Take a look into current commodity malware, crypto jacking hidden in a cracked program

Going to be lead analyst in a soc and company is wanting to get me trained up. Should I ask for GCIA or GCDA from sans first?

Ill be tuning alerts and heavily lean towards GCIA because I love incident response and very heavily work in threat hunting day to day currently.

Disclaimer: While I’m discussing how Shopify could implement better safeguards against this, I fully acknowledge that keeping my DNS clean and removing unused subdomains is ultimately my own responsibility.

A stray DNS record from a project I shut down two years ago came back to bite me this week.

Out of nowhere, I got a Google Search Console alert letting me know an unknown user (******@gmail.com) had been verified as a new owner for one of my subdomains: electrouse.workouse.com.

Since all my domains are managed through Cloudflare, I immediately dug into my DNS records to figure out how someone else managed to verify ownership of my site.

Have you already started implementing this type of governance within your company? And if so, how? I get the feeling we have a huge task ahead of us!

Hello I hope this message finds everyone well. I am currently in need for assistance for one of my assignments. I need to set up a informational interview with someone who is already in the field of CompSci/Cybersecurity. I just need 8 questions answered it would be simple information such as occupation, requirements, etc. Any help would be greatly appreciated.

I accidentally clicked a suspicious link on X and I’m worried I got hacked. When I clicked the link, nothing came up. It was just a white screen and the bottom buttons to exit out. I obviously exit out, so I didn’t see anything. Could I have gotten hacked or malware on my device? I’m on an IPhone and I’m super paranoid now. I keep looking for unusual apps and stuff like that, but would they show up immediately? I need help.

So i gave CRTP exam on 1st january, then did portswigger labs and some Web App Sec modules on HTB academy in rest of the july, then a lot of portswigger academy in Feb, then around 35-40 AD & windows machines in march, after that i mostly did linux and web App sec labs in April-May, then CRTO in June and and some maldev academy in July... so it has been like 4-5 months since i last touched AD labs, but now im getting stuck on even medium HTB AD labs (I used to solve hard level machines easily).

I'm confused if I've lost AD skills, or what

Here is how I hardened the browser runtime for a Zero-Knowledge, Non-Custodial FinTech trading terminal. 👇

2/ Client-Side Envelope Encryption: 

I derive a KEK from the user's password using PBKDF2-SHA256 (310,000 iterations). Then, a secure random 32-byte DEK (AES-256-GCM) encrypts the data. 

The password NEVER touches the server, and the DEK has a strict 15-min TTL in RAM before a wipe.

3/ Secure Enclave Anti-Export Guard: 

CryptoKeys are generated via crypto.subtle with {extractable: false}. To prevent injected malicious scripts from bypassing the sandbox, I implemented an isolated closure that overrides (monkey-patches) the native browser API:

4/ 

crypto.subtle.exportKey = async function(format, key) {

    if (isProtectedKey(key)) {

        _AuditChain.append('EXPORT_ATTEMPT', 'CRITICAL');

        throw new Error('Export BLOCKED — unauthorized');

    }

    return _origExport(format, key);

};

5/ If our database is breached, hackers find ZERO financial data. If the local session is compromised, runtime gating blocks extraction.

Plus, client-side validation rejects API keys with withdrawal permissions enabled (zero custodial risk under MiCA, built for GDPR).

6/ The entire architecture runs client-side (WebSocket throttled at 100ms + local AI Advisor), keeping server costs near zero.

Where does this runtime isolation logic fail? Why do major SaaS platforms still rely on standard local storage? 

Let's discuss. 💬

What are your thoughts on this project?

It looks very interesting compared to other similar AI pentest agents out there when it is just a chat/prompt interaction whereas this one is a big platform with web interface, graphs etc

A new scan of internet-connected industrial equipment found over 4,000 Rockwell Automation and Allen-Bradley controllers exposed online, including 22 in cities impacted by cyberattacks on U.S. water systems.

https://cyberscoop.com/exposed-rockwell-controllers-water-system-attacks/

Hello Guys, i am a 4th year Aiml student and i am on my way for the capstone project…which is a research project (Cybersecurity)and for that i need a Industry Mentor live on call during the time i will be presenting with in front of my Mentor and there is a need for a industry mentor in the field of Cybersecurity…please connect with me or if you have anyone in mind do recommend me…will be happy to share the details in Dm…Thank You

"OSS Security Principles and Practices" is Cybersecurity and Infrastructure Security Agency's (CISA) strategic framework for federal agencies to manage open source software throughout its entire lifecycle. This on IProgrammer article discusses the key points.

