2026-06-09T18:42:03Z https://yabu.me Brian Clark https://yabu.me/npub1mqq55xavlpm9jj9sqhq3deau3f2swkzmgymk7j9355v0edd6tuzq500jgu https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/292/500/061/711/468/original/8e5dc5b94a214b4b.jpeg https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/292/500/061/711/468/original/8e5dc5b94a214b4b.jpeg https://yabu.me/nevent1qqsvzyhyh3g7t6rfqh57qsqsah8cac68d88pusg2s6fcmn3xrxzyekqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg48q424 In reply to <a href='/nevent1qqszancnweql8pe5g0zsnm2fsmqzjmyzasmz8t2sf03263muaytsershfkwhz'>nevent1q…kwhz</a><br/>_________________________<br/><br/>unless you live in or do business in Russia, this is not likely to affect you. This issue is about risk to you and your users. Security is always about tradeoffs, and for most people in the West, this tradeoff is a no-brainer. 2026-02-10T00:29:27Z https://yabu.me/nevent1qqs0f9xxfjlcct8y3necuxsxslsxgu5zs3h508jafkfy36h8hzr4jqqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg5wp4cs In reply to <a href='/nevent1qqswahecjas84cjc3llfk85xp62q83crjmar9nlzkkrk5x6cxeaa3agpz6d2c'>nevent1q…6d2c</a><br/>_________________________<br/><br/>you probably don’t want any files torrented out of Russia. 😬 2026-02-10T00:27:15Z https://yabu.me/nevent1qqsw4sm4dasmepqshzd4j393prfcsn6vmrp55ymfk03fhyezxdn2h9gzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgr9gap2 RE: <a href="https://infosec.exchange/@spamhaus/116013190680647542">https://infosec.exchange/@spamhaus/116013190680647542</a><br/><br/>Folks: block the .ru TLD any and all ways that you can. #cybersecurity<blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note1zfn8t0gem8cznr9vk0hrr2ksqp4kqrtdqs4mnagxcsyc5ydmvyfqpvwtl9" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1zfn…wtl9</a></span><br/> </div> .ru serious? 🇷🇺 ccTLD .ru had an unbelievable +3741% ⏫ in #botnet C&C domains, placing it #1 for the most abused ccTLD in the latter half of 2025. This activity can be attributed almost entirely to #clearfake, a malicious JavaScript framework.<br/><br/>Learn more in the Botnet Threat Update Jul - Dec 2025 ⤵️ ⤵️ <br/><a href="https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/">https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/</a> <br/><br/>#ccTLD #BotnetCC #ThreatIntel<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/013/190/594/477/781/original/a3c6c279f1e710df.png"> <br/> </blockquote> 2026-02-05T23:48:44Z https://yabu.me/nevent1qqs9vgqhr2ndmgew57vfmvj5tpp4xy356luzwfvd7cxdmtjrqhlgnlqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sghrwg5h JAW DROPPING. That was a Nintendo Tecmo Bowl play! #BEARS #nfl 2026-01-19T02:43:24Z https://yabu.me/nevent1qqsratvedwl23rvpw8f0zmuun8r82tc4p9nycem65jqsvqmax0tr6yczyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg0pryy8 tl;dr Block these domains and you’ll have broken several links in this attack’s kill chain:<br/><br/>Webhook[.]site<br/>My-board[.]org<br/>ngrok-free[.]app<br/>rf[.]gd<br/><br/>If you followed <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1cttkhuyqqd467e9e6j2vkvzl3mp3mh4v8dt3j7au7fy637e70pzq443ll8" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>B'ad Samurai :ifin:</span> (<span class="italic">npub1ctt…3ll8</span>)</a></span> ‘s advice and used his block lists, you’d have already blocked a couple of them. <br/><br/><a href="https://www.recordedfuture.com/research/gru-linked-bluedelta-evolves-credential-harvesting">https://www.recordedfuture.com/research/gru-linked-bluedelta-evolves-credential-harvesting</a> #cybersecurity 2026-01-07T23:30:57Z https://yabu.me/nevent1qqsflzus8p4757ztpjcqyp4fuyt2kkmcldcjhmrg0v8kg2g67ez7d5szyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg3545cv