Daily Writeups – Telegram

Daily Writeups

@Daily_Writeups

3.55K subscribers

2 photos

130K links

Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner

Download Telegram

About

Blog

Apps

Platform

3.55K subscribers

🔖New Writeup❗️
———————————————
🗓Date: Wed, 18 Oct 2023 14:27:50 GMT
———————————————
✏️Title: [HTB] Devel
———————————————
📎Link: https://medium.com/p/4a205fd1aa25
———————————————
Tags: #hackthebox #iis #ftp

This is a write-up of Devel on Hack The Box without metasploit — it is for my own learning as well as creating a knowledge bank.

12 views23:02

⤷ Title: CL-STA-0048: Chinese-Linked APT Targets Telecoms in South Asia
════════════════════════
𐀪 Author: do son
════════════════════════
ⴵ Time: Tue, 04 Feb 2025 02:35:43 +0000
════════════════════════
⌗ Tags: #Cyber Security #Malware #apache Tomcat #Chinese APT Groups #CL_STA_0048 #Cobalt Strike #Hex Staging #IIS servers #MSSQL server #SoftEther VPN #SQLcmd #Winos4.0 Downloader

Cybersecurity News

CL-STA-0048: Chinese-Linked APT Targets Telecoms in South Asia

Uncover the details of a newly identified cyberespionage campaign, CL-STA-0048, targeting high-value organizations in South Asia.

20 views03:04

⤷ Title: shortscan: An IIS short filename enumeration tool
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Sun, 09 Feb 2025 00:51:40 +0000
════════════════════════
⌗ Tags: #Vulnerability Assessment #IIS short filename enumeration #shortscan

Penetration Testing Tools

shortscan: An IIS short filename enumeration tool

Shortscan is designed to quickly determine which files with short filenames exist on an IIS webserver.

33 views15:04

⤷ Title: KB5055523 Update Creates Unnecessary inetpub Folder in Windows 11 24H2
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 10 Apr 2025 10:31:19 +0000
════════════════════════
⌗ Tags: #Windows #Bug #IIS #inetpub #KB5055523 #Microsoft #update #Windows 11 24H2 #Windows Update

Daily CyberSecurity

KB5055523 Update Creates Unnecessary inetpub Folder in Windows 11 24H2

The KB5055523 update in Windows 11 24H2 is causing an unexpected inetpub folder to appear. This is not malware and can be safely deleted.

30 views12:04

⤷ Title: Sophisticated IIS Malware Targets South Korean Web Servers
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 09 May 2025 00:20:49 +0000
════════════════════════
⌗ Tags: #Cybercriminals #ASEC #china #cyberattack #Gh0st RAT #HijackDriverManager #IIS #malware #south korea #web server #Web Shell #Winkbj.sys

Daily CyberSecurity

Sophisticated IIS Malware Targets South Korean Web Servers

A sophisticated campaign deployed malicious IIS modules on South Korean web servers, enabling traffic control and backdoor access. Suspected Chinese actor.

14 views02:04

⤷ Title: Gold Melody Unleashed: New Stealthy Attacks Exploit Leaked ASP.NET Keys
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Fri, 11 Jul 2025 03:15:24 +0000
════════════════════════
⌗ Tags: #Malware #ASP.NET #cyberattack #cybersecurity #Gold Melody #IIS #machine keys #memory_only attack #Prophet Spider #UNC961 #ViewState

Penetration Testing Tools

Gold Melody Unleashed: New Stealthy Attacks Exploit Leaked ASP.NET Keys

Gold Melody (Prophet Spider) is exploiting leaked ASP.NET machine keys to launch stealthy, memory-only attacks on global corporate systems.

