Threat Research Blog

A few months ago, I was working on research that involved spanning up and down multiple virtual machines in AWS and used AWS CLI in order to manage them. I decided to make a small...

Executive Summary As more and more business is conducted from remote locations, attackers are focusing their efforts on exploiting the key technologies – like Zoom and Microsoft Teams – that...

AWS is one of the most successful cloud solutions available today. As a pioneer in the infrastructure-as-a-service (IaaS) scene, AWS has more than a million customers. Part of that success is...

Table of Contents Introduction RDP Connection Connection Sequence | Basic Input and Output Channels in RDP | Data Compression RDP Security | Recent RDP Vulnerabilities Conclusion References  ...

More and more companies are deciding to move their infrastructures into cloud environments offered by Microsoft Azure, Google Cloud Computing, Amazon AWS and many more. In our modern and rapidly...

An infostealer is a type of malware that is focused on gathering sensitive and conditional information from the compromised system. While this information is often related to the user’s...

1 Introduction 2 Common Architectures of Thick Client applications 2.1 Two-Ttier architecture 2.2 Three-Tier architecture 3 How to test thick client applications? 3.1 Information Gathering 3.1.1...

While working on research associated with Microsoft Azure and Microsoft OAuth 2.0, we found a vulnerability that allows for the takeover of Microsoft Azure Accounts.

A Technical Deep Dive Into Insider Kubernetes Attack Vectors In part one and part two of our series on Kubernetes penetration test methodology we covered the security risks that can be created by...

We walk through CVE-2019-3726, a privilege escalation vulnerability, and show how easy it is to abuse the DUP installation framework.

Symbolic Link attacks can lead to the escalation of privilege. They are easy to execute and have the potential to cause some serious damage.

Attacking the Cluster Remotely In our previous blog post “Kubernetes Pentest Methodology Part 1”, we wrote about the risks that might be created by misconfiguring the Kubernetes RBAC. Also, we...

Krypton is a small size binary andan efficient credential stealer, working on Windows 7 to 10 without any permission requirements – regular user rights are enough. It might just be antivirus kryptonit

You would expect anti-virus software (AVs) to block this malware easily... so, why are most AVs not detecting it? Maybe because it uses unusual technology for malicious software.

As the pace of life accelerates, we spend less time waiting or in downtime.  Kubernetes offers something similar for our life with technology. It is a container orchestration platform that offers...