~Spiderlabs~
BlackApex and related kits bypass MFA via Microsoft device codes, stealing tokens and PRTs.
-
IOCs: 95[.]133[.]228[.]253:5000, securemsexcel[.]online, login[.]murfin-drilling[.]com
-
#MFA #Phishing #ThreatIntel
BlackApex and related kits bypass MFA via Microsoft device codes, stealing tokens and PRTs.
-
IOCs: 95[.]133[.]228[.]253:5000, securemsexcel[.]online, login[.]murfin-drilling[.]com
-
#MFA #Phishing #ThreatIntel
AI-Coded Device-Code Phishing Kits
www.levelblue.com
November 2, 2026 at 4:21 AM
~Spiderlabs~
BlackApex and related kits bypass MFA via Microsoft device codes, stealing tokens and PRTs.
-
IOCs: 95[.]133[.]228[.]253:5000, securemsexcel[.]online, login[.]murfin-drilling[.]com
-
#MFA #Phishing #ThreatIntel
BlackApex and related kits bypass MFA via Microsoft device codes, stealing tokens and PRTs.
-
IOCs: 95[.]133[.]228[.]253:5000, securemsexcel[.]online, login[.]murfin-drilling[.]com
-
#MFA #Phishing #ThreatIntel
~Spiderlabs~
Q3 attackers increasingly abused trusted access to steal data, with exfiltration in 83% of intrusions.
-
IOCs: CVE-2026-72898, CVE-2026-0257
-
#CVE-2026-72898 #DataExfiltration #ThreatIntel
Q3 attackers increasingly abused trusted access to steal data, with exfiltration in 83% of intrusions.
-
IOCs: CVE-2026-72898, CVE-2026-0257
-
#CVE-2026-72898 #DataExfiltration #ThreatIntel
Trusted Access Fuels Data Theft
www.levelblue.com
October 28, 2026 at 4:10 PM
~Spiderlabs~
Q3 attackers increasingly abused trusted access to steal data, with exfiltration in 83% of intrusions.
-
IOCs: CVE-2026-72898, CVE-2026-0257
-
#CVE-2026-72898 #DataExfiltration #ThreatIntel
Q3 attackers increasingly abused trusted access to steal data, with exfiltration in 83% of intrusions.
-
IOCs: CVE-2026-72898, CVE-2026-0257
-
#CVE-2026-72898 #DataExfiltration #ThreatIntel
~Spiderlabs~
AI coding tools and agents introduce vulnerabilities, misconfigurations, and malicious dependencies across software supply chains.
-
IOCs: PromptMink, Famous Chollima, APT37
-
#AI #SupplyChain #ThreatIntel
AI coding tools and agents introduce vulnerabilities, misconfigurations, and malicious dependencies across software supply chains.
-
IOCs: PromptMink, Famous Chollima, APT37
-
#AI #SupplyChain #ThreatIntel
AI SDLC Supply Chain Risks
www.levelblue.com
October 22, 2026 at 4:05 PM
~Spiderlabs~
AI coding tools and agents introduce vulnerabilities, misconfigurations, and malicious dependencies across software supply chains.
-
IOCs: PromptMink, Famous Chollima, APT37
-
#AI #SupplyChain #ThreatIntel
AI coding tools and agents introduce vulnerabilities, misconfigurations, and malicious dependencies across software supply chains.
-
IOCs: PromptMink, Famous Chollima, APT37
-
#AI #SupplyChain #ThreatIntel
~Spiderlabs~
Two PHP flaws enable unauthenticated RCE across most web servers; patch immediately.
-
IOCs: CVE-2026-109618, CVE-2026-109619
-
#PHP #RCE #ThreatIntel
Two PHP flaws enable unauthenticated RCE across most web servers; patch immediately.
-
IOCs: CVE-2026-109618, CVE-2026-109619
-
#PHP #RCE #ThreatIntel
PHP2Shell RCE
www.levelblue.com
October 22, 2026 at 12:34 PM
~Spiderlabs~
Two PHP flaws enable unauthenticated RCE across most web servers; patch immediately.
