Introductory room for the DFIR module.

Cypher is a medium-difficulty Linux machine that requires exploiting a cypher injection vulnerability on a login page.

FortiGuard Labs identified a new Stealit malware variant abusing Node.js SEA for stealthy distribution. The campaign features a public C2 panel and uses Telegram for data exfiltration.

Forescout found pro-Russian hacktivist group TwoNet fabricated critical infrastructure attacks after compromising a honeypot, exploiting a default login, and pushing the false claim on Telegram.

A Critical RCE flaw (CVE-2025-61929) in Cherry Studio allows attackers to execute arbitrary commands by exploiting a one-click weakness in its custom URL protocol handler.

Microsoft warns of Storm-2657, a financial crime group exploiting MFA flaws to hijack university employee accounts, rerouting salary payments through third-party HR platforms like Workday.

A Critical (CVSS 9.3) flaw (CVE-2025-61928) in Better Auth allows unauthenticated attackers to create/modify API keys for any user, risking full account compromise.

Trend Micro discovered that Axis Communications leaked hardcoded Azure SAS tokens in a signed DLL for its Autodesk Revit plugin, exposing three cloud storage accounts to unauthorized access.

A malware campaign is spoofing Homebrew installer websites to trick macOS developers. The sites use clipboard injection to hide a malicious payload alongside the install command.

GreyNoise warns of a massive, synchronized RDP botnet using 100,000+ IPs from over 100 countries for RDP scanning and enumeration, with US infrastructure as the primary target.

eSentire discovered ChaosBot, a Rust-based malware deployed via DLL sideloading that uses Discord channels as a covert C2 platform to perform reconnaissance and command execution.

DomainTools exposed a Cryptocurrency Drain Conspiracy using a single IP to host scams like MedAI Genesis. Attackers use copied CSS and malicious MobileConfig profiles to drain crypto wallets.

Akira ransomware is actively exploiting the unpatched/misconfigured SonicWall flaw (CVE-2024-40766) and using the rare "UnPAC the Hash" Kerberos technique for lateral movement.

Apple overhauled its Security Bounty program, offering a $2M base reward (up to $5M with bonuses) for zero-click exploits that match mercenary spyware attacks and bypass Lockdown Mode.

The UK's CMA gave Google Strategic Market Status (SMS) over its 90% search dominance. The designation grants the regulator new powers to mandate changes in Google's search and AI services.

Kerberoasting is a way of stealing and cracking service account password hashes offline.

System Administration

When digital trust becomes the most dangerous vulnerability of the twenty-first century

The Twilight of the Invisible Perimeter

The invisible threads of control

Authors: Emmanuel Adetiba, Boladele Akanle, Priscilla Ajayi, Comfort Lawal, Faith O. Sweetwilliams, John Wejin