IT / OT CSIRT L3 Detection Analyst @AirLiquideGroup | Core Team Member @BSidesGoa | #CyberSecurity #ITSecurity #OTSecurity
India
Joined September 2017
- Tweets1.9K
- Following1.1K
- Followers661
- Likes11K
Aniket Chavan retweeted
Fully uncensored MiniMax-M2.1
PRISM abliteration removes refusals while keeping (and in some cases improving) the original coding, reasoning, and agentic strengths.
- Refusal behaviors removed.
- Full technical performance retained.
For researchers and builders who want maximum capability without the guardrails.
- huggingface.co/Ex0bit/MiniMa…
Aniket Chavan retweeted
Hugging Face just dropped the full forensic report,
the first autonomous agent cyberattack.
"The scariest part of Hugging Face’s full forensic report OpenAI’s agent didn’t just escape the sandbox."🤯
It’s how relentlessly it rebuilt its own C2 every time they killed it.
- It went full APT for 4.5 days
- 17,600 autonomous actions.
- Root access.
- Cluster-admin in one second.
- Production secrets.
- GitHub write tokens.
- VPN access 181 enrollments
, and was trying to poison the CI pipeline.
- Self-respawning fleet across 11 nodes.
- CI pipeline PR.
without any human directed a single step.
All because the agent decided the fastest way to pass ExploitGym was to steal the answers.
Every company running agents needs to read this today.
🏭 OT Security Insight
Industrial organizations accounted for nearly 30% of global ransomware activity over the past year.
Many organizations have mature IT monitoring but limited OT visibility.
Visibility remains the foundation of OT security.
itpro.com/security/cyber-att…
🚨 Zero-Day Watch
Trend Micro Apex One (CVE-2026-34926) has been observed under active exploitation.
Priorities:
✔ Validate exposure
✔ Patch affected systems
✔ Review suspicious file access activity
✔ Monitor for lateral movement
🛡️ Detection Engineering Tip
A good detection should answer:
1️⃣ What attacker behavior am I detecting?
2️⃣ What ATT&CK technique maps to it?
3️⃣ How can an attacker evade it?
4️⃣ What telemetry validates it?
Detection logic > Query syntax.
#DetectionEngineering #ThreatHunting
More than 30 Red Hat npm packages were recently compromised with malware designed to steal credentials from developer environments.
Reminder:
Trust ≠ Verification.
Monitor:
• Unexpected package updates
• CI/CD credential access
• New outbound connections from build systems
🎯 Threat Hunting Idea
Hunt for:
• Office → PowerShell
• Browser → cmd.exe
• Teams → PowerShell
These parent-child process relationships continue to be common indicators of phishing-driven initial access and malware execution.
What suspicious process chains are you hunting this week?
#ThreatHunting #ThreatHunt #ThreatIntel #DetectionEngineering #BlueTeam #Cybersecurity
CISA has warned that attackers are actively exploiting SolarWinds Serv-U (CVE-2026-28318), allowing unauthenticated attackers to crash vulnerable servers through crafted requests.
If Serv-U is exposed externally, prioritize patching and monitor for abnormal POST requests.
🚀 Back on X.
I'm CSIRT L3 Detection Analyst securing IT & OT environments.
Looking to connect with fellow cybersecurity professionals, researchers, and defenders. Let's learn, share, & grow together. 🤝
#CyberSecurity #ITSecurity #OTSecurity #SOC #ThreatHunting #DFIR #CSIRT
Aniket Chavan retweeted
WAF Bypass Discovered - Akamai & Cloudflare : 🙌🏻
A fresh technique has been spotted that successfully bypasses WAFs like Akamai and Cloudflare.
#infosec #cybersec #bugbountytips
Aniket Chavan retweeted
I wrote a Tool to detect MongoBleed exploitation in MongoDB logs 🩸
The detection logic is based on @eric_capuano's excellent research: the exploit makes thousands of connections but never sends client metadata. Legit drivers always do.
github.com/Neo23x0/mongoblee…
Features:
- Pure bash/jq/awk - no agents, runs via SSH or on forensic copies
- Streams large logs without loading into memory
- Handles compressed .gz rotated logs
- IPv4 & IPv6 support
- Configurable thresholds
- Risk levels: HIGH/MEDIUM/LOW/INFO
- a Python based wrapper that takes a host list as an input and runs the script on a set of remote systems
The sub folder ./example-logs contains a Mongod.log of an exploited system
Aniket Chavan retweeted
MongoBleed (CVE-2025-14847) is basically Heartbleed for MongoDB
- unauthenticated memory disclosure
- public POC, trivial to exploit
- leaks creds, tokens, cloud keys straight from RAM
- huge exposed surface on the internet
Good writeups and technical details here:
doublepulsar.com/merry-chris…
ox.security/blog/attackers-c…
blog.ecapuano.com/p/hunting-…
Patch fast, rotate secrets, and assume exposed instances were scanned(!)
Aniket Chavan retweeted
🚨A critical vulnerability in MongoDB (CVE-2025-14847) allows unauthenticated attackers to remotely leak sensitive data from MongoDB server memory.
A MongoDB honeypot intel stream has been now added into Defused TF and is available for subscription 🍯
👉console.defusedcyber.com/sig…
Aniket Chavan retweeted
🚨 MongoBleed (CVE-2025-14847)
MongoDB w/ zlib enabled (default) may leak uninitialized heap memory to unauthenticated attackers, risking credentials & tokens.
📌 Censys sees 87K+ potentially vulnerable instances.
✅ Patch: 8.2.3+, 8.0.17+, 7.0.28+, 6.0.27+, 5.0.32+, 4.4.30+
🔗 hubs.ly/Q03Z4_GS0
#MongoDB #CVE202514847
Aniket Chavan retweeted
🚨 Hackers Using PuTTY for Both Lateral Movement and Data Exfiltration
Source: cybersecuritynews.com/putty-…
Hackers are increasingly abusing the popular PuTTY SSH client for stealthy lateral movement and data exfiltration in compromised networks, leaving subtle forensic traces that investigators can exploit.
Threat actors favor PuTTY, a legitimate tool for secure remote access, due to its “living off the land” nature, blending malicious activity with normal admin tasks.
Attackers execute PuTTY binaries like plink.exe or pscp.exe to hop between systems via SSH tunnels and siphon sensitive files without deploying custom malware.
#cybersecuritynews
