Updated daily

What’s new

Everything that appeared in the last 30 days: research, observations, checklists, hunts, references, labs and interview questions. The Threat Wire updates every six hours and has its own page.

86 pieces across 11 days. Members-only pieces are listed so you know they exist.

Sunday 27 Septembertoday

DeskHuntHunt: repeated MFA prompts denied or unanswered for one accountAccounts with five or more failed MFA challenges in an hour, in Entra ID and Okta. The signature of somebody holding the password and waiting for a tired approval.CONSTRUCTED
DeskChecklistFirst 15 minutes: a user typed their password into a phishing pageAssume the session was taken, not just the password. Revoke first, find everybody else the email reached, and check what the attacker did with the time they had.CONSTRUCTED
ObservationsObservation NO. 28One service account password in a personal Google profile, and 134 customers' support filesFrom 28 September to 17 October 2023 a threat actor used a service account to reach files in Okta's customer support system associated with 134 customers. Some were HAR files containing session tokens, which the actor used to hijack the Okta sessions of 5 customers. Okta found that an employee had signed in to a personal Google profile in Chrome on an Okta-managed laptop, and the service account's username and password had been saved into that personal Google account, which Okta considers the most likely route of exposure.REAL

Saturday 26 September

DeskPlaybookCloud account takeover response plan: sessions, methods, devices and grants, then what they readA successful sign-in the user did not make, in Microsoft Entra ID and Microsoft 365. A password reset alone evicts almost nobody. The plan works through the order that does, how to tell a guessed password from a stolen session, and how to answer what they read.CONSTRUCTED
DeskPlaybookData theft extortion response plan: verify the claim, find the way out, own the notificationAn extortion demand with nothing encrypted, or your name on a leak site. Three questions run in parallel with three owners: is the claim real, what left and how, and what you are obliged to say and to whom. A plan for answering each one on evidence rather than on the attacker's framing.MembersCONSTRUCTED
DeskReferenceEntra ID sign-in logs: the fields and error codes that settle an account questionWhich fields in a sign-in record separate a traveller from a stolen session, what the common error codes mean, where non-interactive sign-ins hide, and how long any of it is kept.CONSTRUCTED
DeskHuntHunt: successful sign-ins from an address the user has never usedFor each account, the successful sign-ins from an IP address not seen for that account in the previous 30 days. The first question in any unfamiliar sign-in alert, asked across the whole tenant at once.CONSTRUCTED
DeskChecklistFirst 15 minutes: a ransom note, or files that suddenly will not openEncryption is under way or has just finished. Contain without destroying the memory that holds the operator's tools, protect the backups, and start the clocks that legal and your insurer will ask about.CONSTRUCTED
DeskChecklistFirst 15 minutes: a successful sign-in from an IP address nobody recognisesA user's account signed in successfully from an address, country or device that does not fit. How to tell a traveller from a stolen session in five minutes, and what to cut off if it is the second.CONSTRUCTED
DeskChecklistFirst 15 minutes: a user is getting MFA prompts they did not startRepeated MFA prompts mean somebody already has the password and is waiting for a tired tap. What to tell the user, what to check, and what to change so the next attempt fails.CONSTRUCTED
DeskChecklistFirst 15 minutes: an account was added to Domain AdminsA tier-zero group changed and nobody has a ticket for it. Whoever made the change is at least as compromised as the account they added. How to confirm, contain and scope without handing the operator another credential.MembersCONSTRUCTED

