/
Navigation
C
Chronicles
Browse all articles
C
E
Explore
Semantic exploration
E
R
Research
Entity momentum
R
N
Nexus
Correlations & relationships
N
~
Story Arc
Topic evolution
S
Drift Map
Semantic trajectory animation
D
P
Posts
Analysis & commentary
P
Browse
@
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
?
Concept Search
Semantic similarity search
!
High Impact Stories
Top coverage by position
+
Sentiment Analysis
Positive/negative coverage
*
Anomaly Detection
Unusual coverage patterns
Analysis
vs
Rivalry Report
Compare two entities head-to-head
/\
Semantic Pivots
Narrative discontinuities
!!
Crisis Response
Event recovery patterns
Connected
Nav: C E R N
Search: /
Command: ⌘K
Embeddings: large
VOICE ARCHIVE

Florian Roth

@cyb3rops
32 posts
2026-02-03
Yes, it's basically this #NotepadPlusPlusCompromise [image]
2026-02-03 View on X
BleepingComputer

Notepad++ and security researchers say Chinese state-sponsored threat actors were likely behind the hijacking of its update traffic from June to December 2025

Chinese state-sponsored threat actors were likely behind the hijacking of Notepad++ update traffic last year that lasted for almost half a year …

This is bad. Putty level bad. https://notepad-plus-plus.org/ ... [image]
2026-02-03 View on X
BleepingComputer

Notepad++ and security researchers say Chinese state-sponsored threat actors were likely behind the hijacking of its update traffic from June to December 2025

Chinese state-sponsored threat actors were likely behind the hijacking of Notepad++ update traffic last year that lasted for almost half a year …

For convenience: I wrote a small collector that pulls all SHA-256, SHA-1 and MD5 hashes from Notepad++ releases and compiles them into big CSV + JSON files Use it to check if any Notepad++ installs in your org match known-good release hashes - and spot weird/malicious outliers [image]
2026-02-03 View on X
BleepingComputer

Notepad++ and security researchers say Chinese state-sponsored threat actors were likely behind the hijacking of its update traffic from June to December 2025

Chinese state-sponsored threat actors were likely behind the hijacking of Notepad++ update traffic last year that lasted for almost half a year …

2026-02-02
For convenience: I wrote a small collector that pulls all SHA-256, SHA-1 and MD5 hashes from Notepad++ releases and compiles them into big CSV + JSON files Use it to check if any Notepad++ installs in your org match known-good release hashes - and spot weird/malicious outliers [image]
2026-02-02 View on X
BleepingComputer

Notepad++ and security researchers say Chinese state-sponsored threat actors were likely behind the hijacking of its update traffic from June to December 2025

Chinese state-sponsored threat actors were likely behind the hijacking of Notepad++ update traffic last year that lasted for almost half a year …

Yes, it's basically this #NotepadPlusPlusCompromise [image]
2026-02-02 View on X
BleepingComputer

Notepad++ and security researchers say Chinese state-sponsored threat actors were likely behind the hijacking of its update traffic from June to December 2025

Chinese state-sponsored threat actors were likely behind the hijacking of Notepad++ update traffic last year that lasted for almost half a year …

This is bad. Putty level bad. https://notepad-plus-plus.org/ ... [image]
2026-02-02 View on X
BleepingComputer

Notepad++ and security researchers say Chinese state-sponsored threat actors were likely behind the hijacking of its update traffic from June to December 2025

Chinese state-sponsored threat actors were likely behind the hijacking of Notepad++ update traffic last year that lasted for almost half a year …

2025-11-19
Cloudflare went down because a ClickHouse change made a metadata query return duplicate columns. That blew up the size of a config file, it spread across the network and one module couldn't handle the larger file and crashed. Everything after that was basically fallout from this
2025-11-19 View on X
Cloudflare

Cloudflare says the November 18 outage was caused by a change to one of its “database systems' permissions”, not by “malicious activity of any kind”

On 18 November 2025 at 11:20 UTC (all times in this blog are UTC), Cloudflare's network began experiencing significant failures to deliver core network traffic.

2025-10-07
What's much more interesting to me than detecting vulnerable services from server responses is detecting exploited services from log files. Detecting services by server responses is useful, especially for red teams and anyone scanning their own network, but it's only the first
2025-10-07 View on X
The Record

Oracle urges customers to patch an E-Business Suite vulnerability that cybercriminals are exploiting; Google's Mandiant says the Clop hacking group exploited it

AWAITING ANALYSIS  —  This CVE record has been marked for NVD enrichment efforts. CrowdStrike : CrowdStrike Identifies Campaign Targeting Oracle E-Business Suite via Zero-Day Vulne...

