TLDR: Foothold — Argus DVR 4.0 LFI + filesystem enum for SSH keys; Privesc — DVR 4.0 weak password exploit + runas command

¿Tienes un programa espía en tu teléfono? Guía sencilla para saberlo

The Growing Security Risks in Cloud Productivity

Transitioning from IT to OT cybersecurity is one of the most impactful moves a security professional can make today. While IT focuses on…

I recently completed the PJPT — and what a ride. Huge thanks to TCM Security and Heath Adams for creating an experience that truly mirrors…

Money lost in cryptocurrency has been spreading so wide more than the fastest spreading illness. The money lost in cryptocurrency may be…

How a simple email turned OpenAI’s most advanced AI into an unwitting accomplice

Lessons in cybersecurity and what we can learn from it

A Word of Caution

Discover the top 10 cyber risks businesses face today and learn how to mitigate them effectively. Stay protected with these expert tips.

لَقَدْ مَنَنَّا عَلَيْكَ مَرَّةً أُخْرَىٰٓ

Using basic steganography to hide C2 commands in SVG files

A company’s web server has been breached through their website. Our team arrived just in time to take a forensic image of the running…

Operations at the network layer

When we allow a large language model (LLM) to read external information like web pages, PDFs, or documents, an invisible threat begins. A…

0x00: Claude Joins the Kill Chain

#1 Deploy the Machine:

A new campaign uses a malicious LNK shortcut sent via Discord to deploy a multi-functional RAT that hijacks legitimate Windows binaries to evade detection.

Researchers have uncovered a Russian-linked disinformation campaign targeting Moldova’s upcoming elections, attempting to undermine its pro-EU trajectory.

A new phishing campaign is targeting PyPI maintainers with emails from a fraudulent pypi-mirror.org domain to steal credentials and compromise accounts.