Douglas José Pereira dos Santos

🧱🕵 𝘽𝙍𝙄𝘾𝙆𝙎𝙏𝙊𝙍𝙈 𝘽𝙖𝙘𝙠𝙙𝙤𝙤𝙧: 𝙋𝙍𝘾 𝙥𝙚𝙧𝙨𝙞𝙨𝙩𝙚𝙣𝙘𝙚 𝙤𝙣 VMware 𝙫𝘾𝙚𝙣𝙩𝙚𝙧 / 𝙀𝙎𝙓𝙞 🕵🧱 #cyber_security_highlights 🔎 𝙀𝙭𝙚𝙘𝙪𝙩𝙞𝙫𝙚 𝙨𝙣𝙖𝙥𝙨𝙝𝙤𝙩 (1) CISA + NSA + Canada’s Cyber Centre released AR25-338A on BRICKSTORM (published Dec 4, 2025; updated Jan 20, 2026). (2) Assessment: PRC state-sponsored actors using BRICKSTORM for long-term persistence, mainly against government and IT orgs. (3) It targets VMware vSphere control plane (vCenter/ESXi) and also Windows variants are referenced. 🧬 𝙒𝙝𝙖𝙩 𝙞𝙩 𝙞𝙨 (1) A sophisticated backdoor (Go-based and also Rust-based samples) enabling stealthy access + secure C2. (2) Self-watching persistence: reinstalls / restarts if disrupted. (3) Capabilities: interactive shell, full file ops (browse/upload/download/delete), and some samples provide SOCKS proxy for lateral movement. 📡 𝘾2 𝙚𝙫𝙖𝙨𝙞𝙤𝙣 𝙙𝙚𝙨𝙞𝙜𝙣 (1) Multi-layer encryption: HTTPS + WebSockets + nested TLS. (2) Uses DNS-over-HTTPS (DoH) and mimics web-server behaviour to blend with normal traffic. 🧨 𝙍𝙚𝙖𝙡 𝙞𝙣𝙩𝙧𝙪𝙨𝙞𝙤𝙣 𝙥𝙖𝙩𝙝 (𝙘𝙖𝙨𝙚 𝙨𝙩𝙪𝙙𝙮) (1) Initial access via a DMZ web server with a web shell (April 11, 2024). (2) Lateral move to jump servers + ADFS, then exported cryptographic keys. (3) Uploaded BRICKSTORM to an internal vCenter; persistence observed April 2024 → Sept 3, 2025. 🛡 𝙎𝙊𝘾 𝙦𝙪𝙞𝙘𝙠 𝙬𝙞𝙣𝙨 (1) Treat vCenter/ESXi as Tier-0: restrict admin paths, isolate management, monitor privileged service accounts. (2) Block/monitor unauthorised DoH egress to reduce stealth comms. (3) Use the report’s IOCs + YARA + Sigma to hunt and validate coverage. Thanks to Cybersecurity and Infrastructure Security Agency team for this report: ( links in the comments ) #cybersecurity #infosec #threatintel #malwareanalysis #vmware #incidentresponse #favikon #cloud #cloudcomputing #genai #artificialintelligence

10

2 Comments

Guidance for SIEM and SOAR Implementation "The Cybersecurity and Infrastructure Security Agency (CISA) and Australian Cyber Security Centre (ACSC) released new guidance this week on procuring, implementing, and maintaining security information and event management (SIEM) and security orchestration, automation, and response (SOAR) platforms." https://lnkd.in/d_C-Htbk #cisa #cyberthreatintelligence #cybersecurity

8

Just finished reading. Good report. Noteworthy that network segmentation is highlighted many times as a key mitigation to OT risks, and the lack of segmentation is the first highlighted threat. Not to be self-serving, but network segmentation is what we do!

4

2 Comments

Sharing a book recommendation to help you check your organizational quantum readiness and where there may be exposure. “The window is narrower than your roadmap assumes.” Walt Powell CISSP, CISM

6

always keen to share CTI reports from organization that may notbe on your radar S2GRUPO’s Lab52 recently released "Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure”- https://lnkd.in/gyfWnDQM details a campaign dubbed “Operation MacroMaze”, targeting specific entities in Western and Central Europe. the reports initial access methods and a host of IOCs.