Monday 21 September

DeskPlaybookBusiness email compromise response plan: the money first, then the mailboxTwo responses that have to run at once. One is a race with a bank transfer measured in hours. The other is evicting an operator who is still reading the mailbox, and who survives a password reset unless you remove what they left behind.CONSTRUCTED
DeskPlaybookInsider threat response plan: evidence, proportion and the employee who may have done nothingThe response where the usual instincts are wrong. Speed matters less than lawfulness, the suspect is a colleague with rights, and half of these turn out to be misunderstanding. A plan for investigating quietly, preserving what you would need, and being able to stand behind how you did it.CONSTRUCTED
DeskPlaybookRansomware response plan: from the first renamed file to the reviewThe whole response rather than the first hour of it: who decides what, how to contain without destroying the evidence you will need, what has to be true before you restore, and the notifications whose clocks started before you noticed.CONSTRUCTED
DeskRule packSigma endpoint pack: seven rules for the Windows techniques that keep workingShadow copy deletion, LSASS dumping through comsvcs, long encoded PowerShell, scheduled tasks and services in user-writable paths, WMI subscriptions and a cleared Security log. Each rule ships with the false positives it was written expecting.CONSTRUCTED
DeskRule packSigma network pack: four rules for DNS, proxy and firewall logsLong DNS labels, scripting-engine user agents at the proxy, executables fetched from a bare IP address, and SMB leaving the network. Written for the log sources most estates already collect and rarely alert on.CONSTRUCTED
DeskRule packYARA triage samples: five heuristic rules for a web root, a script directory or a triage collectionRequest-fed web shells in PHP and ASP.NET, PowerShell that decodes, executes and reaches the network in one file, ransom notes, and LSASS minidumps left on disk. Hunting rules that produce files to open, not verdicts.CONSTRUCTED
DeskReferenceForensic timeline cheat sheet: which clock, whose time zone, and what each timestamp really recordsA timeline is only as good as your understanding of what each timestamp means. The artifacts that carry time on Windows, what event each one actually records, the zone it is stored in, and the commands to build and cut a super timeline.CONSTRUCTED
DeskReferenceMemory forensics cheat sheet: acquisition order and the Volatility 3 plugins that answer real questionsWhat to capture before you touch anything else, how to check the image is usable, and the Volatility 3 plugins grouped by the question they answer, with what each one cannot tell you.CONSTRUCTED
DeskReferenceWindows event log cheat sheet: by the question you are askingOrganised by what you are trying to establish rather than by number: who logged on and how, what ran, what persisted, what was tampered with. Every entry says which log, whether it is on by default, and what it does not tell you.CONSTRUCTED
DeskToolhash_manifest.py: write and verify a SHA-256 manifest for an evidence directoryHashes every file in a collection into a sha256sum-compatible manifest, refuses to overwrite one that exists, and on verification reports changed, missing and new files as the three different findings they are.CONSTRUCTED
DeskToollinux-triage.sh: a read-only first-hour collection script for LinuxOne Bash file that collects processes, sockets, deleted-but-running binaries, logons, SSH keys, persistence and recent changes in order of volatility, using only what ships with a distribution. It writes text files and a SHA-256 manifest, and it is short enough to read before you run it.CONSTRUCTED
DeskToolThe analyst's toolbox: what to have installed before you need itOther people's tools, chosen because they are free, maintained and do one part of a triage well. What each is for, where it fits, and the tools already on this site that run in your browser.CONSTRUCTED
DeskTooltimeline_merge.py: merge CSV exports from different tools into one UTC timelineNormalises ISO times, Unix epochs, Windows FILETIME values and zone-less local times to UTC, keeps each original value beside the conversion so it can be checked, flags anything whose zone it had to assume, and never silently drops a row.CONSTRUCTED
DeskHuntHunt: rundll32 calling the comsvcs MiniDump exportFinds LSASS dumps taken with a DLL that ships in System32, whether the export is named or called by ordinal. One idea in three query languages, each bounded to seven days.CONSTRUCTED
DeskHuntHunt: the Security audit log was clearedEvent 1102 is the first record of the new log, so it survives the clearing and names the account that did it. One of the cheapest hunts there is, and worth thirty days rather than seven.CONSTRUCTED
DeskRecipePowerShell -EncodedCommand to readable scriptThe two operations that turn the base64 after -e, -enc or -EncodedCommand into the script that ran. Short, and the one you will use most.CONSTRUCTED
DeskChecklistFirst 15 minutes: an LSASS credential dump alert on a serverA process that is not a security product has read LSASS memory. What to do before the playbook opens, in the order that protects the evidence and stops you adding your own credentials to the pile.CONSTRUCTED
LearnGuided labGuided lab: forty failures, no lockouts, one successA password spray that stayed under the lockout threshold and never produced a failed-logon event on the server it was aimed at. Find where the failures were recorded, identify the account that fell, and explain why the dashboard showed nothing.CONSTRUCTED
LearnGuided labGuided lab: six service tickets in four secondsA burst of Kerberos service ticket requests from one workstation, every one of them legitimate as far as the domain controller is concerned. Find what makes the cluster abnormal, separate it from a legacy application, and say what the log cannot tell you.CONSTRUCTED
LearnGuided labGuided lab: the credential dump that used nothing but WindowsAn LSASS dump taken with a DLL that ships in System32, called by ordinal so the obvious rule misses it. Work out which process touched LSASS, which access mask matters, and whose credentials you now have to assume are gone.CONSTRUCTED
LearnGuided labGuided lab: a service that existed for nine secondsRemote execution over the admin share, reconstructed from the target. Tie four events in three logs into one action, work back to the host it came from, and handle the version where the service is not called PSEXESVC.CONSTRUCTED
LearnEvidence packDNS with something in the labels: a small constructed captureSixty DNS queries from one workstation, fifteen of them TXT lookups whose first label is 56 characters of base32. Small enough to read packet by packet, and generated by a script, so nothing in it came from a real network.CONSTRUCTED
LearnQuestionYou find an executable listed in Shimcache on a Windows 10 workstation. Does that prove it ran?The question that sorts people who have read about Windows forensics from people who have had a finding challenged. Three answers, and the difference between them.CONSTRUCTED
LearnTimelineSeventeen hours at Calderbrook: from a password spray to data leavingA constructed intrusion laid out against the clock and the ATT&CK tactics, following the same four stages as the guided labs. Eleven events, one of them inferred, and one tactic conspicuously missing.CONSTRUCTED
ResearchGuideMini-guide: a PowerShell alert in ninety seconds, in the order that settles it fastestMost PowerShell alerts are administration. Five questions, ordered so the cheapest one that can close the alert comes first, with the answer that means stop and the answer that means keep going.CONSTRUCTED
ResearchGuideMini-guide: the five fields of a 4624 that decide what a logon meansEvent 4624 has more than twenty fields and most triage reads two of them. The five that change the conclusion, what each one is really recording, and the values that catch people out.CONSTRUCTED

