usama R.

Oct 22, 2026 · Reshared

**Before the Ransomware Attack: The Initial Access Broker Economy**

Not every ransomware operation begins with the ransomware group gaining initial access.

In some cases, that access may already be available through an Initial Access Broker (IAB).

Compromised VPN credentials, exposed remote access services, and access to corporate environments can become commodities in underground markets.

For threat researchers, the important question isn't simply who deployed the ransomware.

It's also:

- Who may have obtained the initial access?

- Was that access advertised or transferred before the attack?

- Are there credible links between the access broker and the ransomware operation?

- What evidence supports those connections?

At LAB7 Threat Research, we're exploring these questions through passive OSINT monitoring and analysis of publicly available intelligence.

An advertised access listing is not proof of compromise, and a claimed connection is not confirmed attribution.

**Understanding the access economy may help explain what happens before ransomware deployment.**

#ThreatIntelligence #InitialAccessBroker #Ransomware #ThreatResearch #OSINT

View post

Oct 22, 2026 · Reshared

I've been working on a personal project called Foxscan 🦊, and I wanted to share it with the cybersecurity community and get some feedback.

The idea came from a problem I kept running into: different news outlets covering the same cybersecurity incident, each reporting different details. Information is often fragmented, and it takes time to piece everything together and figure out what's actually relevant or reliable.

So I built Foxscan, an automated cybersecurity news platform available in both English and Italian.

How it works:

- 🔎 News aggregation: Monitors multiple cybersecurity news sources and combines articles covering the same incident into a single, more complete report, bringing together details from different publications.

- 🏷 Categorization: Summarizes key information and organizes news into categories like AI Security, ransomware, vulnerabilities, data breaches, phishing, and more.

- 🚨 Severity classification: Automatically assigns a severity level to each story, highlighting the most critical incidents on the homepage.

- 📱 Social media & RSS: Automatically creates Instagram carousels for major stories and provides an RSS feed for anyone who prefers following news through their own reader.

- 🔐 Security: I also focused on securing the platform itself, including admin access protection, API rate limiting, and URL validation for externally fetched content.

One of the biggest challenges? Keeping everything free.

This is a non-profit personal project built mainly for learning and sharing cybersecurity news. I wanted to see how far I could push automation while keeping the platform running without recurring service costs, using hardware I already own and free hosting/service tiers.

It's still a project I'm improving, so I'd really appreciate feedback, especially on the aggregation approach, severity classification, and overall usefulness.

🔗 Check it out: https://foxscan.vercel.app

Let me know what you think, or what you'd improve!

View post

Oct 22, 2026 · Reshared

🔐 Splunk SIEM INTEGRATION

Generate → Collect → Forward → Parse → Index → Normalize → Search → Alert

⚠️ Collection fails = Splunk is blind.

⚠️ Forwarding/parsing fails = Detection can fail.

🏗️ SPLUNK CORE

🔹 UF → Endpoint log collection

🔹 HF → Optional parsing/routing

🔹 Indexer → Receives amp; stores events

🔹 Search Head → SPL, dashboards amp; investigation

━━━━━━━━━━━━━━

🪟 1️⃣ WINDOWS / AD

📌 Install Splunk Universal Forwarder (UF) on the Windows server/DC.

⚙️ inputs.conf

[WinEventLog://Security]

disabled = 0

index = windows

📊 Collect: Security, System, Application, PowerShell, Sysmon

.➡️ Forward: UF → Indexer

🔌 Port: TCP 9997

🔎 Validate: Service → Connectivity → Index → Sourcetype → Events

━━━━━━━━━━━━━━

🐧 2️⃣ LINUX

📌 Install UF and monitor:

/var/log/auth.log

/var/log/secure

/var/log/syslog

⚙️ Example:[monitor:///var/log/auth.log]

index = linux

➡️ Forward: UF → Indexer

🚨 Detect: SSH brute force, failed authentication, privilege escalation

━━━━━━━━━━━━━━

🔥 3️⃣ FIREWALL

1️⃣ Set Splunk/Syslog receiver IP

2️⃣ Configure UDP/TCP 514

3️⃣ Configure Splunk input

4️⃣ Set index + sourcetype

5️⃣ Search amp; validate events

🔄 Flow: Firewall → Syslog → Splunk → Index → CIM → Detection

━━━━━━━━━━━━━━

🛡️ 4️⃣ EDR

❌ No UF on the cloud console.

1️⃣ Create API credentials

2️⃣ Install vendor App/Add-on

3️⃣ Enter API URL + ID/Secret/Token

4️⃣ Configure polling/ingestion

5️⃣ Set index + sourcetype

6️⃣ Validate events

🔄 Flow: EDR Cloud → API → Add-on → Index → CIM → Detection

━━━━━━━━━━━━━━

☁️ 5️⃣ CLOUD / SaaS

🔗 Methods: API / HEC / Add-on / Cloud integration

☁️ AWS: CloudTrail → S3 → Splunk → Index

1️⃣ Enable required logs

2️⃣ Configure IAM/API access

3️⃣ Configure Splunk input/Add-on

4️⃣ Set index + sourcetype

5️⃣ Validate events

━━━━━━━━━━━━━━

📧 6️⃣ EMAIL SECURITY

M365 / Mimecast / Proofpoint / Barracuda

1️⃣ Enable audit/security logs

2️⃣ Create API/App credentials

3️⃣ Configure Add-on/API input

4️⃣ Set index + sourcetype

5️⃣ Validate phishing, malware, spam amp; mail-flow events

━━━━━━━━━━━━━━

🛡️ 7️⃣ DLP

Netskope / Forcepoint / Purview

🔄 DLP → API/Connector → Splunk

🔐 API Auth → Add-on/Input → Polling → Index/Sourcetype → Fields → CIM

━━━━━━━━━━━━━━

🚨 8️⃣ IDS / IPS / WAF / PROXY

Snort / Suricata / F5 / Cloudflare / Web Proxies

🔗 Methods: Syslog / File Monitor / API / HEC

📁 Example: /var/log/snort/alert⚙️ Input → Index → Sourcetype → Fields → Detection

━━━━━━━━━━━━━━

📱 9️⃣ APPLICATION LOGS

🐧 Linux: /var/log/app/app.log

🪟 Windows: C:Applogsapp.log

1️⃣ Install UF

2️⃣ Configure file monitoring

3️⃣ Set index + sourcetype

4️⃣ Configure timestamp/line breaking

5️⃣ Validate fields amp; events

━━━━━━━━━━━━━━

🧩 🔟 PARSING → CIM → DETECTION

Raw Event → Sourcetype → Field Extraction → CIM → SPL → Correlation → Alert

━━━━━━━━━━━━━━

#Splunk #SplunkSIEM #SIEM #SPL #CIM #LogManagement #SIEMIntegration #SOC #SOCAnalyst #SOCOperations #DetectionEngineering #ThreatHunting #IncidentResponse #CyberSecurity #InfoSec #BlueTeam

COPIED

View post

Oct 22, 2026 · Reshared

https://www.save-europe-act.com/sk/

View post

Oct 22, 2026 · Reshared

When trying to impersonate someone to contact me about a cybersecurity CMO role, spelling their name correctly would be a stronger start.

An email arrived last night. Apparently my cybersecurity marketing and GTM experience had “genuinely stood out”.

Except…

The sender was using a Gmail address.

The company name in that email address didn’t quite match the name of the company (the word “labor” 🇺🇸 had magically grown an additional vowel 🇬🇧, and another word had depluralised itself in the process. One letter in, one letter out, I guess🧐)

The person supposedly approaching me was its Chief Information Officer.

The company specialises in blue-collar staffing.

An unusual combination for a cybersecurity executive search, you might say…

Then, over the course of four sentences, the sender also managed to forget how to spell their own surname. I mean, it happens to the best of us, right? 🤣

There is a real person with that name and title at that company. I’ve reached out independently on LinkedIn to flag the apparent impersonation.

A quick search might have reassured me that the person existed. It wouldn’t have established that they sent the email.

Unfortunately for whoever wrote this, I can read (both British and US English!), and have enough experience to know what a CIO generally doesn’t do.

The job market is exhausting enough without this malarkey. 🤷‍♀️

Alfred Intelligence has reviewed the “opportunity” and would also like to express his reservations. 👀

#RecruitmentScams #JobScams #Cybersecurity #AlfredIntelligence

View post