SOC status: Operational/Continuous monitoring active
Acronis MDR / XDR available +230 5254 7558
Home/Threat Intelligence/Advisory
Filtered view
Advisories, research and playbooks from the Cybernalyst analysis team. Written for the people who have to act on them, not for a newsletter.
A NetScaler bug that Citrix documented as a crash in June turned out to be unauthenticated remote code execution as root. Exploitation began days after a public write-up, and CISA…
Read advisoryA path traversal in the vCenter syslog server went from vendor advisory to mass exploitation in five days. Researchers counted 361 victim addresses across 47 countries, and the implant left…
Read advisoryA six-agency advisory documents Gunra actors deleting backup and archive data on backup infrastructure at both the production data centre and the disaster recovery centre. The same administrative credentials reached…
Read advisoryOperators spoof your help-desk number, call employees on personal phones, and tell them to enrol a passkey immediately. The page is a reverse proxy. Once inside they register their own…
Read advisoryAttackers ask Microsoft for a device code, send it to your user, and the user types it into the genuine login page. No password prompt, no MFA challenge, no phishing…
Read advisoryTwo chained flaws gave unauthenticated root on SonicWall's SMA1000 VPN appliances three weeks before a patch existed. Attackers took user credentials and TOTP seeds, which means patching alone does not…
Read advisoryAttackers are chaining a missing-authentication bug, a deserialisation bug and a spoofing bug against on-premises SharePoint, then stealing IIS machine keys so they can forge their own payloads afterwards. One…
Read advisoryVeeam Backup & Replication took seven critical vulnerabilities in March and another remote code execution flaw in June. Every one of them needs only a low-privilege authenticated domain account —…
Read advisoryA certificate-validation flaw in Check Point's IKEv1 handling let attackers establish remote-access VPN sessions without a password. Exploitation predated the fix by a month, and a Qilin affiliate is the…
Read advisoryNo malware in the identity phase. A phone call impersonating IT support, a triggered SSPR, an approved MFA prompt — and then dozens of secrets pulled from a single Key…
Read advisoryManaged clients receive advisories with client-specific exposure detail, ahead of publication, with remediation already scheduled.
Request an assessment