Daily Writeups
@Daily_Writeups
4.13K subscribers
4 photos
138K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.13K subscribers
Daily Writeups
⤷ Title: Cybercriminals Shift Tactics: Group Deploys Multiple RMM Tools (ScreenConnect, LogMeIn, Naverisk) for Redundant Persistence and Access Resale
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 20 Nov 2025 00:10:58 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Broadcom Threat Hunter #initial access broker #LogMeIn Resolve #Multi_RMM #persistence #RMM Abuse #ScreenConnect
Daily CyberSecurity
Cybercriminals Shift Tactics: Group Deploys Multiple RMM Tools (ScreenConnect, LogMeIn, Naverisk) for Redundant Persistence and…
Broadcom exposed a group deploying multiple RMM tools (ScreenConnect, LogMeIn, Naverisk) weeks apart to achieve redundant persistence. The likely Initial Access Broker (IAB) prepares systems for resale.
31 views
Daily Writeups
⤷ Title: Critical ScreenConnect Flaw (CVE-2025-14265) Risks Config Exposure & Untrusted Extension Installation
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 16 Dec 2025 03:06:18 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Configuration Data #ConnectWise #CVE_2025_14265 #MSP #on_premise #Remote Support #ScreenConnect #Untrusted Extensions
Daily CyberSecurity
Critical ScreenConnect Flaw (CVE-2025-14265) Risks Config Exposure & Untrusted Extension Installation
A critical ScreenConnect flaw (CVSS 9.1) allows authorized users to expose config data or force untrusted extension installs. On-premise users must upgrade to v25.8 immediately; cloud users are already patched.
20 views
Daily Writeups
⤷ Title: Attackers Weaponize Legitimate RMM Tools via Fake PDFs
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 13 Jan 2026 02:12:20 +0000
════════════════════════
⌗ Tags: #Cybercriminals #ASEC #cyber attacks #living_off_the_land #Malware Analysis #NinjaOne #NSIS #PDF Malware #phishing #RMM Abuse #ScreenConnect #SuperOps #Syncro
Daily CyberSecurity
Attackers Weaponize Legitimate RMM Tools via Fake PDFs
In a new report, the AhnLab Security Intelligence Center (ASEC) warns of a rising trend where threat actors are hijacking powerful Remote Monitoring and Management (RMM) software to infiltrate vic…
18 views
Daily Writeups
⤷ Title: Hackers Abuse ScreenConnect to Hijack PCs via Fake Social Security Emails
════════════════════════
𐀪 Author: Deeba Ahmed
════════════════════════
ⴵ Time: Tue, 17 Feb 2026 04:48:54 +0000
════════════════════════
⌗ Tags: #Security #Malware #Cyber Attack #Cybersecurity #Forcepoint #Iran #Scam #ScreenConnect #Social Security #Windows #Windows SmartScreen
Hackread
Hackers Abuse ScreenConnect to Hijack PCs via Fake Social Security Emails
Hackers are using fake SSA emails and hijacked ScreenConnect tools to bypass Windows security to target UK, US, and Canadian organisations.
39 views
Daily Writeups
⤷ Title: Signed Malware Masquerading as Workplace Apps Deploys Persistent Backdoors
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 06 Mar 2026 00:13:17 +0000
════════════════════════
⌗ Tags: #Cybercriminals #cybersecurity #EV Certificate Phishing #infosec #malware #MeshAgent #Microsoft Defender #RMM Backdoors #ScreenConnect #Tactical RMM #threat intelligence
Daily CyberSecurity
Signed Malware Masquerading as Workplace Apps Deploys Persistent Backdoors
Microsoft Defender exposes a new phishing campaign using EV certificates and fake Teams invites to silently deploy RMM backdoors on corporate networks.
16 views
Daily Writeups
⤷ Title: Leaving the Doors Unlocked: Critical 9.0 CVSS ScreenConnect Flaw Exposes Machine Keys
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 18 Mar 2026 12:07:46 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #ConnectWise #Cryptographic Keys #CVE_2026_3564 #cybersecurity #infosec #Patch Alert #Remote Access #ScreenConnect #Server Security #Vulnerability
Daily CyberSecurity
Leaving the Doors Unlocked: Critical 9.0 CVSS ScreenConnect Flaw Exposes Machine Keys
A critical 9.0 CVSS vulnerability (CVE-2026-3564) in ConnectWise ScreenConnect exposes server cryptographic keys. On-premise users must update to 26.1 now.