19 views05:04

⤷ Title: FortiGuard Labs Uncovers Highly Obfuscated Web Shell “UpdateChecker.aspx” Targeting Middle East Critical Infrastructure
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 29 Jul 2025 00:19:37 +0000
════════════════════════
⌗ Tags: #Malware #C++ #Critical Infrastructure #cybersecurity #FortiGuard Labs #IIS #malware #Middle East #Obfuscation #UpdateChecker.aspx #Web Shell

Penetration Testing Tools

FortiGuard Labs Uncovers Highly Obfuscated Web Shell "UpdateChecker.aspx" Targeting Middle East Critical Infrastructure

FortiGuard Labs exposes UpdateChecker.aspx, a heavily obfuscated web shell targeting Middle East critical infrastructure, capable of stealthy system control via encoded C# and JSON.

34 views01:03

⤷ Title: PoC Published for Remote Code Execution Flaw in Microsoft IIS Web Deploy
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 03 Sep 2025 04:15:55 +0000
════════════════════════
⌗ Tags: #Vulnerability #cybersecurity #Deserialization #IIS Web Deploy #Microsoft #rce #Remote Code Execution

Daily CyberSecurity

PoC Published for Remote Code Execution Flaw in Microsoft IIS Web Deploy

A critical RCE flaw (CVE-2025-53772) in IIS Web Deploy allows an authenticated attacker to execute arbitrary code. A PoC is public, and patching is urgent.

14 views06:04

⤷ Title: Phantom Taurus: New Chinese APT Emerges with Fileless NET-STAR Backdoor Targeting Global Governments and Telecoms
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 01 Oct 2025 02:32:34 +0000
════════════════════════
⌗ Tags: #Cyber Security #Chinese APT #Espionage #Fileless Malware #IIS Backdoor #NET_STAR #Phantom Taurus #Telecommunications #Unit 42

Daily CyberSecurity

Phantom Taurus: New Chinese APT Emerges with Fileless NET-STAR Backdoor Targeting Global Governments and Telecoms

Unit 42 uncovers Phantom Taurus, a new Chinese APT using the fileless NET-STAR backdoor to target SQL databases and IIS servers in global espionage campaigns.

13 views04:04

⤷ Title: Phantom Taurus: New Chinese APT Emerges with Fileless NET-STAR Backdoor Targeting Global Governments and Telecoms
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Thu, 02 Oct 2025 03:24:32 +0000
════════════════════════
⌗ Tags: #Cyber Security #Chinese APT #Espionage #Fileless Malware #IIS Backdoor #NET_STAR #Phantom Taurus #Telecommunications #Unit 42

Penetration Testing Tools

Phantom Taurus: New Chinese APT Emerges with Fileless NET-STAR Backdoor Targeting Global Governments and Telecoms

Unit 42 uncovers Phantom Taurus, a new Chinese APT using the fileless NET-STAR backdoor to target SQL databases and IIS servers in global espionage campaigns.

21 views04:03

⤷ Title: UAT-8099: Chinese Group Uses BadIIS Malware on Compromised Servers for SEO Fraud and Credential Theft
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 03 Oct 2025 01:42:17 +0000
════════════════════════
⌗ Tags: #Cybercriminals #BadIIS #Cisco Talos #Cobalt Strike #Credential Theft #Cybercrime #IIS #SEO Fraud #UAT_8099

Daily CyberSecurity

UAT-8099: Chinese Group Uses BadIIS Malware on Compromised Servers for SEO Fraud and Credential Theft

Cisco Talos exposed UAT-8099, a Chinese group compromising IIS servers for SEO fraud, using BadIIS malware and Cobalt Strike to steal credentials and manipulate search rankings.

20 views02:04

⤷ Title: Cisco Talos Exposes UAT-8099: Chinese Group Uses BadIIS Malware on Compromised Servers for SEO Fraud and Credential Theft
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Oct 2025 02:02:52 +0000
════════════════════════
⌗ Tags: #Cybercriminals #BadIIS #Cisco Talos #Cobalt Strike #Credential Theft #cybercrime #IIS #SEO Fraud #UAT_8099

Penetration Testing Tools

Cisco Talos Exposes UAT-8099: Chinese Group Uses BadIIS Malware on Compromised Servers for SEO Fraud and Credential Theft

Cisco Talos exposed UAT-8099, a Chinese group compromising IIS servers for SEO fraud, using BadIIS malware and Cobalt Strike to steal credentials and manipulate search rankings.