Saturday 12 September

ObservationsObservation NO. 27Twenty-one agencies, eleven countries, and the logs were deletedTwenty-one agencies from eleven countries put their seals on this advisory, which is the first thing to notice about it. PRC state-sponsored actors have been inside telecommunications backbone routers, provider edge and customer edge routers since at least 2021, and have used those compromised devices and their trusted connections to pivot into further networks. The named sectors are telecommunications, government, transportation, lodging and military infrastructure. The equipment spans Cisco IOS XE, NX-OS and IOS XR, Palo Alto PAN-OS and Ivanti Connect Secure, with Juniper, Fortinet, Nokia, Sierra Wireless and SonicWall suspected. What is taken is call data logs, a limited number of private communications, and material subject to court-ordered law enforcement requests.REAL
ObservationsObservation NO. 26Ransomware that never runs on any of your machinesDatadog sets out four ways an attacker who already has access to an Azure subscription can encrypt a victim’s stored data without ever deploying ransomware to a host. Two of the four are not theoretical: the first is the route used in a BlackCat deployment in 2023, and the third documents STORM-0501 activity. The other two are researcher demonstrations that Datadog says have not been seen in public reporting. The shape they share is that the attacker turns the platform’s own encryption features against the data, so from the storage service’s point of view every operation is legitimate and authorised.REAL
ObservationsObservation NO. 25A search for monitoring software, and ransomware forty-four hours laterA user searched Bing for ManageEngine OpManager and was lured to opmanager[.]pro, a lookalike domain, where they downloaded a trojanised MSI. It dropped the Bumblebee loader, which called home. Five hours later the operator deployed an AdaptixC2 agent, created domain accounts with Enterprise Admin privileges and installed RustDesk. Over the next two days they moved by RDP to a domain controller, used wbadmin to extract the NTDS.dit Active Directory database, and pushed roughly 77GB out to a server in Ukraine across two transfer sessions of about four and a half hours each. Akira ransomware landed approximately 44 hours after initial access, executed 39 times in the child domain, with shadow copies deleted through WMI.REAL
ObservationsObservation NO. 24Four hours, four hundred packages, and valid provenance on every oneOn 4 August 2026 a self-propagating worm entered npm through a compromised maintainer account. It pushed commits straight into source repositories, which triggered those projects’ own continuous integration pipelines to build and publish poisoned packages. Each infection steals the npm publishing token from wherever it lands, enumerates every package that token can write to, and publishes a poisoned version of each one. It reached more than 400 packages in under four hours, peaking at roughly one infected package per second, starting from keyv, cacheable, flat-cache and file-entry-cache.REAL
ObservationsObservation NO. 23A rogue root certificate, valid for ten yearsOn 9 August an account impersonating a CoinDesk executive direct-messaged a Huntress researcher, asking for help organising an online conference and sharing a Google Doc. The document carried a custom Apps Script sidebar offering an encryption key, which failed to decrypt anything as promised and then presented ClickFix-style instructions and a manual download instead. A second document arrived the next day dressed as a DocSend share. Huntress assesses that a large number of Black Hat and DEF CON attendees were targeted, on both macOS and Windows.REAL
ObservationsObservation NO. 22A decade of poisoned search results, run as a businessThe DFIR Report traces an SEO poisoning operation running since at least 2015 out of Rajasthan, India, which ranks fraudulent lure pages high in search results for tax software, antivirus, streaming, gaming and credit card activation. A click enters a traffic distribution system that fingerprints the browser and puts the visitor through a Cloudflare Turnstile or hCaptcha challenge before deciding what to serve. The outcome is either MayaBot malware or a tech support scam phone number. The researchers found 84 active operator GitHub accounts between January 2024 and March 2026, 180 registered domains reachable through one subdomain service alone, and a single Matomo analytics instance tracking 146 unique domains.REAL