In reply to <a href='/nevent1qqsdljkd0uer4yym6ajva7gaxuhegk87s6utctsvlfajjp7ql07xk6q7jsehs'>nevent1q…sehs</a><br/>_________________________<br/><br/>you ever look at Thuma? They have nice furniture made of real wood. <a href="https://www.thuma.co">https://www.thuma.co</a> 2026-01-06T13:45:12Z https://yabu.me/nevent1qqs87waqgklv0cnz4nlrdk3aa84zwthfngdnukwk2c5dw35e2f84cqgzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg9kyjwj In reply to <a href='/nevent1qqs83du9yk2y7v8h5kwmskfg52xlw5rqxx34h6j9spxwd2lqnaxg7vqpjfyv8'>nevent1q…fyv8</a><br/>_________________________<br/><br/>you sure they are not just blocking your scanner? 2025-11-25T22:49:25Z https://yabu.me/nevent1qqszz7ntg0v6p2jzh5smw5fdcy9ykjpvqqmncgxg4uz870s0xc8zvqqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgufz55j In reply to <a href='/nevent1qqs0q8n6ryttuxej6cg6cc57e6hwqw8sx3enaukeggal2szde53mjlqeqa0x8'>nevent1q…a0x8</a><br/>_________________________<br/><br/>thank you for sharing your knowledge and experience with us. I’ve learned a lot from you over the decade or so I’ve followed you. 2025-11-25T03:42:05Z https://yabu.me/nevent1qqs84aaqcwp7d520w2qaksenrlgr5rr75r9fk09xpusn99lmqgv56qqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgf59dkx In reply to <a href='/nevent1qqsf302h6tvaqlw66fnvdlflcvuu5v8ym0nlg9se94nhc43vl9h2g9srsmnlx'>nevent1q…mnlx</a><br/>_________________________<br/><br/>it doesn’t appear that the csv files themselves are accessible. Just the listing. Or at least that’s the behavior I’m seeing right now. You seeing anything different? 2025-11-24T16:57:28Z https://yabu.me/nevent1qqsg6qyn6d34k653kzyx9vhfvjk9vju3r2yau95mgqtxuxjffj4x49szyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg9fpsvv In reply to <a href='/nevent1qqsyxqu5cj8dys9ekyepumhkwfra3nchjdv0ftzqn40hm0gf8pfergqe5hhg4'>nevent1q…hhg4</a><br/>_________________________<br/><br/>just apply the policy blocking those exe’s after initial deployment 2025-11-13T13:49:51Z https://yabu.me/nevent1qqswwhdd4rgcy0fe4n7udnygvfwft7a8zgzz90dg9txhc2jg4e5aewczyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg4u3sp4 In reply to <a href='/nevent1qqsdxwlqrq6x3vd6g2j5guzz5wkwpu3s0c56p6uervssyl7z5tfshrsjffffx'>nevent1q…fffx</a><br/>_________________________<br/><br/>hasn’t had a significant impact in my environment. But I imagine it depends on how much old software you have hanging around. 2025-11-13T02:20:02Z https://yabu.me/nevent1qqsgc5t7vdtxcehjxq788fnh74cfufmtzg8d2s6wm6j7rvltzy82tmqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg55tr5c In reply to <a href='/nevent1qqsdqc3ktcvnhc3lc4wllrt2p0d0usykwrq8jmhexgy0j8kcv6n2d7qw2edne'>nevent1q…edne</a><br/>_________________________<br/><br/>you absolutely should block the execution of mshta.exe. It will only block some of the ClickFix attacks, but block some other techniques too. Mshta.exe is an attacker favorite. <br/><br/>While you are at it, block cscript.exe and wscript.exe too. 2025-11-13T01:51:23Z https://yabu.me/nevent1qqsxae75yan8dw9mg5ddrh7j4wrwe36py8985wuzxp80w626a3rg9pqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sggzlc7k In reply to <a href='/nevent1qqs0f0uxc45z0a4qmuc96a344pwyny5eflgu74g9tj3zq5uuhnlvqhsun9rpq'>nevent1q…9rpq</a><br/>_________________________<br/><br/>I’m glad you are here. 