Cybersecurity Exploit Techniques

Snowflake, CrowdStrike, and Mandiant (part of Google Cloud) just published a statement on our preliminary findings associated with a threat campaign impacting Snowflake customers.   Threat actors are actively compromising organizations’ Snowflake customer tenants by using stolen credentials obtained by infostealing malware and logging into databases that are configured with single factor authentication.    Any SaaS solution that is configured without multifactor authentication is susceptible to be mass exploited by threat actors. We anticipate threat actors will replicate this campaign across other SaaS solutions that contain sensitive enterprise data.   Here are some of Mandiant’s observations related to infostealers from the past few years: ☣️ Since the beginning of 2020, employees and contractors working from home increasingly use their personal computers to access corporate systems.  ☣️ People often synchronize their web browsers on their work computers and personal computers. ☣️ People (or their children) sometimes inadvertently install software laced with infostealing malware on their personal computers. The malware can capture credentials from their web browsers. ☣️ Threat actors opportunistically search for corporate credentials stolen by infostealing malware and use them to compromise enterprises, steal data, and conduct extortion. 

In a recent interview, I was asked a very simple but powerful question: 👉 “Can you explain what explorer.exe, svchost.exe, and lsass.exe do — and how they might be abused?” At first glance, these sound like basic Windows processes. But the real test is whether you understand both their legitimate roles and how attackers misuse them: 🖥 explorer.exe – The Windows shell (desktop, taskbar, file browser). ⚠️ Abuse: Attackers may run malware through explorer.exe or drop fake versions to masquerade as the real one. ⚙️ svchost.exe – The “Service Host” process that runs Windows services in the background. ⚠️ Abuse: Common target for process injection, or running rogue services to stay hidden. 🔐 lsass.exe – Handles authentication and stores credentials in memory. ⚠️ Abuse: Attackers dump LSASS memory with tools like Mimikatz to steal passwords and move laterally. 💡 Lesson Learned: It’s not enough to know tools and SIEM dashboards — you need to understand what normal looks like and how attackers twist it. That’s the difference between monitoring and detecting. If you’re preparing for SOC roles, build your own cheat sheet of common processes, their normal behaviors, and related MITRE ATT&CK techniques. Trust me, it will make both interviews and investigations much easier. Happy hunting! 🕵️♂️🔍

Let me show you how red teams quietly map your attack surface, without touching your network, in under 30 minutes. We’ve seen this over and over again. And I’m telling you, the most dangerous threats don’t use exploits anymore. They use what you’ve already exposed, unknowingly. Here’s how it works: 01. First 5 minutes? They scrape everything the internet knows about your org: Your domains, subdomains, cloud assets, public repos, mobile apps, SSL certs, employee IDs, GitHub orgs. They use tools like Shodan, FOFA, Censys, Spiderfoot. 02. Next 10 minutes? They hunt for misconfigured assets. Open S3 buckets, exposed Kibana dashboards, Jenkins panels, Prometheus endpoints. You’ll be surprised how many critical services don’t require authentication. And no, your WAF won’t block this. 03. Then 5 minutes just for GitHub. Searching for hardcoded AWS secrets, Slack tokens, VPN creds, SSH keys. They don’t need your main app repo. One forgotten intern-side project with an ENV file leak is enough. 04. Next 5 minutes go into SaaS and shadow IT. They’ll search for Notion pages, Airtable bases, Google Drive folders, public links that hold PII, vendor pricing, old incident logs, internal checklists. No password, no MFA, no revocation. Still indexed by Google. 05. Last 5 minutes? They run people recon. Find 3 employees on LinkedIn, and dig up public email IDs, weak reused passwords from old breaches, social handles, side project domains. Now your entire company’s threat surface includes your people. That’s 30 minutes. No payloads dropped. No alarms raised. But your attack surface is wide open, and you’ve already lost the element of control. I’ve built cybersecurity tools for over 3 decades, from the early days of disassembling file infectors in DOS to watching ChatGPT generate polymorphic malware today. But what hasn’t changed is this. If you don’t look at yourself the way an attacker does, you’re defending a fantasy. Most teams today don’t even know where their real attack surface begins. They’re still focused on endpoints. Seeing this pattern repeatedly is what led us at Seqrite to build our Digital Risk Protection Services (DRPS), focused entirely on what’s visible outside the organisation, including exposed assets and dark web signals. When was the last time you did a zero-touch external scan of your company’s digital footprint? Seqrite #CyberSecurity #AttackSurface #RedTeam #ThreatIntelligence #ExternalExposure #CloudSecurity #SecurityAwareness #CISO #InfoSec #DigitalRisk Quick Heal

