsoft Patch Tuesday, and it addresses eight separate ... Read More
9. 14 OctSpiderLabs Radio: August 21, 2014 August 22, 2014 In this episode: Read More
10. 14 OctMonkey Patching the Matrix August 18, 2014 | Jonathan Claudius For those of you not familiar with monkey patching, it's a mechanism to "extend ... Read More
11. 14 OctSpiderLabs Radio: August 14, 2014 August 16, 2014 In this episode: Read More
12. 11 OctBitcoin Transaction Malleability Theory in Practice – Blackhat USA 2014 August 28, 2014 | Daniel Chechik ***UPDATE: 10/17/2014 Read More
13. 9 OctSpiderLabs Radio: August 28, 2014 August 30, 2014 In this episode: Read More
14. 3 Oct[Honeypot Alert] Active Probes for WordPress revslider_show_image Plugin Local File Inclusion Flaw September 03, 2014 | Ryan Barnett A local file inclusion vulnerability in the WordPress Slider Revolution Plugin ... Read More
15. 1 OctMicrosoft Advance Notification for September 2014 September 04, 2014 | Robert Foggia On Tuesday, September 9th, Microsoft will publish their next security update ... Read More

September 2014

1. 26 SepStupid Spammer Tricks – Reversing Characters September 05, 2014 | Brian Bebeau Spammers engaged in phishing attacks constantly try to get their emails past ... Read More
2. 22 SepSpiderLabs Radio: September 4, 2014 September 12, 2014 In this episode: Read More
3. 22 SepMicrosoft Patch Tuesday, September 2014 September 09, 2014 Today is Microsoft Patch Tuesday and it's one of the lightest of the year. This ... Read More
4. 19 SepIndicators of Compromise: A Discussion with Karl Sigler September 12, 2014 | Trustwave SpiderLabs Head over to the Trustwave blog for a video discussion about indicators of ... Read More
5. 16 Sep[Honeypot Alert] New Bot Malware (BoSSaBoTv2) Attacking Web Servers Discovered September 15, 2014 | Ryan Barnett Our web honeypots picked up some interesting attack traffic. The initial web ... Read More
6. 16 SepSpiderLabs Radio: September 11, 2014 September 13, 2014 In this episode I talk about the non-existent massive leak of 5 million Google ... Read More
7. 15 SepLeveraging LFI To Get Full Compromise On WordPress Sites September 16, 2014 | Robert Rowley In this post I will discuss how a serious but mostly ignored vulnerability can ... Read More
8. 13 SepSpiderLabs Radio: September 18, 2014 September 19, 2014 In this episode: Read More
9. 12 SepIdentify Crimeware Strains with Edit Distance September 22, 2014 | Jonathan Claudius When trying to identify crimeware/malware, it's a good idea to design a ... Read More
10. 12 SepCracking IKE Mission:Improbable (Part3) September 22, 2014 | Daniel Turner Introduction Read More
11. 9 SepSpiderLabs Radio: September 25, 2014 September 26, 2014 The SpiderLabs Radio podcast is on hiatus this week as we absorb all of the ... Read More
12. 5 SepShellshock a Week Later: What We Have Seen October 01, 2014 | Ryan Barnett Trustwave, like most other information security firms, has been busy ... Read More
13. 4 SepSpiderLabs Radio: October 2, 2014 October 03, 2014 In this episode: Read More
14. 3 SepMicrosoft Advance Notification for October 2014 October 09, 2014 | Robert Foggia On Tuesday, October 14, Microsoft will publish their newest security update. ... Read More

August 2014

1. 30 AugSpiderLabs Radio: October 9, 2014 October 11, 2014 In this episode: Read More
2. 28 AugExecuting Apps on Jailbroken Devices October 14, 2014 | SpiderLabs Researcher This post is part two of a three-part series about mobile security. Today's ... Read More
3. 22 AugExploring and Exploiting iOS Web Browsers October 14, 2014 | SpiderLabs Researcher Today we begin a three-post series about mobile security. We start with a ... Read More
4. 18 AugJailbreak Detection Methods October 15, 2014 This post concludes our three-part series about mobile security. Today's post ... Read More
5. 16 AugSpiderLabs Radio: October 16, 2014 October 18, 2014 In this episode we'll be talking about the zero days patched by Microsoft's ... Read More
6. 12 AugSpiderLabs Radio: May 30, 2014 May 31, 2014 In this episode I talk about: Read More
7. 7 AugCVE-2014-0515 Goes to Brazil for World Cup 2014 June 03, 2014 | Arseny Levin The FIFA World Cup 2014 begings June 12 and enthusiasm about the event has ... Read More
8. 5 AugFrom a Username to Full Account Takeover June 10, 2014 | Oren Hafif In the past year there have been many major data breach incidents in which ... Read More
9. 5 AugSpiderLabs Radio: June 5, 2014 June 06, 2014 In this episode I talk about some odd ransom ware targeting Apple iDevices and ... Read More
10. 5 AugMicrosoft Advance Notification for June 2014 June 05, 2014 | Robert Foggia Microsoft will be releasing the next security patch release on Tuesday, June ... Read More
11. 1 AugMicrosoft Patch Tuesday, June 2014 June 10, 2014 June's Microsoft Patch Tuesday contains seven bulletins, including two rated ... Read More

July 2014

1. 31 JulSetting HoneyTraps with ModSecurity: Adding Fake Hidden Form Fields June 12, 2014 | Ryan Barnett This blog post continues with the topic of setting " HoneyTraps" within your ... Read More
2. 23 JulSpiderLabs Radio: June 12, 2014 June 13, 2014 In this episode: Read More
3. 18 JulSpiderLabs Radio: June 19, 2014 June 21, 2014 In this episode: Read More
4. 15 JulWeak passwords? Better call The Doctor. June 24, 2014 | Chris Carlis Every network presents its own unique opportunity for a penetration tester. ... Read More
5. 11 JulSpiderLabs Radio: June 26, 2014 June 27, 2014 In this episode: Read More
6. 11 JulNAC doesn’t like your penetration testing device? IPv6 to the rescue! June 24, 2014 Sometimes when I conduct a network penetration test it's just too easy to get ... Read More
7. 8 JulAnalysis of a New Banking Trojan Spammed by Cutwail July 02, 2014 | Rodel Mendrez The Cutwail spambot has a long history of sending spam with attached malicious ... Read More
8. 4 Jul8 Common Pitfalls of Heartbleed Identification and Remediation (CVE-2014-0160) July 03, 2014 | Robert Rowley Unfortunately, one of the biggest vulnerabilities disclosed this year, ... Read More
9. 3 JulMicrosoft Advance Notification for July 2014 July 04, 2014 Microsoft will publish their next security patch release on Tuesday, July 8. ... Read More
10. 2 JulMicrosoft Patch Tuesday, July 2014 July 08, 2014 July's Microsoft Patch Tuesday is a light release with two "Critical" ... Read More

