Security and Stuff

Austin, TX
Joined September 2014
Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens across customer tenants. ConnectWise Cloud Backup is a multitenant vendor application; customers grant consent for the application to operate in their tenants. We assess that the threat actor likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All. On October 15, 2026, we observed broad successful service principal authentication originating from the IP address 144.172.64[.]128. Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor. Microsoft Defender detects post-exploitation activity with the following alerts: - Any alert related to "Suspicious sign-in" - Graph API activity from a Microsoft threat intelligence IP address - Verified Threat Actor IP Defenders should review service principal sign-ins from unrecognized IP addresses, app credential changes, and OAuth grant activity associated with this specific OAuth AppId. In addition, we recommend looking for Threat Intelligence alerts on matching of IP against the Graph API activity and service principal activities. We will continue to monitor this incident and will share updates as they become available. We encourage customers to check ConnectWise advisory for more information and additional guidance: msft.it/6013aQBvV. Indicators of compromise (IOCs): - App name: ConnectWise Cloud Backup - AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae - Publisher name: SkyKick - Source IP: 144.172.64[.]128 - User agents: Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2
8
119
14
330
37,591
crewfasa retweeted
Probably a good time to point you all to a tool I released not to long ago called SecretsStalker. If you have found an exposed client ID and secret to s service principal, SecretsStalker will authenticate you into the environment and recon the exact rights that it has. github.com/rootsecdev/Secret…
Microsoft Security Research has identified extensive cloud resource destruction activity linked to JADEPUFFER, which Microsoft tracks as Storm-3168. The activity used compromised service principals and performed cloud credential collection that could be used to facilitate future exfiltration. msft.it/6015a9lob Two compromised service principals divided discovery, destruction, and credential collection, with timing and overlapping token streams strongly indicating automated or scripted execution that included more than 100 storage account deletion attempts in about seven minutes. Discovered by Sysdig in July 2026, JADEPUFFER is reported to be the first documented agentic ransomware operation. These new findings expand publicly documented activity associated with Storm-3168 and indicate an evolution in the threat actor's cloud operations. Read the blog for analysis, Microsoft Defender detections, and mitigation guidance on protecting workload identities, revoking or rotating exposed credentials, and safeguarding backup and recovery resources.
3
22
1
144
18,357
Microsoft Security Research has identified extensive cloud resource destruction activity linked to JADEPUFFER, which Microsoft tracks as Storm-3168. The activity used compromised service principals and performed cloud credential collection that could be used to facilitate future exfiltration. msft.it/6015a9lob Two compromised service principals divided discovery, destruction, and credential collection, with timing and overlapping token streams strongly indicating automated or scripted execution that included more than 100 storage account deletion attempts in about seven minutes. Discovered by Sysdig in July 2026, JADEPUFFER is reported to be the first documented agentic ransomware operation. These new findings expand publicly documented activity associated with Storm-3168 and indicate an evolution in the threat actor's cloud operations. Read the blog for analysis, Microsoft Defender detections, and mitigation guidance on protecting workload identities, revoking or rotating exposed credentials, and safeguarding backup and recovery resources.
8
32
4
105
29,078
‼️ BREAKING: Ubiquiti has patched 21 criticalUniFi vulnerabilities, with CVSS scores up to 10.0. Attackers can execute commands remotely, bypass authentication and escalate privileges to take over the device. The vulnerabilities are present in UniFi OS Server and the Protect, Network and Connect applications.
29
191
29
1,728
196,157
FYI, if you’re are coming to the LIV at fountain blue for the after party, they will not let you in with electronic badges at all @defcon @defconparties
134
crewfasa retweeted
Cerberus preorders open use code defcon34 for 10% off
6
67
2,090
crewfasa retweeted
18 years ago today, Dan Kaminsky @dakami disclosed the DNS cache poisoning vulnerability at Black Hat USA 2008, triggering one of the largest coordinated patch efforts in internet history. Before public disclosure, Dan organized multiple vendors to fix the flaw in secret. Many more legendary stories than could fit here, like how he exposed Sony’s rootkit across more than 568,000 networks and identified critical certificate vulnerabilities. Dan followed what he cared about and his curiosity. As Michael Tiffany @kubla put it, “Only Dan thought, ‘I could fix the human eye in software.’” He built DanKam, an augmented-reality app that helped colorblind people see color. Michael hosted Dan while he built the first version and described watching a colorblind houseguest sit at the kitchen table, “crying tears of joy seeing red for the first time.” His mother, Trudy Maurer, may have said it best when she accepted his Lifetime Achievement Award at the 2025 Difference Makers. “Daniel was the catalyst for many achievements across the vast internet spectrum, and I believe Dan truly represented the intersection of technology and humanity.” @dotMudge, who presented the award, said: “The Lifetime Achievement Award isn’t about what you achieve in your lifetime. That’s part of it. It’s about how many people you influence and bring in and then take it further.” We lost Dan too early from diabetic ketoacidosis in April 2021 at age 42. Some of you are hearing the name Dan Kaminsky for the first time.  The coordinated, community-first spirit Dan modeled is the bar. If you're in Vegas this week, you're walking the streets that the legends of security who came before you walked, when they also had no idea what they were doing, facing problems nobody had solved before. They had to figure it out as they went. Just like you're going to do. Thanks to those who contributed to this tribute video: Jeff Moss @thedarktangent, @paulvixie, @gadievron, Lena Smart, Derek Hinch and the many others who shared here.
