Red / Blue team, багбаунти, пентесты - ключевой навык в инфобезе.
Самое время прокачать навык веб-пентеста.
Курс от Яндекс Практикума в Казахстане.
Освоить веб-пентест за 6 месяцев, научиться искать уязвимости и защищать веб-приложения, что может быть проще?)
Что внутри:
• Учат и атаковать, и защищать
• Практика в облаке в формате CTF
• Наставники — практикующие специалисты
• Есть модули по безопасному коду и DevSecOps
Подходит опытным айтишникам и студентам техвузов.
Можно протестировать себя - пройдя бесплатный тест на вход.
🎁 Промокод KZ2025 — скидка 12%. Детали → Здесь.
Партнёрский материал
Самое время прокачать навык веб-пентеста.
Курс от Яндекс Практикума в Казахстане.
Освоить веб-пентест за 6 месяцев, научиться искать уязвимости и защищать веб-приложения, что может быть проще?)
Что внутри:
• Учат и атаковать, и защищать
• Практика в облаке в формате CTF
• Наставники — практикующие специалисты
• Есть модули по безопасному коду и DevSecOps
Подходит опытным айтишникам и студентам техвузов.
Можно протестировать себя - пройдя бесплатный тест на вход.
🎁 Промокод KZ2025 — скидка 12%. Детали → Здесь.
Партнёрский материал
GreyNoise - Observes Exploit Attempts Targeting Zyxel CVE-2023-28771
https://www.greynoise.io/blog/exploit-attempts-targeting-zyxel-cve-2023-28771
https://www.greynoise.io/blog/exploit-attempts-targeting-zyxel-cve-2023-28771
www.greynoise.io
GreyNoise Observes Exploit Attempts Targeting Zyxel CVE-2023-28771
On June 16, GreyNoise observed exploit attempts targeting CVE-2023-28771 — a remote code execution vulnerability affecting Zyxel Internet Key Exchange (IKE) packet decoders over UDP port 500.
Clone, Compile, Compromise: Water Curse’s Open-Source Malware Trap on GitHub
...The malware enables data exfiltration (including credentials, browser data, and session tokens), remote access, and long-term persistence on infected systems ... a supply chain risk, especially to cybersecurity professionals, game developers, and DevOps teams relying on open-source tooling..:
https://www.trendmicro.com/en_us/research/25/f/water-curse.html
...The malware enables data exfiltration (including credentials, browser data, and session tokens), remote access, and long-term persistence on infected systems ... a supply chain risk, especially to cybersecurity professionals, game developers, and DevOps teams relying on open-source tooling..:
https://www.trendmicro.com/en_us/research/25/f/water-curse.html
Trend Micro
Clone, Compile, Compromise: Water Curse’s Open-Source Malware Trap on GitHub
The Trend Micro™ Managed Detection and Response team uncovered a threat campaign orchestrated by an active group, Water Curse. The threat actor exploits GitHub, one of the most trusted platforms for open-source software, as a delivery channel for weaponized…
ConnectUnwise: Threat actors abuse ConnectWise as builder for signed malware
Since March 2025 there has been a noticeable increase in infections and fake applications using validly signed ConnectWise samples. Article reveal how bad signing practices allow threat actors to abuse this legitimate software to build and distribute their own signed malware and what security vendors can do to detect them:
https://www.gdatasoftware.com/blog/2025/06/38218-connectwise-abuse-malware
Since March 2025 there has been a noticeable increase in infections and fake applications using validly signed ConnectWise samples. Article reveal how bad signing practices allow threat actors to abuse this legitimate software to build and distribute their own signed malware and what security vendors can do to detect them:
https://www.gdatasoftware.com/blog/2025/06/38218-connectwise-abuse-malware
Gdatasoftware
Threat Actors abuse signed ConnectWise application as malware builder
Since March 2025, there has been a noticeable increase in infections and fake applications using validly signed ConnectWise samples. We reveal how bad signing practices allow threat actors to abuse this legitimate software to build and distribute their own…
Anatomy of a HexEval Loader
https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages
https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages
Socket
Another Wave: North Korean Contagious Interview Campaign Dro...