June 2014

1. 27 JunSpiderLabs Radio: July 10, 2014 July 11, 2014 In this episode: Read More
2. 24 JunAbout Two Recently Patched IBM DB2 LUW Vulnerabilities July 15, 2014 IBM recently released patches for three security vulnerabilities affecting ... Read More
3. 24 JunIntroducing Windows Exploit Suggester July 11, 2014 | Sam Bertram A tool to detect potential missing patches on Windows hosts and obtain a list ... Read More
4. 21 JunSpiderLabs Radio: July 17, 2014 July 18, 2014 In this episode: Read More
5. 13 Jun[Honeypot Alert] Wordpress XML-RPC Brute Force Scanning July 23, 2014 | Ryan Barnett There are news reports of new Wordpress XML-PRC brute force attacks being seen ... Read More
6. 12 JunBackoff - Technical Analysis July 31, 2014 | Josh Grunzweig As discussed in the an advisory published by US-CERT, Trustwave SpiderLabs has ... Read More
7. 10 JunIt’s ALIVE: Trustwave Global Security Report Online Now Available August 05, 2014 This morning we unveiled our reinvented Trustwave Global Security Report. It's ... Read More
8. 10 JunSpiderLabs Radio: July 31, 2014 August 01, 2014 Hello loyal listeners. I just wanted to let you know that this is not the ... Read More
9. 6 JunA Peek Into the Lion's Den – The Magnitude [aka PopAds] Exploit Kit August 05, 2014 | Trustwave SpiderLabs Recently we managed to get an unusual peek into the content that is used on the ... Read More
10. 5 JunBlackhat Arsenal 2014: Live ModSecurity Demonstrations August 05, 2014 | Ryan Barnett If you are heading out to Blackhat USA 2014 in Las Vegas this week, please stop ... Read More
11. 3 JunMagnitude Exploit Kit Backend Infrastructure Insight - Part I August 07, 2014 | Trustwave SpiderLabs In our recently released Trustwave Global Security Report Online and previous ... Read More

May 2014

1. 31 MayMicrosoft Patch Tuesday, August 2014 August 12, 2014 August's Microsoft Patch Tuesday is upon us and Microsoft is issuing nine ... Read More
2. 30 MaySpiderLabs Radio: April 10, 2014 April 10, 2014 In this episode I bid a fond farewell to Windows XP; Microsoft patches that RTF ... Read More
3. 29 MayAnnouncing ModSecurity v2.8.0 April 16, 2014 | Ryan Barnett Read More
4. 27 MayTrustwave Analysis of the April 2014 Oracle CPU for Databases April 17, 2014 | Alex Kaluski The 17th of April fell this week, which means it is Oracle Critical Patch ... Read More
5. 22 MayNetSupport Information Leakage Using Nmap Script April 23, 2014 | David Kirkpatrick NetSupport allows corporations to remotely manage and connect to PC's and ... Read More
6. 22 MaySpiderLabs Radio: April 17, 2014 April 18, 2014 In this episode: Read More
7. 21 MayLnk files in Email Malware Distribution May 02, 2014 Recently I have noticed more use of .lnk files used in malware distribution via ... Read More
8. 21 MaySpiderLabs Radio: April 24, 2014 April 25, 2014 In this episode: Read More
9. 21 MayPrivilege Escalation Vulnerability in Cisco ASA's SSL VPN April 25, 2014 Trustwave SpiderLabs security researcher Jonathan Claudius has discovered a ... Read More
10. 20 MaySpiderLabs Radio: May 1, 2014 May 02, 2014 In this episode: Read More
11. 20 MayModSecurity Advanced Topic of the Week: JSON Support May 02, 2014 | Ryan Barnett Submitted by Felipe Costa and Ryan Barnett (SpiderLabs Research - ModSecurity ... Read More
12. 15 MayDetecting A Surveillance State - Part 4 Cellular Attacks May 05, 2014 This is the fourth and final post in my series of posts about state actor ... Read More
13. 13 MayMicrosoft Internet Explorer 0-Day (CVE-2014-1776) May 05, 2014 | Trustwave SpiderLabs A zero-day vulnerability in Microsoft Internet Explorer, CVE-2014-1776, was ... Read More
14. 12 MayCVE-2014-6283: Privilege Escalation Vulnerability and Potential Remote Code Execution in SAP Adaptive Server Enterprise September 16, 2014 | Martin Rakhmanov On May 12, 2014, SAP published updates to Adaptive Server Enterprise versions ... Read More
15. 10 May[Honeypot Alert] Open Flash Charts File Upload Attacks May 06, 2014 Our web honeypots picked up some increased scanning/exploit activity for the ... Read More
16. 8 MayExploit Kit Roundup: Best of Obfuscation Techniques May 07, 2014 | Anat (Fox) Davidi The world of exploit kits is an ever-changing one, if you happen to look away ... Read More
17. 7 MayMicrosoft Advance Notification for May 2014 May 08, 2014 | Robert Foggia Tuesday, May 13 marks the next Microsoft security patch release. This release ... Read More
18. 6 MaySpiderLabs Radio: May 8, 2014 May 10, 2014 In this episode: Read More
19. 5 MaySpiderLabs Radio: May 15, 2014 May 15, 2014 In this episode: Read More
20. 5 MayMicrosoft Patch Tuesday, May 2014 May 13, 2014 May's Microsoft Patch Tuesday contains eight bulletins, the most of any release ... Read More
21. 2 MayMass Malicious PDF Email Campaigns from Cutwail May 21, 2014 Over the last two weeks we have noticed a high number of emails with PDF ... Read More
22. 2 MayBaby's first NX+ASLR bypass May 20, 2014 | Dan Crowley Recently, I've been trying to improve my skills with regards to exploiting ... Read More
23. 2 MayDEFCON 22 CTF Qualifiers Writeup May 20, 2014 | Dan Crowley Hi folks! Read More

April 2014

1. 25 AprTrustkeeper Scan Engine Update - May 21, 2014 May 21, 2014 | Donovan Lampa We're back to bring you a large Scan Engine update. We've packed this release ... Read More
2. 25 Apr2014 Trustwave Global Security Report Available Now May 21, 2014 | Trustwave SpiderLabs Read More
3. 23 AprSpiderLabs Radio: May 22, 2014 May 22, 2014 In this episode I talk about: Read More
4. 18 AprJava-based Malware Distributed Through Spam May 22, 2014 | Rodel Mendrez For the past few months, we've observed more spam with Java-based malware ... Read More
5. 17 AprWireless Cameras and Webcams: Are You Being Watched? May 27, 2014 Trustwave SpiderLabs recently disclosed vulnerabilities in several models of ... Read More
6. 16 AprThird-Party Auth Token Theft: The Big Picture May 29, 2014 | David Byrne Nothing sets the technical journalists abuzz like the prospect of a ... Read More
7. 10 AprCVE-2014-2120 – A Tale of Cisco ASA “Zero-Day” May 30, 2014 | Jonathan Claudius A few months ago I was trying to PoC a known cross-site scripting vulnerability ... Read More
8. 9 AprMicrosoft Advance Notification for March 2014 March 06, 2014 The Microsoft Security release for March will include patches for Windows, ... Read More
9. 9 AprGamut Spambot Analysis March 04, 2014 | Rodel Mendrez In this blog post, we'll be describing the functionality of a spamming botnet ... Read More
10. 9 AprTouchlogging Part 1 - iOS March 03, 2014 | Neal Hindocha Although there have been numerous articles posted, I thought I would write ... Read More
11. 8 AprBloodletting the Arms Race: Using Attacker's Techniques for Defense March 06, 2014 Submitted by Ziv Mador and Ryan Barnett Read More
12. 3 AprMicrosoft Patch Tuesday, March 2014 March 11, 2014 March's Patch Tuesday includes five bulletins, two rated "Critical" and three ... Read More
13. 3 AprSpiderLabs Radio: March 7, 2014 March 08, 2014 In this episode we talk about a new Russian rootkit called Uroburos, another ... Read More
14. 3 AprTouchlogging Part 2 - Android March 06, 2014 | Neal Hindocha This is part two in my Touchlogging series, you can find part one here. Read More