21
116
14
576
46,940
Think you've got what it takes? 🎯 RTV CTF returns for DEF CON 34 in the Red Team Village area at the Las Vegas Convention Center. Teams of experienced hackers, pentesters, and researchers go head to head, uncovering and exploiting vulnerabilities under serious pressure. High stakes, serious bragging rights if you place 🔥 More info: redteamvillage.io
3
16
1,566
We've been busy planning and organising for #DEFCON 34 so we're going to unwind with y'all next week on Friday evening. Check out the details in our poster below.
1
13
3
33
2,608
⏰ Another opportunity to score a Red Team Village party ticket arrives tomorrow! 🕓 The next access code drops tomorrow at 8:00 PM ET. A new code will appear on ONE of our social platforms. The only way to maximize your chances is to follow them all: ❌ X: @redteamvillage_ 📸 Instagram: @theredteamvillage 🦋 Bluesky: theredteamvillage.bsky.socia… 💼 LinkedIn: Red Team Village 🎟️ Good luck!
2
6
1,090
👀 Another RTV party access code drops tomorrow! 🕘 The next code drops tomorrow at 2:00 PM ET. Will it be on X? Instagram? Bluesky? LinkedIn? We're not saying. Only one platform gets the code. Follow all of our socials, turn on notifications, and be ready. ❌ X: @redteamvillage_ 📸 Instagram: @theredteamvillage 🦋 Bluesky: theredteamvillage.bsky.socia… 💼 LinkedIn: Red Team Village 🎟️ Every attendee needs their own ticket.
2
4
1,549
Worried about AI adoption in your organization, and whether you’re asking the right questions? I’ll be joining some amazing folks for a panel exploring how AI is changing the landscape for defenders and attackers. sans.org/webcasts/2026-sans-…
1
6
658
🕹️ Hack all day. Party all night. Keep the DEF CON fun going at the Red Team Village Party inside Asylum Bar + Arcade at AREA15. Enjoy arcade games, music, food, drinks, and free arcade tokens throughout the night. 🎟️ Tickets require an access code. 👥 Every guest must have their own ticket. No plus ones. The next access code drops Friday, July 17 at 2 PM EDT, on one of our socials! Want the best chance to score a ticket? Follow all of our social accounts and keep notifications turned on. X: @redteamvillage_ Instagram: @theredteamvillage Bluesky: theredteamvillage.bsky.socia… LinkedIn: Red Team Village 🔗 eventbrite.com/e/red-team-vi…
1
2
8
1,812
🚨 It's official. The Red Team Village Party is back! 🎉 Join us at Asylum Bar + Arcade inside AREA15 during DEF CON 34 for arcade games, music, food, drinks, and an incredible night with the community. 🕹️ We'll provide arcade tokens throughout the night. 🎟️ Tickets require an access code. 👥 Every guest must have their own ticket. No plus ones. The first access code drops Tuesday, July 14 at 7 PM EDT, on one of our socials! Want the best chance to score a ticket? Follow all of our social accounts and keep notifications turned on. X: @redteamvillage_ Instagram: @theredteamvillage Bluesky: theredteamvillage.bsky.socia… LinkedIn: Red Team Village 🔗 eventbrite.com/e/red-team-vi…
2
7
14
1,627
Every SOC has learned to live with alert overload. It shouldn't have to. On July 15, get a first look at NightBeacon CMD, the SOC workbench that helps analysts move from endless alerts to actionable situations with the context they need to make decisions faster. Join @HackingDave, Aaron Estes, and Jason Vest as they walk through how Binary Defense runs its own SOC and why we built NightBeacon CMD to keep analysts focused on the work that actually matters. If you're evaluating what the next generation of security operations looks like, this is a session you won't want to miss. Register today. binarydefense.com/webinars/n…
4
8
2
33
27,884
🚨 THE LABS SCHEDULE IS LIVE — TIME TO LEARN TOGETHER! 🚨 Clear the brush and track the next trail—the official Labs lineup for #CloudVillage at @defcon 34 has officially dropped for #HackerSummerCamp! If you love learning by doing, this is your space. 🌴🦕 Whether you want to learn to attack or scale your defensive skills, our interactive labs are built as collaborative environments for everyone to pick up practical skills. No gatekeeping—just awesome community builders helping each other level up across our core learning tracks: 🗡️ Attack Labs 🛡️ Strategic Defense Labs 🔍 Investigation Labs ⚔️ Attack and Tools Labs Pack your laptop and start mapping out your practical learning roadmap today! 🗺️ 👇 HOW TO PARTICIPATE 👇 1️⃣ Explore the schedule: cloud-village.org/dc34#labs 2️⃣ Reserve your seat: Pre-register here to secure your spot! ➡️ forms.gle/62vUrxFuW7prwUze9 #DEFCON34 #ApexPark #CloudSecurity #Infosec #Cybersecurity
3
1
2
439
We’re back, baby. defconparties.com — now with 2026 chaos edition. BSides -Black Hat- DEF CON and every vendor party trying to bribe you with free drinks! Bookmark it. Plan your liver damage. Thank us later. Share. defconparties.com shirt.defconparties.com
6
10
2
33
3,554
For years, we trained analysts to move faster through the queue. That made sense when the queue was the job. It isn't anymore. The repetitive work that fueled burnout is increasingly being handled by AI and automation. What's left is the work that has always required people: asking better questions, challenging model output, connecting evidence across systems, and making defensible decisions. The organizations that adapt their hiring, training, and performance metrics around that reality will build stronger security teams. The ones that don't will keep measuring success against a role that's already disappearing. @HackingDave breaks down what the Tier 1 analyst role actually looks like in 2027, what skills matter most, and why the conversation shouldn't be about replacing analysts, but elevating them. Read the full blog: binarydefense.com/resources/…
4
1
3
1,045