Cyber Creatures

    Organizations worldwide use Active Directory (AD) as their primary identity service , which makes it a top target for ransomware attacks . This article explains how adversaries exploit Active Directory during ransomware attacks and provides strategies and tools for defending against this modern menace. The two phases of a ransomware attack A common misconception about ransomware attacks is that they are quick: Someone opens an infected email attachment or inserts an infected USB device , and within minutes data across the network is encrypted and a ransom demand is displayed on every screen . The reality is quite different. Ransomware attacks today tend to be quite sophisticated and methodical . To encrypt as much sensitive information as possible and therefore maximize the chances of receiving a high payout , attackers proceed in two phases: Find an entry point — The first step is to gain a foothold in the victim organization ’s network . One common strategy is to comp...

  Security researchers have uncovered critical vulnerabilities in Microsoft’s Active Directory Certificate Services (AD CS) that could allow attackers to establish long-term persistence in compromised networks . The findings, detailed in a comprehensive whitepaper by Will Schroeder and Lee Christensen, reveal how AD CS misconfigurations can be exploited for credential theft , privilege escalation , and domain persistence . AD CS, Microsoft’s implementation of Public Key Infrastructure (PKI) in Active Directory environments , is widely deployed but often overlooked from a security perspective . Microsoft defines Active Directory Certificate Services (AD CS) as “ the server role that allows you to build a public key infrastructure (PKI) and provide public key cryptography, digital certificates, and digital signature capabilities for your organization . “AD CS Enterprise CAs issue certificates with settings defined by certificate templates . These templates are collections of e...

  Security researchers have publicly revealed a newly discovered critical vulnerability that affects all Windows Workstation and Server versions, from Windows 7 and Server 2008 R2 to the latest Windows 11 (v24H2) and Server 2022. The flaw allows attackers to obtain a user’s NTLM credentials simply by tricking them into viewing a malicious file in Windows Explorer. This action could be triggered by opening a shared folder or USB disk containing such a file, or by accessing the Downloads folder where the malicious file might have been automatically downloaded from an attacker’s webpage. After responsibly reporting the issue to Microsoft, the researchers have released micropatches to protect users until they provide an official fix. These micropatches are available free of charge during this interim period. Details of the Vulnerability We are withholding the exact technical details of the vulnerability to minimize the risk of exploitation. However, the researchers emphasize that the v...

Learn how to perform a Man in the middle attack with arpspoof, driftnet and urlsnarf in Kali Linux In this article, you will learn how to perform a MITM attack to a device that's connected in the same Wi-Fi networks as yours. Requirements This article assumes that you know what is a network interface and you know to how to work with Kali Linux and the command line. Before starting, you will need to know the name of the Network interface (installed on your machine) and the IP of the router that provides Wi-Fi access. The Network Interface Name can be easily obtained as running the ifconfig command on a terminal, then from the list copy the name of the interface that you want to use. The IP of the router can be obtained executing ip route show on a terminal and a message like "default via [This is the router IP]". From the victim, you will only need the IP (the user needs to be connected to the network provided by the router). The process of obtaining the device IP of the v...

  A critical security flaw has been discovered in Zabbix , the popular open-source monitoring solution , potentially allowing attackers to gain full control over affected instances . The vulnerability, identified as CVE-2024-42327 , affects multiple versions of Zabbix and has been assigned a CVSS score of 9.9 , indicating its severe nature. The SQL injection vulnerability exists in the CUser class within the Zabbix frontend, specifically in the addRelatedObjects function. This function is called by the CUser.get function , which is accessible to any user with API access . What makes this vulnerability particularly concerning is that it can be exploited by non-admin user accounts with the default User role or any role that provides API access . Security researcher Mark Rakoczi discovered and reported the vulnerability through the HackerOne bug bounty platform. The flaw affects Zabbix versions 6.0.0 to 6.0.31, 6.4.0 to 6.4.16, and 7.0.0 . Technical Analysis Successful exploitati...

In the ever-evolving landscape of cybersecurity, identifying and mitigating vulnerabilities is crucial for maintaining a strong security posture . Vulnerability Assessment and Penetration Testing (VAPT) is an effective method for uncovering security weaknesses that could be exploited by attackers . This article will explore the top 10 vulnerabilities commonly discovered through VAPT and provide strategies for mitigating them. Additionally , we will highlight how Indian Cyber Security Solutions (ICSS) can assist you in strengthening your cybersecurity defenses through our comprehensive VAPT services . 1. SQL Injection What is SQL Injection? SQL Injection occurs when attackers exploit vulnerabilities in an application's database layer by inserting malicious SQL code. This can lead to unauthorized access to sensitive data. Mitigation Strategies Use parameterized queries and prepared statements. Implement input validation and sanitation. Regularly update and patch database manage...

The hacktivist group Head Mare has leveraged a vulnerability in WinRAR to infiltrate and encrypt systems running on Windows and Linux . This group, active since the onset of the Russo-Ukrainian conflict , has primarily targeted organizations in Russia and Belarus . Their attacks are characterized by sophisticated techniques that focus on causing maximum disruption. The Vulnerability: CVE-2023-38831 According to the Secure List report , the vulnerability exploited by Head Mare, identified as CVE-2023-38831 , resides in WinRAR , a popular file archiver utility. This flaw allows attackers to execute arbitrary code on a victim’s system through specially crafted archive files . By exploiting this vulnerability, Head Mare can more effectively deliver and conceal its malicious payloads. How the Exploit Works When a user attempts to open a seemingly legitimate document within a compromised archive , the malicious code is executed , granting the attackers access to the system . Verdicts ...