March 2014

1. 31 MarWordPress XML-RPC PingBack Vulnerability Analysis March 12, 2014 | Ryan Barnett There were news stories this week outlining how attackers are abusing the ... Read More
2. 31 MarDeep Analysis of CVE-2014-0502 – A Double Free Story March 12, 2014 | Ben Hayak A lot has already been said about CVE-2014-0502, the Adobe Flash Player ... Read More
3. 31 MarDetecting A Surveillance State - Part 1 Hardware Implants March 11, 2014 This is the first in a series of four blog posts that will cover defenses and ... Read More
4. 31 MarTouchlogging Part 3 - Final Thoughts March 11, 2014 | Neal Hindocha This is the third and final part on the subject of Touchlogging. I do recommend ... Read More
5. 26 MarSpiderLabs Radio: March 13, 2014 March 13, 2014 In this episode we talk about Microsoft Patch Tuesday providing patches for an ... Read More
6. 20 MarDetecting A Surveillance State - Part 2 Radio Frequency Exfiltration March 18, 2014 | Robert Rowley In the last post we reviewed a few hardware implants that may have been used by ... Read More
7. 20 MarColdFusion Admin Compromise Analysis (CVE-2010-2861) March 18, 2014 | Ryan Barnett In a previous blog post, I provided "Method of Entry" analysis for a ColdFusion ... Read More
8. 18 MarSpiderLabs Radio: March 20, 2014 March 20, 2014 In this episode we talk about the Windigo malware campaign, how a ... Read More
9. 18 MarGoogle Summer of Code (GSoC) + OWASP + ModSecurity = Awesome March 20, 2014 | Bryant Smith OWASP is again participating in the Google Summer of Code (GSoC) Program for ... Read More
10. 13 Mar[Honeypot Alert] JCE Joomla Extension Attacks March 26, 2014 | Ryan Barnett Our web honeypots picked up some increased exploit attempts for an old Joomla ... Read More
11. 12 MarWendel's Small Hacking Tricks - The Annoying NT_STATUS_INVALID_WORKSTATION. March 31, 2014 | Wendel Guglielmetti Henrique Since 2003 a large part of my workday has been devoted solely to hacking ... Read More
12. 12 MarAn Intro to NetSupport Manager Scripts March 31, 2014 | David Kirkpatrick On a recent gig I was hit with hundreds of hosts running a service on port TCP ... Read More
13. 11 MarMicrosoft Word RTF 0-Day (CVE-2014-1761) April 03, 2014 | Trustwave SpiderLabs A zero-day vulnerability in Microsoft Word involving the handling of the RTF ... Read More
14. 11 MarStupid Spammer Tricks – Multi-Character Set Text March 31, 2014 | Brian Bebeau Looking to refinance your house? Install solar panels? Hey, this email about ... Read More
15. 11 MarOld School Code Injection in an ATM .dll March 31, 2014 | Christophe De La Fuente During our last ATM review engagement, we found some interesting executable ... Read More
16. 8 MarSpiderLabs Radio: April 3, 2014 April 03, 2014 In this episode I talk about GMail making HTTPS mandatory, a move some people ... Read More
17. 6 MarCapturing Ghosts: Using inotify to defeat an Android DRM system April 09, 2014 | Mike Park Apart from our typical application penetration testing engagements, clients ... Read More
18. 6 MarMicrosoft Patch Tuesday, April 2014 April 08, 2014 April's Microsoft Patch Tuesday is on par with the prior releases this year. ... Read More
19. 6 MarMicrosoft Advance Notification for April 2014 April 03, 2014 | Robert Foggia The Microsoft April security release is almost upon us with security updates ... Read More
20. 4 MarFarewell to XP April 09, 2014 | woodbusy As Karl noted in his Patch Tuesday post, yesterday was the last day of support ... Read More
21. 3 MarDetecting A Surveillance State - Part 3 Infected Firmware April 09, 2014 In this third installment of Detecting A Surveillance State blog series I will ... Read More

February 2014

1. 24 FebMicrosoft Patch Tuesday, January 2014 January 14, 2014 Hopefully January's Patch Tuesday is a sign of things to come for 2014. With ... Read More
2. 21 FebSpiderLabs Radio: January 16, 2014 January 16, 2014 In this episode: Read More
3. 19 FebWhat Dirty Little Secrets You Find on eBay January 17, 2014 | Videoman So I do networking (computers and wifi things) at a number of security ... Read More
4. 19 FebTrustwave Analysis of the January 2014 Oracle CPU January 16, 2014 It's the second Tuesday in January, so it is Oracle Critical Patch Update (CPU) ... Read More
5. 18 Feb10,000 Litecoins Worth $230,000 USD Were Stolen! January 22, 2014 | Ben Hayak Newspapers, commentators and bloggers have lately been asking whether digital ... Read More
6. 18 FebBeware! Bats hide in your jQuery! January 20, 2014 Injection of malicious code into JavaScript files is not new; however, we ... Read More
7. 17 FebSpiderLabs Radio: January 23, 2014 January 23, 2014 In this episode I sit down with Grayson Lenik, a forensic expert for Trustwave ... Read More
8. 14 FebIntroducing ModSecurity Status Reporting January 28, 2014 | Felipe "Zimmerle" Costa The Trustwave SpiderLabs Research team is committed to making ModSecurity the ... Read More
9. 14 FebModSecurity Advanced Topic of the Week: HMAC Token Protection January 24, 2014 | Ryan Barnett This blog post presents a powerful feature of ModSecurity v2.7 that has been ... Read More
10. 12 FebSpiderLabs Radio: January 30, 2014 January 30, 2014 In this episode we look at a rash of gas pump credit card skimmers, the Syrian ... Read More
11. 11 FebThe Keystone Rocks - Foundation Chips of Pentesting Tips Part 1 February 11, 2014 | Martin Murfitt The knowledgebase of a penetration tester can be broadly split into two ... Read More
12. 11 FebSpiderLabs Radio: February 7, 2014 February 07, 2014 In this episode I talk about a new Adobe zero day in Flash Player, the ... Read More
13. 11 FebMicrosoft Advance Notification for February 2014 February 06, 2014 ***Update as of Monday, February 10, 2014*** Read More
14. 11 FebSpammers Are Taking Advantage of Your Whitelists by Spoofing Legitimate Brands February 05, 2014 ***EDITOR'S NOTE: The content of this article does not make or imply any claims ... Read More
15. 10 FebMicrosoft Patch Tuesday, February 2014 February 11, 2014 February's Patch Tuesday is back to business as usual after the light January ... Read More
16. 7 FebCVE-2014-0050: Exploit with Boundaries, Loops without Boundaries February 11, 2014 | Oren Hafif In this article I will discuss CVE-2014-0050: Apache Commons FileUpload and ... Read More
17. 6 FebJackPOS – The House Always Wins February 11, 2014 | Josh Grunzweig A new point of sale (POS) malware family could be a jackpot for credit card ... Read More
18. 5 FebHTTP NTLM Information Disclosure February 12, 2014 | Justin Cacak Nmap script that anonymously enumerates remote NetBIOS, DNS, and OS details ... Read More

