Threat Intelligence Library
Actionable security intelligence from vulnerabilit…
What should defenders do about Iranian-affiliated PLC targeting?. Build a multi-section brief covering the threat, affected internet-exposed PLC scope, observed access paths, ports 44818, 2222, 102, 502, and 22, ATT&CK techniques, and defender actions. Include a mitigation priority table that separates immediate exposure reduction, log review, project file validation, Rockwell AOI checks, and vendor hardening guidance.
Iranian-Affiliated Targeting of Internet-Exposed PLCs CISA warns that Iranian-affiliated cyber actors have been exploiting internet-connected PLCs across U.S. critical infrastructure, with activity observed in Government Services and Facilities, Water and Wastewater Systems, and Energy. The advisory...
ViewHow did LAUNDRY BEAR turn Zimbra webmail into a credential and mailbox collection path?. Tell the campaign as an operator-focused sequence from CVE-2025-66376 exploitation through Application Passcodes, IMAP enabling, SearchGalRequest activity, and exfiltration over DNS and HTTPS. End with a defender checklist covering patches, suspicious domains, localStorage artifacts, and revocation of Application Passcodes and 2FA scratch keys.
How did a single Zimbra phishing email turn into mailbox theft? CISA says LAUNDRY BEAR used CVE-2025-66376 so that just viewing the message could execute JavaScript in the webmail client and start mail theft[[cite:1]][[cite:2]]. The initial payload was hidden in an SVG onload field, wrapped in Base6...
View5 hunt leads from recent CISA malware and ransomware advisories. Create exactly five operational cards, each centered on one actionable hunt lead from BRICKSTORM, Medusa, Akira, Androxgh0st, and the CISA ransomware guide. Keep each card focused on what to look for, such as IOCs, detection signatures, vulnerable services, initial access patterns, or precursor activity.
Hunt DMZ web shells that precede RDP lateral movement to domain controllers and VMware vCenter. Flag PsExec activity that creates an inbound RDP rule on port 3389, especially `openrdp.bat`. Watch for VPN access without MFA, especially tied to CVE-2024-40766 or stolen VPN credentials. Alert on POSTs ...
ViewHow should defenders rank KEV, EPSS, affected versions, and internet exposure?. Build a structured triage model that starts with CISA KEV evidence of active exploitation, then uses EPSS where direct exploitation evidence is absent, and finally validates urgency with affected versions, fixed releases, and public exposure. Include a comparison table covering KEV, EPSS, NVD affected-version data, the XZ Utils B and R advisory, Apache HttpComponents Core, and router exposure guidance.
Exploitation-led vulnerability triage model Use a simple order of operations: **1) CISA KEV first**, because KEV is the strongest signal of confirmed active exploitation; **2) EPSS next** when you do not yet have direct exploitation evidence, because EPSS is built to prioritize likely exploitation u...
ViewHow should defenders reduce ICS exposure risk?. Structure the thread as a stepwise exposure-control checklist for control system environments, grounded in CISA guidance on legacy ICS risk and ICS advisory mitigation patterns. Emphasize internet exposure, segmentation from business networks, firewall placement, VPN hardening, and affected-version review.
If your ICS can be reached from the Internet, it is already too exposed. CISA’s recurring advice is to reduce reachability first, then layer in segmentation, firewalls, and controlled remote access[[cite:1]][[cite:2]]. Step 1: review the advisory’s affected software or firmware versions and confirm ...
ViewCan you spot the identity and cloud intrusion pattern?. Frame the quiz around analyst decisions: identify whether a behavior maps to help desk social engineering, cloud valid account access, session token abuse, public facing exploitation, or cloud infrastructure discovery. Use Scattered Spider, CISA cloud hardening guidance, the GeoServer incident response report, and MITRE ATTACK cloud techniques as the answer base.
Q1. Which pattern is best described as vishing, spearphishing, or impersonation aimed at help desk staff to reset passwords or transfer MFA tokens? - Help desk social engineering - Cloud valid account access - Session token abuse - Cloud infrastructure discovery Answer: Help desk social engineering[...
View- 1(current)