-
IOCs: CVE-2026-109618, CVE-2026-109619
-
#PHP #RCE #ThreatIntel
Two PHP flaws enable unauthenticated RCE across most web servers; patch immediately.
-
IOCs: CVE-2026-109618, CVE-2026-109619
-
#PHP #RCE #ThreatIntel
LevelBlue SpiderLabs traced Wazza phishing campaigns active since at least July 2026. The kit uses PDF lures, layered redirects, browser checks and Microsoft device code authentication to seek access to Microsoft 365 accounts.
Inside Wazza: Device Code Phishing Kit Targets Microsoft 365 Accounts
LevelBlue SpiderLabs traced Wazza phishing campaigns active since at least July 2026. The kit uses PDF lures, layered redirects, browser checks and Microsoft…
cyber.hendryadrian.com
October 21, 2026 at 8:12 AM
LevelBlue SpiderLabs traced Wazza phishing campaigns active since at least July 2026. The kit uses PDF lures, layered redirects, browser checks and Microsoft device code authentication to seek access to Microsoft 365 accounts.
~Spiderlabs~
Wazza uses PDF lures and OAuth device codes to hijack Microsoft 365 access.
-
IOCs: hutspotmaken[.]eu, beacon-surge-sync[.]workers[.]dev, unhf69e-e0ppo-l0qoo-a12bcfj-ig1sa4v[.]wndws-pip3ln-sql3-waf3-purv3-gdprsx-dfn-azfn-appsvc-0ffapx[.]workers[.]dev
-
...
Wazza uses PDF lures and OAuth device codes to hijack Microsoft 365 access.
-
IOCs: hutspotmaken[.]eu, beacon-surge-sync[.]workers[.]dev, unhf69e-e0ppo-l0qoo-a12bcfj-ig1sa4v[.]wndws-pip3ln-sql3-waf3-purv3-gdprsx-dfn-azfn-appsvc-0ffapx[.]workers[.]dev
-
...
Wazza M365 Device-Code Phishing
www.levelblue.com
October 20, 2026 at 4:19 PM
~Spiderlabs~
Wazza uses PDF lures and OAuth device codes to hijack Microsoft 365 access.
-
IOCs: hutspotmaken[.]eu, beacon-surge-sync[.]workers[.]dev, unhf69e-e0ppo-l0qoo-a12bcfj-ig1sa4v[.]wndws-pip3ln-sql3-waf3-purv3-gdprsx-dfn-azfn-appsvc-0ffapx[.]workers[.]dev
-
...
Wazza uses PDF lures and OAuth device codes to hijack Microsoft 365 access.
-
IOCs: hutspotmaken[.]eu, beacon-surge-sync[.]workers[.]dev, unhf69e-e0ppo-l0qoo-a12bcfj-ig1sa4v[.]wndws-pip3ln-sql3-waf3-purv3-gdprsx-dfn-azfn-appsvc-0ffapx[.]workers[.]dev
-
...
Wazza Phishing Campaign Exploits Microsoft Device Code Authentication to Hijack Microsoft 365 Accounts + Video
Introduction: A Sophisticated Phishing Operation Targets Microsoft 365 Users Cybercriminals are increasingly adopting phishing techniques that go beyond traditional fake login pages,…
Introduction: A Sophisticated Phishing Operation Targets Microsoft 365 Users Cybercriminals are increasingly adopting phishing techniques that go beyond traditional fake login pages,…
Wazza Phishing Campaign Exploits Microsoft Device Code Authentication to Hijack Microsoft 365 Accounts + Video
Introduction: A Sophisticated Phishing Operation Targets Microsoft 365 Users Cybercriminals are increasingly adopting phishing techniques that go beyond traditional fake login pages, combining deceptive documents, multi-stage redirects, browser fingerprinting, and legitimate authentication mechanisms to compromise business accounts. The Wazza phishing campaign, tracked by LevelBlue SpiderLabs, demonstrates how attackers can exploit trusted Microsoft authentication workflows to pursue unauthorized access to Microsoft 365 accounts.