January 2014

1. 30 Jan“Reversing” Non-Proxy Aware HTTPS Thick Clients w/ Burp February 14, 2014 | Jonathan Claudius A little over a month ago, I published a Metasploit auxiliary module for ... Read More
2. 28 JanSpiderLabs Radio: February 13, 2014 February 14, 2014 In this episode we look at Facebook's open-sourcing of the Android crypto API ... Read More
3. 24 JanWait a minute... that’s not a real JPG! February 17, 2014 | Richard Wells When attackers compromise a website and want to harvest credit cards, they need ... Read More
4. 23 JanFAQ: Pony Malware Payload Discovery February 18, 2014 Our team's discovery of the spoils of yet another instance of Pony 1.9 has kept ... Read More
5. 22 JanResponder 2.0 - Owning Windows Networks part 3 February 18, 2014 The power and flexibility of Responder has grown significantly over the past ... Read More
6. 20 JanModSecurity Advanced Topic of the Week: Detecting Browser Fingerprint Changes During Sessions February 19, 2014 | Ryan Barnett This blog post will discuss a section from Recipe 8-5: Detecting Browser ... Read More
7. 17 JanInternet Explorer Zero Day: CVE-2014-0322 February 19, 2014 | Rami Kogan Recently, several security vendors reported about a new IE 0day which affects ... Read More
8. 16 JanLook What I Found: Pony is After Your Coins! February 24, 2014 In our previous episode of "Look What I Found" we detailed our discovery of a ... Read More
9. 16 JanSpiderLabs Radio: February 20, 2014 February 21, 2014 In this episode we look at the new Linksys worm dubbed TheMoon, two new ... Read More
10. 14 JanSpiderLabs Radio: February 27, 2014 February 27, 2014 In this episode we talk about the Apple "gotofail" SSL vulnerability, SEA is ... Read More
11. 14 JanSpiderLabs Radio November 15, 2013 w/ Space Rogue November 15, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
12. 12 JanTrustwave SpiderLabs at OWASP’s AppSec USA 2013 November 15, 2013 | Trustwave SpiderLabs Will you be at the OWASP Foundation's AppSec USA event next week in New York ... Read More
13. 10 JanTutorial for NTDS goodness (VSSADMIN, WMIS, NTDS.dit, SYSTEM) November 21, 2013 I recently performed an internal penetration test where the NTDS.dit file got ... Read More
14. 9 JanMalicious shells; Established != Active November 22, 2013 | Ryan Jones During a recent investigation, SpiderLabs was presented with evidence that ... Read More
15. 6 JanSpam Triple Threat: Voice Message, Important System Update, and DHL Delivery spam campaign. November 22, 2013 This week we discovered a large malware spam campaign that used the Zbot Trojan ... Read More
16. 6 JanVulnerability in RiskNet Acquirer (TWSL2013-031) November 22, 2013 Last week we released an advisory for a vulnerability discovered in the RiskNet ... Read More

2013 211

December 2013

1. 31 DecSpiderLabs Responder Updates November 26, 2013 Responder is a penetration-testing tool in active development. To continue ... Read More
2. 20 DecLook What I Found: Moar Pony! December 03, 2013 | Daniel Chechik In our last episode of "Look What I Found" we talked about a fairly large ... Read More
3. 20 Dec[Honeypot Alert] More PHP-CGI Scanning (apache-magika.c) November 26, 2013 | Ryan Barnett In the past 24 hours, one of the WASC Distributed Web Honeypot participant's ... Read More
4. 19 DecPhysical Address Strangeness in Spam December 05, 2013 | Brian Bebeau Ten years ago, Congress passed the "CAN-SPAM Act" (also known as ... Read More
5. 19 DecHacking a Reporter: Sleepless Nights Outside a Brooklyn Brownstone (Part 3 of 3) December 05, 2013 This post is the conclusion of a three-part series (read the first here and the ... Read More
6. 17 DecMicrosoft Advance Notification for December 2013 December 06, 2013 On December 10th, Microsoft will begin deploying their security updates to ... Read More
7. 13 DecThe Curious Case of the Malicious IIS Module December 09, 2013 Recently, we've seen a few instances of a malicious DLL that is installed as an ... Read More
8. 11 DecMicrosoft Patch Tuesday, December 2013 December 10, 2013 | Robert Foggia 'Tis the season for an increase in cyber-criminal activities. In the past ... Read More
9. 10 DecThe Kernel is calling a zero(day) pointer – CVE-2013-5065 – Ring Ring December 11, 2013 | Ben Hayak SpiderLabs investigates a number of suspicious binary files on a daily basis. A ... Read More
10. 9 DecThe Curious Case of the Malicious IIS Module: Prologue (Method of Entry Analysis) December 13, 2013 Earlier this week, SpiderLabs Research team released a blog post outlining ... Read More
11. 6 DecAnnouncing ModSecurity v2.7.6 Release (CI Platform Usage) December 17, 2013 The ModSecurity Project team is pleased to announce public release version ... Read More
12. 5 DecExploiting Password Recovery Functionalities December 19, 2013 | Marcio Almeida Password recovery functionalities can result in vulnerabilities in the same ... Read More
13. 5 DecQuick Joomla Refresher December 19, 2013 | David Kirkpatrick I haven't come into contact with Joomla for a while, but I had the opportunity ... Read More
14. 3 DecWendel's Small Hacking Tricks - A not so common and neat Oracle [for Windows] hack. December 20, 2013 | Wendel Guglielmetti Henrique Since 2003 a large part of my workday has been devoted solely to hacking ... Read More

November 2013

1. 26 NovThe Case of an Obscure Injection December 31, 2013 | Damian Profancik During a recent application penetration test, I came across what proved to be ... Read More
2. 26 NovHow Snotnose the Elf was Able to Compromise The North Pole Domain and Retrieve the Nice and Naughty Lists December 20, 2013 | Theresa Last Winter, Snotnose won the North vs South Pole CTF contest, and Santa ... Read More
3. 22 NovMicrosoft Advance Notification for January 2014 January 09, 2014 Microsoft is scheduled to release the next security update for consumers on ... Read More
4. 22 NovDaumGame ActiveX 0day January 06, 2014 One might think that vulnerabilities in ActiveX controls are a thing of the ... Read More
5. 22 NovSpiderLabs Radio: January 3, 2014 January 06, 2014 Welcome to the SpiderLabs Radio Reboot! As we bid our old host, Space Rogue, a ... Read More
6. 21 NovSAP Sybase ASE 15.7 security updates January 10, 2014 | Martin Rakhmanov SAP Sybase Adaptive Server Enterprise is a relational database management ... Read More
7. 15 NovSetting HoneyTraps with ModSecurity: Adding Fake HTML Comments January 14, 2014 This blog post continues with the topic of setting " HoneyTraps" within your ... Read More
8. 15 NovSpiderLabs Radio: January 10, 2014 January 12, 2014 In this week's podcast we talk about malware offered up in onlines ads, the ... Read More
9. 12 NovSpiderLabs Radio September 20, 2013 w/ Space Rogue September 20, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
10. 8 NovWendel's Small Hacking Tricks - Killing Processes from the Microsoft Windows Command Line interface. September 25, 2013 | Wendel Guglielmetti Henrique Since 2003 a large part of my workday has been devoted solely to hacking ... Read More
11. 8 NovIs Oracle Application Server End-of-Life? September 20, 2013 I was asked recently to review a web server running Oracle Application Server. ... Read More
12. 7 NovModSecurity for Java - BETA Testers Needed September 27, 2013 Over the course of the summer of 2013, the ModSecurity team participated in ... Read More
13. 1 NovSpiderLabs Radio September 27, 2013 w/ Space Rogue September 27, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More