11

LMG Security’s Top Cybersecurity Control for Q2 2025 is Continuous Vulnerability Management (CVM). A recent flurry of zero-day exploits disclosed for major players shows that cybercriminals aren’t waiting for patch Tuesday, and CVM is the most practical way to keep pace with a world where the exploit window is shrinking, and AI is making attackers faster than ever. Read our blog for more details and advice: https://lnkd.in/ghF5rUng #continuousvulnerabilitymanagement #zeroday #patchmanagement 

10

Traditional SOC models are failing under the weight of enterprise-scale threats, but a shift is occurring. By 2026, the gap between detection and action is being closed by Agentic SOC platforms that replace rigid playbooks with autonomous reasoning. According to recent analysis, AI-driven phishing attacks increased 703% over the 2024-2025 period. Phishing remains the primary initial access vector for 80% of breaches. While traditional SOCs struggle with alert fatigue, Agentic SOC platforms utilize Multi-Layer AI to compress detection times from weeks to mere minutes. Key findings from the 2026 landscape: 70% of breaches now begin with stolen credentials moving laterally at machine speed. The Salt Typhoon campaign remained undetected for up to two years using living-off-the-land tactics, a timeline Agentic SOCs can reduce through behavioral anomaly detection. Leading platforms like Stellar Cyber Open XDR are achieving 20x faster mean time to respond by deploying autonomous agents that triage, correlate, and execute containment without waiting for human authorization. For CISOs and SOC managers, the "So What?" is clear: scaling security with headcount is no longer viable. Moving toward an autonomous SOC architecture is the only way to manage the 62% year-over-year increase in supply chain attacks and the evolving sophistication of state-sponsored actors. Read more: https://lnkd.in/d35g38MQ #CyberSecurity #ThreatIntel #AgenticAI #SOC #AutonomousSecurity #XDR

4

OT incidents remain high, and resilience is lagging. The SANS Institute 2025 State of ICS/OT Security Survey shows progress in detection, but major gaps still exist leaving organizations exposed. → 22% reported an ICS/OT incident → Remote access remains a top risk → Just 14% feel fully prepared 👉 See what’s driving risk—and how to close these #OTSecurity gaps: https://ftnt.net/6045Ck4Jh

3

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77

🚨 CFOs Under Attack: A New Spear-Phishing Campaign is Exploiting Trust and Remote Tools 🚨 A highly targeted #spear-#phishing operation is now sweeping across the #financial #sector, going after CFOs and high-ranking financial executives in #banking, #energy, #insurance, and #investment industries. On May 15th, Trellix’s email security products detected a highly targeted spear-phishing campaign directed at Chief Financial Officers (#CFOs) and finance executives employed by banks, energy companies, insurers, and investment firms across #Europe, #Africa, #Canada, the #Middle #East, and #South #Asia. This multi-stage phishing operation sought to install #NetBird, a legitimate #WireGuard-based remote-access tool, on the victim’s computer. In recent years, adversaries have increasingly utilized remote-access applications such as NetBird to establish persistence and gain unauthorized access to victims’ networks. Trellix ’s URL defense engine successfully blocked the initial call-to-action URL due to #suspicious CAPTCHA #behavior #rules. What makes this campaign different? It blends deep social engineering with the misuse of legitimate remote access tools — a dangerous combo. Key insights from the attack: • Global Reach: Executives across Europe, the Middle East, Africa, Canada, and South Asia are in the crosshairs. • Impersonation at Scale: Threat actors are posing as recruiters from Rothschild & Co to build credibility. • Weaponized Legitimacy: The attackers are using NetBird, a trusted WireGuard-based remote access tool, for covert persistent access. • Evading Defenses: Firebase-hosted pages with custom CAPTCHAs are being used to bypass automated scanning. • Multi-Stage Infection: Targets are tricked into downloading a file that opens the door to full system infiltration. Why it matters: This is a textbook example of how threat actors are adapting — not by building new malware from scratch, but by cleverly abusing tools already trusted by IT teams. How to respond: • Run executive-level security awareness sessions tailored to spear-phishing threats. • Monitor for unusual use of remote access tools like NetBird, even if they appear legitimate. • Update incident response protocols to detect and isolate these hybrid attack chains fast. 📎 Full read from Trellix: https://lnkd.in/dA4SbP6W 📎 More details: https://lnkd.in/dhxWKV3M Executives are no longer just targets — they're the doorway. Secure the top to protect the bottom. #CyberSecurity #CFO #SpearPhishing #NetBird #ThreatHunting #RemoteAccess #SocialEngineering #FinancialSecurity #InfoSec