🙂 2025-11-04T02:52:45Z https://yabu.me/nevent1qqs9tdxq54tk895jgj320dacsc2cspn5sk84puntsjukk6d9nqc6p5qzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgetwr3p In reply to <a href='/nevent1qqsd8zs4a0h5z4yqrsrs0f34tga0jqgm94xa3q4hhz4gddghxmml4egm9u2cx'>nevent1q…u2cx</a><br/>_________________________<br/><br/>Steven Lim has written a Microsoft KQL detection for EDR Freeze and made it available here:<br/><br/><a href="https://detections.ai/share/rule/cicyA1JW">https://detections.ai/share/rule/cicyA1JW</a> 2025-09-23T22:19:53Z https://yabu.me/nevent1qqszcyk33hunttns85kj945dmhc70v0ncvzjr3fr9t6p86vagxljmsszyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgvkz26z Zensec has a good article on the Akira ransomware group&#39;s tactics taken directly from their DFIR experience on 16+ incidents. A few key take-aways:<br/><br/>- Initial Access: Please, please please patch your Internet-facing VPN and firewall devices including your Sonicwall, Cisco ASA and Watchguard devices.<br/>- Patch our Veeam software. They used vulnerable Veeam installs to perform privilege escalation <br/>- Block access to Anydesk.com and remotedesktop.google.com if you don&#39;t use those services<br/><br/>#cybersecurity #ransomware <br/><a href="https://zensec.co.uk/blog/unmasking-akira-the-ransomware-tactics-you-cant-afford-to-ignore/">https://zensec.co.uk/blog/unmasking-akira-the-ransomware-tactics-you-cant-afford-to-ignore/</a> 2025-09-21T22:48:32Z https://yabu.me/nevent1qqstjvnd0a9kkm4mz8pdwvjzknaucujg3trtj5q5lzhkae6zda8t2agzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgh42v3w In reply to <a href='/nevent1qqsq5x0s3ychzmtqq33587laewezmv86uq2gmh6wg06takpxd8zk2jgkhl53j'>nevent1q…l53j</a><br/>_________________________<br/><br/>oh boy, I thought I had run out of stupidity for the day 2025-09-11T22:49:55Z https://yabu.me/nevent1qqsxunh3k0ru5qs3vspj0leapv4rujyelgupqvaqp6965wjjajkf05szyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgjf8a6a In reply to <a href='/nevent1qqstn8ysedahkhvkyfqr343tgwm40y97cffztcfunaqqxv0xkcj66rqaljsz5'>nevent1q…jsz5</a><br/>_________________________<br/><br/>song is giving me Avril Lavigne vibes 2025-09-03T23:02:55Z https://yabu.me/nevent1qqs9sv80dj42mhfuwzjegx3wz4ct5a7qk0cl0mhmpfmyyrw534p77vszyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg7ke38f In reply to <a href='/nevent1qqsvqkaxut53a04ffc4e3tcnwkmgwau9f4d6kuqp0xer6u5dtt6jyxc8dx3aj'>nevent1q…x3aj</a><br/>_________________________<br/><br/>I do t really know why, but I never watched B5 despite being a sci-fi fan and watching all the Star Trek series. Is B5 worth watching now? Does it hold up? 2025-08-24T16:38:09Z https://yabu.me/nevent1qqs265st5epmzswsjkvxqhxzldyjw4hdc7lppygrxhstfmrxud8k7tszyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgxcf5dx In reply to <a href='/nevent1qqszzcvxpeuapqt9ug0nlzdatj6na62sngd2qza3l9j6u62t6w7y39g80053c'>nevent1q…053c</a><br/>_________________________<br/><br/>I’m worried that they got documentation on their customer network and router configurations. That could open up a lot of new attack paths. 2025-08-20T12:51:14Z https://yabu.me/nevent1qqsppfpn7wheygprdrlz6rp49jz4xz4u83el7w82aeqng4qqds45ysczyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sggmneyu In reply to <a href='/nevent1qqstng7gde3wmnyg364x8e5469rvqquh49hzdvwdk8vng8rvl28p67ga54tqz'>nevent1q…4tqz</a><br/>_________________________<br/><br/>love it! 2025-08-20T00:16:31Z https://yabu.me/nevent1qqspyz5fpgk4y3rcdsf840yhfaryxn8cuuua55hzxazuq4kmkgf8ltgzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg5dyscg In reply to <a href='/nevent1qqs95emffdwqv5g2c9f4r546pwe36sqy472n5826e3szyexe5u7048sk4rzlr'>nevent1q…rzlr</a><br/>_________________________<br/><br/>cool event<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/005/604/583/486/818/original/bf8dfe6209b82509.jpeg"> <br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/005/604/159/370/185/original/e197c24b3a4d3ffe.jpeg"> <br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/005/604/087/408/166/original/bf8ab58f54cd18bf.jpeg"> <br/> 2025-08-10T17:18:05Z https://yabu.me/nevent1qqszflpvkw0mwt94ysx48gpu8jz66mcnyakrm5t8knntwzx2u0r6k0szyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgr3rga0 Hello #DEFCON33<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/994/419/769/447/084/original/7fbbfddb01668fb1.jpeg"> <br/> 2025-08-08T17:53:49Z https://yabu.me/nevent1qqsdsx8n6dm9ht05znh9xpehzgavtvfla5up9ngmhs2rqcle97r3h8czyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgm3s0h6 In reply to <a href='/nevent1qqs2el49pf2vvu32lwkrva4xfj9lr4xnv8nm7xs7u3v63t95tsm60wg4v69d3'>nevent1q…69d3</a><br/>_________________________<br/><br/>it’s uncanny how much she looks like Taylor. 