October 2013

1. 31 OctInstalling VMware Tools on Kali Linux and Some Debugging Basics September 30, 2013 | Christophe De La Fuente I have been using Backtrack for a while now and decided to switch to Kali ... Read More
2. 25 OctSpiderLabs Radio October 4, 2013 w/ Space Rogue October 04, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
3. 25 OctTWSL2013-029: Information Disclosure Vulnerability in QNAP Photo Station September 30, 2013 Photo Station, a web application, allows users to upload and share photos over ... Read More
4. 18 OctAnother Day, SpiderLabs Discovers Another IE Zero-Day October 08, 2013 We at SpiderLabs investigate many suspicious webpages on adaily basis. ... Read More
5. 18 OctMicrosoft Advance Notification for October 2013 October 07, 2013 | Space Rogue It is on a monthly schedule but for some reason Microsoft's Patch Tuesday ... Read More
6. 14 OctMicrosoft Patch Tuesday, October 2013 October 08, 2013 Here in Philadelphia this month the localweather people are calling it ... Read More
7. 11 OctAV Vendors Targeted in Defacement Campaign October 08, 2013 | Ryan Barnett Attacked Sites The KDMS hacking team recently defaced several popular websites ... Read More
8. 11 OctExploiting Integer Based SQL Injection In Nested SQL Queries October 08, 2013 | Sasha Zivojinovic SQL injection involving nested queries and arithmetic evaluation. Read More
9. 10 OctThe Technical Aspects of Exploiting IE Zero-Day CVE-2013-3897 October 10, 2013 | Trustwave SpiderLabs Just two days ago we announced thediscovery of in-the-wild attacks that used ... Read More
10. 10 OctHaving a Fiesta With Ploutus October 10, 2013 | Josh Grunzweig A short while ago, SafenSoft reported a new family ofmalware, named 'Ploutus', ... Read More
11. 8 OctCard Data Siphon with Google Analytics October 18, 2013 | Richard Wells The introduction of EMV (Chip &Pin) payment devices in 2003 resulted in a ... Read More
12. 8 OctFingerprinting Ubuntu OS Versions using OpenSSH October 14, 2013 | Jonathan Claudius Over the past couples weeks, I've been working on enhancingthe operating system ... Read More
13. 8 OctSpiderLabs Radio October 11, 2013 w/ Space Rogue October 11, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
14. 8 OctHiding Webshell Backdoor Code in Image Files October 11, 2013 | Ryan Barnett Looks Can Be Deceiving Do any of these pictures look suspicious? Read More
15. 7 OctSpiderLabs Radio October 18, 2013 w/ Space Rogue October 18, 2013 | Space Rogue This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
16. 4 OctSpiderLabs Radio October 25, 2013 w/ Space Rogue October 25, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More

September 2013

1. 30 SepHacking a Reporter: Writing Malware For Fun and Profit (Part 1 of 3) October 31, 2013 | Josh Grunzweig Matthew Jakubowski (@jaku) contributed to the writing of this blog post. Read More
2. 30 SepPHP.Net Site Infected with Malware October 25, 2013 | Ryan Barnett Earlier today, users attempting to access the www.php.net site were met with ... Read More
3. 27 SepMicrosoft Advance Notification for November 2013 November 07, 2013 | Space Rogue Microsoft will release eight bulletins for Patch Tuesday inNovember. Four of ... Read More
4. 27 SepSpiderLabs Radio November 1, 2013 w/ Space Rogue November 01, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
5. 25 SepSpiderLabs Radio November 8, 2013 w/ Space Rogue November 08, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
6. 20 SepMicrosoft Patch Tuesday, November 2013 November 12, 2013 Most of us thought this would be an easymonth with only eight bulletins to deal ... Read More
7. 20 SepHacking a Reporter: Writing Malware For Fun and Profit (Part 2 of 3) November 08, 2013 | Josh Grunzweig Matthew Jakubowski (@jaku) contributed to the writing of this blog post. Read More
8. 20 SepTop Ten Survival Tips for the Dehydrated N00b Zombie Apocalypse at Security Week 2013 July 17, 2013 Just look at the face: it's vacant, with a hint of sadness. Like a drunk who's ... Read More
9. 19 SepSpiderLabs Radio July 26, 2013 w/ Space Rogue July 26, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
10. 19 SepSpiderLabs Radio July 19, 2013 w/ Space Rogue July 19, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
11. 16 SepSpiderLabs Radio August 2, 2013 w/ Space Rogue August 02, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
12. 16 SepAnnouncing the ModSecurity XSS Evasion Challenge July 30, 2013 | Ryan Barnett The SpiderLabs Research Team is pleased to announce the release of the ... Read More
13. 13 SepIntroducing RDI – Reflected DOM Injection August 06, 2013 | Daniel Chechik The other day at DEFCON 21 we (Daniel Chechik and Anat Davidi) gave a talk ... Read More
14. 10 SepMicrosoft Advance Notification for Patch Tuesday – August 2013 August 08, 2013 | Space Rogue No rest for the weary. Microsoft has announced that there will be eight ... Read More
15. 6 SepFun with 'Active Defense' August 09, 2013 Active Defense is steadily becoming a popular trend in the security field, both ... Read More
16. 5 SepSpiderLabs Radio August 9, 2013 w/ Space Rogue August 09, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More

August 2013

1. 30 AugThe Way of the Cryptologist August 12, 2013 Read More
2. 26 AugMicrosoft Patch Tuesday, August 2013 August 13, 2013 The big news this month in Microsoft's Active Protections Program, other than ... Read More
3. 23 AugMicrosoft Pulls MS13-061 Update for Exchange August 14, 2013 Microsoft has pulled one of the three critical patches from yesterdays Patch ... Read More
4. 19 AugThe Web IS Vulnerable: XSS on the Battlefront (Part 1) August 15, 2013 | Ryan Barnett Read More
5. 16 Aug[Honeypot Alert] Probes for Apache Struts 2.X OGNL Vulnerability August 16, 2013 | Ryan Barnett Today our web honeypot sensors picked up probes for the recent Apache Struts ... Read More
6. 16 AugSpiderLabs Radio August 16, 2013 w/ Space Rogue August 16, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
7. 15 AugMultiple Web Application Vulnerabilities in RockMongo August 19, 2013 During a recent code review for a client, I also took a brief look at a tool ... Read More
8. 14 AugSpiderLabs Radio August 23, 2013 w/ Space Rogue August 23, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
9. 13 AugSetting HoneyTraps with ModSecurity: Adding Fake robots.txt Disallow Entries August 26, 2013 | Ryan Barnett The following blog post is taken from Recipe 3-2: Adding Fake robots.txt ... Read More
10. 12 AugSpiderLabs Radio August 30, 2013 w/ Space Rogue August 30, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
11. 9 AugSpiderLabs Radio September 6, 2013 w/ Space Rogue September 06, 2013 Read More
12. 9 AugMicrosoft Advance Notification for September 2013 September 05, 2013 | Space Rogue This month Microsoft continues the recent tradition of large Patch Tuesday with ... Read More
13. 8 AugMicrosoft Patch Tuesday, September 2013 September 10, 2013 | Robert Foggia In Chicago, it's been a roller coaster of a summer with cold weather to now ... Read More
14. 6 AugSpiderLabs Radio September 13, 2013 w/ Space Rogue September 13, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
15. 2 AugTrust for Sale September 16, 2013 Let's, for a moment, get into the mind of a cyber criminal: Read More