undercodenews.com
October 21, 2026 at 8:51 AM
Wazza Phishing Campaign Exploits Microsoft Device Code Authentication to Hijack Microsoft 365 Accounts + Video
Introduction: A Sophisticated Phishing Operation Targets Microsoft 365 Users Cybercriminals are increasingly adopting phishing techniques that go beyond traditional fake login pages,…
Introduction: A Sophisticated Phishing Operation Targets Microsoft 365 Users Cybercriminals are increasingly adopting phishing techniques that go beyond traditional fake login pages,…
🚀 Spider Labs: 75.0% of Bot-Classified Ad Clicks Lacked Basic Browser Automation Signs
🔎 Read the full update:
➡️https://theminingnews.com/spider-labs-75-0-of-bot-classified-ad-clicks-lacked-basic-browser-automation/
#SpiderLab#SpiderLabst#BotDetections#BotClicksu#ClickFraudD#AdTechd#DigitalAdvertis
🔎 Read the full update:
➡️https://theminingnews.com/spider-labs-75-0-of-bot-classified-ad-clicks-lacked-basic-browser-automation/
#SpiderLab#SpiderLabst#BotDetections#BotClicksu#ClickFraudD#AdTechd#DigitalAdvertis
October 15, 2026 at 6:06 AM
🚀 Spider Labs: 75.0% of Bot-Classified Ad Clicks Lacked Basic Browser Automation Signs
🔎 Read the full update:
➡️https://theminingnews.com/spider-labs-75-0-of-bot-classified-ad-clicks-lacked-basic-browser-automation/
#SpiderLab#SpiderLabst#BotDetections#BotClicksu#ClickFraudD#AdTechd#DigitalAdvertis
🔎 Read the full update:
➡️https://theminingnews.com/spider-labs-75-0-of-bot-classified-ad-clicks-lacked-basic-browser-automation/
#SpiderLab#SpiderLabst#BotDetections#BotClicksu#ClickFraudD#AdTechd#DigitalAdvertis
~Spiderlabs~
ClickFix uses PhantomPolia, PowerShell and Donut-packed AutoIt shellcode to deliver Remus Stealer.
-
IOCs: cloudcheckic[.]com, spogear[.]click, voderlence[.]com
-
#ClickFix #Malware #ThreatIntel
ClickFix uses PhantomPolia, PowerShell and Donut-packed AutoIt shellcode to deliver Remus Stealer.
-
IOCs: cloudcheckic[.]com, spogear[.]click, voderlence[.]com
-
#ClickFix #Malware #ThreatIntel
PhantomPolia Delivers Remus Stealer
www.levelblue.com
October 7, 2026 at 4:17 PM
~Spiderlabs~
ClickFix uses PhantomPolia, PowerShell and Donut-packed AutoIt shellcode to deliver Remus Stealer.
-
IOCs: cloudcheckic[.]com, spogear[.]click, voderlence[.]com
-
#ClickFix #Malware #ThreatIntel
ClickFix uses PhantomPolia, PowerShell and Donut-packed AutoIt shellcode to deliver Remus Stealer.
-
IOCs: cloudcheckic[.]com, spogear[.]click, voderlence[.]com
-
#ClickFix #Malware #ThreatIntel
Filling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands #malware
Filling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands
Groups
Conversations
All groups and messages
Sign in
Filling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands
0 views
Eyal Estrin
unread,
10:28 PM (26 minutes ago)
to
https://www.levelblue.com/blogs/spiderlabs-blog/filling-the-well-nightmare-eclipses-bigdiskbuster-and-the-defender-update-that-never-lands
Eyal Estrin
Author | Cloud Architect | AWS • Azure • GCP Insights
Social: @eyalestrin
Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com
Reply all
Reply to author
Forward
dlvr.it
October 7, 2026 at 4:54 AM
Filling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands #malware
~Spiderlabs~
BigDiskBuster exhausts disk space to silently prevent Defender updates.