2025-08-03T19:59:08Z https://yabu.me/nevent1qqsdmc2ldfrnd6wnfssg99k7x0am6rvz40c6k2xk9auy3syvtcavnjczyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg8xjvkx In reply to <a href='/nevent1qqs9h7nfv6vvfqhny8zvn7j50k8h43nygqwaz2rywsjq5nz43csj9ds08qhvj'>nevent1q…qhvj</a><br/>_________________________<br/><br/>&lt;sigh&gt; sold out 2025-07-13T19:46:49Z https://yabu.me/nevent1qqsvvv5g9y2pywpu02nr2ect6r9pje92nrkqslfnjl644tzf8muhcpgzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg3ctq75 In reply to <a href='/nevent1qqsv75r5femf0cef6yrv289f8l5a8g0fen7znufz0sarxz27y3vrq2ssc4jza'>nevent1q…4jza</a><br/>_________________________<br/><br/>Doritos and cannabis is a winning combination if there ever was one 2025-07-07T01:15:36Z https://yabu.me/nevent1qqsg4lfwyghdh6s74egq83wzrcmdhqzxlc45z7298c08hn6jyf0ethszyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgq99gvj In reply to <a href='/nevent1qqspn5hxfc7smtcuzzmrqvvrzms78360jnvq4dx4u4a0thpslv7203gsq905u'>nevent1q…905u</a><br/>_________________________<br/><br/>is this a sub-toot? 2025-07-07T01:14:54Z https://yabu.me/nevent1qqspkqwf433u9hw5s5a0p89qvmmy8xmv3acqr896zu5wmr7mydgf4vgzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgd03x0m In reply to <a href='/nevent1qqsdzr35g7lpx7gscyhn76quk4y9chexqevj9aymdxnyecrzc80ghac9vkw79'>nevent1q…kw79</a><br/>_________________________<br/><br/>can confirm. I’ve got two of these. 2025-07-04T21:24:32Z https://yabu.me/nevent1qqsxrvxmw0mrrdaz6e6ux88shwsyfznc7pkj05c69ujwxrh25k4nyyczyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg079d73 Please raise your hand if you&#39;ve disabled PowerShell 2.0 on your Windows systems. What? Didn&#39;t know that was a thing you should do? PowerShell 2.0 does not have any of the modern logging and security features that newer versions like v5.1 or 7.x have. But if you don&#39;t remove or disable the old 2.0 version, it can be used and abused by malware, info stealers, ransomware operators, etc. Here&#39;s an article that provides you with several ways to remove it from you systems (while keeping the newer version in place) #cybersecurity <br/><br/><a href="https://powershellcommands.com/disable-powershell-20">https://powershellcommands.com/disable-powershell-20</a> 2025-06-23T01:45:36Z https://yabu.me/nevent1qqszk57qcef7gyf0wuwcuy8ww2g8z4dj9vpzjrcpavk692cjert9czczyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgg0zqs2 For this edition of #caturday I present a #cat and his stuffy toy cat buddy. Which one is the real cat? 😉 <br/>#catsofmastodon<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/602/974/290/583/757/original/f1aeb930785b109f.jpeg"> <br/> 2025-05-31T14:44:06Z https://yabu.me/nevent1qqs94lpfu92gjz5p063v3grxgmzx992nztx92gp6x7mrrtzw5dzr9ggzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg09qrg0 In reply to <a href='/nevent1qqsd59njesnk9ycjd5rk0svw6kwlcndyfgtrnyvrxy3unehpz9s9cpqrml89n'>nevent1q…l89n</a><br/>_________________________<br/><br/>I can barely comprehend the awesomeness of her sparkly emerald green dress! 