July 2013

1. 30 JulVino VNC Server Remote Persistent DoS Vulnerability September 16, 2013 | Jonathan Claudius Last week, I was making some performance enhancements to theVNC protocol ... Read More
2. 26 JulTop Five Ways SpiderLabs Got Domain Admin on Your Internal Network September 19, 2013 | Theresa It's always surprising how insecure some internal networks turn out to be. Less ... Read More
3. 19 JulHey, can I use your server for spamming? September 19, 2013 | Phil Hay Over the last few months I have encountered two separate cases of our customers ... Read More
4. 17 JulModSecurity XSS Evasion Challenge Results September 20, 2013 On July 30th, we announced our public ModSecurity XSS Evasion Challenge. This ... Read More
5. 15 JulTWSL2013-006: Cross-Site Scripting Vulnerability in Coldbox June 11, 2013 | Robert Foggia Trustwave SpiderLabs has published a new advisory yesterday fora reflective ... Read More
6. 13 JulSometimes, The PenTest Gods Shine On You June 14, 2013 | Nathan Drier Settling down for a hacking session usually means lots of hard work and a long ... Read More
7. 13 JulSpiderLabs Radio June 14, 2013 w/ Space Rogue June 14, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
8. 12 JulDiscovering BMW Car Systems: Getting Started June 17, 2013 | Bruno Oliveira Since I love both (in)security and cars, it is not uncommon for me to mix those ... Read More
9. 9 JulCBC-R: It's not just for padding oracles! June 20, 2013 This is the short, technical version of a technique that I'll be writing more ... Read More
10. 9 Jul[Honeypot Alert] Inside the Attacker's Toolbox: Webshell Usage Logging June 19, 2013 | Ryan Barnett In a previous blog post, we discussed the common lifecycle of web server botnet ... Read More
11. 6 JulWendel's Small Hacking Tricks - Microsoft SQL Server Edition June 20, 2013 | Wendel Guglielmetti Henrique Since 2003 a large part of my workday has been devoted solely to hacking ... Read More
12. 5 JulThe Problem With Networks ..... June 21, 2013 | David Kirkpatrick Where do I start with this open-ended statement? I guess from a pen testing ... Read More
13. 5 JulSpiderLabs Radio June 21, 2013 w/ Space Rogue June 21, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
14. 1 JulDebugging Android Libraries using IDA June 22, 2013 | Neal Hindocha During a recent test, I encountered a native JNI library used by an Android ... Read More

June 2013

1. 28 JunExploiting Serialized XSS in Joomla! (return of the undead CVE) June 26, 2013 | Robert Rowley While reviewing Joomla! Vulnerabilities I felt a glitch in the matrix. Deja vu ... Read More
2. 28 JunOld Exploits Still Do the Trick June 24, 2013 | Daniel Chechik We are all aware that patching is very important. Many websites, however, take ... Read More
3. 28 JunWelcome to the Spider’s Lair June 24, 2013 "Will you step into my parlor?" said the spider to the fly; "'Tis the prettiest ... Read More
4. 26 JunA Friday Afternoon Troubleshooting Ruby OpenSSL... it's a trap! June 28, 2013 | Jonathan Claudius Last Friday I was trying out some new code that one of my colleagues wrote to ... Read More
5. 26 JunFake Qantas Spam Campaign Leads to Andromeda Bot Infection June 26, 2013 If you have booked a flight from Qantas recently, you might be expecting a ... Read More
6. 26 JunDigging Into the New Apache Injection Module June 26, 2013 | Josh Grunzweig I recently got a chance to dig into a couple variants of the new Apache ... Read More
7. 24 JunSpiderLabs Radio June 28, 2013 w/ Space Rogue June 28, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
8. 24 JunCorporate Passwords Part 1 June 28, 2013 With the vast amount of research and content that was done by SpiderLabs for ... Read More
9. 22 JunLook What I Found: It's a Pony! July 01, 2013 | Anat (Fox) Davidi Every once in a while we get to peek into the lion's den, this time we'll be ... Read More
10. 21 JunCustom Native Library Loader for Android July 05, 2013 | Mike Park If you read my co-worker Neal Hindocha's recent post "Debugging Android ... Read More
11. 21 JunMicrosoft Advance Notification for July 2013 – BOOM! July 05, 2013 | Space Rogue While you were stuffing your face with hotdogs and potato salad and then ... Read More
12. 20 JunModSecurity Advanced Topic of the Week: Detecting Banking Trojan Page Modifications July 09, 2013 The following blog post is taken from Recipe 10-5: Detecting Banking Trojan ... Read More
13. 20 JunSpiderLabs Radio July 5, 2013 w/ Space Rogue July 06, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
14. 19 JunMicrosoft Patch Tuesday, July 2013 - CRITICAL July 09, 2013 | Space Rogue This is probably one of the most important Patch Tuesday's we have seen in ... Read More
15. 17 JunXSS, SQLi in OpenEMR 4.1.1 July 12, 2013 A few tests ago, I came across an OpenEMR install with a weak password for a ... Read More
16. 14 JunSpiderLabs Radio July 12, 2013 w/ Space Rogue July 13, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
17. 14 JunSpiders Are Fun!, DEF CON's 21, Come Chat at Black Hat July 13, 2013 Security week in Las Vegas will be here before we know it. The SpiderLabs team ... Read More
18. 11 JunModSecurity Advanced Topic of the Week: Mitigating XSS Vulnerabilities Using Targeted CSP Enforcement July 15, 2013 | Ryan Barnett Content Security Policy (CSP) Implementation Challenges CSP is an extremely ... Read More
19. 11 JunSpiderLabs Radio April 26, 2013 w/ Space Rogue April 26, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers HostGator, ... Read More
20. 10 JunSpiderLabs Radio May 3, 2013 w/ Space Rogue May 03, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers Living ... Read More
21. 10 JunXML External Entity (XXE) Execution Disabled in ModSecurity v2.7.3 April 30, 2013 | Ryan Barnett On February 27, 2013, the ModSecurity project team was notified by security ... Read More
22. 7 JunMayday! 0-Day May 05, 2013 While many workers around the world were celebrating the May 1st events, the US ... Read More
23. 6 JunMicrosoft Advance Notification for May 2013 May 09, 2013 | Space Rogue There will be ten bulletins released by Microsoft next Tuesday and one of those ... Read More
24. 6 JunAlina: Casting a Shadow on POS May 08, 2013 | Josh Grunzweig Over the pastfew months, a number of malware families targeting Point of Sale ... Read More
25. 3 Jun5 ways to protect your E-Commerce site May 10, 2013 | Grayson Lenik The Trustwave Spiderlabs team frequently responds to E-commerce data breaches. ... Read More
26. 3 JunSpiderLabs Radio May 10, 2013 w/ Space Rogue May 10, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More

May 2013

1. 31 MayTWSL2013-002: Multiple XSS Vulnerabilities in The Bug Genie May 14, 2013 Trustwave SpiderLabs has published a new security advisory for multiple ... Read More
2. 31 MaySecuring Continuous Integration Services May 13, 2013 | Jonathan Claudius Over the last couple weeks, I've had the distinct privilege to share some of my ... Read More
3. 31 MayIntroducing the Burp Notes Extension May 10, 2013 | Austin Lane As a Security Analyst I spend a significant amount of time working in tools ... Read More
4. 24 MayMicrosoft Patch Tuesday, May 2013 May 14, 2013 I keep hoping for an easy relaxing Patch Tuesday of say, only two or three ... Read More
5. 20 MayAnalysis of Malicious Document Files Spammed by Cutwail May 15, 2013 | Rodel Mendrez In our Global Security Report, we highlighted a zero day vulnerability in the ... Read More
6. 17 MaySpiderLabs Radio May 17, 2013 w/ Space Rogue May 17, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
7. 15 MayMachine Learning Update 1 May 20, 2013 | Ryan Merritt It has been almost exactly a month since my last post regarding the new project ... Read More
8. 14 MaySpiderLabs Radio May 31, 2013 w/ Space Rogue May 31, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
9. 14 MaySpiderLabs Radio May 24, 2013 w/ Space Rogue May 24, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
10. 13 MayModSecurity Performance Recommendations May 31, 2013 | Breno Silva Sometimes we see ModSecurity users asking about performance in the mail-list. ... Read More
11. 10 MayThe Speed is from the Devil – Some Thoughts about Google’s New Disclosure Policy June 03, 2013 | Ziv Mador If you follow info-security news, you might have heard about Google considering ... Read More
12. 10 MayAlina: Following The Shadow Part 2 June 03, 2013 | Josh Grunzweig This will likely be the final blog post in this series on the Alina Point of ... Read More
13. 10 MayUnder The Hood: Linksys Remote Command Injection Vulnerabilities May 31, 2013 Several models in the Linksys E-Series WiFi routers running their respective ... Read More
14. 9 MayMicrosoft Advance Notification for June 2013 June 06, 2013 | Space Rogue So far this year we has had two Patch Tuesday months with seven bulletins ... Read More
15. 8 MayModSecurity Updates: Nginx Stable Release and Google Summer of Code Participation June 06, 2013 | Ryan Barnett Availability of ModSecurity 2.7.4: Nginx Stable Release The ModSecurity ... Read More
16. 5 MaySpiderLabs Radio June 7, 2013 w/ Space Rogue June 07, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue is brought to you ... Read More
17. 3 May[Honeypot Alert] Active Exploits Attempts for Plesk Vulnerability June 10, 2013 | Ryan Barnett Last week, hacker "kingcope" provided PoC expliot code for a Plesk 0-day on the ... Read More