Analyzing the leaked code from the Vanhelsing Ransomware, it is essentially a highly modular and automated builder, developed in C++, designed to dynamically generate executable binaries (.exe) based on instructions received from a C2 server. The core logic includes a persistent loop (wmain) that continuously polls for new tasks via REST HTTP requests to an attacker-controlled endpoint. When a task is received, the system automatically compiles two binaries: the locker, responsible for encrypting the victim's files, and the decrypter, which allows for data recovery if the correct key is provided. The main payload is encrypted using AES-256-GCM (via libsodium), with a key derived from an X25519 key pair. The compiled locker binary is read, encrypted, converted into a binary header, and embedded into the loader, which is the final stage responsible for decrypting and executing the locker at runtime. The modular architecture allows the same locker to be reused with multiple loaders. File operations are handled directly through low-level Win32 API calls (CreateFileA, ReadFile, MoveFileA, DeleteFileA), with no dependency on external libraries. PowerShell’s Compress-Archive is also used to efficiently package and transmit artifacts via HTTP. There is a clear separation of responsibilities in the build pipeline: reading, encryption, macro substitution, architecture-specific compilation (Win32/x64), binary renaming, and upload to the C2 are all handled in well-defined stages, with error handling and diagnostics performed via GetLastError(). Summary of Evasion Techniques: - Encryption of artifacts using X25519 + AES-256-GCM - Use of fileless-like execution via loader with embedded payload - Per-build uniqueness through dynamic key and ID insertion - Compilation via MSBuild (LOLBin abuse) #redteam #cybersecurity #malware #malwaredevelopment #malwareanalysis

🔍 Inside a Firewall Vendor’s 5-Year Battle with Chinese Hackers Hijacking Its Devices There’s a lot to unpack here. This article by Wired's Andy Greenberg dives into the relentless, five-year struggle Sophos faced against a network of Chinese hackers targeting its firewalls. It’s a rare and revealing look at how attackers exploited vulnerabilities, pushed the limits of intrusion techniques, and even targeted critical infrastructure—all while Sophos countered with innovative defenses and unprecedented transparency. 1️⃣ Threat actors are increasingly looking to exploit network security devices, ironically using them as entry points to the systems that they’re meant to protect. 2️⃣ In a particularly bold move, one researcher utilized a vulnerability to gain a $20K reward—while also leveraging the same exploit in offensive attacks—a surprising twist that highlights the complex relationship between security researchers and threat actors. 3️⃣ Sophos demonstrated transparency and determination, going so far as to install “implants” on its own devices to monitor the adversaries, offering an unprecedented view into the tactics at play. I love the counter-intelligence angle to this story. 👏 Kudos to Sophos for tackling this head-on and setting an example in the industry on transparency. With an increased focus on network security devices being targeted by threat actors as beachheads into victim networks, it's imperative that organizations employ a #ZeroTrust strategy to limit an adversary’s ability to move laterally within a compromised network. Equally critical is that vendors embrace a #SecureByDesign approach to minimize the risk of their products being exploited. Read more at Wired: https://lnkd.in/e42NWVSN #cybersecurity #technology #softwareengineering #softwaredesign #informationsecurity #riskmanagement #computersecurity