North Korean threat actors linked to the Contagious Interview campaign return with 35 new malicious npm packages using a stealthy multi-stage malware ...
Ongoing Campaign Abuses Microsoft 365’s Direct Send to Deliver Phishing Emails
https://www.varonis.com/blog/direct-send-exploit
https://www.varonis.com/blog/direct-send-exploit
Varonis
Ongoing Campaign Abuses Microsoft 365’s Direct Send to Deliver Phishing Emails
Varonis Threat Labs uncovered a phishing campaign with M365's Direct Send feature that spoofs internal users without ever needing to compromise an account.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Local Privilege Escalation via chroot option
An attacker can leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file:
https://www.sudo.ws/security/advisories/chroot_bug/
An attacker can leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file:
https://www.sudo.ws/security/advisories/chroot_bug/
Sudo
Local Privilege Escalation via chroot option
An attacker can leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
Sudo versions affected: Sudo versions 1.9.14 to 1.9.17 inclusive are affected.
CVE ID: This vulnerability has been assigned…
Sudo versions affected: Sudo versions 1.9.14 to 1.9.17 inclusive are affected.
CVE ID: This vulnerability has been assigned…
Forwarded from Yevgeniy Goncharov
📢 Open SysConf’25 зовёт спикеров!
Есть чем поделиться? Пора выйти на сцену.
📍 4 октября 2025 — день, когда на одной сцене снова соберутся те, кто делает, думает и двигает.
А ты - продолжаешь откладывать? Всё ждёшь "подходящего момента"?
Вот он. Это твой шанс выступить и рассказать миру, что ты понял, построил, сломал или переосмыслил за этот год.
Мы ждём твой доклад, если ты хочешь рассказать о:
- технологиях и коде
- инфраструктуре и хаках
- безопасности, мониторинге, Dev(Sec/App)Ops, ML, IaC, sysadmin'стве и тех/хак ресерчах и наработках
- человеческом факторе, ошибках, росте и том, как не сгореть по дороге
Подать заявку просто: 👉 https://sysconf.io/2025
Твои знания могут стать триггером для чьего-то роста.
Ты с нами? Тогда Welcome! ✌️
Есть чем поделиться? Пора выйти на сцену.
📍 4 октября 2025 — день, когда на одной сцене снова соберутся те, кто делает, думает и двигает.
А ты - продолжаешь откладывать? Всё ждёшь "подходящего момента"?
Вот он. Это твой шанс выступить и рассказать миру, что ты понял, построил, сломал или переосмыслил за этот год.
Мы ждём твой доклад, если ты хочешь рассказать о:
- технологиях и коде
- инфраструктуре и хаках
- безопасности, мониторинге, Dev(Sec/App)Ops, ML, IaC, sysadmin'стве и тех/хак ресерчах и наработках
- человеческом факторе, ошибках, росте и том, как не сгореть по дороге
Подать заявку просто: 👉 https://sysconf.io/2025
Твои знания могут стать триггером для чьего-то роста.
Ты с нами? Тогда Welcome! ✌️
Unmasking AsyncRAT: Navigating the labyrinth of forks
https://www.welivesecurity.com/en/eset-research/unmasking-asyncrat-navigating-labyrinth-forks/
https://www.welivesecurity.com/en/eset-research/unmasking-asyncrat-navigating-labyrinth-forks/
Welivesecurity
Unmasking AsyncRAT: Navigating the labyrinth of forks
ESET researchers map out the labyrinthine relationships among the vast hierarchy of AsyncRAT variants.
Rendershock: Weaponizing Trust In File Rendering Pipelines
RenderShock is a comprehensive zero-click attack strategy that targets passive file preview, indexing, and automation behaviours in modern operating systems and enterprise environments.