11 views06:04

⤷ Title: Chinese Hackers Exploit Exposed ASP.NET Keys to Deploy TOLLBOOTH IIS Backdoor and Kernel Rootkit
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 23 Oct 2025 00:26:42 +0000
════════════════════════
⌗ Tags: #Malware #ASP.NET Machine Key #China APT #IIS Backdoor #Kernel Rootkit #SEO Cloaking #TOLLBOOTH #Web Shell

Daily CyberSecurity

Chinese Hackers Exploit Exposed ASP.NET Keys to Deploy TOLLBOOTH IIS Backdoor and Kernel Rootkit

Elastic exposed Chinese threat actors exploiting public ASP.NET machine keys to deploy TOLLBOOTH IIS backdoor and HIDDENDRIVER kernel rootkit. The malware performs stealthy SEO cloaking.

22 views02:04

⤷ Title: Enterprise Alert: Windows 10 Update KB5071546 Breaks MSMQ Service with Insufficient Permissions
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 16 Dec 2025 02:29:45 +0000
════════════════════════
⌗ Tags: #Windows #Asynchronous Processing #Enterprise Bug #IIS #KB5071546 #Message Queuing #MSMQ #System.Messaging.MessageQueueException #Windows 10

Daily CyberSecurity

Enterprise Alert: Windows 10 Update KB5071546 Breaks MSMQ Service with Insufficient Permissions

Installing Windows 10 update KB5071546 causes MSMQ service failure in enterprise systems due to new, missing write permissions, forcing administrators to uninstall the patch.

14 views04:04

⤷ Title: The Living Mesh: Ink Dragon Turns European Government Servers into a Global ShadowPad Relay Network
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Thu, 18 Dec 2025 03:52:47 +0000
════════════════════════
⌗ Tags: #Cyber Security #APT #Check Point Research #Cyber Espionage #Earth Alux #European Security #FINALDRAFT #IIS Malware #Ink Dragon #ShadowPad #SharePoint Exploit

Penetration Testing Tools

The Living Mesh: Ink Dragon Turns European Government Servers into a Global ShadowPad Relay Network

Researchers at Check Point Research have uncovered a large-scale espionage operation conducted by the Chinese APT group Ink

13 views04:04

⤷ Title: Ink Dragon’s Global Mesh: How Chinese Spies Turn Compromised Government Servers into C2 Relay Nodes
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 18 Dec 2025 00:27:49 +0000
════════════════════════
⌗ Tags: #Cyber Security #Malware #APT41 #ASP.NET #Check Point Research #cyber_espionage #Earth Alux #IIS Listener #Ink Dragon #Microsoft Graph API #Relay Network #ShadowPad

Daily CyberSecurity

Ink Dragon’s Global Mesh: How Chinese Spies Turn Compromised Government Servers into C2 Relay Nodes

Ink Dragon is weaponizing government servers in Europe using a relay-centric mesh. By hijacking IIS servers, they mask C2 traffic across global networks.

19 views04:05

⤷ Title: Emergency Patch: Microsoft Issues Out-of-Band Fix for Broken MSMQ Infrastructure
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Thu, 25 Dec 2025 02:54:51 +0000
════════════════════════
⌗ Tags: #Windows #bug fix #Enterprise IT #IIS #KB5074976 #Microsoft #MSMQ #Out_of_Band #Patch Tuesday #Sysadmin #Windows Server #Windows Update

Information Security News

Emergency Patch: Microsoft Issues Out-of-Band Fix for Broken MSMQ Infrastructure

Microsoft has released an out-of-band update to address a Message Queuing issue that emerged after the December 2025 update. The newly issued patches apply to Windows 10 22H2 ESU, Windows 10 Enter…

18 views04:04