DragonForce ransomware operators leveraged Microsoft Teams to conceal their command and control communications during an attack on a major organization, exploiting a Teams visitor token to evade detection. By disguising malicious activity as legitimate Teams traffic, the attackers were able to obscure their presence from security defenses monitoring network communications.
ESET researchers have identified SprySOCKS for Windows, an upgraded backdoor in FishMonger's toolkit that leverages a kernel driver to achieve enhanced stealth capabilities. The use of kernel-level access represents a significant evolution in the malware's evasion techniques, making detection and removal more challenging for traditional security tools.
Have you ever wondered how you can look at the USN Journal on a live and running system? In this episode, we'll dive in to see how it actually works and whether it matches what we’ve been taught.
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
📖 Chapters
00:00 - Intro
01:04 - Demo
🛠 Resources
NTFS Journal Forensics:
A newly discovered phishing kit called EvilTokens exploits Microsoft's legitimate authentication mechanisms to compromise accounts while bypassing traditional password theft and fake login page detection. The attack manipulates the authentication flow itself, allowing attackers to gain access without needing to intercept credentials or deploy convincing counterfeit login interfaces.
HackTheBox - VariaType
IppSec·5.9K views · 2 months ago
00:00 - Introduction
01:00 - Start of nmap
02:10 - Finding some CVE's in FontTools, but doing more recon on the site before we dive too deep
06:30 - Enumerating the website is flask based upon error message (cookie works too)
09:20 - Trying to create an error message which could leak information about the server like its local path
11:30 - Taking a look at portal.variatype.htb which shows it is PHP
13:50 - Gobuster found a .git, running git-dumper to get the source
15:30 - Finding a File Disclosure in the PHP App because the ../ removal was not recursive
20:30 - Updating the FontTools script to put a reverse shell in, then using it to upload a php reverse shell to the portal
22:00 - Reverse shell returned
22:30 - Looking at the sudoers file, we can't read it but the metadata is a treasure trove of information. Looking at timestamps, doing some filtering getting nothing
26:30 - Using docker to spin up a debian image quickly, looking at the size of the default sudoers file and then comparing it to the box to see it has likely been modified
28:00 - Using find to look for files owned by steve, finding a backup script. It uses FontForge which has a CVE. We can put a malicious archive file and get RCE
37:00 - Shell returned as Steve
39:00 - Looking at the validator python script, first thought with symlinks won't work because we don't own the plugin directory
41:30 - Finding a CVE within SetupTools, using it to write an SSH Key
Three posts? In three days? Are we insane? We're home alone, there's no one to stop us, and we're up past bedtime. So, we need to talk about Splunk. On June 10th, Splunk published this CVE-2026-20253 advisory: It has everything that we
Researchers discovered hundreds of "short-sleeve" RSA and DSA keys with biased bit patterns that could be quickly factored using a novel polynomial-based cryptanalytic technique. The vulnerability, traced to a type mismatch bug in CompleteFTP versions 10.0.0–12.0.0 (RSA) and 10.0.0–23.0.4 (DSA), affected 603 unique RSA keys and 74 DSA keys; EnterpriseDT has released detection and remediation tools for affected users. The research highlights how structural weaknesses in cryptographic implementations can enable practical attacks and underscores the importance of using standard cryptographic libraries rather
It is yet another day in this parallel universe of security, where the devices we bolt onto the edge of our networks to keep the bad people out are, with remarkable consistency, the exact thing that let the bad people in. While we’ve seemingly had a breather from
Today, Ivanti published an advisory. “No way?” we hear you say. "Yes way!" Today’s advisory outlines two vulnerabilities in Ivanti’s Sentry product, appealing directly to our inner desire for sophisticated server-side, pre-authenticated vulnerabilities. CVE-2026-10520 An OS Command Injection
Microsoft and Adobe released record-breaking security updates in June 2026, with Microsoft patching 208 CVEs—the largest monthly release since tracking began in 2017—while Adobe issued 11 bulletins addressing 123 vulnerabilities. Critical priorities include Microsoft's CVSS 9.8 kernel and HTTP.sys remote code execution flaws that are wormable, a CVSS 10 Azure HorizonDB elevation of privilege, and Adobe's CVSS 10 Campaign Classic bugs, along with multiple Secure Boot vulnerabilities that could allow untrusted code execution at boot time.
In our post about Project Glasswing, we made the argument that the architecture around a vulnerability matters more than the speed of the patch. Here we walk through what that architecture looks like, the threats it defends against, and how we run it ourselves as Cloudflare's customer zero.
The Korvath Incident: A macOS Forensics Challenge
13Cubed·1K views · 2 months ago
🔥 Announcing a new challenge for Investigating macOS Endpoints! This comprehensive hands-on macOS forensics scenario accompanies our in-depth training and allows students to put their investigative skills to the test in a realistic case.
Cloudflare has integrated Cloudforce One threat intelligence directly into its WAF, enabling customers to automatically block high-risk traffic based on threat indicators in real time. Security teams can now leverage new cf.intel fields to create rules that target specific threat actors and protect against attacks aimed at their industry vertical.
HackTheBox - Facts
IppSec·10K views · 2 months ago
00:00 - Introduction
00:55 - Start of nmap
02:30 - Discovering it is Camaleon CMS based upon the theme url
04:00 - Looking at the cookie to see it is likely a RAILS App
06:00 - Discovering /admin, enumerating valid usernames by how long a login takes
09:40 - Playing with Mass Assignment spots in the application, failing the first few
13:10 - Exploiting mass assignment from the password reset and setting role to admin
16:30 - Discovering AWS Information in the admin panel, setting upthe AWS CLI to use this endpoint then download a ssh key from S3
21:30 - Cracking SSHNG$6 with John because Hashcat doesn't have this yet
25:15 - Our user can run facter with sudo, looking at the GTFOBin and getting code execution
29:20 - Beyond Root: Exploiting CVE-2024-46987, which is a File Disclosure