cybersecurity Archives | Cyberthreat Blog from Fortify24x7

Bytes over DNS, (Mon, Oct 27th)

by Cyberthreat Blog | Oct 27, 2025 | SANS ISC Bulletins | 0 |

I was intrigued when Johannes talked about malware that uses BASE64 over DNS to communicate. Take...

Kaitai Struct WebIDE, (Sun, Oct 26th)

by Cyberthreat Blog | Oct 26, 2025 | SANS ISC Bulletins | 0 |

When I have a binary file to analyze, I often use tools like 010 Editor or format-bytes.py (a tool...

Phishing Cloud Account for Information, (Thu, Oct 23rd)

by Cyberthreat Blog | Oct 23, 2025 | SANS ISC Bulletins | 0 |

Over the past two months, my outlook account has been receiving phishing email regarding cloud...

Infostealer Targeting Android Devices, (Thu, Oct 23rd)

by Cyberthreat Blog | Oct 23, 2025 | SANS ISC Bulletins | 0 |

Infostealers landscape exploded in 2024 and they remain a top threat today. If Windows remains a...

webctrl.cgi/Blue Angel Software Suite Exploit Attempts. Maybe CVE-2025-34033 Variant?, (Wed, Oct 22nd)

by Cyberthreat Blog | Oct 22, 2025 | SANS ISC Bulletins | 0 |

Starting yesterday, some of our honeypots received POST requests to “/cgi-bin/webctrl.cgi”, attempting to exploit an OS command injection vulnerability: POST /cgi-bin/webctrl.cgi Host: [honeypot ip]:80 User-Agent:...

What time is it? Accuracy of pool.ntp.org., (Tue, Oct 21st)

by Cyberthreat Blog | Oct 21, 2025 | SANS ISC Bulletins | 0 |

Yesterday, Chinese security services published a story alleging a multi-year attack against the...

Many Online Services and Websites Affected by an AWS Outage, (Mon, Oct 20th)

by Cyberthreat Blog | Oct 20, 2025 | SANS ISC Bulletins | 0 |

The info is spreading across the news websites: For approximatively two hours, many online services or websites are suffering of an Amazon Web Services outage. Some affected services: Signal Slack Zoom These may affect...

Using Syscall() for Obfuscation/Fileless Activity, (Mon, Oct 20th)

by Cyberthreat Blog | Oct 20, 2025 | SANS ISC Bulletins | 0 |

I found another piece of malware this weekend. This one looks more like a proof-of-concept because...

VU#652514: DNS Rebinding and Manipulating CORS Headers Enables Exfiltration of Information

by Cyberthreat Blog | Oct 17, 2025 | CERT-Vulnerabilities | 0 |

Overview A vulnerability in cross-origin resource sharing (CORS) headers in Chromium, Google Chrome, Microsoft Edge, Safari, and Firefox enables the CORS policy to be manipulated. Combined with a DNS rebind, an attacker can send...

VU#516608: Multiple Password Managers Vulnerable to Clickjacking Attacks

by Cyberthreat Blog | Oct 17, 2025 | CERT-Vulnerabilities | 0 |

Overview Browser-extension password managers, which autofill sensitive information on websites, can be exposed to various clickjacking attacks. These attacks exploit the trust relationship between a web page and the...

TikTok Videos Promoting Malware Installation, (Fri, Oct 17th)

by Cyberthreat Blog | Oct 17, 2025 | SANS ISC Bulletins | 0 |

Attackers are everywhere! They try to abuse victims using new communication channels and social...

New DShield Support Slack, (Thu, Oct 16th)

by Cyberthreat Blog | Oct 16, 2025 | SANS ISC Bulletins | 0 |

This week, we set up a new Slack workspace for DShield.org. This workspace replaces the old workspace we originally configured back in 2016 or 2017. The workspace was originally configured as a free workspace to support the...

Tag: cybersecurity