Daily Writeups
@Daily_Writeups
4.01K subscribers
4 photos
136K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.01K subscribers
Daily Writeups
⤷ Title: Delphi PatoRAT Backdoor Hijacks LogMeIn Resolve and PDQ Connect RMM Tools for Full System Takeover
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 13 Nov 2025 00:00:11 +0000
════════════════════════
⌗ Tags: #Malware #ASEC #Delphi RAT #lateral movement #LogMeIn Resolve #PatoRAT #PDQ Connect #Remote Access Trojan #RMM Abuse
Daily CyberSecurity
Delphi PatoRAT Backdoor Hijacks LogMeIn Resolve and PDQ Connect RMM Tools for Full System Takeover
ASEC exposed PatoRAT, a Delphi RAT that hijacks LogMeIn Resolve and PDQ Connect RMM tools. Attackers use maliciously configured installers disguised as 7-Zip/Notepad++ to gain full system control.
13 views
Daily Writeups
⤷ Title: Cybercriminals Shift Tactics: Group Deploys Multiple RMM Tools (ScreenConnect, LogMeIn, Naverisk) for Redundant Persistence and Access Resale
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 20 Nov 2025 00:10:58 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Broadcom Threat Hunter #initial access broker #LogMeIn Resolve #Multi_RMM #persistence #RMM Abuse #ScreenConnect
Daily CyberSecurity
Cybercriminals Shift Tactics: Group Deploys Multiple RMM Tools (ScreenConnect, LogMeIn, Naverisk) for Redundant Persistence and…
Broadcom exposed a group deploying multiple RMM tools (ScreenConnect, LogMeIn, Naverisk) weeks apart to achieve redundant persistence. The likely Initial Access Broker (IAB) prepares systems for resale.
31 views
Daily Writeups
⤷ Title: The Admin’s Shadow: How Hackers Turned the Nezha Monitoring Tool into a Stealth RAT
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 24 Dec 2025 02:38:40 +0000
════════════════════════
⌗ Tags: #Malware #Cyber Security 2025 #Evasion #Nezha #NT AUTHORITY\SYSTEM #Ontinue #open source #post_exploitation #Qualys #RAT #RMM Abuse #Root Access
Information Security News
The Admin’s Shadow: How Hackers Turned the Nezha Monitoring Tool into a Stealth RAT
Threat actors have begun repurposing a legitimate server monitoring tool as a ready-made platform for remotely controlling systems that have already been compromised. According to the Ontinue Cybe…
18 views
Daily Writeups
⤷ Title: New “Eternl Desktop” Phishing Lure Drops LogMeIn to Hijack Cardano Wallets
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 02 Jan 2026 00:00:36 +0000
════════════════════════
⌗ Tags: #Cybercriminals #ADA #Anurag #Blockchain security #Cardano #crypto security #Eternl Wallet #LogMeIn Resolve #malware #Phishing Campaign #RMM Abuse #Staking Scams #supply chain attack
Daily CyberSecurity
New “Eternl Desktop” Phishing Lure Drops LogMeIn to Hijack Cardano Wallets
The Cardano community is currently in the crosshairs of a highly sophisticated “wolf in sheep’s clothing” campaign. Threat researcher Anurag has issued a critical warning regardi…
47 views
Daily Writeups
⤷ Title: Attackers Weaponize Legitimate RMM Tools via Fake PDFs
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 13 Jan 2026 02:12:20 +0000
════════════════════════
⌗ Tags: #Cybercriminals #ASEC #cyber attacks #living_off_the_land #Malware Analysis #NinjaOne #NSIS #PDF Malware #phishing #RMM Abuse #ScreenConnect #SuperOps #Syncro
Daily CyberSecurity
Attackers Weaponize Legitimate RMM Tools via Fake PDFs
In a new report, the AhnLab Security Intelligence Center (ASEC) warns of a rising trend where threat actors are hijacking powerful Remote Monitoring and Management (RMM) software to infiltrate vic…
18 views
Daily Writeups
⤷ Title: The Fatal Screensaver: ReliaQuest Unmasks Phishing That Uses .scr Files to Decapitate EDR
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 09 Feb 2026 03:39:45 +0000
════════════════════════
⌗ Tags: #Cybercriminals #.scr files #BYOVD #Initial Access #JWrapper #persistence #ReliaQuest #Remote Monitoring and Management #RMM tools #screensaver phishing #SpearPhishing #Tech News 2026
Penetration Testing Tools
The Fatal Screensaver: ReliaQuest Unmasks Phishing That Uses .scr Files to Decapitate EDR
Security analysts at ReliaQuest have unmasked a sophisticated phishing campaign wherein adversaries secrete remote access mechanisms within an
27 views
Daily Writeups
⤷ Title: Exploited in the Wild: Critical BeyondTrust Flaw (CVSS 9.9) Opens Door to Network Takeover
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sun, 15 Feb 2026 03:58:23 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Arctic Wolf #BeyondTrust #CISA KEV #CVE_2026_1731 #lateral movement #Patch Alert #Privileged Remote Access #Remote Support #RMM #SimpleHelp
Daily CyberSecurity
Exploited in the Wild: Critical BeyondTrust Flaw (CVSS 9.9) Opens Door to Network Takeover
Arctic Wolf warns of CVE-2026-1731, a critical BeyondTrust flaw exploited in the wild. Attackers use it to deploy backdoors. Patch self-hosted instances now.
18 views
Daily Writeups
⤷ Title: The Fake IT Threat: “TrustConnect” Malware-as-a-Service Masquerades as Legitimate RMM Software
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 00:11:21 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AI Malware #Cyber Security #DocConnect #infosec #MaaS #Malware_as_a_Service #Proofpoint #Redline stealer #RMM Abuse #TrustConnect
Daily CyberSecurity
The Fake IT Threat: "TrustConnect" Malware-as-a-Service Masquerades as Legitimate RMM Software
Proofpoint exposes TrustConnect, a new Malware-as-a-Service masquerading as an IT tool. The AI-assisted fake RMM software replaces dismantled threats.
10 views
Daily Writeups
⤷ Title: Stealth & Persistence: MuddyWater’s New Rust-Based Payload Mimics Cloudflare and Reddit
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 25 Feb 2026 00:06:20 +0000
════════════════════════
⌗ Tags: #Cyber Security #Malware #Genians Report #infosec #Macro_based Attacks #MuddyWater APT #Operation Olalampo #RMM tool abuse #Rust malware #State_Sponsored Espionage #threat intelligence
Daily CyberSecurity
Stealth & Persistence: MuddyWater’s New Rust-Based Payload Mimics Cloudflare and Reddit
Genians report reveals MuddyWater APT's shift to Rust-based malware and RMM tool abuse for long-term espionage across government and critical infrastructure.
24 views
Daily Writeups
⤷ Title: Signed Malware Masquerading as Workplace Apps Deploys Persistent Backdoors
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 06 Mar 2026 00:13:17 +0000
════════════════════════
⌗ Tags: #Cybercriminals #cybersecurity #EV Certificate Phishing #infosec #malware #MeshAgent #Microsoft Defender #RMM Backdoors #ScreenConnect #Tactical RMM #threat intelligence
Daily CyberSecurity
Signed Malware Masquerading as Workplace Apps Deploys Persistent Backdoors
Microsoft Defender exposes a new phishing campaign using EV certificates and fake Teams invites to silently deploy RMM backdoors on corporate networks.
16 views
Daily Writeups
⤷ Title: Hackers are Using “Legit” IT Tools to Hijack the 2026 Tax Season
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sun, 05 Apr 2026 13:27:06 +0000
════════════════════════
⌗ Tags: #Cybercriminals #2026 Tax Season #BEC #cybersecurity #identity theft #infosec #malware #phishing #Proofpoint #Remote Access #RMM #TA2730 #TA4922 #W_2 Fraud
Daily CyberSecurity
Hackers are Using "Legit" IT Tools to Hijack the 2026 Tax Season
Proofpoint identifies a surge in 2026 tax scams using RMM tools (39%) to bypass security. Learn how TA4922 and TA2730 target your data this filing season.