2025-05-28T01:00:31Z https://yabu.me/nevent1qqsgpgj905kklkrfq5p75z8e456nsswh5stx67q82rkuhuue6nxnl8czyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg7ely7d In reply to <a href='/nevent1qqsrqd3gld0yrqrvxjhv3cgnz5v96w9a8pypz50fph8s7x5706tnmhspkta87'>nevent1q…ta87</a><br/>_________________________<br/><br/>&lt;sigh&gt; yes, this is true. Will be made worse after all the cuts to social services like Medicare and Medicaid the Republicans are putting in. 2025-05-14T12:39:27Z https://yabu.me/nevent1qqswe77ehy8l4gmvl7n3z9vdf9rhhjca5nhq0q4gwm30tz8dhe5x4vczyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgfrfqnr In reply to <a href='/nevent1qqs8jmx7vmx6wy5q9vd6vzdchr0um0y57jnkfxaztypzxy3e7vmqn6sh4slzp'>nevent1q…slzp</a><br/>_________________________<br/><br/>I assume this doesn’t work if Tamper Protection is enabled? 2025-05-08T22:54:52Z https://yabu.me/nevent1qqsrtuswcy2tnpaqrsrqf8y4w3msgg3vllm789n5jva7g95pdt3hddqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sggtfacn Hey <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1dqdh3ta2uxg4wz5qf7h6j0qywrxryzcyjw4vhq0n0alu83d6mgnsxm8xy4" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>DEF CON</span> (<span class="italic">npub1dqd…8xy4</span>)</a></span> is your website down? I cannot get to <a href="https://defcon.org">https://defcon.org</a> 2025-05-04T22:39:38Z https://yabu.me/nevent1qqsx3pxe8gf7hre77as6rr73064lflyckm6h9pjfjlly5rj09du024szyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgw8te04 In reply to <a href='/nevent1qqs9up3zmfn30n8c9jpdl3m42p7cx82xxt2gz64kem9xr2na4zse6ls0xld6q'>nevent1q…ld6q</a><br/>_________________________<br/><br/>I’m just glad the feature is off by default on managed systems and you have to have an admin specifically allow it to be enabled by an end user. 2025-04-28T22:19:20Z https://yabu.me/nevent1qqsrusyy7f694e50a6l8cu632lc7jhz6v8z4akwnznuq2l6ru7zpkzszyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgejcn6e In reply to <a href='/nevent1qqsdrdd3h0n8x76z498rnrecfht5nqvmzpyshlvm9axrc6d8xffxeysutj54v'>nevent1q…j54v</a><br/>_________________________<br/><br/>I didn’t realize this part. It won’t show up in MDE logs? 2025-04-17T21:55:37Z https://yabu.me/nevent1qqsv8tfd3lzfg4v45pykan6ff6uvgvj0mh9r9htms2k356elsfe9pmgzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgx2fgf4 Sekoia has a good report out on Interlock ransomware. One thing that jumped out at me is the continued abuse of Cloudflare’s free trycloudflare[.]com service. This domain should be blocked if you want to avoid ransomware as this isn’t the only group using this service for C2 and remote access. If your developers need this kind of functionality, you should have them sign up for the inexpensive paid version of the service that allows for the use of your own custom domain name. #cybersecurity <br/><br/>From: [@sekoia_io](<a href="https://infosec.exchange/@sekoia_io">https://infosec.exchange/@sekoia_io</a> )<br/><a href="https://infosec.exchange/@sekoia_io/114346873677895469">https://infosec.exchange/@sekoia_io/114346873677895469</a> 2025-04-17T13:02:47Z https://yabu.me/nevent1qqspqg3h6yc2n657z0jwduvnsvqvgz40spzhhwzpzgsvm7gc3vux5tgzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgc0zk27 Security Firm <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1xrhn2zk0fhcxz8gtaggj0hfmvgm0j4v5n2c2yhjssu22tqmxnmgslhfkxn" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Sophos X-Ops</span> (<span class="italic">npub1xrh…fkxn</span>)</a></span> published another report, this one on incidents at small and medium-sized businesses by <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1557n7au4g2pg7rv5zqghn2t2vgplr9nqx6v8fgh5ll3vawndmw5szymf0x" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Sean Gallagher :verified: 🐀 :donor:</span> (<span class="italic">npub1557…mf0x</span>)</a></span> and Anna Szalay. One of the things I always look for in these reports are easy #cybersecurity wins -- and this report has a bunch of them. <br/><br/>First off - take a look at this chart: Top 15 dual-use tools. Imagine the pain you can cause threat actors by blocking the use of these tools and disrupting their playbooks!