Unlike traditional phishing or malware campaigns requiring a user’s active participation, RenderShock uses standard system behaviours and trusted automation features to perform malicious actions ranging from reconnaissance and data exfiltration to credential theft and remote code execution. By embedding malicious logic in metadata, preview triggers, and document formats, RenderShock capitalizes on system convenience as an unguarded attack vector..:
https://www.cyfirma.com/research/rendershock-weaponizing-trust-in-file-rendering-pipelines/
RenderShock is a comprehensive zero-click attack strategy that targets passive file preview, indexing, and automation behaviours in modern operating systems and enterprise environments.
Unlike traditional phishing or malware campaigns requiring a user’s active participation, RenderShock uses standard system behaviours and trusted automation features to perform malicious actions ranging from reconnaissance and data exfiltration to credential theft and remote code execution. By embedding malicious logic in metadata, preview triggers, and document formats, RenderShock capitalizes on system convenience as an unguarded attack vector..:
https://www.cyfirma.com/research/rendershock-weaponizing-trust-in-file-rendering-pipelines/
CYFIRMA
RENDERSHOCK: WEAPONIZING TRUST IN FILE RENDERING PIPELINES - CYFIRMA
EXECUTIVE SUMMARY RenderShock is a comprehensive zero-click attack strategy that targets passive file preview, indexing, and automation behaviours in modern...
VMware ESXi, Workstation, Fusion, and Tools Multiple Vulnerabilities
Affected Products
VMware Cloud Foundation
VMware vSphere Foundation
VMware ESXi
VMware Workstation Pro
VMware Fusion
VMware Tools
VMware Telco Cloud Platform
VMware Telco Cloud Infrastructure
https://threatprotect.qualys.com/2025/07/16/vmware-esxi-workstation-fusion-and-tools-multiple-vulnerabilities-cve-2025-41236-cve-2025-41237-cve-2025-41238-cve-2025-41239/
Affected Products
VMware Cloud Foundation
VMware vSphere Foundation
VMware ESXi
VMware Workstation Pro
VMware Fusion
VMware Tools
VMware Telco Cloud Platform
VMware Telco Cloud Infrastructure
https://threatprotect.qualys.com/2025/07/16/vmware-esxi-workstation-fusion-and-tools-multiple-vulnerabilities-cve-2025-41236-cve-2025-41237-cve-2025-41238-cve-2025-41239/
Popular fitness app Fitify exposes 138K user photos
Fitify’s publicly accessible Google cloud storage bucket has exposed hundreds of thousands of files. Some of the files were user-uploaded progress pictures that individuals upload to track their body changes over time...
https://cybernews.com/security/fitify-app-data-leak-user-photos-exposed/
Fitify’s publicly accessible Google cloud storage bucket has exposed hundreds of thousands of files. Some of the files were user-uploaded progress pictures that individuals upload to track their body changes over time...
https://cybernews.com/security/fitify-app-data-leak-user-photos-exposed/
Cybernews
Popular fitness app Fitify exposes 138K user progress photos
Fitify fitness app exposed 138K user progress photos through unsecured Google cloud storage. Some of the photos include barely dressed people.
Coyote in the Wild: First-Ever Malware That Abuses UI Automation
https://www.akamai.com/blog/security-research/active-exploitation-coyote-malware-first-ui-automation-abuse-in-the-wild
https://www.akamai.com/blog/security-research/active-exploitation-coyote-malware-first-ui-automation-abuse-in-the-wild
Akamai
Coyote in the Wild: First-Ever Malware That Abuses UI Automation | Akamai
Learn about the latest Coyote malware variant: The first malware that abuses UI Automation.
🎉 Open SysConf’25 — с Днём системного администратора!
Сегодня благодарность тем, кто держит цифровой мир на плаву:
серверы работают, сети не падают, почта ходит, а баги чинятся ещё до того, как мы их заметим.
Open SysConf’25 — конференция для таких людей: инженеров, девопсов, исследователей, безопасников.
Тех, кто делает ИТ лучше каждый день. 💪
4 октября мы собираемся в Алматы, чтобы снова поговорить о хаках, ресерчах, опыте и… немного о жизни.
