ADMIN.FOUNDATION

  • Pentagon preps for end-of-year, zero trust blitz

    ·

    With two years until its 2027 zero trust deadline, the Pentagon is revving up its cybersecurity efforts, with plans for a new strategy, detailed guidance, and the review of dozens of “granular” action plans for defense organizations. 

    “We're 24 months away from our deadline of the end of fiscal ‘27 to hit target level ZT,” which is a baseline ability to secure the Defense Department’s data, applications, assets, and services, Randy Resnick, who leads the Pentagon’s zero trust efforts, said Wednesday at the Billington Cybersecurity Summit. 

    Zero trust is a cybersecurity concept that assumes hackers are already inside networks, so the focus is on continuously verifying all users and devices that connect to the network. 

    The Pentagon formally created the zero trust portfolio management office in July to lead implementation and define the mission, roles, and authorities to update the Defense Department’s cybersecurity infrastructure to defend against modern threats. That office, which Resnick leads, is reviewing “granular information from the components on exactly what their plan is,” including details like what they’re going to buy, at what level, how it will be installed, and expected number of users. Annual plans are expected by November. 

    “We’re fully expecting [components’ plans] to be poised, because it's now first quarter fiscal ‘26. We’ve been saying to the components: time to buy,” Resnick said. “They’re going to need every bit of those 24 months, or whatever the number of months is remaining, to move into a target level environment,” which includes waiting on supply chains to deliver, building infrastructure, developing policy, and migrating users and data. 

    [[Related Posts]]

    The Pentagon expects to release new cybersecurity guidance for operational technology, such as industrial control systems, as well as a new zero-trust strategy document, both by January.  

    “We'll come out with a new zero trust strategy. We're calling it version 2.0. That'll be essentially a global update, because it's been many years since ‘22. We've learned a lot for zero trust for IT, we’ll include zero trust for OT and just bring everything modernized and up to date and make it more more focused,” Resnick said.

    “We're in a good place. We're focused almost entirely on the implementation, the procurement of zero trust for IT, and you're going to see communications coming out of the DOD in the near future that is going to cement that message.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Top 10 Best Cloud Penetration Testing Companies in 2025

    ·

    , ,

    Cloud is the foundation of modern business, but it comes with a complex and evolving security landscape. Traditional penetration testing, which focuses on on-premise networks and applications, is not sufficient to secure these dynamic environments. Cloud penetration testing requires specialized expertise to identify and exploit vulnerabilities unique to cloud-native architectures, including misconfigurations, insecure identity and […]

    The post Top 10 Best Cloud Penetration Testing Companies in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Top 10 Best Penetration Testing as a Service (PTaaS) Companies in 2025

    ·

    , ,

    Penetration Testing as a Service (PTaaS) is a modern approach to offensive security that combines the best of human-led penetration testing with the efficiency of an automated platform. Unlike traditional, project-based penetration tests, a PTaaS model provides continuous, on-demand testing, real-time collaboration, and a centralized dashboard for managing findings. In 2025, this agile approach is […]

    The post Top 10 Best Penetration Testing as a Service (PTaaS) Companies in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Business speed, lasting security: Conversation with Amazon’s Senior Software Development Engineer Naman Jain

    ·

    ,

    To ensure the security of sensitive internet data, it takes more than encryption; it requires clear principles, careful design, and evidential support.

    Naman Jain is a Senior Software Development Engineer and a leading practitioner in secure systems for fintech and digital payments.

    At Amazon, he has led the architecture of an enterprise tokenization and sensitive data platform, driven large scale migration from decades old legacy systems to modern cloud native infrastructure while safeguarding high-value transactions and sensitive data for millions of users, and co-invented a pending tokenization approach that reduces cost while improving resilience.

    During this interview, he explains why tokenization has become an integral part of infrastructure, how Zero Trust changes our day-to-day architectures, and what it takes to run secure platforms at web scale.

    He also shares what keeps him motivated and how the next five years will reshape data protection.

    In addition, he discusses how the next five years will change the face of data protection, as well as the motivation that keeps him moving forward in his foundational work that end-users rarely see but always rely on.

    The concept of secure tokenization is gaining traction across industries. From your experience working on large-scale tokenization systems in industry, why is tokenization becoming such a foundational element in modern data infrastructure?

    Tokenization has become foundational in modern data infrastructure, driven by two forces: more sophisticated security threats and tighter global regulations.

    At its core, it replaces sensitive information — payment details, personal identifiers, or health records — with tokens that cannot be reversed and have no value without secure mappings and cryptographic controls.

    From a security perspective, tokenization reduces the attack surface, limits blast radius when incidents occur, and supports Zero Trust by keeping real data accessible to only a small set of systems.

    From a compliance perspective, it keeps regulated data only where needed while analytics, AI, and reporting work on tokenized data. This simplifies audits, helps meet GDPR, HIPAA, PCI, and data-localization rules, and speeds work in regulated global industries.