ObservationsObservation NO. 21Paste this into Terminal to prove that you are humanA compromised website shows a fake Cloudflare CAPTCHA that asks the visitor to copy a command and paste it into Windows Terminal or PowerShell. The command pulls down a ZIP holding a legitimate Windows binary and a malicious dui70.dll beside it, which sideloads. Payload fragments are hidden inside PNG images. It persists through the registry and a scheduled task that re-runs every 60 minutes, enumerates Active Directory, and ends by standing up a reverse tunnel out over 443 that gives the operator "persistent, network-level proxy access through the compromised host". Organisations across multiple industries are affected.REAL
ObservationsObservation NO. 20The download site was counterfeit and the tamper protection heldCounterfeit download sites impersonating well known software vendors served malicious installers to people looking for ordinary applications. Microsoft confirms compromises across medical devices and healthcare, manufacturing, gaming, technology, logistics, government and higher education, primarily affecting China-based operations of multinational organisations and Chinese-speaking users. Once run, the malware persists through scheduled tasks running as SYSTEM, tries to weaken the endpoint’s own protection, deletes volume shadow copies, disables Windows Update, and calls out to attacker infrastructure on a roughly 60 second cadence.REAL
ObservationsObservation NO. 19One remote support session, then the domain controllersFirst contact is a Microsoft Teams message from outside the tenant, from somebody presenting as IT or the helpdesk, and the ask is a remote support session. Inside that session the operator uses PowerShell to install an MSI quietly, which drops a portable Node.js runtime and an obfuscated JavaScript implant giving persistent command execution. Then host and Active Directory reconnaissance, screenshots, and movement over Windows Remote Management on TCP 5985 to dozens of hosts across multiple regions, aimed at domain controllers and certificate authorities.REAL
ObservationsObservation NO. 18Industrial-scale extraction, through the API you sellCISA says China-based AI companies have been systematically extracting the capabilities of US frontier models by querying them at scale, taking "billions of tokens across millions of exchanges/requests" from variants of Claude, GPT, Gemini and Grok since at least late 2024. The route is not an intrusion. It is the product’s own inference API, reached through accounts "not registered to legitimate users" and through premium subscriptions bought in bulk and shared across teams of developers, with automated failover between pathways whenever one gets blocked. Individual campaigns run from days to months, at query volumes in the thousands to millions per domain.REAL
ObservationsObservation NO. 17A million emails, a fabricated thread, and an invoice for fifty thousand dollarsBetween 3 and 5 August 2026 an operator sent more than a million phishing emails to enterprise finance staff, from domains registered on 31 July. The messages impersonate the recipient’s own chief executive and ServiceNow, and they carry fabricated invoices inside fabricated email threads built to look like a conversation already under way. 87.7% of the campaign went at US companies, accounts payable departments were the target, and IT services, business advisory and consumer goods were the sectors most hit. The ask is an ACH payment of nearly $50,000.REAL
ObservationsObservation NO. 16Eight years on, the routers are still answering to the community string in the manualFSB Center 16 actors continue to take networking equipment worldwide, and CISA frames this as a hygiene problem rather than an exploitation one. Two routes carry it. Cisco Smart Install, still reachable on TCP 4786 and still unpatched against CVE-2018-0171. And SNMP agents answering to common or default community strings over SNMPv1 and SNMPv2, which have no meaningful authentication to begin with. What the actors take is configuration, pulled out over TFTP, and the credentials inside it. The sectors named are Communications, the Defence Industrial Base, Energy, Financial Services, Government Services and Facilities with state and local called out specifically, and Healthcare and Public Health.REAL
ObservationsObservation NO. 15The hotel Wi-Fi sign-in page was the compromiseStorm-2945 compromised the shared captive portal services that hotels, conference centres and similar venues run, then manipulated DNS and HTTP traffic on those networks to send guests to attacker infrastructure. Zscaler found compromised gateways in several US cities, in India and in Saudi Arabia. What the traveller sees is the sign-in page they were expecting. What follows is Microsoft 365 credential harvesting, device code phishing and malware delivery. The victims here are not the hotels. They are whoever stayed in them, across every sector.REAL
ObservationsObservation NO. 14Controllers on the public internet, still holding the password they shipped withIranian-affiliated actors have been reaching programmable logic controllers directly over the internet at US water and wastewater utilities, energy organisations and local municipalities, and changing what those controllers do. CISA names Rockwell Automation CompactLogix and Micro850, Schneider Electric Modicon M340 and Siemens S7-1200, and says other manufacturers are likely in scope. There is no exploit to write about. The devices were exposed, they still held their default authentication keys and passwords, and from there the actors altered project files, manipulated what the operator saw on the HMI and SCADA displays, and disabled shutdown and alarm logic.REAL
ObservationsObservation NO. 13The helpdesk rings your personal phone, and the lure is a passkeySince May 2026 Microsoft has tracked a campaign that opens with a call or a message to the target’s personal phone number from somebody claiming to be the organisation’s IT helpdesk. The pretext is a security improvement: enrol a passkey, re-register your MFA, sort out single sign-on. The link goes to an adversary-in-the-middle page that takes the session. The operator then registers their own authenticator app or phone number as an additional method on the account, and reads: SharePoint, OneDrive and Exchange, at scale, as the person whose identity they now hold.REAL
ObservationsObservation NO. 12A scripting bug in webmail, and ninety days of everybody’s emailRussian state-supported actors have been compromising Western government and commercial organisations running Zimbra Collaboration Suite since at least July 2025. The delivery is an email and the victim clicks nothing. Viewing the message in the Classic webmail client runs the attacker’s JavaScript, exploiting CVE-2025-66376, a cross-site scripting flaw in how Zimbra sanitises CSS import directives. In twelve asynchronous stages the payload takes the last 90 days of mail, the organisation’s Global Address List and whatever else it can reach, and pushes it out over DNS. The sectors CISA names are the Defence Industrial Base, federal and local government, education, energy, law enforcement, media, non-governmental organisations and technology.REAL
ObservationsObservation NO. 11Detection was not the limiting factor. Response time was.Compromised VPN credentials put an operator on the network. Over the next three days they scanned east to west across a broad range of ports, triggered Active Directory replication consistent with a credential dump, ran command and control over SSL, pushed data out to Wasabi cloud storage, and encrypted thousands of files. The customer had behavioural detection running and it saw all of it, stage by stage, while the intrusion was still reversible. Three days is a long time to be inside a network that is watching you.REAL
ResearchAnalysisEvidence Gap Challenge No. 2: the proxy only kept the domainA developer laptop, a package that should not have been installed, and a proxy that logged where the traffic went but not what was asked for. Work out what the truncation costs you, what you can still prove, and whether a full-URL log would have been worth what it costs to keep.CONSTRUCTED
ResearchAnalysisCase study: one appliance, and the disclosure that followedCL0P against MOVEit Transfer, worked as a case rather than read as news. A zero-day in an internet-facing file transfer product, a web shell, and a scope question that has nothing to do with how many hosts were touched. Nine questions, and the answers are in the advisory.Members
ResearchAnalysisEvidence Gap Challenge No. 3: four people knew that passwordAn operational technology jump host, a shared engineering account, and a change nobody will own. Every log works, every timestamp is right, and attribution is still impossible. Work out what that costs, and what you would have needed to collect to make a name provable.CONSTRUCTED
ResearchAnalysisCase study: the update was signed, and that was the problemA trusted software update that carried a backdoor, worked as a case. Signing proved the build was the vendor's; it proved nothing about what was in it. Eight questions on detection, scope and the uncomfortable part, which is that nothing your endpoint controls were watching for was wrong.Members

Friday 11 September

ObservationsObservation NO. 10Reverse Engineering the Six Stages of MacSync Stealer and RATHuntress recently investigated an incident where the victim searched Google for how to install Claude on a Mac, clicked a sponsored result, and landed on a weaponised claude.ai/share conversation dressed up as an Apple Support install guide. It told them to open Terminal and paste a single curl command. MacSync is a six-stage kill chain, not a smash-and-grab.REAL
ObservationsObservation NO. 09Akira Hits Safe Mode: Ransomware Rebooting Around EDRAfter gaining access via an exposed SonicWall VPN, an Akira affiliate rebooted the victim host into Safe Mode with Networking to defeat EDR, a first for this ransomware variant in our telemetry. Safe Mode is a boot mode that only loads essential drivers and services, disabling most third-party software. As such, the reboot stopped the Huntress agent and disabled Microsoft Defender's real-time protection; Defender couldn't quarantine the file until the attacker rebooted back to normal mode.REAL
ObservationsObservation NO. 08The same red team against two SOCs, and the alert queue that swallowed oneCISA ran two red team assessments at the same time, using similar tradecraft against a government services organisation and a water utility. Both ended the same way: full domain compromise, sensitive business systems reached, cloud resources reached. One of them caught the initial access within minutes and quarantined the hosts, which forced the red team into an assume breach model to carry on. The other never detected anything at all. The two organisations were running comparable tooling, and that is what makes this advisory worth the time.REAL

