Zane A.

Oct 19, 2026

Hey all - Happy Monday!!

Module 8: Malware Threats is live on iscsecurity.org.

This is the module after system hacking: moving from local host exploitation to understanding, analyzing, and mitigating the malicious software that powers modern cyber campaigns. Decoding automated delivery mechanisms, analyzing advanced persistent threats, dissecting complex strains, and mastering defense-evasion tradecraft. Lab-only. Isolated topology.

What's shipped (Full Module Layout):

• 01. Introduction to Malware Threats: Beyond the signatures—understanding the malicious ecosystem

• 02. Malware Fundamentals: Core characteristics, propagation types, and baseline structures

• 03. APT Concepts: Advanced Persistent Threats, state-sponsored actors, and targeted campaigns

• 04. Trojan Concepts: Entry vectors, distribution networks, and stealth deployment mechanisms

• 05. Virus & Worm Concepts (Part 1): Self-replicating code, structural designs, and infection vectors

• 06. Virus & Worm Concepts (Part 2): Advanced replication techniques and large-scale network propagation

• 07. Fileless Malware Concepts: Leveraging native system binaries to bypass endpoint detection

• 08. AI-Based Malware Concepts: Next-generation threats, automated evasion, and machine learning exploits

• 09. Malware Analysis: Reverse engineering fundamentals, sandboxing, and behavioral monitoring

• 10. Malware Countermeasures: Constructing active defensive barriers and signature development

• 11. Module Summary: Core takeaways, review points, and practical lessons compiled

• 12. Malware Threats Cheat Sheet: Quick-reference tools, identification syntaxes, and exam preparation resources

Malware Threats is where analysis becomes software: proving execution, breaking detection boundaries, and demonstrating how automated code runs natively inside compromised infrastructure.

If you skip it, security assessment lacks payload knowledge and defense remains blind.

Master Class Series → Malware Threats iscsecurity.org

#ethicalhacking #malwarethreats #malwareanalysis #reverseengineering #apt #aimalware #redteam #blueteam #purpleteam #infosec

View post

Oct 5, 2026

Module 7: System Hacking is live on iscsecurity.org.

This is the module after vulnerability analysis: moving from a prioritized target list to active exploitation, privilege escalation, and domain dominance. Gaining initial access, bypassing local defenses, dumping credentials, cracking hashes, and establishing deep, persistent control. Lab-only. Isolated topology.

What's shipped (Full Module Layout):

• 01. Introduction to System Hacking: Why automated tools are just the starting point

• 02. Gaining Access: Intercepting, forcing, and capturing initial entry points

• 03. Vulnerability Exploitation: Weaponizing infrastructure flaws and breaking through perimeters

• 04. Vulnerability Exploitation (Page 2): Advanced targeting and dealing with complex edge cases

• 05. Escalating Privileges: Local privilege escalation vectors and misconfiguration abuse

• 06. Malicious Applications: Crafting, delivering, and executing custom payloads and backdoors

• 07. Covert Storage and Steganography: Hiding data in plain sight and evading detection mechanisms

• 08. Post-Exploitation Operations: Local host enumeration, harvesting, and lateral movement prep

• 09. Domain Dominance: Pivoting into active directory, DPAPI, DCSync, and credential harvesting

• 10. Advanced Persistence (Kerberos): Forging Golden/Silver tickets and breaking authentication trust boundaries

• 11. Clearing Logs & Covering Tracks: Event log evasion, artifact cleanup, and anti-forensics

• 12. Advanced Persistence Deep-Dive: Long-term control, configuration persistence, and stealth operations

• 13. Module Summary: Core takeaways, review points, and practical lessons compiled

• 14. System Hacking Cheat Sheet: Quick-reference commands, syntaxes, and exam preparation resources

System Hacking is where analysis becomes action: proving impact, breaking trust boundaries, and demonstrating how a single flaw can lead to total network takeover.

If you skip it, security assessment is theory and remediation lacks proof.

Master Class Series → System Hacking iscsecurity.org

#ethicalhacking #systemhacking #activedirectory #privilegeescalation #kerberos #redteam #blueteam #purpleteam #infosec

View post

Oct 1, 2026

Hello All,

Warm Greetings from Austria – Been Out of Action for the last few days, I hope this post will bring some of you up to speed!

The Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-76504)

The Story:

CISA has added a critical 9.8 CVSS zero-day vulnerability impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities (KEV) catalog. The flaw allows completely unauthenticated, remote attackers to hijack the management API with full administrative (netadmin) privileges. Because SD-WAN Manager serves as a single pane of glass to configure hundreds of branch routers, gaining admin access through this API bypass allows immediate network-wide pivoting, traffic mirroring, and persistence without spraying a single credential.

The Claim:

CISA confirms the vulnerability is being actively exploited in the wild. The flaw stems from a severe architectural issue classified under CWE-177: mishandled URI hex and URL encoding inside the HTTP request authentication handler lets an attacker bypass the security middleware filters entirely.

