LSTAR-EN

LSTAR - Aggressor Translated to English! By Google Translate and Deepl CSの右クリックを簡素化し、自己インテグレーションを容易にする目的で、多数のポストインフィルトレーションプラグインを参照しています。 ホスト関連の資格情報取得、多段階イントラネット侵入、隠しスケジュールタスク、キル対策Mimikatz、ユーザーのクローン追加など、機能をリファクタリングして強化しました。 特徴： CobaltStrikeのTCP、SMB、Proxyなどを連携して、複雑なネットワーク環境に侵入します...

CrossC2Kit

CrossC2 Kit README | 中文文档 CrossC2Kit は、CrossC2 から派生した Unix プラットフォーム周辺の侵入拡張です。Aggressor Script オープンソーススクリプトエンジンを使用します。Red Team の操作プロセスをシミュレートする自動化を作成し、CobaltStrike クライアントを拡張するために使用できます。 CrossC2Kit は CobaltStrike の元の機能を継承しているため、開発および記述文法は公式ドキュメントを引き続き参照します:...

An Undercover Google Analyst Infiltrated a Notorious Supply-Chain Hacking Gang

TeamPCP pulled off the worst-ever software supply-chain hacking spree and breached thousands of companies. Now Google’s threat intelligence group says it had a mole inside the hackers’ inner circle...

North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring

Companies are used to thinking about attackers as outsiders trying to break in. North Korean IT workers flip that model. They apply for jobs, pass interviews, receive legitimate credentials, and can end up inside the same systems companies spend millions trying to protect. That risk is no longer...

PT-2026-59296

Impact The Response.set cookie method does not sanitize its string arguments, and in particular will not detect the presence of the r sequence in them. This can be a potential source of header injection attacks. For a header injection attack through this issue to be possible, an attacker must fir...

DPRK Operatives Impersonate Professionals on LinkedIn to Infiltrate Companies

The information technology IT workers associated with the Democratic People's Republic of Korea DPRK are now applying to remote positions using real LinkedIn accounts of individuals they're impersonating, marking a new escalation of the fraudulent scheme. "These profiles often have verified...

CVE-2019-11447

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a...

Keyboard Lag Leads Amazon to North Korean Impostor in Remote Role

Amazon Security Chief explains how a subtle keyboard delay exposed a North Korean impostor. Read about the laptop farm scheme and how 110 milliseconds of lag ended a major corporate infiltration...

Amadey Exploiting Self-Hosted GitLab to Distribute StealC

Amadey Exploiting Self-Hosted GitLab to Distribute StealC By Rahul Sharma · December 18, 2025 Executive summary Amadey is a malware loader that has been active since 2018, primarily used to distribute second-stage payloads and infostealers. While Amadey has been previously known to distribute...

Siemens COMOS

SUMMARY COMOS is affected by multiple vulnerabilities that could allow an attacker to execute arbitrary code or cause denial of service condition, data infiltration or perform access control violations. Siemens has released new versions for several affected products and recommends to update to...

The CISO imperative: Building resilience in an era of accelerated cyberthreats

The latest Microsoft Digital Defense Report 2025 paints a vivid picture of a cyberthreat landscape in flux. The surge in financially motivated cyberattacks and the persistent risk of nation-state actors demand urgent attention. But for those of us in the Office of the Chief Information Security...

Online Event Judging System create_account.php File SQL Injection Vulnerability

Online Event Judging System is an online event judging system. Online Event Judging System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally-entered SQL statement in the parameter fname in the file /createaccount.php. The vulnerability can be...

First Sentencing in Scheme to Help North Koreans Infiltrate US Companies

An Arizona woman was sentenced to eight-and-a-half years in prison for her role helping North Korean workers infiltrate US companies by pretending to be US workers. From an article: According to court documents, Chapman hosted the North Korean IT workers' computers in her own home between October...

Chinese Salt Typhoon Infiltrated US National Guard Network for Months

A Department of Homeland Security memo confirms Chinese group Salt Typhoon, extensively compromised a US National Guard network for nearly a year, stealing sensitive military and law enforcement data...

Exploit for Cross-site Scripting in Roundcube Webmail

CVE-2024-42008-9-exploit The scripts in this repository are ma...

North Korea Stole Your Job

For years, North Korea has been secretly placing young IT workers inside Western companies. With AI, their schemes are now more devious—and effective—than ever...

Dpanel's hard-coded JWT secret leads to remote code execution

Summary The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine. Details The Dpanel service, when initiated using its default configuration, includes a hardcoded JWT secret embedded directly...

Zyxel CPE Devices Face Active Exploitation Due to Unpatched CVE-2024-40891 Vulnerability

Cybersecurity researchers are warning that a critical zero-day vulnerability impacting Zyxel CPE Series devices is seeing active exploitation attempts in the wild. "Attackers can leverage this vulnerability to execute arbitrary commands on affected devices, leading to complete system compromise,...

New FireScam Infostealer Spyware Hits Android via Fake Telegram Premium

Researchers at Cyfirma have discovered FireScam, an Android malware disguised as 'Telegram Premium' that steals data, monitors activity, and infiltrates devices. Learn about its distribution, functionality, and the impact on user privacy...

⚡ THN Recap: Top Cybersecurity Threats, Tools and Tips (Dec 2 - 8)

This week's cyber world is like a big spy movie. Hackers are breaking into other hackers' setups, sneaky malware is hiding in popular software, and AI-powered scams are tricking even the smartest of us. On the other side, the good guys are busting secret online markets and kicking out shady chat...