<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/350/603/475/705/098/original/35b29599747d242d.webp"> <br/> 2025-04-17T01:08:09Z https://yabu.me/nevent1qqswyer84gsj5spsnsnxn7xxqpdmhne67er9mps25s75vphv9358q8czyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgvw4ddt In reply to <a href='/nevent1qqs989sqg9y80az9983ccqd4w7a4aauuj6rjze7dvj2f83cvaqjs4wcapwstm'>nevent1q…wstm</a><br/>_________________________<br/><br/>dark 2025-03-20T12:22:33Z https://yabu.me/nevent1qqsphv85rxces92u6wutspxeqrx8tat83tn6zh2w7hdqjpxu7n428qqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sggn6h5y The free service from portmap.io is being abused to support malware C2 communications. If you don’t use it, I suggest blocking *.portmap.io via DNS, NGFW and/or web proxy.<br/><br/>#cybersecurity #threatintel <br/><br/>From: <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1vcntjau36pvfp3a4n28ktjkel36sm0lrcz8py7jz623qezqcz45q77s5ug" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>ScumBots</span> (<span class="italic">npub1vcn…s5ug</span>)</a></span><br/><a href="https://infosec.exchange/@ScumBots/114167879065509347">https://infosec.exchange/@ScumBots/114167879065509347</a> 2025-03-15T18:58:32Z https://yabu.me/nevent1qqsg40t3jmnlseu862x4v4an52sd0upg3wl282t2m40faxrzccmksqgzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg3g66xu I’ve never heard of the MSP-focused bluetrait.io but add it to the list of legitimate services that get abused. If you don’t use this RMM service, I suggest blocking it via DNS, NGFW or Web security proxy. #cybersecurity <br/><br/>From: <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1n2hv8zxa4nfr6fsr8rey0yn3g54gcalmh8kusewtakc3aujejd5sfc4lsk" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Threat Insight</span> (<span class="italic">npub1n2h…4lsk</span>)</a></span><br/><a href="https://infosec.exchange/@threatinsight/114144688263847941">https://infosec.exchange/@threatinsight/114144688263847941</a> 2025-03-13T02:40:59Z https://yabu.me/nevent1qqsv2f97zwv43v25923hu0582sr2w4zegk73uxfkg384y783323tesqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgpu4pwa There’s been a #Microsoft #outage going on all day today resulting in email and other M365 services including Teams being unavailable. Microsoft says they’ve rolled back the code change that caused the problem so things should start working again soon. Check on MO1020913 in the Microsoft Admin Portal for details. 2025-03-01T22:54:30Z https://yabu.me/nevent1qqsydm7mcahpw9ujyvex7qlxqhyktle4wtes9m3z9ffx2c95rj370dqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgevtfcf In reply to <a href='/nevent1qqsw7zkntj3p4mey4vggducp4jj90nzpwp80u46u9qfz4lcuw7nghfg37mvnc'>nevent1q…mvnc</a><br/>_________________________<br/><br/>I’m glad you are here! 2025-02-18T05:00:35Z https://yabu.me/nevent1qqsfhndtqylgtk3tgh6vrjerl6sdw074st36n0zsem5eprm6aaz2mgqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgcqdhat In reply to <a href='/nevent1qqsqqjlcx56tps86p6apx7pkarua0t5vu2jf8zyz7d0z5pfhha49g4sa8px3f'>nevent1q…px3f</a><br/>_________________________<br/><br/>so this is a post about Telegram, but i also advocate for blocking entire categories of apps, such as messengers and chat apps, and only allowing those that are vetted and approved in your org. The only way you can effectively do that is with a tool that keeps track of those apps for you, such as Netskope, Zscaler, an NGFW or maybe a DNS-based service like Cisco Umbrella. 