ClickFix is definitely the largest I see by quite a long way. EDR can usually see from the actions taken and what was pasted into cmd that this was the source.
Replying to @BushidoToken
What are you seeing as the most popular initial access delivery mechanisms for RMM?
Outright social engineering is one answer but kind of inefficient at scale.
ClickFix delivery of RMM is super simple, but I think we lose a lot of telemetry because a lot of ClickFix attacks are missed until later stages when EDR or ZTNA detects some other activity, maybe in the discovery or ingress tool transfer stage. As a result I don’t see much hard data on this pathway (rare vs frequent?).
We have done a few demos of maldoc delivery of RMM install (w/ @Shammahwoods at @BSides_ABQ last year), but the maldoc stuff gets fixed quickly.
We all seem to agree that RMM abuse is happening extremely frequently, but I see a little less data on exactly what delivery methods of RMM are most frequent. Maybe I just haven’t read the right reports.
@M_haggis @UK_Daniel_Card @ZackKorman @christian_tail
LAPS is great, but make sure those other local admins are audited and removed too!
LAPS continues to be one of the best controls available to prevent lateral movement
The best part? It's free :)
The admin experience is nicer in Entra than it is in Active Directory, and if you need something more, Lithnet Access Manager is awesome: lithnet.io/products/access-m…
Raphael Waller retweeted
OVERCLOCKED - Sortation Arena turns a boring enterprise backlog into a live arcade where AI agents race to clear a warehouse sortation line - same model, different silicon. Every parcel isn't a single prompt but a real multi-agent graph: a Router classifies the exception and dispatches it to one of 18 specialist worker agents, an image-aware Verifier independently double-checks the work and bounces it back for a retry when it's wrong, and an Exceptions Specialist makes the final call on adversarial or low-confidence items - all coordinated by an orchestrator that emits a full decision trace.
That's the heart of Track 1 (Multiverse Agents): genuine orchestration over genuinely multimodal work - vision (label photos, hazmat placards, damage), document (customs invoices, manifests), text (tariff, routing, SLA), and video (a conveyor-cam clip the model reads frame-by-frame). And because an agentic loop is latency-bound by design - several sequential model calls per parcel - wafer-scale inference compounds its lead: Cerebras runs Gemma 4 31B at ~1,000 tokens/sec while the identical model on a GPU crawls near 100, its conveyor visibly jamming. The race itself is the benchmark.
This is real work, not a toy: 18 task types across 111 hand-authored scenarios, every output schema-constrained and machine-graded against locked ground truth, with an ROI payoff card that tallies parcels cleared, accuracy, and pounds saved vs. manual handling - Track 3 (Enterprise Impact) made tangible.
It's engineered like production software, too: API keys live only in a Cloudflare Worker (never the browser), every task derives from a single Zod schema (one source of truth for the prompt, parser, grader, and UI), and a per-lane circuit breaker trips a failed provider to OFFLINE so a missing key never kills the demo - the other lanes race on. The whole blueprint is documented end-to-end in the Docusaurus docs - overclocked-docs.ourbiplane.… - and the full source is on GitHub
And it's fun - the People's Choice (Track 2) hook: a coin-op cabinet where animal clerks melt down under the backlog, a rubber-stamp THWACK lands on every cleared parcel, and a crown and confetti drop on the winner. "Watch AIs race to clear a warehouse backlog while their clerks drown in paper - same model, different silicon" is the scroll-stopper, and the side-by-side speed gap is the punchline. Watch the 60-second demo or play the live build right now - overclocked.ourbiplane.com - it ships with deterministic mock inference, so the full experience runs in your browser with no keys and no backend (hosted that way to keep it free to run). Same model, different silicon.
Speed is the game. ⚡
Raphael Waller retweeted
"That synagogue has been turned into a mosque so I don't know why someone would petrol bomb it."
The antisemitism crisis in a nutshell
The irony is that they actually consult for other regions and faiths helping them implement it within their own communities.
Raphael Waller retweeted
Friends! Iran 🇮🇷 is experiencing one of the darkest periods of her history. I am trying to be the voice of voiceless!
I will never forget who stood up for us during this terrible time. #FreeIran
A signed and whitelisted binary.
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
Raphael Waller retweeted
IDF: based on forensic, the Bibas babies were murdered by their Gazan captors with their bare hands. They chocked and beat the life out of their little bodies. Their bodies were then mutilated. Yarden Bibas wants the world to know what happened to his children. Tell them.
Raphael Waller retweeted
Eli Sharabi 💔
His wife Lian and his daughters Noya (16) and Yahel (13) were murdered by #Hamas on October 7th.
He was kidnapped with his brother Yossi, who was later also murdered.
Look at him.
#BringThemHomeNow 🎗️
If putting the maps as an overlay of NYC, probably best to compare to NYC population.
Manhattan and Bronx population is 50% more than Gaza in a smaller space if the map is correct.
Yes! This bit me when implementing Entra Private Access and authentication to on premise resources.
There's no LoS to a DC at login.
Did you ever hear of Kerberos Negative Caching on Windows machines? No me neither....
Check this post as this could also cause Kerberos issue in your environment.
#EntraID #Windows #ModernWorkplace #MsIntune
Raphael Waller retweeted
Just one video from the 7 October 2023: IRGC/HAMAS terrorists murder an Israeli man with his daughter in his arms.
Raphael Waller retweeted
Ariel Bibas is a child held hostage by Hamas in Gaza. On his 5th birthday, we all only have one wish. We want him, his family, and all the hostages home now.
.@AndresGorzelany any recommendations for putting in restrictions on Teams Communication Credits so users can only use them for specific numbers?
Raphael Waller retweeted
Abdallah Aljamal wrote this article while Israeli hostage Noa Argamani was being held hostage in his own home. Crazy.
“Homes are gone, and with that, the memories, hopes and aspirations of Palestinians and their ability to realize other rights,” the statement continued.
Read the latest story by Abdallah Aljamal, reporting from war-torn Gaza.
palestinechronicle.com/domic…
