    In practice, there are two main variants. Vault-based tokenization maps tokens to originals in a secure vault and suits environments that need centralized control, auditability, and legacy integration.

    Vaultless tokenization uses cryptography to generate tokens without a central store, cutting latency and operational risk for cloud-scale, high-performance workloads.

    Both are established; the right choice depends on regulation, scale, and risk appetite.

    Tokenization is also expanding into new domains: in AI, where “tokenization” usually means text units for processing, security tokenization serves a different role—ensuring models and agents work only with safe, nonreversible data and enabling verifiable proof of authorized use.

    In blockchain, sensitive data stays off-chain in secure environments while tokenized or hashed values live on-chain, preserving privacy, supporting requirements like the GDPR “right to be forgotten,” and enabling secure interoperability with traditional systems.

    Looking ahead, tokenization adds a layer of defense as organizations prepare for a post-quantum world.

    The bottom line: it lets businesses innovate, scale globally, and build customer trust while keeping security and compliance at the core.

    From your experience, what guiding principles are most important when designing secure and scalable infrastructure for sensitive data?

    When you design infrastructure for sensitive data, two words should guide every decision: trust and resilience.

    First, adopt a Zero Trust mindset. Most risk comes from ordinary mistakes, not only malicious insiders. Design so every access is verified, every privilege is deliberate, and no single error can put the system at risk.

    Second, make security and scalability evolve together. Design for both from day one so the system handles more transactions and more threats without slowing down. Build in tokenization, encryption in transit and at rest, strong key management, and keep latency low.

    Third, isolate sensitive workloads. Separate regulated data from everything else so only a small set of systems can access real data; that makes protection and audits easier.

    Fourth, design for failure and attack. Ask “what if,” plan for the worst, and use multi-region replication, disaster-recovery drills, and fallback paths that keep critical services running.

    Finally, build for verifiability. Be ready to show clear proof of how data is protected — whether to a regulator or a customer—so trust is earned and demonstrated.

    Treat these as essential nonfunctional requirements, and you get infrastructure that protects sensitive data even as threats and regulations evolve.

    Zero Trust is increasingly becoming a standard in modern security thinking. In your view, why is this model gaining so much traction, and how does it change the way organizations think about trust and control in distributed systems?

    Zero Trust is gaining traction because the old idea of a trusted physical or network perimeter no longer fits modern architectures. Today’s environments are built on cloud workloads, microservices, remote workforces, and interconnected third-party platforms. Add AI systems, IoT devices, and edge computing, and you get an ecosystem where data constantly flows across boundaries, so no single physical or network boundary can keep it all safe.

    Zero Trust flips the old mindset of ‘trust by default, verify when needed’ to ‘never trust, always verify.’ It is not about paranoia, but about recognizing that threats can come from anywhere, for example, a compromised endpoint, a vulnerable AI integration, or even a well-meaning employee making a mistake.

    Zero Trust requires organizations to design with the assumption that every request, whether from inside or outside the network, must be authenticated, authorized, and continuously validated. In distributed systems, that means granular controls at the service, workload, and data levels. In AI-driven workflows, it means models and agents access only the data they are authorized to use, with every interaction logged and auditable.

    It also reshapes how we think about control: grant the minimum access needed, for the shortest time possible, and monitor access actively. These principles apply equally to cloud-native microservices, blockchain integrations, and AI pipelines, wherever data moves across systems.

    The result is more than stronger defenses. Zero Trust reduces the blast radius of internal errors and system vulnerabilities. It is gaining traction because it matches the reality of today’s distributed, AI-enabled systems, treating every connection as potentially risky, and every access as a deliberate decision, not an assumption.

    How did the idea of Vaultless Tokenization come, and how does this solution differ from the data protection methods that existed at the time?

    The idea for vaultless tokenization came from a practical industry-wide challenge: how to protect sensitive data without bottlenecks or single points of failure. Historically, most data security solutions were storage-based. That can work for some less latency-sensitive workflows, but it introduces latency, operational complexity, and a dependence on one high-value target.

    Vaultless tokenization flips that model. Instead of storing the original data in a vault, it uses cryptographic mechanisms to deterministically generate tokens on demand, without persisting the sensitive value in a retrievable form. This removes the central data store attackers could target, eliminates the vault as a scaling bottleneck, and reduces operational risk even if the tokenization service is compromised.

    For service providers, vaultless also decouples security from storage. You can deliver the tokenization and detokenization logic, ensuring data security, while each business maintains its own storage, aligned to its compliance and audit requirements. This separation keeps you out of scope for many customers’ storage regulations and gives flexibility to meet geographic, regulatory, and operational needs without sacrificing security.

    Existing methods such as vault-based tokenization, format-preserving encryption, and static masking have tradeoffs in performance, reversibility, or compliance complexity. Vaultless tokenization addresses these issues by combining strong cryptography with distributed architecture principles, making it high performance and resilient.

