
Cyber | Security Operations & Engineering. coordinating @ngwhitehat, building @cyberplural. CISO of Nigeria 🇳🇬
🌍
Joined April 2011
- Tweets4.2K
- Following111
- Followers1.3K
- Likes3.8K
Pinned Tweet
Every little piece of #information or #data you dropped somewhere on the Internet is a piece of the puzzle named YOU. When the time is right, they can always be brought together.
Don't forget
You are your data!
#CyberAware – at Abuja, Nigeria
Hamzah 'Lateef retweeted
For the better part of October, the Cybersecurity Awareness Month, I have been touring the EU visiting 4 countries and 6 cities with a major focus on the transnational nature of cybercrime and a little bit of vacation.
I had the privilege of joining nearly 500 experts particpants from 106 countries in Strasbourg, France for the 16th Octopus Conference, organized by the Cybercrime Programme Office of the Council of Europe (C-PROC), to celebrate the 25th anniversary of the Budapest Convention on Cybercrime.
On my 3rd mission to the @coe , I took the stage alongside other distinguished speakers at the hemicycle for the closing plenary’s Lightning Talks. My session, "Beyond Yahoo Yahoo: AI, Cyber Slavery, and the Industrialization of Cybercrime in Africa," took an introspective look beyond traditional romance scams and BEC to expose a much darker, transnational reality taking root in Africa.
While Artificial Intelligence has certainly lowered the technical barrier to entry for cybercrime, the most terrifying development is physical: the massive, industrialized "scam compounds" that devastated Southeast Asia are now being franchised into Africa.
From Nigeria to Ghana to Uganda to Kenya to Zambia and other African nations, foreign-led syndicates are disguising themselves as legitimate tech and services companies. They are preying on systemic youth unemployment, luring in young adults into a life of cyber criminality, and stripping away their free will. This is no longer just fraud. It is digitalized human trafficking. It is cyber slavery.
At Cybersecurity Education Initiative (@cysedHQ ), our mission is clear: we implement preventive community diversion, intercepting and equipping our youth for legitimate digital employment before these syndicates can lure them in.
Thank you to the Council of Europe and Cybercrime Programme Office of the Council of Europe (C-PROC) team Aisling K., Catalina, Hortensia and others for an exemplary event and for giving these grassroots realities a global platform.
A special thank you to our session chair Stanislaw and other distinguished speakers Roberto, Oleksandra, Lucía, Jersain, Beatrice, Camila, and Adelina for their valuable contributions.
The technology is borderless, the syndicates are borderless, and our prevention strategies must be equally unified.
#OctopusConference #OctopusConference26 #Cybercrime #BudapestConvention #CyberDiplomacy #CYSED #DigitalRights #HumanRights #cyberslavery
Hamzah 'Lateef retweeted
Cyber warfare is real!
Episode 6 with @password_ng should be part of your todo list this weekend. Watch on YouTube: youtu.be/pkIl0y3E75I?si=v1NH…
#thecybervoicepodcast #cybersecurity #podcast #cyberwarfare #humanincyber
Hamzah 'Lateef retweeted
He copied a value out of the Windows Event Log.
Pasted it into his special browser.
And he was signed into Microsoft Entra as the user who had just authenticated.
No password. No phishing link. No stolen private key.
@MGrafnetter's Black Hat USA 2026 research...
Hamzah 'Lateef retweeted
I keep getting asked the same question lately:
Attackers are increasingly running large parts of intrusions with AI agents, and everyone can see the attacks are getting faster. So why aren’t defenders bringing the same firepower?
I wrote down where I see the real problem and what a realistic defensive approach could look like.
nextron-systems.com/2026/08/…
Hamzah 'Lateef retweeted
Today we have published the technical analysis and PoC for CVE-2026-55040, the Microsoft SharePoint authentication bypass we disclosed last month: rapid7.com/blog/post/ra-micr…
Earlier this year I built out an unauth RCE chain against SharePoint, we disclosed it to Microsoft in May and today they have patched out the chains auth bypass vuln, CVE-2026-55040. Disclosure details on the @rapid7 blog, full technical details to be published at a later date...
Hamzah 'Lateef retweeted
DEF CON 34でAccentureの研究者2人が、USB機器をWindowsへ接続するだけでSYSTEM権限を取得できる「Plug and Pwn」を発表した。管理者権限やログイン中のユーザーを必要とせず、Windows Plug and Playが自動取得する署名済みドライバーパッケージを悪用する。
攻撃ではSierra Wireless機器をエミュレートし、Everyoneに読み書きを許可した名前付きパイプのSetDNS機能を使ってDNSを変更する。続いてSony FeliCa機器をエミュレートすると、コインストーラーが平文HTTPから設定ファイルを取得するため、攻撃者のサーバーへ誘導できる。
さらにパストラバーサルを利用し、SYSTEM権限で任意のファイルをディスクへ書き込む。研究者はSystem32へDLLを配置して読み込ませた。また、RDPのUSBリダイレクトを利用すれば、物理的なUSB機器なしでも一般ユーザーが偽のデバイス情報を送り、サーバー側にSYSTEM権限でドライバーを導入させられるという。
関連するコンポーネントにはSierra Wireless、Sony FeliCa、Wacom、Atheros、Intel RealSenseが含まれる。研究者はFaceDancer用スクリプトなどPoC一式を公開している。
securityonline.info/windows-…
Hamzah 'Lateef retweeted
🇰🇵 We built a fake company. We recruited DPRK IT workers. We recorded everything.
📹 The full story is finally out: hours of footage, IOCs, things we never showed at DEF CON and even a familiar face from Season 1.
Smile, You’re on Camera: Episode 2.
🔥 We “hired” Lazarus APT remote workers — and uncovered their toolkit.
@BirminghamCyber & @north_scan used #ANYRUN Sandbox to capture weeks of Famous Chollima activity inside a fake startup.
👀 How not to let a spy in? See full story and videos: any.run/cybersecurity-blog/l…
Hamzah 'Lateef retweeted
CERT Polska: Follow-Up Analysis of the 29 December 2025 Energy Sector Incident
"To the best of our knowledge, the attack vector used in this case has not previously been observed in any known incidents."
"Attacks against industrial networks initiated directly from a PLC are not among the scenarios typically observed in OT environments."
cert.pl/uploads/docs/CERT_Po…
(Programmable Logic Controller, Operational Technology)
Hamzah 'Lateef retweeted
DEFCON: New Red Team Tactic doctoreww.github.io/EvilFont…
Hamzah 'Lateef retweeted
CVE-2026-45454 — Microsoft SharePoint Server Upload Page Folder Path Traversal to Remote Code Execution - @AretiqAI
aretiq.ai/research/vul260531…
Hamzah 'Lateef retweeted
🚨 PoC released: CVE-2026-27912, a Windows Kerberos privilege escalation vulnerability, now has a public exploit.
The flaw affects Windows Server 2012 and allows an authorized attacker to elevate privileges over an adjacent network.
PoC: github.com/semperis-communit…
#Microsoft #Windows #Kerberos #CVE #PoC #CyberSecurity #ActiveDirectory #Infosec
Hamzah 'Lateef retweeted
DLL Sideloading and Proxying in Red Team Operations

Author: Smukx
Resource: zerotracelab.com/blog/dll-si…
Yeah for those asking: NetExec now detects CVE-2026-27912 (ResetNightmare) via the enum_cve module.
Patch or check exposure 🚀
Replying to @stratosberry @ThreatWire_
Funny that you ask, the PR by @azoxlpf just got merged today adding the detection😁
Hamzah 'Lateef retweeted
CVE-2026-34348 exploitation demo from my #BHUSA "Pass-the-Passkey Family of Attacks" talk: WebAuthn assertion from recent YubiKey authentication is extracted from Windows Event Log and replayed against Microsoft Entra ID using Passkey Injector.
Whitepaper: specterops.io/passkeys
Hamzah 'Lateef retweeted
A fully operational Cobalt Strike campaign is active, leveraging a single exposed server at 43.156.228[.]149 (Tencent Cloud, SG) that functions simultaneously as the HTTPS Beacon C2, a WebDAV staging host, and an NTLM credential harvesting front. The attack chain begins with a .lnk shortcut disguised as AFC_Security_Report_2026.pdf. Upon execution, its PowerShell dropper sleeps for 3 seconds to evade sandboxes, disables AMSI via amsiContext corruption, and XOR-decrypts (key 0x75) a 762-byte x64 Beacon shellcode. The implant is injected entirely into memory using VirtualAlloc and CreateThread, leaving no disk artifacts. The Beacon communicates over HTTPS on port 443 using a static, randomized URI and impersonates a macOS Chrome user agent to blend into legitimate traffic.
The same IP serves an HTML clickfix page that abuses the search-ms: protocol to force Windows authentication against xyzblue.dpdns[.]org, transparently leaking the user's NTLM hash to the attacker for offline cracking or relay attacks. Port 8888 openly hosts the .lnk payloads via WebDAV, while port 443 delivers both the Beacon endpoint and the phishing interface. The adversary's operational security is severely lacking: the single IP exposes the C2, storage, phishing page, and relay trigger without any segmentation, and the full PowerShell payload along with the relay domain are left in cleartext within the HTML source. This otherwise technically capable campaign becomes entirely trivial to fingerprint and block.
#CobaltStrike #Beacon #NTLMRelay #Clickfix #FilelessMalware #AMSI #Infosec #ThreatIntel #OpSecFail #CyberSecurity
You don't need a USB. You need to look like one.
Emulate the device, Windows fetches a signed package off Windows Update and runs vendor code as SYSTEM. Arbitrary code execution, LPE, standard user or empty logon screen.
DEF CON 34 talk w/ @Qm9yamFN.
Link at the first comment.
One of the coolest Reverse Engineering TTPs. Analyzing APT29's recurring phishing methodologies and provides practical, technical demonstration on how reverse engineers extracts and reverse engineered Commercial C2 to uncover its operational security flaws. Re by @ippsec
Where do you see an average of 4200 attacks per week which is higher than the global average!
Information operations at it peak.
Believe those stat coming from sales men at your own peril.
Hamzah 'Lateef retweeted
Google Threat Intelligence Group is dropping our latest AI Threat Tracker report today, which covers several threats we are watching through a variety of means. The report includes some details of the first 0day exploit we've found developed with AI. 1/x cloud.google.com/blog/topics…




