2025-02-16T23:55:32Z https://yabu.me/nevent1qqs8xqyjppnwlc88zhd526ms4dsss57ajh9g5azrtjev65ksrm4jargzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg3x7jpr In reply to <a href='/nevent1qqsvwttlpnjdp5f993xv63pxxv24h4nas3cqpcv9j70vk8el5rrx63gkk6jct'>nevent1q…6jct</a><br/>_________________________<br/><br/>Also, I’d add that blocking an app in your environment that has more than a few users requires communicating with those users beforehand. Doesn’t seem like that happened in your case. 2025-02-16T23:30:08Z https://yabu.me/nevent1qqswdtcvaepc9p43rcwhr4zx54ckg2lgldzsq2zpn2swpenh3364h9szyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgc3dcts If you help maintain #cybersecurity on a business network you should absolutely block Telegram—there’s nothing good there. If you have a web security proxy like Netskope or Zscaler, or an NGFW, block it there. You can also block it via DNS. Blocking these domains should do the job:<br/><br/>telegram.me<br/>telegram.org<br/>t.me<br/>cdn-telegram.org<br/>telegram-cdn.org<br/><br/>From: <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1nfcxlme0vu874ttzet99lr9z67qz2my0ks37y23fm5c3re7flynqp8yzp9" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Christoffer S.</span> (<span class="italic">npub1nfc…yzp9</span>)</a></span><br/><a href="https://swecyb.com/@nopatience/114009822145442393">https://swecyb.com/@nopatience/114009822145442393</a> 2025-02-16T19:23:37Z https://yabu.me/nevent1qqsrlzfmszg2lqhvq22nrxsktl7lw2205m7vve2un5324dxn7yudu7czyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgxrnjd4 If you can completely disable device code flows using Conditional Access, you should do so. If you cannot, at least limit which user IDs can use them. If you allow any users to use device code flows, use the #KQL provided to hunt for abuse. <br/><br/>#cybersecurity #microsoft <br/><br/>From: [@fabian_bader](<a href="https://infosec.exchange/@fabian_bader">https://infosec.exchange/@fabian_bader</a> )<br/><a href="https://infosec.exchange/@fabian_bader/114013896376345681">https://infosec.exchange/@fabian_bader/114013896376345681</a> 2025-02-16T19:08:06Z https://yabu.me/nevent1qqsgx8tucxt8dnwlu8gjh7ex4elffhgzv28gsul3nel0du3t0lrepsczyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgthe2va This tactic of sending unsolicited messages and calls via Teams has an easy solution—only allow specific external domains to communicate with your end users. Review your Teams logs, see which domains your users are communicating with, add them to the allow list and enable the control. Make your end users open up a support ticket for future domain adds so you can vet them. <br/><br/>Forget about Zero Trust and apply best practice security configurations. Let the marketing people and the CISO worry about whether something is “zero trust” or not. #Cybersecurity <br/><br/>Microsoft docs:<br/><a href="https://learn.microsoft.com/en-us/microsoft-365/solutions/trusted-vendor-onboarding?view=o365-worldwide#allow-the-vendors-domain-in-teams-external-access">https://learn.microsoft.com/en-us/microsoft-365/solutions/trusted-vendor-onboarding?view=o365-worldwide#allow-the-vendors-domain-in-teams-external-access</a><br/><br/>From: <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub14g0mj0fmn0sepfuhp2wupyk7d8xyz7rezpmrx2gfsav9vxlwxypq4xznd6" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Not Simon 🐐</span> (<span class="italic">npub14g0…znd6</span>)</a></span><br/><a href="https://infosec.exchange/@screaminggoat/113867636525001029">https://infosec.exchange/@screaminggoat/113867636525001029</a> 2025-01-21T19:36:22Z https://yabu.me/nevent1qqspsu2p5d5h9eq9svrtzulkfueqj95cw30r4tp3c4p23pr9npws2pszyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgaxl5sq