    What excites me is that tokenization shifts from a security control to an architectural enabler: protect data at the edge, tokenize in real time, and meet strict compliance without slowing critical workflows.

    Migrating from a decades old legacy on-premises system, managing over $1 trillion in transactions, and securing the data of millions of users…

    How did you personally handle that level of responsibility? What helped you stay focused throughout?

    Handling responsibility at that scale can feel daunting at first, but what has helped me in high stakes environments is shifting from doing everything myself to setting clear priorities, a shared mindset, and processes that scale through others.

    First, I lean on clarity of purpose. It’s easy to get lost in the complexity, but keeping the goal of protecting people’s trust in critical systems helps me stay grounded and guides my decision-making.

    Second, I invest in processes and frameworks as enablers. They are not just a structure. They help multiply impact through others and free up energy for the most ambiguous problems. As a technical leader, clarity is essential: knowing what to measure, what to automate, and where to embed guardrails so good practices are enforced by default. That way, even when I’m not directly present, quality and security are maintained.

    Third, I operate with a security-first mindset, expecting the unexpected. Even with strong controls, threats evolve as technology changes, and the trickiest risks are often the hardest to detect. Proactive investment in monitoring, threat modeling, and defense in depth gives confidence that even the unknowns can be surfaced and addressed.

    Finally, I rely on trust and distributed ownership. No one can carry responsibility of that magnitude alone. Building alignment, empowering others to own their domains, and fostering open conversations about risk make the responsibility not just manageable, but sustainable.

    The pressure never completely disappears, but I don’t see it as a burden. I see it as a privilege: the chance to design systems resilient enough that people can depend on them every day without questioning their security.

    Considering that security is a critical aspect but often invisible to end users — what personally inspires you in this line of work?

    What inspires me most about working in security is that it is one of those disciplines where success is often invisible to end users while failure is immediately felt.

    End users rarely notice the controls and guardrails that keep their data safe; but that is the point.

    Security is about creating trust so people can live and work without worry, and for businesses that invisible layer becomes customer safety, trust, and an easier way to do business over time.

    I’m deeply motivated by protecting people at scale: identities, payments, and privacy. It is not flashy, but it is meaningful.

    I’m also inspired by the evolving challenge. The threat landscape never stands still, and technologies like AI, blockchain, and quantum computing bring both opportunity and risk.

    Security demands constant learning and adaptation, which keeps the work engaging and impactful.

    Last but not least: the privilege of scale keeps me going. That sense of responsibility and impact continues to inspire me in this field.

    And finally, in your view, how will sensitive data protection evolve over the next five years?

    It is already a universal expectation today, and customers, regulators, and businesses treat it as a given. The challenge is that while it is expected everywhere, it is not always executed consistently or deeply enough.

    Over the next five years, I believe technology advances will make those gaps much more visible, especially for organizations and workflows that do not already operate at a higher bar.

    Everyone will need to elevate their approach, because those that do not proactively address these gaps will be the ones most exposed to evolving threats.

    Protection will also become more adaptive, automatically adjusting to context such as geography, data type, or risk level. Just as important, verifiability will become a central requirement.

    Businesses will not just be expected to claim their data is secure; they will need to prove it continuously with clear evidence that customers, partners, and regulators can trust.

    With quantum computing on the horizon, we will see wider adoption of post-quantum cryptography and layered defense strategies.

    Data protection will not just remain a universal expectation; it will become a universal reality: adaptive, provable, and deeply woven into the fabric of digital systems.

    The post Business speed, lasting security: Conversation with Amazon’s Senior Software Development Engineer Naman Jain appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • PhishKit Evasion Tactics: What You Need to Pay Attention to Right Now 

    ·

    , ,

    Cyber attackers constantly refine their evasion methods. That’s what makes threats, including phishing, increasingly hard to detect and investigate.

    Kits like Tycoon 2FA regularly evolve with new tricks added to their arsenal. They slip past defenses and compromise companies, demonstrating great adaptivity in modern cyber threats. 

    Let’s review three key evasion techniques of Tycoon 2FA using ANY.RUN Interactive Sandbox. 

    Technique #1: Use of Different CAPTCHAs (reCAPTCHA, IconCaptcha, etc.)  

    Instead of using a single CAPTCHA system per threat, Tycoon 2FA cycles through different providers, such as reCAPTCHA, IconCaptcha, and custom CAPTCHAs.

    This rotation challenges signature-based detection systems and bot-driven analysis tools. They aren’t able to consistently bypass this evasion technique. 

    For example, in the following analysis session of Tycoon 2FA, previously used custom CAPTCHA was replaced with reCAPTCHA:  

    View analysis 

    reCAPTCHA used in Tycoon 2FA, as shown in ANY.RUN sandbox 

    Other providers, like IconCaptcha, have been detected earlier, too (e.g. in a submission dated April 7, 2025). 

