pyattck

Welcome to pyattck's Documentation root@kitploit: . ... | \ \ \ / / / \ | | | / || |/ / | | | \ / / / ^ \ ---| |-------| |----| ,----'| ' / | / \ / / /\ \ | | | | | | | Current Version is 7.1.1 pyattck is a light-weight framework for MITRE ATT&CK Frameworks. This package extracts details from the...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 介绍 Out-FINcodedCommand 是一个兼容 PowerShell v2.0+ 的 PowerShell POC 脚本，旨在突出显示 FIN 威胁行为者使用的几种混淆技术。此工具重点展示的混淆技术包括： 1. cmd.exe 的变量字符/字符串替换功能 2. cmd.exe 和 powershell.exe 的标准输入命令调用能力 3. 环境变量子字符串功能，用于混淆 "cmd" 和 "powershell" 安装 Out-FINcodedCommand 的源代码托管在 Github 上，您可以从该仓库...

ThreatActors-TTPs

注意：这是从Crocodyli复刻的——我所做的只是根据自己的目的添加内容。我使用它来驱动 https://incidentbuddy.ai 上的gapMATRIX页面。 威胁行为者和勒索软件——TTPs 此仓库旨在帮助公司 和独立研究人员 研究基于MITRE ATT &CK框架的战术、技术和程序（TTPs） ，这些TTPs被活跃或已停止活动的勒索软件运营者/组织 以及其他威胁行为者 所采用。 此内容包括TTP映射、活动历史 以及被利用的CVE（通用漏洞与暴露）记录。此外，我还包含了有关DFIR/CTI领域中的 命令、工具 以及用于研究工件的有用位置 的数据。 主要重点是提供每个行为者轨...

SentryPeer

Protect your SIP Servers from bad actors 特别感谢 Deutsche Telekom Security GmbH 对我们的赞助！非常友善！ 何不给我们加颗星并在 Twitter 上关注我们！ 目录 介绍 概述 功能 演讲 采用 设计 Docker 环境变量 安装 Homebrew macOS 或 Linux Alpine Linux Ubuntu 包 从源码构建 运行 SentryPeer WebHook RESTful API 端点 /health-check 端点 /ip-addresses 端点 /ip-addressss/ip-addres...

ThreatActors-TTPs

威胁行为者与勒索软件 - TTPs 本仓库旨在帮助公司 和独立研究人员 研究基于 MITRE ATT &CK 框架的战术、技术和程序（TTPs） ，这些内容由活跃或已停止运营的勒索软件运营商/团伙 以及其他威胁行为者 所采用。 本内容包含 TTP 映射、活动历史 以及已利用的 CVE（通用漏洞与暴露）记录。此外，我还包含了涉及命令 、工具 以及在 DFIR/CTI 领域中用于研究工件的有用位置的数据。 主要重点是提供每个行为者轨迹 的摘要，提供安全组织和个体研究人员可以使用的关键信息。 合作与数据共享 本项目依赖于社区内各研究人员的贡献。此处收集的数据也旨在为其他安全项目（如...

IOCs

////////////////////// // //////////////////////// // /// /////// ///// /////// /////// /////// /////// //////// //////// //////// //////// //////// //////// //////// //////// //////// //////// /////// /////// /////// /////// ///// // ////// // // ///////////////////////// ///////////////////////...

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

CVE-2018-13379

IOCs para CObalt Strike/CVE-2018-13379 Todo el crédito para Awake/Arista/https://www.linkedin.com/in/kevin-romano-48071a42/ IOCs copiados de DD: https://awakesecurity.com/blog/exploiting-cve-2018-13379-a-case-study-of-threat-actors-exploiting-years-old-cves/...

SupplyChainAttacks

Ataques a la Cadena de Suministro de Firmware Este repositorio proporciona una colección curada y exhaustiva de ataques documentados a la cadena de suministro de firmware descubiertos o investigados por el equipo de investigación de Binarly. Mantenido por Binarly, el proyecto sirve como un recurs...

vulnerabilities present in Oracle E-Business Suite

Oracle has identified 159 vulnerabilities in various Oracle E-Business Suite products, including Oracle Applications Framework, Oracle Document Management and Collaboration, Oracle Mobile Application Server, Oracle Alert, Oracle Application Object Library, Oracle Applications Manager, Oracle Bill...

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. The threat actors, which the artificial intelligence AI company has branded Generative...

U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches

The U.S. Department of the Treasury has announced fresh sanctions on Iranian cyber actors as part of what it called an "unprecedented, whole-of-government, economic campaign" against the nation and its enablers. "We are launching an economic onslaught against Iran's financial connections around t...

North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring

Companies are used to thinking about attackers as outsiders trying to break in. North Korean IT workers flip that model. They apply for jobs, pass interviews, receive legitimate credentials, and can end up inside the same systems companies spend millions trying to protect. That risk is no longer...

GHSA-WCX4-WPFV-MC5C jsii-diff: Command Injection via npm: package argument

Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool. Impa...

Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation

The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access OWA, to target U.S. and European government entities, as well as the telecommunications, financial,...

Microsoft SharePoint CVE-2026-50522 Post-Exploitation Payload Collection

A collection of payloads, webshells, and HTTP request artifacts observed following exploitation of the Microsoft SharePoint CVE-2026-50522 vulnerability. The repository documents real-world payloads deployed by multiple threat actors rather than providing an exploit for the underlying vulnerabili...

VulnCheck KEV: CVE-2025-68686

Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An...

CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking

For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an opportunity arose. That model is changing. Recent investigations...

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers across US Critical Infrastructure

The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology OT devices, including programmable logic controllers PLCs. These actions disrupted PLCs across several U.S. critical infrastructure sectors through...

PT-2026-63426

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST API. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure...