Cyber Threat Hunter
Joined December 2020
- Tweets787
- Following126
- Followers2K
- Likes1.9K
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
🚨❤️🔥💀 13 NEW remote RCEs on pfSense CE 2.9.0 💀❤️🔥🚨
These are BRAND NEW and not from Tuesday's earlier drop!
🔥 1. Wireless clone ifconfig
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root ifconfig command from a stored wireless clone interface
• 🔗 github.com/abraxas/pfsense-w…
🔥 2. Assign Interfaces Add
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root command from Assign Interfaces Add
• 🔗 github.com/abraxas/pfsense-a…
🔥 3. IPv6 gateway %zone
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root dpinger command from an IPv6 gateway zone
• 🔗 github.com/abraxas/pfsense-g…
🔥 4. Timezone php.ini prepend
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run root PHP on the next FPM request via php.ini auto_prepend_file
• 🔗 github.com/abraxas/pfsense-t…
🔥 5. sshguard THRESHOLD CRLF
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root sshguard command via THRESHOLD CRLF
• 🔗 github.com/abraxas/pfsense-s…
🔥 6. L2TP RADIUS mpd.conf
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root mpd helper from L2TP RADIUS
• 🔗 github.com/abraxas/pfsense-l…
🔥 7. PPPoE ptpid crontab
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root cron job from PPPoE ptpid
• 🔗 github.com/abraxas/pfsense-p…
🔥 8. PPPoE mpd.secret bang helper
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root bang-helper from PPPoE mpd.secret
• 🔗 github.com/abraxas/pfsense-p…
🔥 9. Captive Portal HA pfctl
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run root pfctl from Captive Portal HA host
• 🔗 github.com/abraxas/pfsense-c…
🔥 10. Unbound sock-queue-timeout
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: inject an Unbound include and run unbound-control as root
• 🔗 github.com/abraxas/pfsense-u…
🔥 11. Unbound ACL CRLF
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: inject an Unbound include through ACL CRLF
• 🔗 github.com/abraxas/pfsense-u…
🔥 12. OpenVPN connect_async eval
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: eval a RADIUS username as root in OpenVPN connect_async
• 🔗 github.com/abraxas/pfsense-o…
🔥 13. OpenVPN learn-address CN
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run su -c as root from an OpenVPN learn-address CN
• 🔗 github.com/abraxas/pfsense-o…
🧨 First drop (Tuesday) - 5 RCE's - pfSense:
• 🔗 xitter.cf/abraxas_null/status/21…
🧨 Second drop (Wednesday) - pfSense API:
• 🔗 xitter.cf/abraxas_null/status/21…
📖 Full series:
• 🔗 abraxaslabs.tech/research/pf…
🤖 Made with AI
🚨 🧯 Even MORE pfSense 0day? How??? 🧯 🚨
🧨 🚒 Exclusively pfSense API Exploits 🚒 🧨
Nine leftovers in Netgate’s pfSense Plus MIM API toolkit (public OpenAPI + official samples). Loopback labs. Full write-up at the end.
🔥 1 • Privilege leftover • Remote • Shape controller JSON so enrollment SSH runs as admin on every listed firewall • github.com/abraxas/pfsense-a…
🔥 2 • Privilege leftover • Remote • SSH MITM of first-contact enroll steals the SSH user and plants a hostile controller • github.com/abraxas/pfsense-a…
🔥 3 • Privilege leftover • Local • Any local uid that can open the device unix socket enrolls a hostile controller and dumps identity • github.com/abraxas/pfsense-a…
🔑 4 • Privilege leftover • Remote • With a read-shaped MIM JWT, download CA and leaf private keys and PKCS12 with no password • github.com/abraxas/pfsense-a…
🔑 5 • Privilege leftover • Remote • GET /services/acme returns the Let’s Encrypt account key and issued private keys • github.com/abraxas/pfsense-a…
🪪 6 • IDOR • Remote • One controller JWT lists every device and, if the role includes console, php/shell any enrolled box • github.com/abraxas/pfsense-a…
🪪 7 • IDOR • Remote • A stolen or derived ACB userkey fetches full Auto Config Backup blobs • github.com/abraxas/pfsense-a…
📂 8 • File read • Remote • GET Snort rules {file} may join outside the ruleset after %2F decode • github.com/abraxas/pfsense-a…
🔓 9 • Privilege leftover • Remote • Official samples disable TLS verify, so MITM of :8443 steals the JWT and replays 4–6 / php/shell • github.com/abraxas/pfsense-a…
abraxaslabs.tech/research/pf…
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
🚨 RCE in curl (CVE-2026-92392, HIGH Severity) 🚨
A malicious HTTP/2 server can turn a use-after-free during uploads into remote code execution.
Prerequisites:
● curl -T over HTTP/2 to an attacker-controlled server
● is ~135KB+ and contains \n\n anywhere
● -Z / --parallel for exploitation when PIE/ASLR is on
Affected: 8.12.0–8.22.0
Fix: 8.23.0 (or 8.20.2 / 8.16.2 / 8.14.3)
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
571 IIS servers hijacked using machine keys from public docs.
@soolidsnakee and @k33b0i break down REF3927 at @virusbtn VB2026
• Today, 15:00 CEST in the Green room.
Talk abstract and kill chain outline: go.es.io/3Us9kSw
Full blog: go.es.io/4hZ5TKG
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
VirusTotal is now available in ChatGPT
Scan files, URLs, and domains for potential threats, right from your chat
chatgpt.com/plugins/plugin_a…
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
We identified a malicious npm package, apexacc/cli, which led us to an operation posing as a Web3 accelerator.
Read more about REF8801 by @k33b0i and @DanielStepanic : go.es.io/3TDeUBk
The fake accelerator spent months courting crypto founders with free Claude and Gemini credits.
Our supply-chain monitor caught the package. It was malicious from its first published version.
The 2 Apex packages we examined, and what they deliver:
• apexacc/cli: redirects OpenRouter-labeled model requests to an attacker-controlled API
• apexacc/audit: MCP server whose 18 tools return fabricated findings
• macOS payload: CloudSyncD backdoor
• Windows payload: infostealer that exfiltrates to Telegram
We asked the operation's scoring tool to rate a project that doesn't exist. It scored 51 in every category, and said its AI scorer was down.
ALT How 1 npm alert led us to a fake Web3 acclerator
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
When Jev came out, this was exactly the kind of use case I had in mind.
I’ve been experimenting with a variation of this in my own incident-review workflow since then, and I finally turned the idea into an open PoC and I'm calling it Jevline.
The concept is pretty straightforward, give it one thing you’ve already confirmed is malicious, like a process, IP, domain, account or host.
It will follow the telemetry from there to reconstruct the incident and timeline.
Instead of asking Jev to reason over millions of events, Jevline only asks it about things actually connected to the incident.
On one real lab intrusion, starting from a single malicious process across 2.3 GB and 1M+ records, it reconstructed 40 of 41 processes in the analyst-built attack chain in 21 seconds for $0.11.
𝗘𝗹𝗮𝘀𝘁𝗶𝗰 𝗗𝗲𝗳𝗲𝗻𝗱
705,017 records / 1.3 GB
→ 33/41 processes
→ 1 wrong decision
→ 10 seconds
→ $0.03
𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗲𝘃𝗲𝗻𝘁 𝗹𝗼𝗴𝘀
310,942 records / 1.0 GB
→ 37/41
→ 0 wrong decisions
→ 6 seconds
→ $0.03
𝗕𝗼𝘁𝗵 𝘁𝗼𝗴𝗲𝘁𝗵𝗲𝗿
1,015,959 records / 2.3 GB
→ 40/41
→ 1 wrong decision
→ 21 seconds
→ $0.11
All three runs started from 2.8.exe alone.
The analyst still reviews the result. Jev is deciding whether something belongs to the incident, not whether it is malicious.
The clip below shows it working.
Try it:
jev-incident-timeline.vercel…
Code:
github.com/tsale/jevline
This made me rethink where AI actually fits into security engineering.
For purely engineering work, forget about ChatGPT or Claude.
TypeSafe AI just released Jev, and I think it’s going to change how we build AI into security workflows.
Instead of asking an LLM to “investigate this,” you define the questions and possible outputs, then get structured probabilities and decisions your code can actually use.
For security, the possibilities are huge. Think of the below use cases 🤯:
Threat Hunting:
➡️ Rank broad hunt results by relevance
➡️ Score users, hosts, processes, or sessions based on how suspicious their surrounding activity looks
➡️ Classify noisy activity at scale. Think thousands of rundll32.exe executions automatically grouped into expected admin activity, software execution, suspicious usage, or unknown
Detection Engineering:
→ Classify historical alerts for FP analysis
→ Add context-aware scoring on top of deterministic detections
→ Validate whether an alert actually supports the behavior the rule claims to detect
Incident Response:
→ Reduce massive timelines down to the events most relevant to the intrusion
→ Continuously score hosts/users for possible compromise
→ Help prioritize scope expansion, triage, and response decisions
This feels much closer to how AI should be integrated into security engineering. I'm currently working through most of the above, mostly focusing on instant response, but at the same time doing some of the threat hunting use cases that I mentioned.
Typesafe AI can be basically a decision engine sitting inside the workflow while being x200 fast and cheaper.
Don’t sleep on this... This is huge!
👉 typesafe.ai/
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
Which detection rules should you enable first?
Our prebuilt rules now answer that with a Profile tag.
It's a points score, recalculated monthly from fleet telemetry. Full scoring model: go.es.io/3Tl4W7y
Additional context added via rules tags:
- Noise: alert volume per environment across the fleet
- Performance: average and p95 execution time
- Threat: whether it covers a threat our team actively tracks
- Profile: severity plus the other 3, rolled into Recommended or Aggressive
Profile is a quick starting point: 385 rules are Recommended.