    Speed up and Simplify Detection with Proactive analysis in ANY.RUN’s Interactive Sandbox -> Sign up today 

    Technique #2: Browser Fingerprinting 

    Using this technique, Tycoon 2FA phishing kit can distinguish real users from environments for analysis.

    Fingerprinting stands for collecting detailed info on user’s system, such as screen parameters, time zone, browser details, etc.  

    Based on this data, the threat decides whether to go on with phishing content or to redirect the user to a legitimate page. This significantly reduces detection risk by disarming sandbox-based defenses. 

    In the case below, opening the phishing link leads to a page that requests image element and executes Base64-encoded script in case of an error: 

    View analysis 

    Suspicious onerror handler in image element 

    If we decode the script with CyberChef, it will reveal that it’s meant to collect:   

    • Browser data, such as screen parameters, browser/platform name, URL, host, protocol, console properties, and document body.   
    • Info on time zone, JavaScript runtime internals, iframe checks, and graphical interface properties. 
    • Other technical information.  

    Code used to collect browser properties 

    Gathered data in JSON is then inserted into an invisible form and sent to the attacker’s server via a POST request.   

    The server analyzes the fingerprint data and returns a response with a Location header. There are two possible outcomes based on the specifics of received data:   

    • Redirection to a Legitimate Page: If gathered info indicates that something’s off, e.g., there signs of a sandbox, the user is redirected to a legitimate site like Emirates, Tesla, or SpaceX website. 
    • Redirect to Phishing Page: Otherwise, if the environment seems genuine, the user is directed to the Tycoon 2FA Stage 1 phishing page. 

    Technique #3: Obfuscation via Encryption 

    While earlier versions of Tycoon2FA relied on simpler obfuscation like Base64 or XOR, more recent samples employ AES encryption for payload obfuscation. This complicates detection significantly.

    Static analysis becomes much more difficult, especially when hard-coded keys and initialization vectors (IVs) are embedded in the code. 

    In this sample, we can observe that the Tycoon2FA uses AES encryption for payload obfuscation, not just for uploading/downloading stolen and service data in the final stages of execution: 

    View analysis 

    Obfuscation via encryption in code 

    Even though otherwise the execution chain is similar to previously known, AES-level obfuscation requires much more effort for reverse engineering and detection. 

    Live Webinar on New Malware Tactics 

    Learn more about the latest, most relevant TTPs and find out how to detect them efficiently at the webinar by ANY.RUN. 

    Join us on Wednesday, September 17 at 3:00 PM GMT. 

    New Malware Tactics: Cases & Detection Tips for SOCs : Register for webinar 

    Conclusion: Breaking Down Evasion Tactics With ANY.RUN 

    These evasion techniques are just a small portion of all constantly evolving TTPs used by threat actors. Traditional solutions that rely too much on automation and signature-based analysis are proven to be inefficient against them.  

    You can see better results with in-depth behavioral, interactive, not automated, analysis. That’s what ANY.RUN delivers with its sandbox: 

    • Interactivity in Real Time: Analyze malware from its very core by observing and investigating its behavior in action. 
    • Fast Results: See verdicts and identify malware families in under 40 seconds upon the launch to cut your analysis time to mere minutes. 
    • Detailed Behavior Analysis: Gain clear visibility into modern threat tactics, techniques, and procedures for thorough investigation. 
    • Efficient Automation: Detonate threats hands-free with Automated Interactivity and cut your workload by automating time-consuming routine tasks. 

    In-depth Research and Proactive defense for SOC teams : Try ANY.RUN 

    The post PhishKit Evasion Tactics: What You Need to Pay Attention to Right Now  appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New VMScape Spectre-BTI Attack Exploits Isolation Gaps in AMD and Intel CPUs

    ·

    , ,

    A novel speculative execution attack named VMSCAPE allows a malicious virtual machine (VM) to breach its security boundaries and steal sensitive data, like cryptographic keys, directly from its host system.

    The vulnerability, identified as CVE-2025-40300, affects a wide range of modern processors, including all current generations of AMD Zen (1 through 5) and Intel’s Coffee Lake CPUs.

    Research from a team at ETH Zurich details the first practical guest-to-host Spectre Branch Target Injection (Spectre-BTI) attack that works against unmodified hypervisor software in a default cloud configuration, posing a significant threat to virtualized environments.

    VMScape Exploiting Gaps in Virtualization Security

    VMSCAPE’s success hinges on the discovery of incomplete isolation within the CPU’s Branch Prediction Unit (BPU). Modern CPUs use branch predictors to execute instructions to improve performance speculatively.

    While vendors have implemented hardware mitigations like Enhanced IBRS (eIBRS) and Automatic IBRS (AutoIBRS) to prevent different privilege levels (e.g., user vs. kernel) from influencing each other’s predictions, the researchers found these defenses are too coarse-grained for virtualized settings.

