Released 02/21/2022 (Retired)

As part of the SOC Analyst learning path, I completed the “SOC138 — Detected Suspicious Xls File” alert on LetsDefend (Event ID:
77). As…

Explain them to me.

In this challenge you will explore some less common SQL Injection techniques.

Suzaku is a threat hunting and fast forensics timeline generator for cloud logs. (Imagine Hayabusa but for cloud logs instead of Windows event logs.)

Mobile Reconnaissance Framework is a powerful, lightweight, and platform-independent offensive mobile security tool

WinDiff is an open-source web-based tool that allows browsing and comparing symbol and type information of Microsoft Windows binaries

A critical flaw (CVE-2025-21204) in the Windows Update Stack allows local privilege escalation. Details and proof-of-concept exploit released.

A sophisticated DKIM Replay Attack spoofed Google, bypassing email security. Learn how this attack worked and how to protect yourself from email spoofing.

A WinZip vulnerability (CVE-2025-33028) allows attackers to bypass Mark-of-the-Web (MotW) protection, enabling silent code execution via malicious archives.

FOG ransomware campaign spreads via phishing and stealthy loaders, targeting tech, education, and manufacturing sectors with obfuscated payloads.

Threat actors abuse Microsoft’s mavinject.exe to inject malicious DLLs into trusted processes, evading detection in stealthy APT campaigns.

SuperCard X malware uses a novel NFC-relay technique to steal credit card data from Android devices, enabling fraudulent POS and ATM transactions.

A critical vulnerability (CVE-2025-1976) in Brocade Fabric OS allows a local admin user to execute arbitrary code with root privileges. Update immediately!

Malicious npm packages are targeting Telegram bot developers, installing SSH backdoors and stealing data. Learn how this supply chain attack works and how to protect yourself.

RustoBot, a sophisticated botnet written in Rust, is exploiting vulnerabilities in TOTOLINK & DrayTek routers to launch DDoS attacks. Learn how this malware operates and how to protect your network.

Phishing attacks are evolving! Cybercriminals now embed HTML in SVG files to bypass detection. Learn how SVG phishing works and how to stay safe.

Yarix uncovers a sophisticated Magecart attack using obfuscated JavaScript to steal credit card data from an e-commerce site, highlighting evolving web skimming tactics.

Handy tools in your OSINT journey.

Welcome to the series (Cloud Control Freak — the GRC way) of articles focused on GRC Engineering <> AWS. This series is for all GRC…

How working in a security company led me to explore the invisible threats we all face online.