CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway

UPDATE: Palo Alto Networks confirmed on Tuesday (4/16) that disabling device telemetry is no longer ...

Read More

CNAPP, CSPM, CIEM, CWPP – Oh My!

We all know the cybersecurity industry loves its acronyms, but just because this fact is widely ...

Read More

Phishing Deception - Suspended Domains Reveal Malicious Payload for Latin American Region

Recently, we observed a phishing campaign targeting the Latin American region. The phishing email ...

Read More

Zero Trust Essentials

This is Part 5 in my ongoing project to cover 30 cybersecurity topics in 30 weekly blog posts. The ...

Read More

Why We Should Probably Stop Visually Verifying Checksums

Hello there! Thanks for stopping by. Let me get straight into it and start things off with what a ...

Read More

Agent Tesla's New Ride: The Rise of a Novel Loader

Malware loaders, critical for deploying malware, enable threat actors to deliver and execute ...

Read More

Evaluating Your Security Posture: Security Assessment Basics

This is Part 4 in my ongoing project to cover 30 cybersecurity topics in 30 weekly blog posts. The ...

Read More

Trustwave SpiderLabs: Artificial Intelligence Playing a Prime Role in BEC and Phishing Attacks

Criminals have historically been quick to embrace cutting-edge technology for their financial gain. ...

Read More

The Inevitable Threat: AI-Generated Email Attacks Delivered to Mailboxes

Generative AI exploded in popularity not too long ago but its influence on text and media creation ...

Read More

Cybersecurity Documentation Essentials

This is Part 3 in my ongoing project to cover 30 cybersecurity topics in 30 weekly blog posts.

Read More

Ukrainian Intelligence Claims Successful Compromise of the Russian Ministry of Defense

On March 4, 2024, the Telegram channel of the Main Directorate of Intelligence of the Ministry of ...

Read More

Cost Management Tips for Cyber Admins

As anyone who has filled out an expense report can tell you, cost management is everyone's ...

Read More

Resurgence of BlackCat Ransomware

Updated March 8: Based on our experience, we believe that BlackCat's claim of shutting down due to ...

Read More

Cloud Architecture, Frameworks and Benchmarks

At any point in your cloud security journey, you should consider practical architectures, ...

Read More

Hunting For Integer Overflows In Web Servers

Allow me to set the scene and start proceedings off with a definition of an integer overflow, ...

Read More

Welcome to Adventures in Cybersecurity: The Defender Series

I’m happy to say I’m done chasing Microsoft certifications (AZ104/AZ500/SC100), and as a result, ...

Read More

Trustwave SpiderLabs: Insights and Solutions to Defend Educational Institutions Against Cyber Threats

Security teams responsible for defending educational institutions at higher education and primary ...

Read More

Breakdown of Tycoon Phishing-as-a-Service System

Just weeks after Trustwave SpiderLabs reported on the Greatness phishing-as-a-service (PaaS) ...

Read More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising

During an Advanced Continual Threat Hunt (ACTH) investigation that took place in early December ...

Read More

Trustwave SpiderLabs Guide: Jailbreaking Apple iOS 17 and Above

PLEASE NOTE: Jailbreaking any phone has the potential to permanently damage your device. Even if ...

Read More

Trusted Domain, Hidden Danger: Deceptive URL Redirections in Email Phishing Attacks

In this ever-evolving landscape of cyberthreats, email has become a prime target for phishing ...

Read More

Spoofing 802.11 Wireless Beacon Management Frames with Manipulated Power Values Resulting in Denial of Service for Wireless Clients

This is another one of those blog posts from me about how I independently carried out some security ...

Read More

Trustwave SpiderLabs Detects Spike in Greatness Phishing Kit Attacks on Microsoft 365 Users

Trustwave SpiderLabs is tracking a spike in usage of the Greatness phishing kit to attack Microsoft ...

Read More

Apache ActiveMQ Vulnerability Leads to Stealthy Godzilla Webshell

Trustwave has observed a surge in attacks exploiting vulnerabilities in Apache ActiveMQ hosts. In ...

Read More

Beyond the Facade: Unraveling URL Redirection in Google Services

In the murky waters of cyber threats, one tactic has steadily gained wide adoption: URL redirection ...

Read More

Types of Social Engineering Attacks used to Gain Internal Network Access

Social engineering is a technique commonly used by adversaries to manipulate individuals or groups ...

Read More

(Response) Splitting Up Reverse Proxies To Reach Internal Only Paths

When I’m carrying out security research into a thing, I generally don’t like to Google prior ...

Read More

Trustwave Transfers ModSecurity Custodianship to the Open Worldwide Application Security Project (OWASP)

After serving as its steward for over a decade, Trustwave has agreed to transfer the reins of the ...

Read More