    They fail to properly distinguish between four key domains: Host User (HU), Host Supervisor (HS), Guest User (GU), and Guest Supervisor (GS).

    The researchers identified a new attack primitive they call vBTIGU→HU, which allows an unprivileged process inside a guest VM to manipulate the BPU state of a user-level process on the host. This effectively creates a loophole in the isolation that is supposed to keep guest and host operations separate.

    The attack chain targets QEMU, a popular open-source hypervisor component used with KVM. A malicious actor in a guest VM can “train” the BPU by repeatedly executing specific code patterns.

    When the guest triggers a VM-to-host transition (a VMEXIT), the host’s QEMU process takes over.

    Due to the poisoned BPU state, QEMU is tricked into speculatively executing a “disclosure gadget” a snippet of its own existing code which accesses sensitive memory. The data is then exfiltrated one byte at a time using a FLUSH+RELOAD cache side-channel attack.

    VMScape Exploitation

    A key challenge in mounting the attack was achieving a sufficiently large “speculation window” the brief period during which speculative execution occurs.

    The researchers overcame this by reverse-engineering the cache architecture of AMD’s Zen 4 and Zen 5 CPUs, developing the first reliable eviction sets for their non-inclusive Last Level Cache (LLC).

    This technique delays the resolution of the correct branch path, extending the speculation window and enabling the attack to leak memory from the QEMU process at a rate of 32 B/s.

    The full end-to-end exploit, including bypassing Address Space Layout Randomization (ASLR), was demonstrated in under 20 minutes.

    Following a responsible disclosure on June 7, 2025, Linux kernel developers have released patches. The mitigation, based on the researchers’ guidance, involves issuing an Indirect Branch Prediction Barrier (IBPB) on VMEXITs just before the system transitions to execute code in the hypervisor’s userspace.

    This clears the malicious BPU entries. While performance overhead is marginal (~1%) for most workloads, it can rise to 51% in I/O-heavy scenarios.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post New VMScape Spectre-BTI Attack Exploits Isolation Gaps in AMD and Intel CPUs appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Leveraging Open-Source AdaptixC2 in Real-World Attacks

    ·

    , ,

    In early May 2025, security teams began observing a sudden rise in post-exploitation activity leveraging an open-source command-and-control framework known as AdaptixC2.

    Originally developed to assist penetration testers, this framework offers a range of capabilities—file system manipulation, process enumeration, and covert channel tunneling—that have now been adopted by malicious actors.

    The framework’s modular design and extensibility through “extenders” make it particularly attractive for adversaries seeking a customizable toolkit that can evade traditional defenses.

    Palo Alto Networks researchers noted that AdaptixC2 remained largely under the radar until threat intelligence feeds began reporting infections across multiple sectors.

    One early campaign relied on social engineering via fake help desk remote support requests, tricking users into executing Quick Assist sessions that unleashed a multi-stage PowerShell loader.

    Within minutes, adversaries achieved in-memory execution of the beacon without dropping any files, sidestepping endpoint detection measures and establishing persistent control over the victim host.

    As incidents proliferated, a different cluster of intrusions emerged involving AI-generated scripts designed to deploy AdaptixC2.

    Palo Alto Networks analysts identified stylistic markers—numbered comments and verbose output confirmations—that pointed to code produced by large language models.

    These scripts not only downloaded and decrypted a Base64-encoded payload, but also used .NET’s GetDelegateForFunctionPointer to execute shellcode directly in memory.

    By leveraging built-in Windows APIs such as VirtualProtect and CreateProcess, attackers achieved stealthy deployment and reliable persistence.

    Across both scenarios, the impact has been significant. Compromised environments have seen lateral movement facilitated by SOCKS4/5 tunneling and port forwarding, enabling data exfiltration in small chunks to blend with normal traffic patterns.

    In one documented case, adversaries combined AdaptixC2 with Fog ransomware in an attack against a financial institution in Asia, demonstrating the framework’s versatility and potential to amplify downstream payloads.

    Organizations relying on legacy detection systems found themselves ill-prepared for this modular, evolving threat.

    AdaptixC2 server (Source – Palo Alto Networks)

    The graphical view of linked agents and sessions, highlighting how attackers map available targets and plan multi-stage operations.

    Beacon HTTP builder UI (Source – Palo Alto Networks)

    The encrypted configuration parameters—RC4-encrypted payloads stored alongside their keys in the PE header—allowing rapid customization of communication profiles.

    Infection Mechanism via Fileless PowerShell Loader

    One of the most insidious elements of AdaptixC2 deployment is its fileless infection mechanism, executed entirely in memory to evade disk-based defenses.

    The initial vector often begins with a seemingly innocuous PowerShell script, delivered through a social engineering email or remote support prompt.

    Upon execution, the script invokes Invoke-RestMethod to retrieve a Base64-encoded shellcode payload from a legitimate cloud storage service.

