CVE-2024-0311

CVE-2024-0311 ？ 这是一个针对我认为 是 CVE-2024-0311、SB10418 的 PoC。 恶意内部人员无需有效的发布代码即可绕过 Skyhigh Client Proxy 的现有策略。 很多细节。非常利用。¯\ツ /¯ 该 PoC 会注入到用户运行的 SCPBypass.exe 进程中，并写入 SCPService.exe 的管道：\.\pipe\MCPTrayPipe0。 注入是必要的，因为即使管道是 RW Everyone，WGUARDNT 也会对写入管道的可执行文件进行一些检查（检查写入者路径），请参阅下文。 我们提供了一个示例 shellcode，即使在...

Insider-Threat

内部威胁图模型（R5.2 和 R6.2） 本仓库包含使用 CMU CERT 内部威胁测试数据集（R5.2、R6.2）进行内部威胁检测的数据准备、特征提取以及基于图的模型（用于隐式和显式信号的 GCN-NN、GCN-BiLSTM 和 GCN-BiLSTM+Attention）。 仓库结构 root@kitploit: . │ environment.yml │ requirements.txt │ tree.txt │ ├── data/ │ ├── original/ │ │ ├── r5data/ │ │ └── r6data/ │ ├── preprocessed/ │ │ ├──...

ThreatDetect

ThreatDetect ThreatDetect 是一个基于 Streamlit 的内部威胁检测原型，用于分析员工活动数据并标记潜在风险行为。它使用训练好的 XGBoost 分类器结合孤立森林异常检测器，生成组织级风险摘要和可解释的员工级洞察。 演示 该应用可以使用 Streamlit 本地运行。之前发布了一个部署演示，地址为： https://threatdetectcos720.streamlit.app/ 主要功能 从上传的 CSV 文件进行批量风险检测 组织威胁摘要，包含数量、概率分布和风险等级 使用 SHAP 值对每位员工进行可解释性分析...

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

Threat actors with ties to the Democratic People's Republic of Korea aka DPRK or North Korea have been observed seeking job opportunities beyond the information technology IT sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical professio...

EUVD-2026-62468

Renovate versions from 42.68.1 before 42.96.3 and from 42.68.1 before 43.4.4, including corresponding Docker images renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker =13.3.0 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As ...

Weaponized AI: The Commoditization of Cybercrime

Weaponized AI: The Commoditization of Cybercrime By Jambul Tologonov · August 12, 2026 Executive Summary The Trellix Advanced Research Center has been actively monitoring dark web forums and criminal communication channels for emerging threats tied to artificial intelligence AI. What we are...

Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots

A critical flaw in Google's Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-enabled agents in the same Google Cloud project. From there, they could read live conversations, steal the data users shared, and make the bots send...

Malicious code in @lexisnexisrisk/insider-threat-platform (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dae189d0977c5458ccfe6ac903cf5014acf0e73277c22ad68edf683813066398 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6629 Malicious code in @lexisnexisrisk/insider-threat-platform (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dae189d0977c5458ccfe6ac903cf5014acf0e73277c22ad68edf683813066398 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-210211

Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List DACLs on the service object and related registry keys,. Produc...

OrgForge-IT: A Verifiable Synthetic Benchmark for LLM-Based Insider Threat Detection

Synthetic insider threat benchmarks face a consistency problem: corpora generated without an external factual constraint cannot rule out cross-artifact contradictions. The CERT dataset -- the field's canonical benchmark -- is also static, lacks cross-surface correlation scenarios, and predates th...

Hardening Confidential Federated Compute against Side-Channel Attacks

In this work, we identify a set of side-channels in our Confidential Federated Compute platform that a hypothetical insider could exploit to circumvent differential privacy DP guarantees. We show how DP can mitigate two of the side-channels, one of which has been implemented in our open-source...

EUVD-2026-8913

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's personal environment by ID. user-environments.resolver.ts:82-109, updateUserEnvironment mutation uses @UseGuardsGqlAuthGuard but is missing the @GqlUser...

Availability Attacks without an Adversary: Evidence from Enterprise LANs

Denial-of-Service DoS conditions in enterprise networks are commonly attributed to malicious actors. However, availability can also be compromised by benign non-malicious insider behavior. This paper presents an empirical study of a production enterprise LAN that demonstrates how routine docking...

PT-2026-6470

Summary RustFS logs sensitive credential material access key, secret key, session token to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be accessible to internal or external log consumers and could lead to compromise of sensitive...

CISA: Assembling a Multi-Disciplinary Insider Threat Management Team

In CISA's continuing work to strengthen infrastructure security, the Assembling a Multi-Disciplinary Insider Threat Management Team infographic aims to enhance the awareness of critical infrastructure stakeholders regarding insider threats, the potential damage they can inflict, and the steps...

Vulnerability fixed in Microsoft SQL Server

Microsoft has fixed a vulnerability in SQL Server A malicious party can exploit the vulnerability to gain unauthorized access to DEBUG functionality and thereby generate, among other things, memory dumps. These dumps can also involve memory outside the scope of SQL Server, allowing the malicious...

Behavioral Analytics for Continuous Insider Threat Detection in Zero-Trust Architectures

Insider threats are a particularly tricky cybersecurity issue, especially in zero-trust architectures ZTA where implicit trust is removed. Although the rule of thumb is never trust, always verify, attackers can still use legitimate credentials and impersonate the standard user activity. In...

CVE-2020-10655

The Proofpoint Insider Threat Management Server formerly ObserveIT Server before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouse API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The...

CVE-2020-10656

The Proofpoint Insider Threat Management Server formerly ObserveIT Server before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouseWithChunksV2 API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. Th...