The Attack:

By crafting an encoded request that specifically targets paths like /j_security_check, threat actors reach the authentication handler without ever passing through the middleware that would normally check them. The middleware sees one representation of the URI, the backend sees another, and the gap between the two becomes the exploit. The attacker never needs valid credentials. The bypass is unauthenticated, remote, and trivial to execute once the encoding pattern is known.

Verification:

CISA's KEV listing confirms active exploitation. The 9.8 CVSS score places this in the critical range, and the unauthenticated, remote nature of the flaw means no user interaction is required. Federal agencies have been given a strict patch deadline of October 3, 2026. Crucially, the KEV listing mandates forensic triage (per BOD-26-04), meaning defenders must actively hunt for containment breaches rather than just deploying the update.

The Response:

Cisco has released patches. CISA has issued a binding operational directive requiring federal agencies to patch by October 3, 2026. Private sector organizations running Cisco Catalyst SD-WAN Manager should treat the same deadline as their own.

How They Did It:

The attacker crafts an HTTP request with a specific encoding pattern targeting the authentication endpoint. The middleware does not normalize the URI before it compares the pattern, so the encoded variant passes through unchecked and reaches the authentication handler as a trusted request. The attacker then gains netadmin privileges on the SD-WAN Manager API, which controls the entire network fabric.

What This Means:

Once netadmin access is obtained, the value is not the initial bypass. The value is what comes next: east-west movement across every branch the fabric touches, traffic mirroring at the edge, and persistence that lives inside the controller rather than on any single endpoint. The operator does not need to be clever. The flaw is unauthenticated and remote. The path is trivial. What matters is what the operator does with netadmin access once it is obtained.

Why This Matters:

• For Red Teams: This is a skeleton key to enterprise network fabrics. SD-WAN Manager configures hundreds of branch routers through a single management interface. The bypass is unauthenticated, remote, and requires no user interaction. The reconnaissance value is the fabric itself: once you are inside the controller, you see every branch, every tunnel, and every policy. The tradecraft lesson is to look for middleware that parses requests differently at different layers, because the gap between those layers is where authentication bypasses live.

• For Blue Teams: Defenders are under real pressure. The patch deadline is October 3, 2026, and the KEV listing means exploitation is already confirmed. Because CISA triggered the mandatory forensic triage protocol, incident responders must immediately hunt through web logs before wiping memory pools during patching. The primary artifact is a raw POST requests hitting an obfuscated or double URL-encoded endpoint variation, typically targeting /j_security_check or an encoded equivalent. Look for URI patterns that do not match the expected form, that contain unexpected percent-encoding sequences, or that reach the authentication handler without a corresponding pre-auth session. Anything that bypasses the expected middleware chain should be treated as hostile until proven otherwise.

• For Developers: This is a textbook example of why API routing code cannot rely on naive string matching. Developers must normalize the input before they compare it, and they must treat every encoding layer as an attacker-controlled surface. If the middleware sees one representation and the backend sees another, the gap between them becomes the exploit. The same class of bug appears in reverse proxies, WAFs, and API gateways whenever URI normalization is inconsistent across components. The fix is not a single patch. The fix is a design principle: normalize first, then evaluate. Never the other way around.

Feel free to join my platform, As you're all aware, I am always open to dialog and your expert opinions.

ISCSECURITY Master Class Series: https://iscsecurity.org

Join the discussion: https://cyberr.ai/groups/iscsecurity

GitHub: https://github.com/zanderson73/

View post

Sep 29, 2026

Morning all,

Just a quick FYI, tomorrow I will be relocating to Austria. If anyone on the platform is from there and would like to reach out, let me know. Would be happy to meet up - connect - collaborate 😀

View post

Sep 25, 2026

CISA Orders Federal Agencies to Patch Four Actively Exploited Zero-Days Within 72 Hours

TL;DR: CISA has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, affecting F5 BIG-IP, Arista VeloCloud Orchestrator, and two Check Point platforms. Federal agencies have until September 25 to remediate. The prerequisites matter; not every deployment is in scope, but for those that are, exploitation is already confirmed in the wild.

Why the KEV Catalog Matters:

CISA's KEV catalog is not just guidance; it triggers binding remediation deadlines for US federal agencies and is treated by many private-sector organizations as a de facto priority signal. When a CVE lands in KEV, exploitation is confirmed. These four entries carry a compressed 72-hour deadline because the flaws are unauthenticated, internet-reachable, and already being weaponized.