    Attack vector of AdaptixC2 installation on victim machine (Source – Palo Alto Networks)

    It then decodes this payload and calls VirtualAlloc to allocate a memory region with PAGE_EXECUTE_READWRITE permissions.

    Using reflection and dynamic invocation, the loader constructs a delegate pointing to the shellcode entry point:-

    var ptr = GetDelegateForFunctionPointer(shellcodePtr, typeof(Action));
((Action)ptr)();

    This method sidesteps the need for written executables, leaving minimal forensic artifacts. Following successful execution, the script employs CreateShortcut in the user’s Startup folder or writes a Run key to the registry under a familiar name such as “Updater,” ensuring that the beacon survives reboots.

    Detection evasion is further enhanced by configurable KillDate and WorkingTime parameters, which limit beacon activity to pre-defined windows, and by customizable user-agent strings and HTTP headers.

    Security teams must therefore enrich telemetry with memory-based detections and network-behavior analytics to intercept these in-flight payloads before they fully establish their C2 channels.

    Continuous monitoring for dynamic invocation APIs and anomalous PowerShell child processes remains critical to disrupting this modern, fileless infection chain.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Threat Actors Leveraging Open-Source AdaptixC2 in Real-World Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • L7 DDoS Botnet Hijacked 5.76M Devices to Launch Massive Attacks

    ·

    , ,

    In early March 2025, security teams first observed an unprecedented L7 DDoS botnet targeting web applications across multiple sectors.

    The botnet, rapidly expanding from an initial 1.33 million compromised devices, employed HTTP GET floods to exhaust server resources and circumvent traditional rate limiting.

    By mid-May, the threat escalated as the botnet grew to 4.6 million nodes, leveraging compromised IoT devices and poorly secured endpoints to amplify its attack surface.

    By September, this sprawling network had mobilized 5.76 million IP addresses for a coordinated assault on a government organization, generating tens of millions of requests per second.

    Qrator Labs analysts noted significant shifts in geographical distribution, with Brazil, Vietnam, and the United States emerging as major sources of malicious traffic.

    The attack unfolded in two waves: an initial surge engaging approximately 2.8 million devices, followed an hour later by an additional 3 million nodes.

    HTTP headers in the second wave revealed randomized User-Agent strings designed to evade simple traffic filtering.

    Qrator Labs researchers identified key adaptations in the botnet’s control mechanism that facilitated its rapid scaling.

    The malware communicates over encrypted channels with a decentralized command-and-control (C2) infrastructure, which the attackers rotate frequently to avoid blacklisting.

    Signature-based mitigation struggled to keep pace as each C2 endpoint was active for mere hours before rotation.

    Infection Mechanism and Persistence

    The core infection vector relies on brute-force exploitation of default credentials and unpatched vulnerabilities in common IoT firmware.

    Once inside a device, the malware deploys a lightweight rootkit that hooks into network interfaces and intercepts firmware update routines.

    A code snippet extracted by Qrator Labs illustrates the persistence strategy:-

    // Intercept firmware update calls
int hook_update(char *path) {
    if (!strcmp(path, "/usr/bin/fw_update")) {
        launch_payload();
        return 0;
    }
    return orig_update(path);
}

    This approach ensures the malicious modules reload after each system restart, rendering simple reboot-based remediation ineffective.

    The stealthy rootkit also suppresses suspicious process listings, further complicating detection and removal.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post L7 DDoS Botnet Hijacked 5.76M Devices to Launch Massive Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Pixel 10 Adds C2PA Support to Verify AI-Generated Media Authenticity

    ·

    Google on Tuesday announced that its new Google Pixel 10 phones support the Coalition for Content Provenance and Authenticity (C2PA) standard out of the box to verify the origin and history of digital content. To that end, support for C2PA’s Content Credentials has been added to Pixel Camera and Google Photos apps for Android. The move, Google said, is designed to further digital media

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Political violence in the USA; House’s NDAA; Intel centers may close; Old ICBMs may operate longer; And a bit more.

    ·

    A manhunt is underway after 31-year-old American far-right “youth whisperer” Charlie Kirk was shot and killed while answering a question about gun violence during an outdoor speaking event at a Utah college campus Wednesday afternoon. The shooter appears to have fled the scene, which erupted in chaos moments after a shot rang out, striking Kirk in the neck in front of about 3,000 people at Utah Valley University, just north of Provo. 

    “Officials believe Kirk was shot from a roof,” and at least two videos have been shared that seem to show a gunman, but it’s not yet clear, the BBC reports. 

    Latest: Investigators Thursday morning said they’ve recovered a rifle in a wooded area around campus and isolated a footprint for further analysis, NBC News reports. The weapon was described as a “high-powered, bolt-action rifle,” which authorities say they believe was used in the shooting. Utah’s Republican Gov. Spencer Cox: “This is a dark day for our state. It’s a tragic day for our nation,” he told reporters at a press conference Wednesday, adding, “I want to be very clear that this is a political assassination.”