I was recently helping someone with Incident Response where they received a phishing Email from a trusted vendor (who was compromised). The lure asked them to review a PDF file. The link took them to acrobat[.]adobe[.]com where the document then lead them to another link which leveraged storage[.]googleapis[.]com and S3 buckets behind CAPTCHA (to evade automated analysis) to host HTML files impersonating a Google login page. The user authenticated. The threat actor spent a week in their Google account downloading their Google Drive, reading their emails, setting up email rules to hide bounces, forwarding emails to the attacker's email addresses, and deploying malware (session hijacker) via Google Chrome sync. In the end, the threat actor sent a lure to all of the victim's contacts, looking for their next target. What I found interesting was that the attacker: 1. Leveraged trusted sites (Adobe and Cloud Storage) 2. Remained hidden for 1 week+ as they executed their playbooks 3. Never touched the endpoint, except what was synced with Google Chrome Has anyone else investigated an incident like this? What were your findings?

9 tries... That's all it took to break Gemini across all 6 attack stages. New research just dropped, and I'm proud to have had a small part in it. LAAF, the Logic-layer Automated Attack Framework, is the first automated red-teaming framework built for a vulnerability class that had no testing tool: Logic-layer Prompt Control Injection (LPCI). If you think this is about standard prompt injection, it's not. LPCI payloads persist in memory and vector stores. They survive session boundaries. They sit dormant until a trigger fires, a keyword, a tool call, or a turn count. Then they execute in sessions you thought were clean. The team built a 49-technique taxonomy across six attack categories: 1. Encoding 2. Structural manipulation 3. Semantic reframing 4. Layered combinations 5. Trigger timing 6. Exfiltration Combined with variants and lifecycle stages, that's a theoretical space of 2.8 million unique payloads. The core of LAAF is the Persistent Stage Breaker. When a payload breaks through one stage, it seeds the next stage with a mutated version of what worked, which is exactly how a real attacker escalates. We tested against five production LLM platforms. Gemini. Claude. LLaMA3. Mixtral. ChatGPT. Mean aggregate breakthrough rate across three independent runs: 84%. Gemini fell in 9 total attempts. Claude's document-access mode was broken in a single attempt through a compliance reframe. ChatGPT held at some stages and collapsed at others. Wake-up call... These were baseline defenses. Standard system prompts with no custom guardrails, no enterprise security stack, no layered filtering. So you might say to yourself, "Ok, so our protections will cover us." Now, remind yourself of your half-baked agent stack with persistent memory, RAG pipelines, and tool access bolted on with default permissions. The answer is probably worse than 84%. The framework is open source. The taxonomy is published. The winning techniques for each platform and stage are all documented. Huge credit to Hammad Atta - CISA-CISM for leading this research and the full team of co-authors, Ken Huang, Vineeth Sai Narajala, and the rest. 👉 Paper is attached. 👉 Follow and connect for more AI and cybersecurity insights with the occasional rant #AgenticAISecurity #LLMRedTeam #PromptInjection Keren Katz Chris Hughes Kayla Underkoffler Michael Bargury Ben Hanson Ben Kliger John Sotiropoulos Helen Oakley Eva Benn Evgeniy Kokuykin Allie Howe Laz . Idan Habler, PhD Tomer Elias Ariel Fogel Steve Wilson Rob van der Veer Aruneesh Salhotra Behnaz Karimi Dan Sorensen Peter Holcomb Douglas Brush Fred Wilmot Richard Bird Dutch Schwartz Mike May Jared Smith Karen Worstell, MA, MS Sabrina Caplis Ron F. Del Rosario Sandy Dunn Itzik Kotler Ron Bitton, PhD Jason Haddix Philip A. Dursey John V. Zenity