19 views
Daily Writeups
⤷ Title: The “Special Invitation” Trap: STAC6405 Abuses Legitimate RMM Tools to Hijack Your PC
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 07:30:02 +0000
════════════════════════
⌗ Tags: #Cybercriminals #cybersecurity #infosec #LogMeIn Resolve #Microsoft Teams Lure #Norton Mimicry #phishing #Punchbowl Lure #Remote Access #RMM Abuse #ScreenConnect #Sophos MDR #STAC6405
Daily CyberSecurity
The "Special Invitation" Trap: STAC6405 Abuses Legitimate RMM Tools to Hijack Your PC
Sophos MDR uncovers STAC6405, a phishing campaign abusing RMM tools like LogMeIn for unattended access. Learn how to spot the "Special Invitation" lure.
21 views
Daily Writeups
⤷ Title: New Stealth Attack Chain Weaponizes Legitimate Remote Access Software
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 14 Apr 2026 09:21:28 +0000
════════════════════════
⌗ Tags: #Malware #.NET Reflection #Adobe Acrobat #cybersecurity #Fileless Malware #In_Memory Execution #infosec #ScreenConnect #UAC bypass #VBScript Loader #Zscaler ThreatLabz
Daily CyberSecurity
New Stealth Attack Chain Weaponizes Legitimate Remote Access Software
Zscaler reveals a 2026 attack chain using fake Adobe Reader lures to install ScreenConnect via in-memory execution and UAC bypass. Protect your network now!
15 views
Daily Writeups
⤷ Title: Cyber-Actors are “Laundering Trust” to Hijack the Global Supply Chain
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 20 Apr 2026 08:04:03 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Cargo Diversion #Cyber Reconnaissance #Fleet Payments #infosec #Load Board Phishing #powershell #Proofpoint #RMM Abuse #ScreenConnect #Signing_as_a_Service #Transportation Security
Daily CyberSecurity
Cyber-Actors are "Laundering Trust" to Hijack the Global Supply Chain
Proofpoint monitors a 30-day supply chain attack using "signing-as-a-service" to bypass Windows security. Protect your load boards and fleet payments now.
14 views
Daily Writeups
⤷ Title: Attackers Hijack Trusted RMM Tools to Create Invisible, Permanent Backdoors
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 07 May 2026 08:15:06 +0000
════════════════════════
⌗ Tags: #Cybercriminals #cybersecurity #infosec #living_off_the_land #persistence #phishing #RMM Hijacking #Safe Mode #ScreenConnect #Securonix #SimpleHelp #social engineering #Threat Hunting
Daily CyberSecurity
Attackers Hijack Trusted RMM Tools to Create Invisible, Permanent Backdoors
Securonix exposes an 80+ organization breach using "self-healing" RMM tools and Safe Mode persistence. Standard antivirus is blind—learn how to hunt it!
14 views
Daily Writeups
⤷ Title: Weaponized JPEG Payload Deploys Trojanized ScreenConnect for Covert Espionage
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 14 May 2026 07:01:10 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AMSI Bypass #ConnectWise #Cyber Security #Cyfirma #infosec #JPEG Exploit #Operation SilentCanvas #PowerShell Malware #ScreenConnect #Trojan #UAC bypass
Daily CyberSecurity
Weaponized JPEG Payload Deploys Trojanized ScreenConnect for Covert Espionage
CYFIRMA warns of Operation SilentCanvas: A weaponized JPEG delivers trojanized ScreenConnect, bypassing AMSI and UAC for full-system surveillance. Stay alert!
12 views
Daily Writeups
⤷ Title: Algorithmic Infiltration: Microsoft Unmasks Generative AI Poisoning in Cryptojacking Campaign
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Fri, 29 May 2026 06:43:30 +0000
════════════════════════
⌗ Tags: #Malware #autorun.dll sideloading exploit #cryptocurrency harvesting evasion techniques #Dynu dynamic DNS infrastructure #Fake hardware monitoring cryptojacker #HWMonitor FurMark cloned malware #Microsoft Defender registry exclusions #poisoned AI chatbot search results #ScreenConnect remote access trojan #SimpleRunPE.exe process injection #smart GPU throttling miner
Information Security News
Fake Hardware Monitoring Cryptojacker Hijacks High-End GPUs
Microsoft exposes a stealthy fake hardware monitoring cryptojacker mimicking FurMark and HWMonitor. It masks its GPU usage to avoid detection.