    Kirk was one of the most visible and influential activists in conservative U.S. politics, beginning in 2012 when he co-founded the organization Turning Point USA after dropping out of college at the age of 18. By the time he reached 31, he’d become famous while spreading misinformation and conspiracy theories as conservative donors helped him build “a $92 million-a-year political empire, with millions of followers online and a direct line to President Donald Trump like few others,” Fortune reports. “Today, Turning Point says it has a presence in more than 3,500 high school and college campuses nationwide—and its revenue, per tax filings, has skyrocketed from $4.3 million in 2016 to $81.7 million in 2023. When combined with its political-action arm, Turning Point Action, that figure tops $92 million.”

    FBI Director Kash Patel thought authorities had captured Kirk’s shooter Wednesday afternoon, but he spoke too soon. “The subject in custody has been released after an interrogation by law enforcement,” he wrote in a follow-up social media post two hours later. “Our investigation continues and we will continue to release information in interest of transparency.” 

    A second person taken into custody was also later released, the New York Times reports. Patel’s “backtrack was a source of significant embarrassment for the F.B.I. director on a day when three former F.B.I. agents filed a lawsuit against Mr. Patel that portrayed him as a partisan neophyte more interested in social media, and swag, than in the day-to-day operations of the nation’s flagship law enforcement agency,” the Times noted. 

    President Trump ordered flags to be lowered. “In honor of Charlie Kirk, a truly Great American Patriot, I am ordering all American Flags throughout the United States lowered to Half Mast until Sunday evening at 6 P.M.,” the president wrote on social media Wednesday. His order spans “the White House and upon all public buildings and grounds, at all military posts and naval stations, and on all naval vessels of the Federal Government in the District of Columbia and throughout the United States and its Territories and possessions,” the White House said in a separate statement. Trump also said Thursday he will award Kirk the Presidential Medal of Freedom posthumously. 

    Bigger picture: Kirk’s shooting has “punctuated the most sustained period of U.S. political violence since the 1970s,” Reuters reports, noting its reporters have “documented more than 300 cases of politically motivated violent acts across the ideological spectrum since supporters of Trump attacked the U.S. Capitol on January 6, 2021.” That includes the June murders of Democratic Minnesota House of Representatives Speaker Emerita Melissa Hortman and her husband Mark Hortman, as well as the stalking and shooting of Minnesota Democratic State Senator John Hoffman and his wife Yvette Hoffman, in addition to the attempted shooting of their daughter by a man dressed as a police officer in the early morning hours of June 14. The shooter had in his possession a hit list of 45 Democratic elected officials.

    Contributing factors for rising political violence in the U.S. include “economic insecurity, anxiety over shifting racial and ethnic demographics, and the increasingly inflammatory tone of political discourse,” Reuters reports separately. “That anger is amplified by a mix of social media, conspiracy theories and personal grievances.”

    Without any evidence, Trump blamed “the radical left” for Kirk’s shooting. “For years, those on the radical left have compared wonderful Americans like Charlie to Nazis and the world's worst mass murderers and criminals. This kind of rhetoric is directly responsible for the terrorism that we're seeing in our country today, and it must stop right now,” he said in a video posted online Wednesday evening. He also vowed to “find each and every one of those who contributed to this atrocity, and to other political violence, including the organizations that fund it and support it, as well as those who go after our judges, law enforcement officials, and everyone else who brings order to our country.” 

    Expert reax: “In the past, we had elected officials that would seek to bring the country together rather than to cast blame,” Bruce Hoffman, who specializes in counterterrorism and homeland security at the Council on Foreign Relations, told the Associated Press. “We’ll have to see what in the coming days our national leaders have to say about this, and whether they can be effective in lowering the temperature.”

    Second opinion: “This is an administration that, whether you agree with it or not, has made profound changes to this country in the eight months it’s been in office,” Mike Jensen, a researcher at the University of Maryland, told Reuters. “Some people love it, some people hate it. The people that hate it are starting to act out. People who love it are going to act out against those people that hate it, and it becomes a vicious spiral that could lead us into something really, really bad.” The New York Times has similar reporting here. 

    Additional reading: 

    Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day 24 years ago, the 9/11 attacks claimed the lives of nearly 3,000 people.

    Around the Defense Department

    House NDAA passes. The lower house’s $892.6 billion defense authorization bill includes “a 3.8% pay raise for troops and plans to improve the military's acquisition system, including by shortening approval timelines and increasing artificial intelligence research,” Reuters reports.

    It would rescind decades-old AUMFs. A bipartisan effort added “an amendment to rescind a pair of open-ended war powers laws, originally adopted in the run-up to the 2003 invasion of Iraq but used for a host of military missions worldwide since then,” Military Times reports.