2

Why your IR team should be running exercises with your red team monthly, not annually Most organizations treat incident response exercises like compliance events. Check the box once a year, update the deck, and move on. That approach might satisfy auditors, but it does almost nothing to prepare teams for a real incident. Annual exercises test memory. Monthly exercises build muscle. Real incidents are chaotic, emotional, and brutally time compressed. People are tired. Information is incomplete. Systems behave in ways no one expects. Under those conditions, no one is recalling what they read in a tabletop nine months ago. They are defaulting to habit, instinct, and whatever they practiced most recently. Running red and blue team exercises once a year assumes that incident response is a knowledge problem. It is not. It is a coordination problem. It is about how quickly people can share signal, make decisions with partial information, and act without waiting for perfect clarity. Those skills decay fast if they are not exercised regularly. Monthly collaboration between red teams and IR teams exposes the real issues early. Not the theoretical ones. The awkward handoffs. The alerts no one trusts. The escalation paths that look fine on paper but fall apart at 2 a.m. The tools that technically work but are too slow or confusing to use under pressure. Finding those problems during an exercise costs hours. Finding them during a live incident costs reputations. There is also a human factor most organizations underestimate. Trust. When red and blue teams only meet during formal annual events, the interaction feels adversarial and performative. When they work together regularly, it becomes practical and honest. The red team stops trying to “win.” The IR team stops being defensive. Both sides start focusing on improving outcomes instead of protecting ego. That trust pays off when it matters. During a real incident, teams that have trained together communicate faster, escalate earlier, and argue less. They know how each other thinks. They know where assumptions tend to break. They know when to push and when to step back. The uncomfortable truth is this: you do not rise to the occasion in an incident. You fall to the level of your training. If that training happens once a year, your response will reflect that. If it happens monthly, under realistic pressure, with people who challenge you constructively, your organization will be measurably harder to break. If you’re serious about incident response, treat it like a capability, not a calendar event.

7

Iran-linked Handala Hack (aka Void Manticore, COBALT MYSTIQUE) is a reported vector for an increase in wiper attacks. This Insights blog details proactive recommendations for security teams, from identity management to enhancing security controls.

5

Is your organization now more or less likely to experience a significant #cybersecurity event than it was 10y ago? Well, that depends. Let's look at some data from Cyentia Institute's recent 2025 Information Risk Insights Study (IRIS). The chart below depicts the annualized incident probability for firms in each revenue tier. I won't go into the details here of how we modeled this, but the methodology appendix in the report does get into that (link in comments). And if you want even more detail, Joran Elias has an excellent blog post for Cyentia Institute members (free account). For now, just assume we've used many incidents over many years to model the probabilities you see here. From the chart, you can see why I say "that depends" to the lead question. The probability of a <$100M firm suffering a security incident has more than doubled, while the chance of a $100B+ megacorporation having an event has dropped by a third over the same time frame. Meanwhile, incident probability for organizations in $1B to $100B range have remained relatively static. Unfortunately, our dataset is silent on the underlying factors behind these #cyberevent trends, but we can engage in some informed speculation. And LinkedIn is the perfect platform for it. I'll start. To me, this chart hammers home Wendy Nather's concept of the security poverty line. Giant corporations with their giant budgets to hire the best people, buy the best technology, and implement the best processes, are finding success. But the pace of digitalization has outpaced SMBs’ ability to defend their growing attack surfaces and mitigate #cyberrisk. I have many other thoughts regarding the factors underlying what we see here, but I'd rather hear from you. What do you see as key contributors? **** Get the IRIS 2025 here: https://lnkd.in/enFDtTTT You'll have the option to just download it or get it or join Cyentia's free membership program for the report plus a bunch of bonus analytical content. ****

60

12 Comments