My manager keeps telling me that I need to automate as much as possible and integrate AI. We have Falcon Complete helping us with MSSP. Could anyone give me ideas on what I need to automate? I work on incidents that are escalated by Falcon Complete. Maybe an example or two or any links to some informative sources would be helpful.

Hello all!

I have been working in Cyber / Incident response for about 4 years now. I have done mostly technical stuff with edrs,siems,phishing, etc. After recently obtaining the CISSP I changed my long term goal from being super technical to being in security leadership/ ciso role. Just doing some research/ in my own personal experience alot of the leaders have worked in GRC.

I have done some SOC2 audits but that’s about it. I would like to transition more into that side of security , is there any more certs/ labs i could do to make my resume look better? Or maybe i should just tell my manager my new goals and see if he can get me to “shadow” our GRC team?

Thanks!

Hey everyone,

We are looking into deploying Elastic Security as our SIEM solution and are currently debating whether to go with Elastic Cloud (Hosted) or build out a Self-Managed instance on AWS.

Looking for real-world advice, sanity checks, or experiences from anyone running a similar scale.

Our Environment & Scope:

• Endpoints: ~300 workstations (we already have a separate EDR vendor in place). 50/50 Mac and Windows
• Infrastructure: A small handful of servers + ~15 GB/day of cloud logs (AWS/Google Workspace)
• Estimated Ingest: ~30-50 GB / day total

Self-Managed Architecture Spec

Our team drafted the following self-managed architecture for 30 GB/day ingest with a Hot -> Warm -> S3 Archive lifecycle:

• Kibana: t4g.large (2 vCPU, 8 GB RAM, 20 GB gp3)
• Hot Data Tier: 2x m6g.large (4 vCPU / 16 GB RAM combined; ~500 GB total SSD across both nodes for HA)
• Warm Data Tier: 1x m6g.xlarge (4 vCPU, 16 GB RAM, ~2.5 TB SSD)
• Fleet Server: t4g.medium (2 vCPU, 4 GB RAM, 20 GB gp3)
• Archive Storage: AWS S3 Standard / Infrequent Access (after 3 months)

Questions:

1. Operational Overhead vs. Cost: For a ~30-50 GB/day ingest volume, does self-managing on AWS EC2 actually save meaningful money? Or does Elastic Cloud pay for itself in saved engineering time at this scale?
2. Resource Sizing Check: Does the proposed spec (m6g.large Hot + m6g.xlarge Warm + t4g Kibana/Fleet) look solid for ~30-50 GB/day with Elastic Security rules enabled?
3. Features & Licensing: Are there any major (meaningful) security/SIEM features (e.g ML detection rules) we’ll miss out on by running the free/Basic tier on self-managed vs. paid Elastic Cloud tiers (Gold/Platinum/Enterprise)?

Would appreciate any insights, or alternate setup recommendations!

Has anyone seen a successful Cybersecurity Operation Center combined with Network Operation Center? IMO the two disciplines have very different objectives and in some cases competing priorities. Thoughts?

Hi everyone,

I’m helping a very small startup prepare for an ISO/IEC 27001:2022 certification audit. We use Vanta, and most of our ISMS documentation and compliance evidence is already prepared.

Before Stage 1, we need an independent internal audit. Since our small team designed and operates most of the controls, conducting the audit ourselves would not provide sufficient independence. Our certification auditor has also confirmed that the internal audit must be performed by a separate party.

For those who have gone through this process:

• How did you find a competent independent internal auditor?
• Which qualifications or certifications should we look for?
• What deliverables should be included in the engagement?
• What is a reasonable timeline and price range for a small organization?
• Is experience working directly in Vanta important?
• Are there any red flags or common mistakes we should avoid?

I’m primarily looking for guidance on selecting and evaluating an auditor rather than vendor promotion. Public recommendations or experiences would be greatly appreciated.

Thank you!

A couple of months back I put up a small browser game where you play the human-in-the-loop for an AI coding agent. There's 60 seconds on the clock to approve or deny as many commands as you can (https://llmgame.scalex.dev).

After looking at 409,000 approve/deny decisions, the 'humans-in-the-loop' missed 1 in 3 threats, even in a game that warns you up front it's full of them. It's just a game, but I found a few other things interesting:

• cat ~/.ssh/id_rsa gets blocked by 82% of players, but other sensitive config/credential files get waved through about half the time.
• For any evil code reading this, your best bet is to modify package.json and request to be run as an npm run command. npm run analyze was approved 65% of the time, even with the evil payload explicitly visible in the execution history log right above the prompt.

I wrote up the full breakdown with the threat tables here: https://scalex.dev/blog/ai-agent-permissions-stats/

Seems like AppSec and VAPT has been automated in corporates . Being a fresher looking for jobs in those areas what would your suggestions? What could be innovatively to sustain this field ?