Wednesday 9 September

ResearchGuideFalse-Positive Hall of Fame No. 1: six alerts that were the software workingChrome opens a pipe that Cobalt Strike also opens. Chrome's updater reads LSASS. Discord ships a signed binary that launches other binaries. Six alerts that fire on normal software, each with the benign explanation and the discriminator, and a count of how often the public rulebase admits any of this.
ResearchGuideThe operator set the clock, and set only one of themTimestomping is a decision, not an accident, and the decision is visible. NTFS keeps eight timestamps per file and the ordinary Windows API writes four of them. What the other four say about the tool the operator chose, the checklist they were working from, and where they stopped.Members
ResearchAnalysisEvidence Gap Challenge No. 1: the laptop was reimaged on TuesdayA supplier is out €96,000 and the only endpoint that mattered was wiped on day one, by a helpdesk following the documented process correctly. Here is every artefact that still exists. Work out what you can prove, what you can only say is consistent, and the one collection change that would have moved the most from the second column to the first.CONSTRUCTED

Friday 4 September

ObservationsObservation NO. 07Still RDP, still brute force, still workingPhobos operators scan the internet for exposed Remote Desktop with off-the-shelf tools such as Angry IP Scanner, brute force whatever they find, and walk in on valid credentials. From there it is SmokeLoader, Cobalt Strike, Bloodhound and Mimikatz, then exfiltration through WinSCP and Mega before the encryption anyone eventually notices.REAL
ObservationsObservation NO. 06The remote access tool that had to revoke its own signatureAttackers reached AnyDesk's production systems in late December 2023 and took source code along with private code-signing keys. AnyDesk detected it during an internal audit in mid-January, brought in CrowdStrike, revoked its certificates and shipped a rebuilt binary on 29 January, disclosing publicly on 2 February; within a day, more than 18,000 AnyDesk credentials were on sale on criminal forums.REAL
ObservationsObservation NO. 05Ten minutes on the phone to the help deskScattered Spider identified an MGM Resorts employee on LinkedIn, called the IT help desk impersonating them, and talked their way into a password reset that yielded administrative access to MGM's Okta tenant. MGM pulled systems offline to contain it; ALPHV still encrypted more than a hundred ESXi hypervisors, and MGM disclosed roughly $100 million of impact to its Las Vegas and regional operations.REAL
ObservationsObservation NO. 04Credentials from 2020, and 165 tenants with nothing in the wayFrom April 2024, UNC5537 used credentials harvested by commodity infostealer malware to reach more than 100 Snowflake customer tenants, with around 165 organisations ultimately notified. Mandiant found no compromise of Snowflake's own infrastructure: every case was a customer tenant configured without MFA and without network allow-listing.REAL
ObservationsObservation NO. 03A Citrix portal without MFA, and nine days to ransomwareALPHV/BlackCat operators logged into a Change Healthcare Citrix remote access portal on 12 February 2024 using stolen credentials. The portal had no multi-factor authentication. They moved laterally for nine days and deployed ransomware, disrupting roughly a third of US healthcare transactions and ultimately affecting around 190 million people.REAL
ObservationsObservation NO. 02One legacy test account, and the OAuth app that reached productionMidnight Blizzard ran a low-and-slow password spray against a legacy, non-production test tenant in late November 2023 and compromised an account that had no MFA. From there they abused a legacy OAuth application holding elevated permissions into the corporate Exchange Online tenant, and read the mailboxes of senior leadership, legal and the security team itself until detection on 12 January 2024.REAL
ObservationsObservation NO. 01The GeoServer nobody patched, and the EDR alert nobody readThreat actors exploited an unpatched, public-facing GeoServer at a US federal civilian agency eleven days after the CVE was disclosed, then used a second unpatched instance thirteen days later. They held the network for three weeks, deploying the Stowaway proxy, China Chopper web shells and reconnaissance tooling before anyone noticed.REAL