34 views
Daily Writeups
⤷ Title: Sophisticated GPU Cryptojacking Campaign Surfaced by Microsoft Experts
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 01 Jun 2026 07:11:24 +0000
════════════════════════
⌗ Tags: #Malware #AI Search Poisoning #GPU Cryptojacking #malware #Microsoft Defender #Process Hollowing #ScreenConnect #threat intelligence
Daily CyberSecurity
Sophisticated GPU Cryptojacking Campaign Surfaced by Microsoft Experts
A stealthy GPU cryptojacking campaign leverages AI search poisoning and process hollowing injection to hijack high-end rigs. Read the Microsoft report.
36 views
Daily Writeups
⤷ Title: ScreenConnect AsyncRAT Campaign Hides Inside Fake Freeware
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 13 Jul 2026 12:38:06 +0000
════════════════════════
⌗ Tags: #Malware #AsyncRAT #kaspersky #Malware Campaign #ScreenConnect
Daily CyberSecurity
ScreenConnect AsyncRAT Campaign Hides Inside Fake Freeware
At a Glance Malware Family: AsyncRAT Threat Actor: Unknown cybercriminals Target or Victims: Individual consumers and corporate networks Delivery Vector: SEO poisoning and fake freeware portals Ke…
16 views
Daily Writeups
⤷ Title: SMOKE#SCREEN Campaign Abuses ScreenConnect RMM for Stealthy Remote Access
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 07 Aug 2026 08:02:07 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Cloudflare Tunnel #phishing #RMM Abuse #ScreenConnect #Securonix #SMOKE#SCREEN
Daily CyberSecurity
SMOKE#SCREEN Campaign Abuses ScreenConnect RMM for Stealthy Remote Access
At a Glance Attribute Detail Actor / group Unattributed threat actor (tracked by Securonix as SMOKE#SCREEN) Activity type Multi-wave phishing and RMM abuse for remote access Targets / victims Wind…
11 views
Daily Writeups
⤷ Title: ScreenConnect Weaponized as a Self-Propagating Worm
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Wed, 09 Sep 2026 08:30:20 +0000
════════════════════════
⌗ Tags: #Cybercriminals #ConnectWise #Huntress #Malware Campaign #ScreenConnect
Information Security News
ScreenConnect Weaponized as a Self-Propagating Worm
Cybercriminals have transformed ScreenConnect into a weaponized mechanism capable of infecting other ScreenConnect systems during standard connections. The modified client automatically detects a …
22 views
Daily Writeups
⤷ Title: Phishing Campaign Exploits Google Infrastructure for Data Theft
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 11 Sep 2026 07:13:10 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Credential Harvesting #Google Infrastructure #phishing #ScreenConnect
Daily CyberSecurity
Phishing Campaign Exploits Google Infrastructure for Data Theft
At a glance Threat researchers from the KnowBe4 Threat Lab uncovered a highly sophisticated phishing campaign recently. The attackers systematically abuse Google infrastructure to bypass corporate…
7 views
Daily Writeups
⤷ Title: CVE-2026-84869: ConnectWise ScreenConnect Vulnerability Exploited
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Sat, 12 Sep 2026 07:11:32 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #ConnectWise #CVE_2026_84869 #cybersecurity #ScreenConnect
Daily CyberSecurity
CVE-2026-84869: ConnectWise ScreenConnect Vulnerability Exploited
ConnectWise released an emergency security patch today to address a critical ConnectWise ScreenConnect vulnerability. The severe flaw allows unauthorized attackers to transfer and execute maliciou…
30 views
Daily Writeups
⤷ Title: Phishing Abuses RMM Tools for Persistent Network Access
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 02 Oct 2026 06:11:09 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Microsoft Defender Experts #MSP360 #phishing abuses RMM tools #phishing abuses RMM tools for access #RMM Abuse #ScreenConnect
Daily CyberSecurity
Phishing Abuses RMM Tools for Persistent Network Access
At a Glance Summary Attribute Details Actor or Group Unattributed cybercrime operators Activity Type Phishing, dual RMM deployment, living-off-the-land access Targets or Victims Enterprise network…
12 views
Daily Writeups
⤷ Title: Phishing Campaign Abuses Microsoft Power BI to Install Rogue ScreenConnect Clients
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 09 Oct 2026 06:15:01 +0000
════════════════════════
⌗ Tags: #Malware #Email Security #Huntress #phishing #Power BI #Remote Access #RMM Abuse #ScreenConnect
Daily CyberSecurity
Phishing Campaign Abuses Microsoft Power BI to Install Rogue ScreenConnect Clients
At a Glance Malware family Rogue ScreenConnect clients and a defense evasion tool Threat actor Unknown; no attribution Targets A handful of endpoints, plus 22 more linked by a retroactive hunt (Hu…
11 views