27 views
Daily Writeups
⤷ Title: The “Special Invitation” Trap: STAC6405 Abuses Legitimate RMM Tools to Hijack Your PC
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 07:30:02 +0000
════════════════════════
⌗ Tags: #Cybercriminals #cybersecurity #infosec #LogMeIn Resolve #Microsoft Teams Lure #Norton Mimicry #phishing #Punchbowl Lure #Remote Access #RMM Abuse #ScreenConnect #Sophos MDR #STAC6405
Daily CyberSecurity
The "Special Invitation" Trap: STAC6405 Abuses Legitimate RMM Tools to Hijack Your PC
Sophos MDR uncovers STAC6405, a phishing campaign abusing RMM tools like LogMeIn for unattended access. Learn how to spot the "Special Invitation" lure.
21 views
Daily Writeups
⤷ Title: Cyber-Actors are “Laundering Trust” to Hijack the Global Supply Chain
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 20 Apr 2026 08:04:03 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Cargo Diversion #Cyber Reconnaissance #Fleet Payments #infosec #Load Board Phishing #powershell #Proofpoint #RMM Abuse #ScreenConnect #Signing_as_a_Service #Transportation Security
Daily CyberSecurity
Cyber-Actors are "Laundering Trust" to Hijack the Global Supply Chain
Proofpoint monitors a 30-day supply chain attack using "signing-as-a-service" to bypass Windows security. Protect your load boards and fleet payments now.
14 views
Daily Writeups
⤷ Title: Attackers Hijack Trusted RMM Tools to Create Invisible, Permanent Backdoors
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 07 May 2026 08:15:06 +0000
════════════════════════
⌗ Tags: #Cybercriminals #cybersecurity #infosec #living_off_the_land #persistence #phishing #RMM Hijacking #Safe Mode #ScreenConnect #Securonix #SimpleHelp #social engineering #Threat Hunting
Daily CyberSecurity
Attackers Hijack Trusted RMM Tools to Create Invisible, Permanent Backdoors
Securonix exposes an 80+ organization breach using "self-healing" RMM tools and Safe Mode persistence. Standard antivirus is blind—learn how to hunt it!
14 views
Daily Writeups
⤷ Title: WhatsApp VBS Campaign Installs ManageEngine RMM for Remote Access
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Wed, 24 Jun 2026 03:11:44 +0000
════════════════════════
⌗ Tags: #Malware #kaspersky #Malware Campaign #ManageEngine Endpoint Central #RMM Abuse #VBScript #WhatsApp
Information Security News
WhatsApp VBS Campaign Installs ManageEngine RMM for Remote Access
Trust in a familiar sender keeps turning into a weak point. A new campaign against WhatsApp users builds on exactly that bet. The attackers send malicious files from already-hijacked accounts. The…
16 views
Daily Writeups
⤷ Title: SimpleHelp Authentication Bypass Exploited in the Wild to Deploy TaskWeaver and Djinn Stealer
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 30 Jun 2026 01:43:57 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Authentication Bypass #CVE_2026_48558 #Djinn Stealer #information stealer #MSP Security #OIDC #RMM security #SimpleHelp #TaskWeaver
Daily CyberSecurity
SimpleHelp Authentication Bypass Exploited in the Wild to Deploy TaskWeaver and Djinn Stealer
On 29 June 2026, CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalog. The flaw is a critical SimpleHelp authentication bypass in the OIDC login flow. Attackers now use it in t…
34 views
Daily Writeups
⤷ Title: CVE-2026-18577: N-central Account Takeover Exploited in the Wild
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 03 Aug 2026 16:25:05 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Account Takeover #Authentication Bypass #CVE_2026_18577 #exploited in the wild #MSP Security #N_able #N_central #RMM security
Daily CyberSecurity
CVE-2026-18577: N-central Account Takeover Exploited in the Wild
TL;DR: Attackers are actively exploiting a N-central account takeover flaw tracked as CVE-2026-18577. N-able says an incomplete patch for an earlier bug left the door open. A hotfix for version 20…
12 views