-
IOCs: BigDiskBuster[.]exe, MSNightmare, 0x80070643
-
#Malware #MicrosoftDefender #ThreatIntel
BigDiskBuster exhausts disk space to silently prevent Defender updates.
-
IOCs: BigDiskBuster[.]exe, MSNightmare, 0x80070643
-
#Malware #MicrosoftDefender #ThreatIntel
BigDiskBuster Blocks Defender Updates
www.levelblue.com
October 5, 2026 at 4:18 PM
~Spiderlabs~
BigDiskBuster exhausts disk space to silently prevent Defender updates.
-
IOCs: BigDiskBuster[.]exe, MSNightmare, 0x80070643
-
#Malware #MicrosoftDefender #ThreatIntel
BigDiskBuster exhausts disk space to silently prevent Defender updates.
-
IOCs: BigDiskBuster[.]exe, MSNightmare, 0x80070643
-
#Malware #MicrosoftDefender #ThreatIntel
~Spiderlabs~
Toolkit probes WordPress, decrypts SMTP credentials, scans JavaScript secrets, and exfiltrates data.
-
IOCs: 31[.]56[.]58[.]59, 193[.]32[.]162[.]134, 195[.]178[.]110[.]209
-
#CredentialTheft #ThreatIntel #WordPress
Toolkit probes WordPress, decrypts SMTP credentials, scans JavaScript secrets, and exfiltrates data.
-
IOCs: 31[.]56[.]58[.]59, 193[.]32[.]162[.]134, 195[.]178[.]110[.]209
-
#CredentialTheft #ThreatIntel #WordPress
TIKTOUK WordPress Credential Toolkit
www.levelblue.com
October 1, 2026 at 4:20 PM
~Spiderlabs~
Toolkit probes WordPress, decrypts SMTP credentials, scans JavaScript secrets, and exfiltrates data.
-
IOCs: 31[.]56[.]58[.]59, 193[.]32[.]162[.]134, 195[.]178[.]110[.]209
-
#CredentialTheft #ThreatIntel #WordPress
Toolkit probes WordPress, decrypts SMTP credentials, scans JavaScript secrets, and exfiltrates data.
-
IOCs: 31[.]56[.]58[.]59, 193[.]32[.]162[.]134, 195[.]178[.]110[.]209
-
#CredentialTheft #ThreatIntel #WordPress
~Spiderlabs~
Exploitation progressed from command injection to payloads, reverse shells, config theft, privileged access, and web shells.
-
IOCs: 64[.]94[.]85[.]67, 45[.]141[.]21[.]130, 23[.]27[.]143[.]20
-
#CVE-2026-88771 #NetScaler #ThreatIntel
Exploitation progressed from command injection to payloads, reverse shells, config theft, privileged access, and web shells.
-
IOCs: 64[.]94[.]85[.]67, 45[.]141[.]21[.]130, 23[.]27[.]143[.]20
-
#CVE-2026-88771 #NetScaler #ThreatIntel
Citrix NetScaler CVE-2026-88771 Exploitation
www.levelblue.com
October 1, 2026 at 4:22 PM
~Spiderlabs~
Exploitation progressed from command injection to payloads, reverse shells, config theft, privileged access, and web shells.
-
IOCs: 64[.]94[.]85[.]67, 45[.]141[.]21[.]130, 23[.]27[.]143[.]20
-
#CVE-2026-88771 #NetScaler #ThreatIntel
Exploitation progressed from command injection to payloads, reverse shells, config theft, privileged access, and web shells.
-
IOCs: 64[.]94[.]85[.]67, 45[.]141[.]21[.]130, 23[.]27[.]143[.]20
-
#CVE-2026-88771 #NetScaler #ThreatIntel
~Spiderlabs~
Critical NetScaler flaws enable unauthenticated RCE and are actively exploited worldwide.