А пока — регистрируйся, подавай заявку на доклад, делись своей историей:
👉 https://sysconf.io/2025
#sysconf25 #деньсисадмина #devops #conference #cfp #community #opensysconf #sysadminday
Сегодня благодарность тем, кто держит цифровой мир на плаву:
серверы работают, сети не падают, почта ходит, а баги чинятся ещё до того, как мы их заметим.
Open SysConf’25 — конференция для таких людей: инженеров, девопсов, исследователей, безопасников.
Тех, кто делает ИТ лучше каждый день. 💪
4 октября мы собираемся в Алматы, чтобы снова поговорить о хаках, ресерчах, опыте и… немного о жизни.
А пока — регистрируйся, подавай заявку на доклад, делись своей историей:
👉 https://sysconf.io/2025
#sysconf25 #деньсисадмина #devops #conference #cfp #community #opensysconf #sysadminday
Sploitlight: Analyzing a Spotlight-based macOS TCC vulnerability
https://www.microsoft.com/en-us/security/blog/2025/07/28/sploitlight-analyzing-a-spotlight-based-macos-tcc-vulnerability/
https://www.microsoft.com/en-us/security/blog/2025/07/28/sploitlight-analyzing-a-spotlight-based-macos-tcc-vulnerability/
Microsoft News
Sploitlight: Analyzing a Spotlight-based macOS TCC vulnerability
Microsoft Threat Intelligence has discovered a macOS vulnerability, tracked as CVE-2025-31199, that could allow attackers to steal private data of files normally protected by Transparency, Consent, and Control (TCC), including the ability to extract and leak…
Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools
trojanized PuTTY and WinSCP trgets to users...
https://arcticwolf.com/resources/blog/malvertising-campaign-delivers-oyster-broomstick-backdoor-via-seo-poisoning-trojanized-tools/
trojanized PuTTY and WinSCP trgets to users...
https://arcticwolf.com/resources/blog/malvertising-campaign-delivers-oyster-broomstick-backdoor-via-seo-poisoning-trojanized-tools/
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
PyPi Incident Report: Phishing Attack
- 4 user accounts were successfully phished
- 2 API Tokens were generated by the attackers
- 2 releases of the num2words project were uploaded by the attacker
https://blog.pypi.org/posts/2025-07-31-incident-report-phishing-attack/
- 4 user accounts were successfully phished
- 2 API Tokens were generated by the attackers
- 2 releases of the num2words project were uploaded by the attacker
https://blog.pypi.org/posts/2025-07-31-incident-report-phishing-attack/
blog.pypi.org
PyPI Phishing Attack: Incident Report - The Python Package Index Blog
Follow-up on the recent phishing attack targeting PyPI users.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Arch Infected AUR packages - firefox, zen-browser, chrome
Just ten days after a previous incident, malware with a Remote Access Trojan has once again been discovered in Arch Linux AUR packages.
https://linuxiac.com/arch-aur-under-fire-once-more-as-malware-resurfaces/
Just ten days after a previous incident, malware with a Remote Access Trojan has once again been discovered in Arch Linux AUR packages.
https://linuxiac.com/arch-aur-under-fire-once-more-as-malware-resurfaces/
Linuxiac
Arch AUR Under Fire Once More as Malware Resurfaces
Just ten days after a previous incident, malware with a Remote Access Trojan has once again been discovered in Arch Linux AUR packages.
RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies
https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_shellcode_steganographic
https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_shellcode_steganographic
www.genians.co.kr
RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies
A new RoKRAT variant used by APT37 was found hiding malware in image files via steganography and using two-layer encrypted shellcode to evade analysis.
MCP Horror Stories: The Security Issues Threatening AI Infrastructure
https://www.docker.com/blog/mcp-security-issues-threatening-ai-infrastructure/
https://www.docker.com/blog/mcp-security-issues-threatening-ai-infrastructure/
Docker
MCP Security Issues Threatening AI Infrastructure | Docker
Learn about critical MCP security issues, their real-world horror stories, and how to best mitigate these rising vulnerabilities.