April 2013

1. 30 AprBehind the Phish: Romance Perhaps? June 10, 2013 | Phil Hay When I look at the masses of spam we receive on a daily basis, I often wonder ... Read More
2. 26 AprTWSL2013-007: Multiple Vulnerabilities in VLC Media Player - Web Interface June 11, 2013 Yesterday, Trustwave SpiderLabs has published an advisory for multiple ... Read More
3. 24 AprMongodb - Security Weaknesses in a typical NoSQL database March 21, 2013 | David Kirkpatrick Over the last year or so, I've noticed 2 ports appearing more frequently during ... Read More
4. 22 AprSpiderLabs Radio March 15, 2013 w/ Space Rogue March 21, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers China, ... Read More
5. 20 AprSpiderLabs Radio March 22, 2013 w/ Space Rogue March 22, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers Korea, ... Read More
6. 19 AprDid Grum Really Get Killed? March 25, 2013 For several years before July 2012 takedown, Grum was one of the notorious spam ... Read More
7. 19 AprBaiting Attack Exercise – The Old School Way Still Works March 22, 2013 In the past few months, we have had quite a few social engineering and ... Read More
8. 18 AprHooked on Packets: Reading PCAPs for D Students - Preview March 26, 2013 | Ryan Linn SOURCE Boston is coming up in April, and Mike Ryan and I are giving a ... Read More
9. 17 AprCracking IKE Mission:Improbable (Part 1) March 27, 2013 | Daniel Chechik All too often during pen tests I still find VPN endpoints configured to allow ... Read More
10. 16 AprAn Analysis Of CVE-2017-5638 March 27, 2013 | Eric Rafaloff A detailed analysis of the Apache Struts server-side template injection ... Read More
11. 12 AprBreaking the Authentication Chain April 01, 2013 | Robert Rowley This little post is going to talk about how authentication goes beyond just ... Read More
12. 12 AprSpiderLabs Radio March 29, 2013 w/ Space Rogue March 29, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers OMG DDoS ... Read More
13. 11 AprJamming With WordPress Sessions April 02, 2013 | Robert Rowley Let's talk about some targeted attacks where session management can be targeted ... Read More
14. 10 AprMicrosoft Advance Notification for April 2013 April 04, 2013 | Space Rogue Ah, April, for most of us the weather is turning warm, birds return to their ... Read More
15. 9 AprModSecurity User Survey 2013 April 05, 2013 | Ryan Barnett The ModSecurity web application firewall project has grown a lot in the past ... Read More
16. 5 AprMicrosoft Patch Tuesday, April 2013 April 09, 2013 | Space Rogue This month we have nine bulletins, two critical covering just fourteen CVEs. ... Read More
17. 5 AprSpiderLabs Radio April 5, 2013 w/ Space Rogue April 05, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers Carberp, ... Read More
18. 5 AprWeb Application Defender's Cookbook: CCDC Blue Team Cheatsheet April 05, 2013 | Ryan Barnett Trustwave is a corporate sponsor of the National Collegiate Cyber Defense ... Read More
19. 4 AprRansomware Author 3's Farm Animals April 10, 2013 | Dan Meged As security researchers, our virtual journey in revealing new threats on the ... Read More
20. 2 AprRestricting Adobe CQ Admin Logins with Trustwave WAFs April 11, 2013 | Ryan Barnett One of the many useful features of a web application firewall (WAF) is its ... Read More
21. 1 AprSpiderLabs Radio April 12, 2013 w/ Space Rogue April 12, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers OpIsreal, ... Read More

March 2013

1. 29 MarMicrosoft Recalls Update April 12, 2013 | Space Rogue Microsoft has recalled part of an update that was release earlier this week as ... Read More
2. 27 MarMe Myself and I, Robot April 17, 2013 | Ryan Merritt Growing up I read every book my library had to offer by Jules Verne and Isaac ... Read More
3. 27 MarDefending WordPress Logins from Brute Force Attacks April 16, 2013 | Ryan Barnett As has been reported by many news outlets, WordPress login pages have been ... Read More
4. 26 MarLarge scale malicious spam campaign exploiting Boston bombing April 18, 2013 In our latest Global Security Report, we noted malicious spam campaigns were on ... Read More
5. 25 MarCracking IKE Mission:Improbable (Part 2) April 19, 2013 | Daniel Turner A couple of weeks ago I posted Part 1 of Cracking IKE, detailing some useful ... Read More
6. 22 MarSpiderLabs Radio April 19, 2013 w/ Space Rogue April 20, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers Schnucks, ... Read More
7. 22 MarJava is So Confusing... April 19, 2013 | Anat (Fox) Davidi It's been a short while, but we find ourselves again with a Java vulnerability ... Read More
8. 21 MarBasic Packers: Easy As Pie April 24, 2013 | Josh Grunzweig Throughout Trustwave SpiderLabs' many forensicinvestigations, we often stumble ... Read More
9. 21 MarAccidental Stored XSS Flaw in Zemanta 'Related Posts' Plugin for TypePad April 22, 2013 | Ryan Barnett Note that the vulnerability described here was fixed by Zemanta. Read More
10. 12 MarMicrosoft Advance Notification for February 2013 February 07, 2013 | Space Rogue The Advance Notification of Patch Tuesday from Microsoft has twelve bulletins ... Read More
11. 12 MarModSecurity IIS Updates: Stable Release, Award Recognition and More February 05, 2013 ModSecurity for IIS Stable Release As part of our recent release of ModSecurity ... Read More
12. 12 MarSpiderLabs Radio February 1, 2013 w/ Space Rogue February 01, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue covers The New ... Read More
13. 8 MarCryptOMG Walkthough - Challenge 2 February 07, 2013 | Andrew Jordan For those of you that missed it last time, CryptOMG is a configurable CTF-style ... Read More
14. 7 MarSpiderLabs Radio February 15, 2013 w/ Space Rogue February 15, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue covers Bit9 Looses ... Read More
15. 7 MarMicrosoft Patch Tuesday, February 2013 – Happy Chinese New Year! February 12, 2013 | Ryan Barnett Submitted by Space Rogue Read More
16. 7 MarServer-Side XSS Attack Detection with ModSecurity and PhantomJS February 08, 2013 | Ryan Barnett Client-Side JS Overriding Limitations In a previous blog post, I outlined how ... Read More
17. 7 MarSpiderLabs Radio February 8, 2013 w/ Space Rogue February 08, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers Twitter ... Read More
18. 6 MarOwning Windows Networks With Responder Part 2 February 15, 2013 One of the great things about working within SpiderLabs is that we prefer to ... Read More
19. 6 Mar[Honeypot Alert] User-Agent Field PHP Injection Attacks February 15, 2013 | Ryan Barnett In a previous Honeypot Alert blog post, I showed an example of attackers using ... Read More
20. 5 MarEasy DOM-based XSS detection via Regexes February 19, 2013 | Antisnatchor If you are interested in finding DOM-based XSS, you must have knowledge of ... Read More
21. 4 MarSpiderLabs Radio February 22, 2013 w/ Space Rogue February 22, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers The ... Read More
22. 4 MarLevelBlue TrustKeeper PCI Scan Notification - Phishing ALERT February 21, 2013 Over the last few hours, LevelBlue has received multiple reports of individuals ... Read More
23. 1 MarMore on the TrustKeeper Phish February 22, 2013 | Phil Hay Yesterday we alerted people to a widespread phishing campaign misusing ... Read More