-
IOCs: CVE-2026-88771, CVE-2026-88772
-
#CVE202688771 #CVE202688772 #ThreatIntel
Critical NetScaler flaws enable unauthenticated RCE and are actively exploited worldwide.
-
IOCs: CVE-2026-88771, CVE-2026-88772
-
#CVE202688771 #CVE202688772 #ThreatIntel
Citrix NetScaler Zero-Days Exploited Globally
www.levelblue.com
September 29, 2026 at 8:15 PM
~Spiderlabs~
Critical NetScaler flaws enable unauthenticated RCE and are actively exploited worldwide.
-
IOCs: CVE-2026-88771, CVE-2026-88772
-
#CVE202688771 #CVE202688772 #ThreatIntel
Critical NetScaler flaws enable unauthenticated RCE and are actively exploited worldwide.
-
IOCs: CVE-2026-88771, CVE-2026-88772
-
#CVE202688771 #CVE202688772 #ThreatIntel
~Spiderlabs~
File retrieval via Graph or scripts may log as FileAccessed, not FileDownloaded.
-
IOCs: ShinyHunters, PEAR, HELIX
-
#DFIR #M365 #ThreatIntel
File retrieval via Graph or scripts may log as FileAccessed, not FileDownloaded.
-
IOCs: ShinyHunters, PEAR, HELIX
-
#DFIR #M365 #ThreatIntel
M365 File Acquisition Hidden as FileAccessed
www.levelblue.com
September 24, 2026 at 4:28 PM
~Spiderlabs~
File retrieval via Graph or scripts may log as FileAccessed, not FileDownloaded.
-
IOCs: ShinyHunters, PEAR, HELIX
-
#DFIR #M365 #ThreatIntel
File retrieval via Graph or scripts may log as FileAccessed, not FileDownloaded.
-
IOCs: ShinyHunters, PEAR, HELIX
-
#DFIR #M365 #ThreatIntel
~Spiderlabs~
Public SSPR portal exposes valid users, MFA methods, and likely admins.
-
IOCs: passwordreset[.]microsoftonline[.]com, github[.]com/mlcsec/ResetSpy
-
#MFA #SSPR #ThreatIntel
Public SSPR portal exposes valid users, MFA methods, and likely admins.
-
IOCs: passwordreset[.]microsoftonline[.]com, github[.]com/mlcsec/ResetSpy
-
#MFA #SSPR #ThreatIntel
Microsoft SSPR Enumeration
www.levelblue.com
September 23, 2026 at 8:03 PM
~Spiderlabs~
Public SSPR portal exposes valid users, MFA methods, and likely admins.
-
IOCs: passwordreset[.]microsoftonline[.]com, github[.]com/mlcsec/ResetSpy
-
#MFA #SSPR #ThreatIntel
Public SSPR portal exposes valid users, MFA methods, and likely admins.
-
IOCs: passwordreset[.]microsoftonline[.]com, github[.]com/mlcsec/ResetSpy
-
#MFA #SSPR #ThreatIntel
~Spiderlabs~
Nightmare-Eclipse’s ShieldCrash abuses Defender object-manager symlinks despite patches; current PoC is incomplete but may evolve.
-
IOCs: CVE-2026-69414
-
#CVE202669414 #ThreatIntel #Windows
Nightmare-Eclipse’s ShieldCrash abuses Defender object-manager symlinks despite patches; current PoC is incomplete but may evolve.
-
IOCs: CVE-2026-69414
-
#CVE202669414 #ThreatIntel #Windows
ShieldCrash Defender Bypass
www.levelblue.com
September 16, 2026 at 4:05 PM
~Spiderlabs~
Nightmare-Eclipse’s ShieldCrash abuses Defender object-manager symlinks despite patches; current PoC is incomplete but may evolve.