The Breakdown:

1. The F5 Flaw: CVE-2026-94127

a) Vulnerability Type: Heap-based buffer overflow in BIG-IP Access Policy Manager (APM)

b) Severity: CVSS 9.8

c) Critical Exposure Prerequisite: The vulnerability is only present when BIG-IP APM is explicitly configured as an OAuth Authorization Server with an access policy and OAuth profile active on the same virtual server. Deployments using APM strictly as an OAuth Client or Resource Server are entirely unaffected

d) The Threat: Unauthenticated remote code execution is possible via crafted traffic sent directly to the virtual server. Because the attack targets the data plane rather than the management plane, restricting access to the administrative console offers no protection

e) Detection Indicator: F5 requires forensic triage prior to patching. Look for multiple OAuth authentication failures from a single IP in a short window, followed closely by anomalous commands and a Traffic Management Microkernel (TMM) SIGABRT crash

2. The Arista Flaw: CVE-2026-93952

a) Vulnerability Type: Improper input validation in Arista VeloCloud Orchestrator (VCO) On-Prem

b) Severity: CVSS 10.0 (Maximum Severity)

c) Critical Exposure Prerequisites:

1. The on-premises environment must actively use certificate-based authentication between VeloCloud Edge devices and the Orchestrator

2. The attacker must possess the public key of a valid VeloCloud Edge authentication certificate

3. Network routing access to the VCO web interface is required

d) The Threat: A compromised orchestrator extends the adversary's blast radius to every VeloCloud Edge device it manages, allowing total control over downstream enterprise transit paths

e) Known Threat Intel: Arista has flagged active exploitation emerging from the following malicious IP addresses: 142.93.149.77 and 104.248.126.159

3. The Check Point Edge Flaw: CVE-2026-85102

a) Vulnerability Type: Improper Certificate Validation in the VPN negotiation process

b) Severity: CVSS 9.8

c) Critical Exposure Prerequisite: Affects Security Gateways running or allowing certificate-based authentication for Site-to-Site VPN or Remote Access VPN. Gateways relying strictly on Pre-Shared Keys (PSK) are not vulnerable to this vector

d) The Threat: Allows an unauthenticated remote attacker to completely bypass standard cryptographic validation checks and execute native arbitrary code directly on the Security Gateway, breaking the perimeter boundary

4. The Check Point Management Flaw: CVE-2026-93616

a) Vulnerability Type: Critical Path Traversal affecting Check Point Security Management Server, Multi-Domain Management, Log Server, and SmartEvent platforms

b) Severity: CVSS 9.8

c) Critical Exposure Prerequisite: Relies on network-level access to the Management Plane or SmartEvent APIs. Smart-1 Cloud, standard Firewall Appliances, and Spark Firewalls are not affected

d) The Threat: An unauthenticated attacker can upload and execute malicious web scripts over the network, effectively hijacking the central control plane that dictates an entire enterprise's security policy

Why This Matters:

For Red Teams:

These four flaws represent tier-one initial access vectors. F5 BIG-IP and Arista VCO sit squarely on the perimeter; compromising them yields rapid lateral movement and persistent transit visibility. The F5 OAuth flaw is a masterclass in data-plane targeting, entirely bypassing administrative ACL restrictions.

For Blue Teams:

This is an immediate triage priority. For Arista, check nginx logs for the x-vc-opt HTTP header, audit for unauthorised files at /usr/local/sbin/.vcnode.js, and block the known malicious IPs immediately. For Check Point, CVE-2026-85102 must be patched instantly as it entirely circumvents perimeter gateway authentication.

For Developers and Architects:

The F5 flaw corrupts the exact identity provider (IdP) layer your corporate applications trust. If your SSO setup routes through a vulnerable Authorization Server deployment, every downstream federated application faces immediate session risks. The Check Point Management flaw means your central security policy plane could be manipulated, allowing attackers to alter firewall rules, disable logging, and establish persistent backdoors.

For Decision Makers:

If any of these four products sit in your externally-facing estate, treat this as a P1 incident. The prerequisites matter and reduce the blast radius for some organizations, but for those in scope, the exploitation window is already open. Confirm patch status and IOCs today, not Monday.

Quick Reference: Affected Products and Actions

F5 BIG-IP APM (CVE-2026-94127)

Condition: APM must act as an OAuth Authorization Server

Action: Apply F5's temporary mitigation iRule to isolate the vector for triage, then deploy the official engineering hotfix. Review logs for OAuth failures followed by TMM SIGABRT crashes

Arista VeloCloud Orchestrator On-Prem (CVE-2026-93952)

Condition: Certificate-based edge authentication active

Action: Upgrade immediately to a remediated release (5.2.3.16+ or 6.4.2.8+). Tightly restrict the VCO web interface to trusted administrative network segments. Block the known malicious IPs

Check Point Gateways (CVE-2026-85102)

Condition: VPN architecture utilizing certificate-based authentication

Action: Prioritise immediately. Apply LivePatch Take 24 or the relevant Jumbo Hotfix Accumulator version for your specific software branch

Check Point Management (CVE-2026-93616)

Condition: Network access available to Management or SmartEvent API ports

Action: Restrict Management Server access to tightly trusted, localised IP addresses. Audit directories for rogue script uploads or unrecognised configuration modifications

I hope you find this information useful; have an awesome weekend.

N.B. If interested, join https://cyberr.ai/groups/iscsecurity where discussions can be held or simply getting to know one another 😊

ISCSECURITY Master Class Series: https://iscsecurity.org

Instagram: https://www.instagram.com/iscsecurity73/

GitHub: https://github.com/zanderson73/

#cybersecurity #CISA #zeroDay #F5 #Arista #CheckPoint #redteam #blueteam #infosec #vulnerabilitymanagement #KEV

View post