Scattered Spider Launching Ransomware on Hijacked VMware Systems, Google

A new report from Google's GTIG reveals how UNC3944 0ktapus uses social engineering to compromise Active Directory, then exploits VMware vSphere for data theft and direct ransomware deployment. Understand their tactics and learn vital mitigation steps...

Active-Directory-Exploitation-Cheat-Sheet

Based on the provided context and code cues, here is a summary of the analysis: Classification: This is an offensive tool for Windows Active Directory exploitation. Primary CVE ID: Not specified. Target Product/Service: Windows Active Directory. Vulnerability Class/Vector: Not specified. Probable...

Kerberoasting Detections: A New Approach to a Decade-Old Challenge

Security experts have been talking about Kerberoasting for over a decade, yet this attack continues to evade typical defense methods. Why? It’s because existing detections rely on brittle heuristics and static rules, which don’t hold up for detecting potential attack patterns in highly variable...

Kerberoasting Detections: A New Approach to a Decade-Old Challenge

Security experts have been talking about Kerberoasting for over a decade, yet this attack continues to evade typical defense methods. Why? It's because existing detections rely on brittle heuristics and static rules, which don't hold up for detecting potential attack patterns in highly variable...

Detecting and Visualizing Lateral Movement Attacks with Trellix XDR

Detecting and Visualizing Lateral Movement Attacks with Trellix Helix Connect By Maulik Maheta and Adithya Chandra · July 17, 2025 Executive summary This blog marks the third installment in our series on detecting and visualizing lateral movement attacks with Trellix Helix Connect. A lateral...

Metasploit Wrap-Up 07/11/2025

Active Directory LDAP Library This week Metasploit added a library for working with Active Directory Domain Controllers over LDAP. The library consolidates common functionality and implements a caching mechanism to support common operations such as looking up objects by their DN, sAMAccountName, ...

com.atlassian.connect:atlassian-connect-spring-boot-core (>=2.1.8, <=2.2.1), com.atlassian.connect:atlassian-connect-spring-boot-jwt (>=2.1.8, <=2.2.1) +131 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (8.20.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 8.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.atlassian.connect:atlassian-connect-spring-boot-core =2.1.8, =2.1.8, =2.1.8, =3.4.0, =3.3.0,...

CVE-2025-52925

In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812...

CVE-2025-52925

In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812...

CVE-2025-52925

The vulnerability CVE-2025-52925 affects One Identity OneLogin Active Directory Connector versions prior to 6.1.5, where DirectoryToken encryption was mishandled (aka ST-812). Affected component: the connector’s encryption handling of DirectoryToken. Reported impact is limited to the mismanagemen...

CVE-2025-52925: Transmission of Private Resources into a New Sphere

In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812...

CVE-2025-52925

In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812...

CVE-2025-52925

In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812...

One Identity OneLogin Active Directory Connector 安全漏洞

One Identity OneLogin Active Directory Connector is a connector software from One Identity USA. A security vulnerability exists in One Identity OneLogin Active Directory Connector versions prior to 6.1.5 that stems from improper handling of DirectoryToken encryption...

PT-2025-27583 · One Identity · One Identity Onelogin Active Directory Connector

Name of the Vulnerable Software and Affected Versions: One Identity OneLogin Active Directory Connector versions prior to 6.1.5 Description: The issue concerns the mishandling of DirectoryToken encryption, also known as ST-812. This problem occurred due to an error in the encryption process...

One Identity OneLogin AD Connector 安全漏洞

One Identity OneLogin AD Connector is a connector software from One Identity USA. A security vulnerability exists in One Identity OneLogin AD Connector versions prior to 6.1.5 that originates in the /api/adc/v4/configuration endpoint resulting in information disclosure...

One Identity OneLogin AD Connector 安全漏洞

One Identity OneLogin AD Connector is a connector software from One Identity USA. A security vulnerability exists in One Identity OneLogin AD Connector versions prior to 6.1.5, which stems from a JWT signing key disclosure leading to an authentication bypass...

Are Forgotten AD Service Accounts Leaving You at Risk?

For many organizations, Active Directory AD service accounts are quiet afterthoughts, persisting in the background long after their original purpose has been forgotten. To make matters worse, these orphaned service accounts created for legacy applications, scheduled tasks, automation scripts, or...

Are Forgotten AD Service Accounts Leaving You at Risk?

For many organizations, Active Directory AD service accounts are quiet afterthoughts, persisting in the background long after their original purpose has been forgotten. To make matters worse, these orphaned service accounts created for legacy applications, scheduled tasks, automation scripts, or...

Security Bulletin: IBM Security Verify Password Synchronization Plug-in for Windows AD is affected by multiple vulnerabilities

Summary IBM Security Verify Password Synchronization Plug-in for Windows AD has addressed these vulnerabilities. Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime...