Recently active topics

CVE-2026-20245 matters as a control plane compromise that can lead to root access on Cisco Catalyst SD-WAN control components. The issue affects the CLI in Cisco Catalyst SD-WAN Controller, Manager, and Validator, which were formerly known as vSmart, vManage, and vBond. Cisco describes it as an authenticated local privilege escalation. An attacker with netadmin privileges can submit a crafted file, trigger command injection, and run commands as root. That access requirement changes how the case should be read. In most cases, this is a second-stage issue rather than the first move. The attacker already needs a foothold, whether through valid credentials, compromised credentials, or an earlier SD-WAN authentication bypass weakness. Cisco has not described broad exploitation through other paths, but it has seen limited cases where attackers used this access to push configuration changes to edge devices. Prioritize systems exposed to untrusted management networks, the ones showing rogue pe

OverviewBetween March 30 and May 1, 2026, Cato CTRL researcher Vitaly Simonovich tracked a French-speaking cybercriminal known by the handle "Poisson" through every command of a 33-day intrusion operation. The result was 339 recorded commands, four compromised victims, and a persistence mechanism that continued functioning for 18 days after the attacker's primary command-and-control (C2) server went offline.What makes Operation Poisson stand out from the routine credential-theft campaigns that plague small businesses is not the sophistication of the attacker. Poisson is, by all available indicators, a junior operator -- likely a student learning offensive security while running live operations against real targets. What makes it notable is the specific persistence decision he made on Day 8: installing OpenSSH Server and Tailscale VPN on a victim machine to create a resilient access layer entirely independent of his C2 framework.That single move validated what defenders have theorized f

TL;DRThe Gentlemen (operators tracked by Microsoft as Storm-2697) is a Russian-speaking, financially motivated ransomware-as-a-service operation that emerged mid-2025 from a Qilin affiliate split; its distinguishing feature is that operators centrally build, maintain, and distribute a full EDR-killer suite anchored by the in-house GentleKiller framework (8+ BYOVD variants) directly to affiliates, lowering the bar for affiliate-led intrusions. GentleKiller and its companion third-party killers (HexKiller, ThrottleBlood, HavocKiller) all work via Bring Your Own Vulnerable Driver (BYOVD): drop a signed-but-vulnerable kernel driver, load it as a service, then send IOCTLs to terminate 400+ security processes mapped to 48 vendors, defeating user-mode tamper protection from Ring 0. The single best detection surface is kernel driver-load telemetry (Sysmon Event ID 6 / Event ID 7045 service install) plus the GentlemenCollection staging directory. FortiGate edge compromise (CVE-2024-55591) is th

FortiBleed should be treated as an edge-credential exposure event. If a FortiGate administrator or SSL VPN account is valid and exposed, an attacker may not need a new exploit. They may be able to log in directly.  Public reporting describes a credential-harvesting campaign involving Fortinet FortiGate firewalls, SSL VPN gateways, and administrative management interfaces. Researchers reported tens of thousands of device entries, including URLs, usernames, email addresses, plaintext passwords, and credential material tied to FortiGate environments. Fortinet's June 19 analysis says its initial review points to credential reuse from earlier incidents and brute-force activity against systems with weak password hygiene and no MFA. Fortinet says the activity is not tied to a new Fortinet vulnerability or a recent advisory. Current confidence  Medium. Public reporting and Fortinet analysis agree that exposed or reusable credentials are the central issue. They differ on scale, collec

 Have a Product Idea? Help Shape the Future of Securonix Innovation at Securonix is driven by you — our customers and partners. Whether you’ve identified a gap, experienced a challenge, or have an idea for a new feature, we want to hear from you. We’ve created a dedicated Product Ideation space where you can share ideas, collaborate with others, and help influence our product roadmap.  🚀 What You Can Do  Submit feature requests directly to our Product team Share ideas to improve workflows and usability Collaborate with other customers and build on ideas Upvote submissions to help prioritize what matters most   🔐 Access the Full Guide & Submit Your Idea To learn how the ideation process works — including what to submit, when to submit it, and how ideas are reviewed — access the full guide below: 👉 [Log in to view the Product Ideation Guide ] 🔒 This guide is available to logged-in customers only. 🧭 What You’ll Find Inside Once logged in, you’ll get step-by-step guidance on

name: ErrTraffic ClickFix C2 API Endpoint Pattern Analyticsignatureid: PXY-WEB10-RUNcategory: 'Command and Control'threatname: 'Application Layer Protocol: Web Protocols'functionality: 'Web Proxy'description: | Detects outbound HTTP requests matching the distinctive C2 API endpoint patterns used by the two identified ErrTraffic ClickFix framework clusters ("Analytics" and "Beer"), as documented by Sekoia TDR. The "Analytics" cluster fetches its ClickFix lure script from a /cf.js endpoint after resolving its C2 via a single stable Polygon smart contract. The "Beer" cluster instead queries /api/index.php with a distinctive parameter set (a=ctx, os=, src=cloudflare, mode= download) to retrieve an RC4-encrypted PowerShell command, or loads its injector via /api/css.js. These endpoint and parameter patterns are independent of the current C2 domain, which both clusters rotate frequently via EtherHiding, making this a more durable signature than domain-based blocking alone.reference:

name: ErrTraffic ClickFix XOR-Decoded PowerShell Dropper Analyticsignatureid: WEL-PSH135-RUNcategory: 'Defense Evasion'threatname: 'Obfuscated Files or Information: Command Obfuscation'functionality: 'Microsoft Windows Powershell'description: | Detects the distinctive XOR-decode-and-execute PowerShell pattern used by the ErrTraffic ClickFix distribution framework to deobfuscate and run its dropper stage. ErrTraffic is a Malware-as-a-Service ClickFix toolkit (operator alias "LenAI") that, since its v3 release, uses the EtherHiding technique (Polygon and BNB Smart Chain smart contracts) as a dead-drop resolver to fetch C2 infrastructure and ClickFix lure content. After the victim is socially engineered into pasting a "verification" command into Run or PowerShell, the resulting PowerShell command line contains a Base64/character-code XORed string that is decoded inline using bxor against [int][char] values before being invoked. This decode pattern is distinct from generic obfusca

There's a particular kind of dread that sets in when two well understood attacker techniques, each individually annoying but manageable, get packaged together into a single commercial product. That's exactly what's happened with ErrTraffic, a Malware as a Service (MaaS) framework that has spent the past several months quietly fusing the EtherHiding technique with the ClickFix social engineering tactic into one rentable toolkit.Neither technique is new on its own. What's new is that they're now sold together, supported by a vendor, and actively iterated on based on customer feedback, the same way any other SaaS product evolves.The product, not the payloadErrTraffic first surfaced on Russian language cybercrime forums in December 2025, advertised by a threat actor operating under the handle LenAI. It wasn't pitched as malware. It was pitched as infrastructure: a Traffic Distribution System (TDS) that other criminals could rent to deliver whatever payload they wanted.The pitch was specifi

Securonix UDS Content Library This catalog provides a central place for customers to discover dashboards available for Unified Data Source (UDS), with a focus on threat detection, investigation, operations, executive reporting, and compliance.How to import a dashboardUse the following steps to import a dashboard into Security Center Data Insights:Open Menu in the upper navigation. Select Security Center and then Data Insights. Click the + icon and choose Create New Dashboard. Select Import Dashboard. Drag the file into the upload area or click to upload. Select Yes on the import prompt. The dashboard will be imported and saved under the name included in the import package.Featured dashboards MITRE Coverage Dashboard Measures detection coverage across the MITRE ATT&CK framework and helps identify gaps, validate analytics maturity, and understand how content maps to adversary behavior. Highlights Complete MITRE coverage by tactic and technique Analytics technique covera

name: Suspicious WMI QoS Policy Instance Creation Targeting Security Processes Analyticsignatureid: EDR-SYM933-RUNcategory: 'Defense Evasion'threatname: 'Impair Defenses: Disable or Modify Tools'functionality: 'Endpoint Management Systems'description: | Detects process-level WMI activity consistent with programmatic creation of MSFT_NetQosPolicySettingData instances in ROOT\StandardCimv2, the mechanism used by the EDRChoker compiled binary to apply QoS bandwidth throttle policies against EDR agent processes without invoking PowerShell. EDRChoker uses System.Management (WMI) directly from a C# binary to call ManagementClass.CreateInstance() and Put(PutType.CreateOnly) on MSFT_NetQosPolicySettingData, setting ThrottleRateAction to 8 bits per second against a target EDR process via AppPathNameMatchCondition. This approach bypasses Script Block Logging entirely and is not captured by WEL-PSH130-RUN. Detection relies on Sysmon Event ID 19/20/21 (WMI activity) or equivalent WMI ope

