DEV Community: Mark0

The New Hotness in Phishing: Device Code Attacks in M365

Mark0 — Thu, 23 Jul 2026 06:32:15 +0000

Device code phishing represents a significant evolution in attack techniques, bypassing traditional security measures like multi-factor authentication (MFA) and Conditional Access policies. Unlike conventional phishing, victims are directed to a legitimate Microsoft URL to enter a code, inadvertently granting attackers persistent access tokens. These tokens, particularly refresh tokens, can provide broad, long-term access to critical Microsoft 365 services such as Exchange, SharePoint, and Microsoft Graph, enabling activities like mailbox enumeration, data exfiltration, and the creation of malicious inbox rules for persistence.

The attack's effectiveness stems from its deceptive legitimacy; users see authentic Microsoft prompts and URLs. However, this method leaves a distinct footprint in Entra ID sign-in logs, specifically through the "deviceCode" authentication protocol. Defenders can detect this by hunting for rare device code sign-ins, especially when originating from multiple IPs or followed by suspicious activities like inbox rule modifications, which often signal post-compromise persistence.

The most robust defense is a structural one: organizations should block the device code flow using Conditional Access policies unless explicitly required for specific, limited use cases. Additionally, education emphasizing that users should only enter codes they personally initiated is crucial. In the event of compromise, immediate steps include revoking refresh tokens (as password resets alone are insufficient), assessing the extent of access, cleaning up malicious configurations, and reinforcing Conditional Access blocks to prevent re-exploitation.

Read Full Article

2026-05-31: Seven days of scans and probes and web traffic hitting my web server

Mark0 — Thu, 23 Jul 2026 06:30:50 +0000

This entry details the availability of a network traffic capture (PCAP) file, which logs "seven days of scans and probes and web traffic hitting a web server." This associated file, specifically named 2026-05-31-seven-days-of-scans-and-probes-and-web-traffic-hitting-my-web-server.pcap.zip, offers insights into various network activities targeting the server.

It is important to note that the provided zip file is password-protected. Access to its contents requires a password, which can be found on the "about" page of the website. The author also highlights that a new password scheme has been implemented for accessing such files on this particular site.

Read Full Article

The Agentic SOC: Transforming Data into Defensive Velocity

Mark0 — Thu, 23 Jul 2026 06:29:44 +0000

Modern Security Operations Centers (SOCs) face significant challenges, primarily stemming from the vast and fragmented data ecosystems they inherit. Analysts are often overwhelmed by manual data aggregation tasks, such as enriching IP addresses and correlating logs from diverse sources, which severely delays threat investigation and mitigation. This administrative burden, coupled with the machine-speed operations of threat actors, highlights a critical architectural failure where human defenders are expected to manually counter automated threats using inconsistent data. The article emphasizes that fixing this "upstream data problem" is a prerequisite for achieving defensive velocity and improving all downstream security functions.

To address this, the article introduces advanced data pipelines, exemplified by SentinelOne’s Singularity AI Data Pipelines. These pipelines ingest telemetry from various sources, normalize it into standardized formats like OCSF using AI, and optimize data streams by filtering noise and routing logs based on value. This process significantly reduces infrastructure costs, improves the signal-to-noise ratio, and ensures data is "fit for purpose" for subsequent analysis. With a clean, structured data foundation, detection engines like Singularity AI SIEM can perform petabyte-scale queries with minimal latency, while agentic reasoning layers like Purple AI autonomously investigate and synthesize threat intelligence, connecting disparate low-signal events into cohesive narratives before major breaches occur.

The integration of data pipelines, agentic reasoning, and governed hyperautomation redefines the analyst's role. Instead of being bogged down by repetitive tasks, analysts are empowered to exercise expert judgment. By offloading data collection, investigation groundwork, and initial response to AI-powered systems, the "Autonomous Security Intelligence (ASI)" model multiplies an analyst's operational output. This shift allows SOCs to evolve into dynamic systems that actively neutralize threats at machine speed, ultimately elevating analysts to strategic decision-makers with full situational awareness, rather than passive observers.

Read Full Article

From Triage Grind to Strategic Operator: The New AI SOC Career Path

Mark0 — Thu, 23 Jul 2026 06:28:22 +0000

The traditional tiered SOC model is undergoing a fundamental transformation as AI absorbs the high-volume triage and correlation tasks that once defined junior and senior analyst roles. Rather than dissolving the tier system, AI is shifting the focus from linear capacity to depth of expertise, allowing teams to handle data volumes that compound exponentially.

This evolution redefines the daily workflow, moving from manual overnight alert vetting to proactive threat hunting and strategic governance. By leveraging AI-powered investigations, SOC teams can identify threats significantly faster and manage machine-speed tempos of modern adversaries, effectively reducing burnout while increasing operational efficiency through automated response and evidence-backed verdicts.