Noise, Performance and Threat show the trade-off behind each call.
Domain, Platform and DataSource tags then narrow it to your own track.
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
"DDoS-Guard verification" ClickFix malware. It uses DNS TXT records of luqiuid91[.]com to retrieve payloads
urlscan.io/search/#filename%…
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
Found a very useful dataset for anyone building security agents.
• 2M+ sanitized SOC events
• 51K+ incident provenance graphs
• natural-language attack reports
• ATT&CK context
Much better benchmark than asking your agent to explain Mimikatz.
huggingface.co/datasets/witf…
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
🚨CVE-2026-91843 is a critical (CVSS 9.8) pre-auth RCE affecting Check Point Quantum Security Management and Log Servers.
Censys sees 3,836 hosts globally with the management/log server role, not a confirmed-vulnerable count.
No public PoC or confirmed exploitation as of publication. Patches are available for supported versions. bit.ly/4y4ovQs
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
🚨 LOTTunnels — LIVING OFF THE TUNNELS 🔥
🔥 Telegram: t.me/hackinarticles
✴️ Twitter: xitter.cf/hackinarticles
Attackers don't always need custom infrastructure.
Sometimes, legitimate tunneling services can become part of the attack chain. 🌐⚔️
LOTTunnels is a community-driven project documenting digital tunnels that can be abused for:
🔹 Access
🔹 Shell Access
🔹 Data Exfiltration
🔹 Persistence
🔹 Phishing
🔹 Payload Download
The catalog includes tools/services such as:
⚡ ngrok
⚡ Cloudflared
⚡ localhost.run
⚡ LocalXpose
⚡ PageKite
⚡ Pinggy
⚡ Serveo
⚡ Tmate
⚡ TunnelTo
⚡ VSCode Tunnels
🎯 Why should Red Teamers & Defenders care?
Tunneling can create legitimate-looking network traffic while providing paths for remote access, command execution, or data movement.
For defenders, these services should be part of attack-surface discovery, detection engineering, and network monitoring.
🔗 Explore LOTTunnels:
lottunnels.github.io/
📌 Bookmark this resource for your next Red Team / Blue Team / Threat Hunting research.
⚠️ Use these techniques only in authorized environments.
♻️ REPOST & SHARE with your cybersecurity community!
#LOTTunnels #LivingOffTheLand #CyberSecurity #RedTeam #BlueTeam #ThreatHunting #Pentesting #C2 #NetworkSecurity #InfoSec
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
Several VBS samples associated with the infection chain used by UAC-0099 in campaigns targeting Ukrainian organizations
VBS IOCs:
fb211db793a58d54f92fcb664cf902afb7da780b07fc1e6534ba508957e753e3
c5c90e14f5f46acad888737d306c1b5b3c0c0996b0a15659f6962e2088ed2844
b937cf8dcdb4834c55d259b4345301b942a0939bf0bd59fcc4110d4d185a9bf8
9021d92a530bbb7b865d4842cc1b933e5b397d7a95c3f6a02db1c2512684222d
7f95f974717013734dcbc29ad5f22390fb1101468d86693438830fb1764b49ee
These samples are associated with the delivery chain
described by CERT-UA.
Report: cert.gov.ua/article/6318634
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
While investigating an ongoing intrusion, we have come across a threat actor using what appears to be a custom RMM written in Python.
The screenshot below shows the operator panel.
Anyone recognize this RMM or come across something similar before? Please reach out and we will be happy to share more details from what we are seeing at the moment.
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
❗️ CrowdStrike and NVIDIA have built two AI security models together, one to attack and one to defend
The pair were tested against each other on a digital twin of NVIDIA's own infrastructure
CrowdStrike says both run on NVIDIA Nemotron, trained on Falcon telemetry and 15 years of its incident-response data
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
🤓 I compiled some of the early AI Threat Intelligence reports and the progression is interesting!
2024 > AI was mainly used for assistance, influence operations, disinformation and early underground AI infrastructure.
2025 > We saw early malware using LLM, MCP attacks after broader adoption and the first alleged "agentic attacks".
2026 > Agent Skills became a supply chain target. Attackers also took advantage of coding agents that install packages and reports started to show agents such as Claude Code connected to offensive tooling during attacks.
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
Further Domain: register-mfa[.]com
🚨 New UNC6671 phishing infrastructure turning up in urlscan spoofing @AWNetworks and others
IoC: arcticwolfnetworks.mfaregister[.]com
Root domain:
mfaregister[.]com
匚ㄚ乃乇尺ㄖᐯ乇尺ㄥㄖ卂ᗪ retweeted
Top 5 most shared links in my network (Aug 31, 2026):
1. mannulinux.org/2026/08/Privi… (12 people)
2. calif.io/research/oempocalyp… (8 people)
3. github.com/MSNightmare/Prett… (7 people)
4. trustedsec.com/blog/securing… (7 people)
5. blackstormsecurity.com/resea… (7 people)