Cybiosity retweeted
Giving away 2x full access packages:
Linux Attack, Detection & Forensics v2.0 - Hands-on Purple Teaming Playbook + 90 days PurpleLabs VPN access
To enter:
✅ Follow me
❤️ Like this post
💬 Comment
🔁 Repost
Winners announced March 22nd 🎯
First time doing this, let's see how it goes 😄
edu.defensive-security.com/l…
#linux #redteam #blueteam #dfir
Cybiosity retweeted
Active #RDP connections can reveal the client hostname 🔎
A key indicator for investigations & #CTI: some attackers reuse hostnames.
Traces to check: CLIENTNAME env variable & RDP printer redirection.
🛡️ Incident? Contact #Synacktiv CSIRT 24/7: [email protected]
Cybiosity retweeted
Binary obfuscation in 2026:
Just put ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FA... into your program 😎
I recently gave my 1st talk at an infosec conf (hack.lu 2025) w/ @Aeinot_ From our joint perspective (a Red Teamer and a DFIR analyst), we provided insights on how to use Blue Team tools to the Red Teamer's advantage.
youtube.com/watch?v=XDFWsWIA…
Recent attacker tradecraft, documented by Huntress (huntress.com/blog/velocirapt…), Talos Intelligence (blog.talosintelligence.com/v…) and Sophos (news.sophos.com/en-us/2025/0…) proves that we weren't that far off. 🤓
Si vous cherchez un stage/alternance, que vous êtes passioné⋅e⋅s par la cybersécurité et attaché⋅e⋅s aux détails, tentez votre chance dès maintenant ! Et pour les fans de DFIR, un stage dans l'équipe de Réponse aux Incidents est disponible à Toulouse. DM pour plus d'infos 😀
The @Synacktiv 2025-2026 Internship Opportunities Book is now available 📢
Assignments, desired profiles, contacts... everything you need to help you apply!
Send us your CV 📩 linkedin.com/feed/update/urn…
Cybiosity retweeted
LinkPro: new stealthy #Linux rootkit based on eBPF - full analysis 🔍️
Our #CSIRT team discovered and named LinkPro, a new Linux rootkit, during an incident response. It exploits eBPF for evasion and persistence.
Here are the four key technical points in the image below. 💡
🔗 Full analysis: synacktiv.com/en/publication…
Cybiosity retweeted
🚨 Still a few days to register for our Azure Intrusion for Red Teamers training at #BHUSA! Very hands-on, full kill chain from zero to Global Admin with stealth in mind. Secure your seat now! blackhat.com/us-25/training/…
If you're interested in YARA and Sigma rules linked to this research, check them out on our dedicated repository: github.com/synacktiv/synackt…
In recent incident responses with an Ivanti CSA compromise as the root cause, Synacktiv's CSIRT came across open-source tools used for post-exploitation. Our ninja @Cybiosity explores their functionalities and discusses detection capabilities.
synacktiv.com/en/publication…
If you're interested in detecting exploit scripts associated with these vulnerabilities, Sigma correlation rules are available right here: github.com/synacktiv/synackt…
Feel free to test them out, any feedback is appreciated 🙏
In 2024, Fortinet deployed several patches for CVE-2023-42791 and CVE-2024-23666, discovered by @Aeinot_, Paul Barbé and @loadlow. These vulnerabilities allow, from read-only access to a FortiManager, to execute code as root and thus take control of all managed FortiGates. synacktiv.com/advisories/for…
Cybiosity retweeted
Hello everyone! Our team loves everything related to LPE exploits. However, there is no publicly available list on the web with fresh LPE exploits (2023-2024) for Windows. However, we do have such a list. And we are sharing it with you!
github.com/MzHmO/Exploit-Str…
Cybiosity retweeted
me after my pull request of fixing a typo gets merged into an open source project
Cybiosity retweeted
Dependency confusion attacks pose a significant threat to modern software development. In their blogpost, @Scouty__ & @_Worty explain the risks and introduce DepFuzzer, a tool designed to detect vulnerabilities in your project dependencies: synacktiv.com/publications/f…
Cybiosity retweeted
Have you ever wondered how your PC communicates with an Android device when using adb? Check out our new blogpost!
synacktiv.com/publications/d…
Cybiosity retweeted
New script to dump the KCM database of recent versions of SSSD and convert Kerberos tickets to the standard CCACHE format to ease pass-the-cache: github.com/synacktiv/kcmdump
Cybiosity retweeted
A few months ago, the @freebsdfndation appointed us to audit two #FreeBSD critical components: the Bhyve hypervisor and the Capsicum sandboxing framework.
Today, related advisories and patches have come out 🧵
1. Multiple vulnerabilities in libnv
freebsd.org/security/advisor…
It's been really fun trying to fit my weird use case into @velocidex ! There is still work to accomplish, but I like to think it could be useful in remote #Veeam #DFIR investigations.
Want to collect forensic data from remote Veeam backups? @Cybiosity's exploration of remote Veeam forensics with Velociraptor might be what you're looking for!
synacktiv.com/publications/u…