Read Full Article

A new extortion cocktail: office printers, small ransoms, and BitLocker

Mark0 — Thu, 23 Jul 2026 06:27:40 +0000

Recent investigations in Latin America have uncovered a trend where attackers leverage built-in Windows tools, specifically BitLocker, to encrypt corporate data following the exploitation of misconfigured services. Two primary cases in Colombia and Mexico highlight how internet-exposed RDP services and MSSQL servers with enabled xp_cmdshell provide initial access. In these incidents, attackers notably bypassed traditional endpoint protection by exploiting application incompatibilities or leveraging stolen credentials found on public repositories like GitHub.

Beyond encryption, the "XEntry Team" and similar actors have demonstrated a unique method of communication by hijacking corporate printers to produce physical ransom notes. They often utilize Remote Monitoring and Management (RMM) tools like Mesh Agent and Tactical RMM to maintain persistence and deploy encryption tasks via Group Policy Objects (GPO). The findings underscore the critical need for strict RDP hardening, proactive log management, and robust backup strategies to mitigate the risks posed by these low-cost yet effective "living-off-the-land" ransomware tactics.

Read Full Article

Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks

Mark0 — Thu, 23 Jul 2026 06:26:44 +0000

In February 2026, Socket.dev identified a sophisticated multi-stage npm supply chain worm operating under the flag SANDWORM_MODE. This campaign represents a new class of threats specifically targeting AI-augmented development workflows, including AI coding assistants and CI/CD automation. Unlike traditional attacks that focus on static backdoors, SANDWORM_MODE exploits the runtime behaviors of LLM toolchains and environment-specific triggers to compromise developer workstations and ephemeral build runners.

The infection follows a three-stage lifecycle: an obfuscated loader, an initial reconnaissance phase for credential harvesting, and a full capability suite. The worm establishes persistence via global Git hooks and deploys rogue Model Context Protocol (MCP) servers to manipulate AI assistants into exfiltrating secrets. Notably, the malware includes a destructive 'dead switch' that shreds all writable user files if its primary propagation and exfiltration channels are blocked.

Read Full Article

New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery

Mark0 — Thu, 23 Jul 2026 06:24:31 +0000

⚠️ Region Alert: UAE/Middle East
Project CAV3RN, a sophisticated cyberespionage framework attributed with low confidence to OilRig (APT34), has undergone a significant architectural shift. Kaspersky's analysis reveals a new .NET Native AOT communication module designed to replace previous HTTP/WebSocket components. This module leverages Microsoft Graph to use Outlook calendar events as a covert Command and Control (C2) channel, scheduling events in the year 2050 to avoid detection. Commands are transmitted via encrypted attachments within these calendar events, utilizing RSA and AES-GCM for robust encryption and decryption.

A critical feature of this updated module is its robust configuration recovery mechanism. Should Microsoft Graph authentication or tenant validation fail, the module employs a unique DNS AAAA record protocol to retrieve replacement connection settings, including tenant ID, client ID, client secret, and user email. This fallback system uses actor-controlled authoritative nameservers to dynamically supply fragmented configuration data through specially crafted DNS queries, demonstrating the attackers' ingenuity in maintaining persistent access.

The behavioral patterns observed in this new module, such as the use of Microsoft-hosted services for C2, attachment-based command exchange, and a secondary mechanism for restoring cloud C2 access, strongly align with known OilRig (APT34) tactics. This ongoing evolution, with significant changes between December 2025 and May 2026, highlights the active development and adaptation of the CAV3RN framework, underscoring the persistent threat it poses, particularly to targets in the Middle East.

Read Full Article

XSSer v.1.9 - "Bl4ck Swarm!" released

Mark0 — Thu, 23 Jul 2026 06:22:05 +0000

XSSer v.1.9, nicknamed "Bl4ck Swarm!", has been officially released. This automated framework is designed to detect, exploit, and report Cross-Site Scripting (XSS) vulnerabilities in web-based applications. The latest version comes pre-installed with over 1,500 attacking vectors and advanced techniques for code injection and filter bypassing.

This release significantly enhances the tool's capability to bypass major Web Application Firewalls (WAFs) such as Cloudflare, Akamai, AWS, and Mod-Security. Users can access the source code via several mirrors, including GitHub and SourceForge, or download the direct packages to start testing their web environments against complex XSS threats.

Read Full Article

wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution

Mark0 — Thu, 23 Jul 2026 06:21:28 +0000

The wp2shell vulnerability (CVE-2026-63030 and CVE-2026-60137) is a critical pre-authentication remote code execution chain affecting WordPress Core versions 6.9.0 through 7.0.1. The flaw originates from route confusion within the WordPress REST API batch handling, allowing attackers to escalate a SQL injection primitive into full system compromise. Public proof-of-concept tools, such as the Icex0 PoC, have already been released, leading to active exploitation in the wild.