Published: June 10, 2026Tags: Defense Evasion, EDR Bypass, Red Team, T1562.001, Windows InternalsIntroductionFor years, the conversation around EDR bypass has centered on one of two approaches: kill the agent process outright, or cut its network access. Tools in both categories have matured significantly, and defenders have responded with increasingly robust detections. Firewall-based blocks leave packet-drop artifacts. BYOVD attacks require dropping a kernel driver to disk. Neither approach is quiet anymore.On June 7, 2026, a researcher publishing under the handle @TwoSevenOneT released a tool called EDRChoker that takes a different path entirely. Rather than killing or blocking an EDR agent, EDRChoker starves it. By applying extreme bandwidth throttling at a layer of the Windows network stack that most EDR solutions have never monitored, it causes agents to time out silently and continuously, severing their connection to the server without generating the artifacts defenders are train

Audience: Securonix Administrators, Identity Administrators, MSSPs Product Module: Administration → Settings → SAML Settings Last Updated: February 27, 2026 KB ID: KB-20260227-uds-sso-login-failuresTags: SAML, SSO, Azure AD, Okta, Authentication, Redirect Loop, Certificate Expired, Invalid Audience, Role Mapping Table of ContentsProblem  Objective  Step-by-Step Solution  Step 1 – Perform a 60-Second Configuration Validation (Always Do This First)  Step 2 – Validate Metadata and URL Alignment Step 3 – Validate the Signing Certificate Step 4 – Validate Time Synchronization (Clock Skew) Step 5 – Validate User Assignment and Role Mapping Step 6 – Validate Local Login (Isolation Test) Final Notes When to Contact Support Verification Checklist Need Additional Help?Problem   Users are unable to log in to UDS using SAML SSO. Common symptoms include:  Redirect loop after login  “Invalid SAML response”  “Invalid audience”  “Signature validation failed”  Azure error AADSTS700016 (applica

name: Suspicious Developer Secret Access via Node.js Ecosystem Analyticsignatureid: EDR-SYM931-RUNcategory: 'Credential Access'threatname: 'Unsecured Credentials'functionality: 'Endpoint Management Systems'description: | Detects Node.js ecosystem processes accessing sensitive developer, cloud, container, and infrastructure credential files. This behavior is commonly associated with malicious npm packages abusing lifecycle hooks such as preinstall, install, postinstall, or prepare scripts to harvest secrets from developer workstations. Threat actors increasingly target software supply chains by embedding credential-stealing functionality into npm packages. During execution, malicious Node.js code may enumerate SSH keys, cloud provider credentials, Kubernetes configurations, Docker authentication files, package manager tokens, Terraform state files, and Vault secrets before exfiltrating them to attacker-controlled infrastructure. Similar techniques wer

Published: June 4, 2026Tags: Supply Chain, npm, Credential Theft, CI/CD Security, T1195.002IntroductionOn June 1, 2026, a credential-stealing worm quietly embedded itself into 32 officially published packages under Red Hat's @redhat-cloud-services npm namespace. By the time security researchers noticed and began pulling malicious versions, those packages had already accumulated roughly 80,000 weekly downloads across 96 poisoned versions. By June 3, a second wave had spread the same worm to 57 more packages across entirely separate maintainer ecosystems, including the official Vapi.ai server SDK with over 408,000 monthly downloads.The campaign has been named Miasma, after a string the malware stamps onto attacker-created GitHub repositories: "Miasma: The Spreading Blight." The name fits. This is not a targeted intrusion against a single organization. It is a self-replicating supply chain worm, and the infection vector was not a zero-day or a clever bypass. It was a session cookie stolen