July 2021

PetitPotam and ESC8: The NTLM Relay Chain That Owned Active Directory

Post author:Prabhu Kalyan Samal
Post published:July 25, 2021
Post category:Cloud & Infrastructure Identity & Phishing Security

PetitPotam coerced Windows machines to authenticate, AD CS web enrollment happily minted a DC certificate, and domains fell in an afternoon. The relay class is still with us.

HiveNightmare: The Two-Line Bug That Leaked Every Local Password Hash

Post author:Prabhu Kalyan Samal
Post published:July 18, 2021
Post category:Cloud & Infrastructure Security

One broken inheritance flag left Windows SAM, SYSTEM, and SECURITY hives readable by any user. With shadow copies in play, that meant every local NTLM hash on the box.

Pegasus Zero-Click: Spyware That Needed No Click at All

Post author:Prabhu Kalyan Samal
Post published:July 18, 2021
Post category:Emerging Tech & Architecture Identity & Phishing Security

The Pegasus Project exposed 50,000 targeted numbers and a hard truth: modern mercenary spyware infects phones through iMessage and WhatsApp without the victim doing anything.

Kaseya VSA Ransomware: 60 MSPs, 1,500 Businesses, One Friday

Post author:Prabhu Kalyan Samal
Post published:July 4, 2021
Post category:Ransomware & Malware Security Supply Chain Security

REvil turned Kaseya's remote-management platform into a mass-encryption weapon, hitting ~60 MSPs and up to 1,500 downstream businesses days before a patch could land.