Defensive analysis using Elastic Defend reveals a distinct attack pattern involving web server runtimes (like Apache or PHP-FPM) spawning shell processes and creating malicious plugin directories under wp-content/plugins/. Effective detection relies on behavioral rules that monitor for unusual command execution from web server parents rather than static indicators. Administrators are urged to patch to WordPress versions 7.0.2 or 6.9.5 immediately and monitor for unauthorized file modifications or suspicious process lineage.

Read Full Article

On Flock License Plate Tracking Cameras

Mark0 — Thu, 23 Jul 2026 06:20:37 +0000

Recent incidents involving Flock Safety's license plate recognition technology have highlighted critical flaws in automated surveillance systems. A notable case involved the misidentification of a Jaguar Land Rover vehicle due to machine learning models flagging partial plate matches, leading to a wrongful arrest. Despite the error, Flock maintains that their system functioned as requested by law enforcement, who prefer receiving alerts for any character matches within their "hot lists."

Beyond license plate tracking, the Flock camera network is increasingly being utilized by police departments to identify specific individuals based on physical descriptions, such as clothing or build. This expansion into human surveillance, coupled with instances of database abuse and the CEO's past derogatory comments toward privacy advocates, underscores the growing tension between public safety technology and civil liberties. The ease of nationwide tracking facilitated by these systems represents a significant shift from traditional localized policing.

Read Full Article

⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More

Mark0 — Thu, 23 Jul 2026 06:19:51 +0000

This week saw a significant surge in cyber threats, marked by critical vulnerabilities and evolving attacker tactics. A pre-authenticated remote code execution (RCE) flaw in WordPress Core (wp2shell), chaining CVE-2026-63030 and CVE-2026-60137, is already being actively exploited, posing a severe risk to countless websites. Other zero-day vulnerabilities targeted SonicWall SMA VPN appliances (attributed to UTA0533) and Microsoft SharePoint Server (CVE-2026-58644), with the latter added to CISA's Known Exploited Vulnerabilities catalog. Furthermore, a denial-of-service (DoS) flaw dubbed HollowByte in OpenSSL could allow remote unauthenticated attackers to exhaust server memory with minimal payloads.

New and updated malware campaigns are also causing concern. OkoBot, an evolved infostealer, targets Windows users to phish cryptocurrency seed phrases by injecting into wallet processes and leveraging browser extensions. A new Go botnet, NadMesh, is actively scanning for exposed AI services like ComfyUI and Ollama to steal AWS keys and Kubernetes tokens. Ransomware operations, specifically Qilin, are employing aggressive kernel-level defense evasion techniques, including an EDR killer that exploits a vulnerable driver. The report also highlighted a data leak at India's Kudankulam Nuclear Power Plant due to a ransomware attack on a third-party vendor, and the ongoing activities of the Blind Eagle threat actor.

The article underscores the shrinking window between vulnerability disclosure and exploit weaponization, largely driven by AI-assisted tooling. This rapid pace necessitates immediate patching and proactive security measures. Recommendations include rapid patching, implementing controls to detect and remove backdoors, and adopting frameworks for governing expanding attack surfaces, especially in AI-driven development. The emphasis is on assuming public vulnerabilities are already being tested by attackers and prioritizing urgent fixes.

Read Full Article

HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050

Mark0 — Thu, 23 Jul 2026 06:15:54 +0000

A newly discovered espionage implant, dubbed HollowGraph by Group-IB, is employing a highly sophisticated and stealthy command-and-control (C2) mechanism. This malware hijacks compromised Microsoft 365 calendars, embedding operator instructions and exfiltrating stolen data as attachments on calendar events dated far into the future, specifically 2050. By leveraging legitimate Microsoft Graph API traffic, HollowGraph's activity masquerades as normal Microsoft 365 chatter, making it exceptionally difficult to detect with traditional network controls. The .NET DLL implant supports get and send commands, with all communications secured using hybrid RSA and AES-256 encryption.

In addition to the calendar-based C2, HollowGraph maintains a second, cruder DNS channel. This channel, operating over IPv6 AAAA records from cloudlanecdn[.]com, is used to refresh Entra ID (Azure AD) login details, which are then written to a file named logAzure.txt. Group-IB attributes HollowGraph with high confidence to Cavern (also known as Cavern Manticore), an Iranian Ministry of Intelligence and Security-linked actor that overlaps with MuddyWater and Lyceum. The attacks are highly targeted espionage, found on a small number of machines, with victim traffic observed as recently as July 2026.

Since HollowGraph exploits normal Microsoft Graph API functionality rather than a software vulnerability, detection focuses on identity and application permissions monitoring. Defenders should look for specific indicators, including far-future calendar events on 2050-05-13 with bare GUID subjects or File{n}.txt attachments. Auditing client-credential OAuth apps, monitoring Microsoft Graph and mailbox activity for application-driven calendar changes, and scrutinizing DNS for frequent AAAA queries to suspicious domains like cloudlanecdn[.]com are crucial steps to identify this elusive threat.

Read Full Article