The NSA, together with CISA, FBI, and international partners, issued a major joint cybersecurity advisory exposing how Chinese state-sponsored actors have been compromising critical networks worldwide to fuel a global espionage system. The advisory highlights persistent campaigns targeting telecoms, transport, lodging, defense, and government networks using leveraging vulnerabilities on large backbone routers of major telecommunication providers, as well as provider edge (PE) and customer edge (CE) infrastructure. These operations are attributed to multiple advanced threat clusters, including Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807, and others. The report highlights the TTPs, IOCs, and list of CVEs commonly exploited by this APT group. The recommendations are clear: strengthen threat hunting at the edge, enforce centralized logging and network visibility, and close off known vulnerabilities before they are exploited. 𝗖𝗮𝗹𝗹 𝘁𝗼 𝗮𝗰𝘁𝗶𝗼𝗻 If you're responsible for network security in a critical infrastructure organization, prioritize reviewing the detailed technical guidance provided in this advisory. Implement the recommended mitigations, conduct thorough audits of your network edge devices, and ensure your security teams are equipped to detect the specific TTPs outlined in the report. #Cybersecurity #APT https://skd.so/UXMrof

Al isn't just making defenders more productive. It's making attackers faster, cheaper, and far more adaptive! 🎯 #movingtarget We're moving beyond malware with static code. Today's threats can generate payloads, rewrite commands, adapt to their environment and evade traditional detection in real time using Al. The shift is already happening! In July 2025, Ukraine’s CERT-UA identified LameHug, the first infostealer observed in the wild using an LLM to generate commands dynamically during execution. In 2026, PromptSpy demonstrated the next level: Android malware capable of calling a generative AI model during execution to analyze its environment, generate actions on the fly, and adapt its behavior in real time. AI-driven morphing malware is emerging as a significant threat. Instead of relying on static code, it continuously rewrites itself, making signature-based detection increasingly ineffective. The mistake is believing this is an antivirus problem. It isn't! The organizations that will stay ahead won't focus on what malware looks like. They'll focus on what it does! That means: ☑️Behavioral and identity-centric detection over signatures. ☑️Visibility into runtime activity, not just files on disk ☑️Resilience built on Zero Trust, strong identity controls, and rapid detection and response. Al has fundamentally lowered the cost of sophisticated attacks. Defenders must raise the bar for success. #CyberSecurity #AI #ThreatIntelligence #ZeroTrust

How are AI-driven malware variants evading traditional detection methods AI-driven malware variants are evading traditional detection methods through several sophisticated techniques: 1. Polymorphism and Mutation: These malware strains use AI to constantly change aspects of their code, file structure, and behavior—sometimes every few seconds—making it extremely difficult for signature-based antivirus programs to identify them. Polymorphic malware, which mutates its hash and code structure automatically, is now present in more than 70% of major breaches and over 76% of phishing attacks. AI allows these mutations to happen rapidly and unpredictably, outpacing static detection engines. 2. Adversarial Examples: Attackers create subtle modifications in malware and use adversarial machine learning tactics to fool detection models. By tuning payloads with adversarial examples, they cause classifiers to misidentify malicious files as benign. Memetic algorithms and generative adversarial networks (GANs) are now being used to optimize these evasion tactics, achieving success rates of up to 98% against advanced AI detectors like MalConv, and notable evasion rates even against leading commercial antivirus products. 3. Prompt Injection and AI Model Manipulation: Some advanced malware now embeds natural-language prompts into their code, attempting to "trick" AI-driven security tools into misclassifying them as harmless. This is a relatively new evasion method: instead of altering code structure alone, attackers manipulate the logic and instructions of large language models used for malware analysis. The goal is for the AI to falsely declare “NO MALWARE DETECTED.” Such attacks exploit the contextual vulnerabilities of modern AI models, especially as these models become more central to automated threat detection. 4. Real-Time Learning from Failed Attempts: New AI-powered strains can learn from failed attacks or detections, tweaking future attack vectors for better success. This self-improving loop allows malware to incrementally bypass increasingly complex defensive measures. Traditional signature-based antivirus, static heuristics, and even some behavioral analysis tools are being outpaced by these adaptive, AI-driven threats. The future of defense will likely depend on deploying similarly advanced AI models that can keep up with these evolving tactics and spot anomalies that legacy tools miss. #malware #advesary #detection