    It also includes several conservative policy dictates. New York Times: “The 231-to-196 vote, mostly along party lines, reflected how Republicans in Congress have transformed the annual Pentagon policy measure, once an overwhelmingly popular bill, into a vehicle for conservative social policy dictates. For the third consecutive year, Republicans attached new restrictions to block diversity, equity and inclusion initiatives, a range of climate restrictions, and an increase in the flow of decommissioned military weapons into a civilian firearms program—alienating even Democrats who had initially supported it.” 

    Not in the bill, per Military Times: 

    • A Ukraine-aid ban. “Lawmakers on both sides of the aisle joined to defeat (by a 60-372 vote) a proposal from Georgia Republican Rep. Marjorie Taylor Greene to eliminate nearly all support for Ukraine security assistance from next year’s military plans.”
    • A proposal to change the name of the Defense Department. “Republican leaders also blocked debate on that proposal for now.”
    • A ban on sending National Guard troops to cities. Republicans shot down “Democratic proposals to limit President Donald Trump’s ability to use National Guard forces for domestic law enforcement support.”

    Update: Minuteman ICBM may operate until 2050. The Sentinel program to replace the Minuteman III has gone so badly that the Air Force is now considering operating the already-half-century-old ICBM until 2050, according to a new report from the Government Accountability Office. 

    What’s going on: “The Air Force reported to Congress in 2021 that Minuteman III would reach the end of its service life in 2036. Now, facing delays to Sentinel, the Air Force is evaluating options to continue operating Minuteman III through 2050,” said the report, which was released Wednesday. “The Minuteman III Program Office concluded that operation of Minuteman III until 2050 is feasible.” One of your D Briefers has more from the report, here.

    Developing: The U.S. is on the brink of selling Finland more than 400 AMRAAMs, which refer to AIM-120D-3 Advanced Medium Range Air-to-Air Missiles from defense prime RTX, the Pentagon’s arms export agency announced Wednesday. The weapons “could be used to arm the Finnish air force’s current Boeing F-18 Hornet fighters and on-order Lockheed Martin F-35As,” Flight Global reports. 

    If the deal goes forward, it would “add to a record run of major contracts for the AMRAAM, with the most recent having been a $3.5 billion order to provide missiles to the US military and 19 international customers,” Craig Hoyle of Flight Global adds. 

    We forgot to flag another big U.S. sale of six Patriot air defense systems to Denmark for $8.5 billion. The Pentagon’s Defense Security Cooperation Agency announced that one two weeks ago, which “will require the assignment of 12-17 additional U.S. Government and 17-23 contractor representatives [who will need] to travel to Denmark periodically for up to 7 years for equipment fielding, system checkout, training, and technical and logistics support,” according to DSCA. 

    We’re also late to a separate, record-setting $9.8 billion U.S. Army deal with Lockheed Martin to make 1,970 Patriot PAC-3 missiles in southern Arkansas. Army officials announced the order last Wednesday, which Stars and Stripes described as “the largest in the history of the company’s missiles and fire control unit.” 

    Panning out: Especially since Russia launched its full-scale invasion of Ukraine, “Lockheed Martin has been working to increase its production for years and plans to deliver more than 600 interceptors in 2025, topping its record-breaking production of 500 last year,” Stripes writes. See also local coverage from near Camden, Arkansas, where the missiles will be made. 

    Related reading: 

    Trump 2.0

    ODNI likely to curtail counterintelligence center in latest shake up. Two intelligence-coordination centers would shrink or be closed under a reorganization plan that some observers say will hinder the U.S. ability to counter spies and terrorists, Defense One’s Patrick Tucker reported Wednesday. 

    ODNI is considering either closing or greatly reducing the National Counterintelligence and Security Center and the National Counterterrorism Center, according to current and former officials. These developments are the latest moves in a broad restructuring of the U.S. intelligence community under Trump. Certain elements of that restructuring, which spans ODNI, CISA, the FBI, NSA, CIA, and other agencies, are already harming information sharing with partner intelligence agencies around the world, Tucker reports, citing sources. The changes, they say, are exposing the U.S. government, businesses, and civilians to a wide range of new espionage threats.

    While the existence of the National Counterintelligence and Security Center at ODNI is not widely known, it plays a key role in U.S. understanding of how spies are spying on us, as one source succinctly put it. So while it rarely makes big headlines, the failure of counterintelligence operations could result in the loss of critical U.S. secrets. Continue reading, here. 

    And lastly: New polling shows a majority of Americans are uncomfortable with Trump's moves to expand presidential power, Reuters reported Thursday. That includes Trump’s decision to deploy the U.S. military in American cities. 

    “On crime, only 32% of Americans said they would feel safer with armed soldiers deployed to large cities in their state,” Reuters reports. For a little more on those numbers, “Some 62% of Trump's fellow Republicans were warm to military patrols in big cities, but only one in four independents felt the same way, as did just one in 10 Democrats.” More, here. 

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