-
IOCs: CVE-2026-69414
-
#CVE202669414 #ThreatIntel #Windows
Nightmare-Eclipse’s ShieldCrash abuses Defender object-manager symlinks despite patches; current PoC is incomplete but may evolve.
-
IOCs: CVE-2026-69414
-
#CVE202669414 #ThreatIntel #Windows
~Spiderlabs~
PoCs abuse security products to steal hashes, bypass UAC, evade detection, and gain SYSTEM access.
-
IOCs: \Device\NamedPipe\PRETTYPRAGUE, \Device\NamedPipe\FALCONFLANK, \\[.]\aswSnx
-
#ThreatActor #ThreatIntel #Windows
PoCs abuse security products to steal hashes, bypass UAC, evade detection, and gain SYSTEM access.
-
IOCs: \Device\NamedPipe\PRETTYPRAGUE, \Device\NamedPipe\FALCONFLANK, \\[.]\aswSnx
-
#ThreatActor #ThreatIntel #Windows
Nightmare-Eclipse PoCs
www.levelblue.com
September 9, 2026 at 4:12 PM
~Spiderlabs~
PoCs abuse security products to steal hashes, bypass UAC, evade detection, and gain SYSTEM access.
-
IOCs: \Device\NamedPipe\PRETTYPRAGUE, \Device\NamedPipe\FALCONFLANK, \\[.]\aswSnx
-
#ThreatActor #ThreatIntel #Windows
PoCs abuse security products to steal hashes, bypass UAC, evade detection, and gain SYSTEM access.
-
IOCs: \Device\NamedPipe\PRETTYPRAGUE, \Device\NamedPipe\FALCONFLANK, \\[.]\aswSnx
-
#ThreatActor #ThreatIntel #Windows
~Spiderlabs~
GitHub staging linked to phishing, RATs, crypters, and DuckDNS C2.
-
IOCs: dccomicrat81[.]duckdns[.]org, creainovada[.]xyz, simpmit[.]co
-
#BlindEagle #Malware #ThreatIntel
GitHub staging linked to phishing, RATs, crypters, and DuckDNS C2.
-
IOCs: dccomicrat81[.]duckdns[.]org, creainovada[.]xyz, simpmit[.]co
-
#BlindEagle #Malware #ThreatIntel
Blind Eagle GitHub Loader
www.levelblue.com
August 29, 2026 at 1:16 PM
~Spiderlabs~
GitHub staging linked to phishing, RATs, crypters, and DuckDNS C2.
-
IOCs: dccomicrat81[.]duckdns[.]org, creainovada[.]xyz, simpmit[.]co
-
#BlindEagle #Malware #ThreatIntel
GitHub staging linked to phishing, RATs, crypters, and DuckDNS C2.
-
IOCs: dccomicrat81[.]duckdns[.]org, creainovada[.]xyz, simpmit[.]co
-
#BlindEagle #Malware #ThreatIntel
~Spiderlabs~
A UK generator was offline for days after a cyber incident; attack path and Iran-linked attribution remain unconfirmed.
-
IOCs: (None identified)
-
#EnergySecurity #OT #ThreatIntel
A UK generator was offline for days after a cyber incident; attack path and Iran-linked attribution remain unconfirmed.
-
IOCs: (None identified)
-
#EnergySecurity #OT #ThreatIntel
UK Energy OT Disruption
www.levelblue.com
August 29, 2026 at 1:12 PM
~Spiderlabs~
A UK generator was offline for days after a cyber incident; attack path and Iran-linked attribution remain unconfirmed.
-
IOCs: (None identified)
-
#EnergySecurity #OT #ThreatIntel
A UK generator was offline for days after a cyber incident; attack path and Iran-linked attribution remain unconfirmed.
-
IOCs: (None identified)
-
#EnergySecurity #OT #ThreatIntel
~Spiderlabs~
PoC abuses Cloud Files, Object Manager, and Defender APIs to achieve SYSTEM via phoneinfo.dll hijacking.