Thursday 3 September

ResearchAnalysisCloud identity and token theft detection pack for Entra ID and OktaFour Sigma rules for the cloud identity attacks that actually land: illicit consent grants, authentication methods added after a risky sign-in, help-desk MFA resets, and session tokens replayed from a second address.Members

Tuesday 1 September

LearnGuided labGuided lab: build a disk image, then take it apartThe first lab for a machine of your own. You create the evidence yourself, delete a file from it, and then recover the file you deleted, which is the only way to be certain the recovery worked.
LearnGuided labGuided lab: read Windows event logs without WindowsEvery other lab here asks for a virtual machine. This one asks for a terminal. Pre-recorded event logs, a cross-platform parser, and the same reasoning, on whatever laptop you already have.
LearnGuided labGuided lab: the mailbox rule that was not the pointA business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.MembersCONSTRUCTED
ResearchAnalysisThe detection that was switched off in MarchIssue one. A control that existed and had been disabled nine weeks earlier, a signup flow that failed silently for anyone behind a VPN, and the retention number that decides whether any of the rest matters.
ResearchAnalysisIncident report: Kesterline Components, 8 May 2026A full DFIR report on a constructed ransomware incident, written the way one gets handed to a board. Three hours twenty from first execution to encryption, four separate points where it could have been stopped, and the write-up that follows.MembersCONSTRUCTED

Monday 31 August

LearnGuided labGuided lab: a service that starts before you doWindows services run as SYSTEM and start before anyone logs in, which makes them the most valuable persistence on the box and the hardest to spot among the two hundred already there. Part three of the persistence series.
LearnGuided labGuided lab: the persistence that leaves almost no logWMI event subscriptions run code on a condition you choose, survive reboots, live nowhere in the filesystem, and log nothing by default. The last of the persistence series, and the one that changes how you think about the other three.Members
LearnGuided labGuided lab: find the Run key before it finds youA first investigation for anyone who has read about persistence but never gone looking for it. You will plant a Run key with Atomic Red Team, then find it three different ways and work out which of the three you would actually trust in production.
LearnGuided labGuided lab: nine hours at Northwind Freight, from lure to scheduled taskA constructed intrusion written as a DFIR report. You get the same artifacts an analyst gets on day one, in the order they arrive, and you build the timeline yourself. The company is fictional; the techniques, event IDs and analytic reasoning are not.MembersCONSTRUCTED
LearnGuided labGuided lab: the scheduled task that looks like WindowsPlant a scheduled task with Atomic Red Team, then find it four ways and work out which one survives an attacker who names their task properly. Closes the loop on the persistence you found on the domain controller in the Northwind case.
ResearchGuideWhat ATT&CK actually is, and how to stop being intimidated by itA beginner's guide to MITRE ATT&CK that does not open with the matrix. What it is, what it is not, why the giant grid is the worst way to meet it, and how to use it on a Tuesday afternoon rather than in a strategy deck.

Sunday 30 August

ResearchAnalysisZimbra, again: unauthenticated command injection over SMTPCVE-2026-73570 needs no credentials and no user interaction. A crafted SMTP request executes commands as the zimbra user. Mail servers accept connections from strangers by definition, which is what makes pre-auth bugs in them a different category of problem.
ResearchAnalysisGitea's diffpatch endpoint plants a Git hook, and the hook does the restCVE-2026-60004 turns repository write access into shell execution as the Gitea service account. The interesting part is not the injection. It is that Git hooks are executable files sitting inside a directory your developers write to all day.
ResearchAnalysisCISA just added four old local privilege escalation bugs to KEV. That is the interesting part.Between 25 and 27 August, KEV gained CVEs from 2015, 2021 and 2022, most of them local and none of them remote entry points. A catalogue of what attackers are actively using is telling you about the second stage, and about how much end-of-life software is still running.Members