In reply to <a href='/nevent1qqsgjhv0jvjwvdlcchve3pw8fr4y7vx7tng5vkkaupxnale0gvp4q0sv3xyl9'>nevent1q…xyl9</a><br/>_________________________<br/><br/>I’m glad you still do these write-ups! 2025-01-14T23:49:04Z https://yabu.me/nevent1qqsraz5g5tqg0g3nf0t4wer8wz8z0ymx72fl5j444zrgl9k0uvssktgzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sglpyxgp My daughter put a sweater on the #cat and now he looks like a Dr. Seuss character #caturday #catsofmastodon<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/614/686/491/245/515/original/20941eb6b238babf.jpeg"> <br/> 2024-12-08T01:50:35Z https://yabu.me/nevent1qqs2nzhng3g05e2k39c3m2rxk0ph4x0de52t66qgg4lq2ec26wf6ztqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgfvw95h In reply to <a href='/nevent1qqs295xx59qmadd6hfzdm9azpztl86ntf58fdt6c63rz4fs9zlt0gusz5mykl'>nevent1q…mykl</a><br/>_________________________<br/><br/>they just went GA (for Microsoft anyway) last month. Who’s going to widely deploy something from Microsoft that’s not GA? 2024-12-05T23:18:30Z https://yabu.me/nevent1qqszv2vke7kyevwpe6ymlcuxp00zej7x6cjwuvt2xds6kh6xr9d03zszyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgdyqrdn In reply to <a href='/nevent1qqs9tqm0l0z5efslytspwgmtnjcxgc05d9t2pwnnpx3gsmnelgy22hsk4paka'>nevent1q…paka</a><br/>_________________________<br/><br/>“The Man from Earth” is an underrated movie. Hard to believe it is so good when it’s really just a bunch of people talking for almost two hours. 2024-12-04T03:08:40Z https://yabu.me/nevent1qqsvz96f5jcltmql9aa9uz0smzr80pm836gjqx8ua7hd63me3sawadqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg6l7csa In reply to <a href='/nevent1qqsvdncv36laqzzydkqmx5fa55j5kr8mg3cwctm3x0tyvyye3v0unscsc3rzm'>nevent1q…3rzm</a><br/>_________________________<br/><br/>no interest was ever shown where I am — until Copilot PC’s were promoted by Microsoft. Now we have some interest. 2024-12-04T00:40:48Z https://yabu.me/nevent1qqsqcw3y86kra9u9c4lxkfpvqkprfd6tyrj3x9ax7rgsh5pnady6dcqzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgs5kym6 In reply to <a href='/nevent1qqs27qhx0mkxcj8sechuslwzzyajr2chcsxd88xw8szxxjcklrs322chcg67t'>nevent1q…g67t</a><br/>_________________________<br/><br/>it’s faithful to the book too. The author was the show runner. 2024-11-23T19:35:44Z https://yabu.me/nevent1qqsgvskskscw3myxvdmhkst909k7m9ujnnwwtjwmqh95rlm4pv9undgzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgd5v7j0 In reply to <a href='/nevent1qqsxacyn2clt7yetlr4ky96prmun5xe5a4dhpvm0kpf47l8smsrmh3ghzp3l9'>nevent1q…p3l9</a><br/>_________________________<br/><br/>I love nerd insults! 2024-11-22T22:49:21Z https://yabu.me/nevent1qqsy6thk9qphufk9dw0evpzpfmyyxhnl0y5l82d0smlccann3h2hk0gzyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgvxmdxg In reply to <a href='/nevent1qqszsnlanhplwt964uzw8hn79cyckhcww69kkl9mk3ddjfg0qua62hgxw5mra'>nevent1q…5mra</a><br/>_________________________<br/><br/>aren’t all forward web proxies identity-aware these days? 2024-11-18T23:54:49Z https://yabu.me/nevent1qqsdcyzp05cfz8puxfw8cgpkhwfn76ae4ad8car4vdzruc8ae7x52uczyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sgufynha In reply to <a href='/nevent1qqs9u5vsxdust93kjhtffhqdp5v90v5q66clrq03nhcgrvwrjr554cs0ye7pm'>nevent1q…e7pm</a><br/>_________________________<br/><br/>that hurricane is TIGHT! 2024-10-08T02:56:04Z https://yabu.me/nevent1qqsquruutrfwg6whm7640fyzn3xqts3elad54p4l6p8k4s7lrz9qynszyrvqzjsm4nu8vk2gkqzuz9h8hj992p6ctdqnwm6gkxj33l94hf0sg2u82nw This #cat is well-snuggled #caturday #catsofmastodon<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/257/026/456/836/508/original/d3d39d4fb2ef2f55.jpeg"> <br/> 2024-10-05T21:51:45Z