-
IOCs: C:\Windows\System32\phoneinfo[.]dll, \pipe\SHIELDBREAK, ShieldBreak[.]exe
-
#LPE #ThreatIntel #WindowsDefender
PoC abuses Cloud Files, Object Manager, and Defender APIs to achieve SYSTEM via phoneinfo.dll hijacking.
-
IOCs: C:\Windows\System32\phoneinfo[.]dll, \pipe\SHIELDBREAK, ShieldBreak[.]exe
-
#LPE #ThreatIntel #WindowsDefender
ShieldBreak Windows Defender LPE PoC
www.levelblue.com
August 19, 2026 at 4:13 PM
~Spiderlabs~
PoC abuses Cloud Files, Object Manager, and Defender APIs to achieve SYSTEM via phoneinfo.dll hijacking.
-
IOCs: C:\Windows\System32\phoneinfo[.]dll, \pipe\SHIELDBREAK, ShieldBreak[.]exe
-
#LPE #ThreatIntel #WindowsDefender
PoC abuses Cloud Files, Object Manager, and Defender APIs to achieve SYSTEM via phoneinfo.dll hijacking.
-
IOCs: C:\Windows\System32\phoneinfo[.]dll, \pipe\SHIELDBREAK, ShieldBreak[.]exe
-
#LPE #ThreatIntel #WindowsDefender
~Spiderlabs~
RAVEN is an offensive security framework for Elasticsearch/Kibana featuring destructive capabilities like index deletion, mapping corruption, and DoS modes, gated by triple-confirmation safety controls.
-
IOCs: (None identified)
-
...
RAVEN is an offensive security framework for Elasticsearch/Kibana featuring destructive capabilities like index deletion, mapping corruption, and DoS modes, gated by triple-confirmation safety controls.
-
IOCs: (None identified)
-
...
Release the RAVEN: Destruction and Discipline
www.levelblue.com
August 18, 2026 at 8:23 PM
~Spiderlabs~
RAVEN is an offensive security framework for Elasticsearch/Kibana featuring destructive capabilities like index deletion, mapping corruption, and DoS modes, gated by triple-confirmation safety controls.
-
IOCs: (None identified)
-
...
RAVEN is an offensive security framework for Elasticsearch/Kibana featuring destructive capabilities like index deletion, mapping corruption, and DoS modes, gated by triple-confirmation safety controls.
-
IOCs: (None identified)
-
...
"Trustwave SpiderLabs said it recently observed an EncryptHub [Russia] campaign that brings together social engineering and the exploitation of a vulnerability in the Microsoft Management Console (MMC) framework (CVE-2025-26633, aka MSC EvilTwin)" patched thehackernews.com/2025/08/russ... #cybersec
Russian Group EncryptHub Exploits MSC EvilTwin Vulnerability to Deploy Fickle Stealer Malware
EncryptHub exploits CVE-2025-26633 with social engineering and rogue MSC files, delivering Fickle Stealer malware.
thehackernews.com
August 16, 2025 at 4:16 PM
"Trustwave SpiderLabs said it recently observed an EncryptHub [Russia] campaign that brings together social engineering and the exploitation of a vulnerability in the Microsoft Management Console (MMC) framework (CVE-2025-26633, aka MSC EvilTwin)" patched thehackernews.com/2025/08/russ... #cybersec
Eternidade Stealer Trojan Fuels Aggressive Brazil Cybercrime - Infosecurity Magazine ://www.infosecurity-magazine.com/news/eternidade-stealer-trojan-brazil/
Eternidade Stealer Trojan Fuels Aggressive Brazil Cybercrime
Trustwave SpiderLabs has observed new banking Trojan Eternidade Stealer targeting Brazil using WhatsApp for propagation and data theft
www.infosecurity-magazine.com
November 20, 2025 at 4:20 AM
Eternidade Stealer Trojan Fuels Aggressive Brazil Cybercrime - Infosecurity Magazine ://www.infosecurity-magazine.com/news/eternidade-stealer-trojan-brazil/