February 2013

1. 27 FebMicrosoft Patch Tuesday, June 2013 June 11, 2013 Finally, patch Tuesday has arrived and fortunately this one will be a real ... Read More
2. 22 FebCyber' Security - must become a board level issue in the UK ...really? March 04, 2013 | SpiderLabs Researcher The UK Government is "committed to helpingreduce vulnerability to attacks and ... Read More
3. 22 FebSpiderLabs Radio March 1, 2013 w/ Space Rogue March 01, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers Half a ... Read More
4. 21 FebNew Year, New Data, Same Mistakes: Passwords March 04, 2013 | Barry O’Connell Like a late-arriving Christmas, one of the gifts of the new year is the release ... Read More
5. 19 FebYou Injected What? Where? March 05, 2013 | Theresa While harder to detect, there are still some instances of websites exploitable ... Read More
6. 15 FebMy 2013 RSA Conference Keynote the Jimmy Kimmel Influence March 07, 2013 Read More
7. 15 FebKelihos is Dead… No wait… Long Live Kelihos! Again! March 06, 2013 This post is inspired by a news article which highlighted a recent presentation ... Read More
8. 15 FebThe Life Cycle of Web Server Botnet Recruitment March 06, 2013 This blog post is an excerpt taken from the recently released Global Security ... Read More
9. 12 FebOS Image Wrangling March 07, 2013 | Nathan Drier On most PenTests, alot of research goes into the things you find along the way. ... Read More
10. 8 FebMicrosoft Advance Notification for March 2013 March 07, 2013 | Space Rogue First the raw numbers; we have seven bulletins this month, four critical, and ... Read More
11. 8 FebUpcoming Webinars: 2013 Trustwave Global Security Report Threat Trends March 07, 2013 A few weeks ago we released the 2013 LevelBlue Global Security Report. This ... Read More
12. 7 FebMicrosoft Patch Tuesday, March 2013 – Happy St. Patch-rick's Day! March 12, 2013 | Space Rogue Saint Patrick's day is quickly becoming Saint Patrick's week. Some cities have ... Read More
13. 7 FebSpiderLabs Radio March 8, 2013 w/ Space Rogue March 08, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers Pwn2own, ... Read More
14. 5 FebFresh Coffee Served by CoolEK March 12, 2013 | Moshe Basanchig As you may already know, the past few months have been problematic to Oracle ... Read More
15. 1 FebMimicking Attackers: Building Malware for CCDC March 12, 2013 | Josh Grunzweig This past weekend my fellow coworkers/friends and myself had the opportunity ... Read More

January 2013

1. 25 JanSpiderLabs Radio December 28, 2012 w/ Space Rogue December 28, 2012 We are back with another episode of SpiderLabs Radio hosted by Space Rogue. ... Read More
2. 25 JanSpiderLabs Radio December 21, 2012 w/ Space Rogue December 21, 2012 We are back with another episode of SpiderLabs Radio hosted by Space Rogue. ... Read More
3. 24 JanGetting Terminal Access to a Cisco Linksys E-1000 December 31, 2012 | Jonathan Claudius Over the past couple weeks, I've been spending a lot of time hacking on various ... Read More
4. 21 JanTeaching Security Self-Defense December 31, 2012 | Barry O’Connell My background in IT comes mostly from a nomadic perspective. In my years of IT ... Read More
5. 18 JanWardrive, Raspberry Pi Style! December 31, 2012 | Videoman I purchased a Raspberry Pi a few weeks back. I found that I could power it, ... Read More
6. 17 JanBe Off the Beaten XPath, Go Blind December 31, 2012 | Christophe De La Fuente XPath (XML Path Language) is a language used to query XML documents in order to ... Read More
7. 16 JanAssessing iOS Applications – setting up a test environment and grabbing low hanging fruit December 31, 2012 This guide should serve as an introduction for those wishing to get into iOS ... Read More
8. 14 JanInternet Explorer - 2012 Last Minute 0-Day January 01, 2013 | Rami Kogan Using Zero Days attacks at end of the year are not the most considerate thing ... Read More
9. 11 JanChoppy Regulatory Waters ahead for EU SMEs? January 02, 2013 There's been a reasonable amount of coverage of the (proposed) data protection ... Read More
10. 10 JanHacking with Drain Cleaner – Yet Another BitLocker Bypass Technique January 02, 2013 As hard-wired as any Application Specific Integrated Circuit it seems the ... Read More
11. 10 JanPhotobucket: An Identity Thief's Playground January 02, 2013 Photobucket is a popular social media site that acts as gallery and cloud ... Read More
12. 9 JanMicrosoft Advance Notification for January 2013 January 03, 2013 | Space Rogue If you were hoping for a nice relaxing Patch Tuesday after the holidays, well, ... Read More
13. 8 JanSpiderLabs Radio January 04, 2013 w/ Space Rogue January 04, 2013 We are back with another episode of SpiderLabs Radio hosted by Space Rogue. ... Read More
14. 8 JanDissecting a CVE-2012-4792 Payload January 04, 2013 | Trustwave SpiderLabs A little while ago I was fortunate enough to get ahold of a sample that was ... Read More
15. 4 JanGoodies released with Trustwave SWG Security Update 141 January 08, 2013 | Rami Kogan As cliché as it may sound, security is done in layers and so, using our generic ... Read More
16. 4 JanMicrosoft Patch Tuesday, January 2013 – Hot Sauce January 08, 2013 | Space Rogue I had lunch today at a great little Cajun restaurant in Chicago called Heaven ... Read More
17. 3 JanSpiderLabs Crypto Contest - Hints January 09, 2013 This is a post for those attempting to solve the Crypto contest I introduced a ... Read More
18. 2 JanSpiderLabs Radio January 11, 2013 w/ Space Rogue January 11, 2013 | Space Rogue We are back with another episode of SpiderLabs Radio hosted by Space Rogue. ... Read More
19. 2 JanModSecurity Mitigations for Ruby on Rails XML Exploits January 10, 2013 | Ryan Barnett There is big trouble in Ruby on Rails (RoR) land... The issue is related to XML ... Read More
20. 2 JanFirst Java 0day For The Year 2013 January 10, 2013 Today @Kafeine was the first to announce the new Java 0day. This 0day allows an ... Read More
21. 1 JanMicrosoft Patch Tuesday, January 2013 - Part II January 14, 2013 | Robert Foggia It's now official, there is another bulletin (MS13-008) release for the month ... Read More