2025-06-03
This is the first time I really feel like an approach actually makes sense and targets something useful https://www.crowdstrike.com/ ... [image]
2025-06-03 View on X
Reuters

Microsoft, Google, CrowdStrike, and Palo Alto Networks plan to create a public glossary of state-sponsored hacking groups to ease unofficial alias confusion

Microsoft, CrowdStrike, Palo Alto (PANW.O) and Alphabet's (GOOGL.O) Google on Monday said they would create a public glossary …

2025-04-16
Ah 👀 https://www.thecvefoundation.org/ [image]
2025-04-16 View on X
BleepingComputer

CISA says it will extend funding to Mitre, which runs the CVE Program, and “there will be no lapse in critical CVE services”, after Mitre said funding expired

CISA says the U.S. government has extended MITRE's funding to ensure no continuity issues with the critical Common Vulnerabilities and Exposures (CVE) program.

MITRE announced on April 15 that their CVE contract ends on April 16. That timing alone raises some questions. The language in the message feels very deliberate: “We're committed,” “considerable efforts,” “if a break were to occur” - while they know a break will happen the next
2025-04-16 View on X
BleepingComputer

CISA says it will extend funding to Mitre, which runs the CVE Program, and “there will be no lapse in critical CVE services”, after Mitre said funding expired

CISA says the U.S. government has extended MITRE's funding to ensure no continuity issues with the critical Common Vulnerabilities and Exposures (CVE) program.

2025-03-06
There could be multiple reasons why VMware didn't publish details: 1. They might believe the exploitation isn't widespread enough to justify detailed disclosure. 2. They might worry that publishing specifics (log entries, vulnerable components, or temporary files) could enable
2025-03-06 View on X
BleepingComputer

Broadcom fixes three VMware zero-days exploited in the wild found by Microsoft; attackers with admin or root access can chain the flaws to escape a VM's sandbox

Broadcom warned customers today about three VMware zero-days, tagged as exploited in attacks and reported by the Microsoft Threat Intelligence Center.

VMware reports active exploitation of new ESXi zero-days - but only gives us a patch matrix 🙄 - How is it so hard to understand that if a zero-day is actively exploited, we need indicators and forensic guidance to hunt? - Otherwise, we're just blindly patching already [image]
2025-03-06 View on X
BleepingComputer

Broadcom fixes three VMware zero-days exploited in the wild found by Microsoft; attackers with admin or root access can chain the flaws to escape a VM's sandbox

Broadcom warned customers today about three VMware zero-days, tagged as exploited in attacks and reported by the Microsoft Threat Intelligence Center.

2024-07-24
CrowdStrike must have been aware that these updates are interpreted by the drivers and could lead to problems. They should have implemented a staggered deployment strategy for Rapid Response Content from the start. A content validator, being code, can also have flaws or blind [image]
2024-07-24 View on X
The Register

CrowdStrike says the problematic July 19 software update that brought down 8.5M Windows PCs was deployed into production due to “a bug in the Content Validator”

CrowdStrike has blamed a bug in its own test software for the mass-crash-event it caused last week.

2024-06-29
#TeamViewer updated their public statement https://www.teamviewer.com/... [image]
2024-06-29 View on X
BleepingComputer

TeamViewer warns that its corporate environment was breached on June 26 and attributes the cyberattack to the Russian hacking group APT29, aka Midnight Blizzard

but customer and company data is safe Alex Ivanovs / Stack Diary : TeamViewer confirms Russian spies hacked its corporate network The Hacker News : TeamViewer Detects Security Brea...

2024-06-28
#TeamViewer updated their public statement https://www.teamviewer.com/... [image]
2024-06-28 View on X
BleepingComputer

TeamViewer warns that its corporate environment was breached on June 26, and attributes the cyberattack to the Russian hacking group APT29 aka Midnight Blizzard

The remote access software company TeamViewer is warning that its corporate environment was breached in a cyberattack yesterday …

2024-02-04
Just to be clear : this rule is for hunting purposes only. This doesn't imply that the rule causes many false positives - on the contrary. We haven't yet seen files signed with this certificate on VirusTotal. We expect developments regarding AnyDesk's current situation to...
2024-02-04 View on X
BleepingComputer

Remote desktop software maker AnyDesk says it has suffered a cyberattack recently; source: hackers stole source code and private code signing keys

AnyDesk confirmed today that it suffered a recent cyberattack that allowed hackers to gain access to the company's production systems.

2023-08-30
I've added the hash of the Qakbot uninstaller & YARA rule for LOKI/THOR Lite users to check if systems were infected with #Qakbot &cleaned by the FBI/Dutch Police in the operation https://www.justice.gov/... on @virustotal you see that it was already uploaded from various countries [image]
2023-08-30 View on X
BleepingComputer

The FBI led an effort to dismantle the Qakbot botnet, which ransomware gangs used as an infection vector for years, on August 25 after infiltrating its network

It was live on 700k endpoints (!) which should give you an idea of the scale of cybersecurity woes at many orgs (it's still really, really bad out there). X: Nick Carr / @itsreally...

2023-06-03
Okay, let's cover the 0day exploitation of the #MOVEit Transfer service with some rules Filename IOCs https://github.com/... Sigma rule https://github.com/... https://twitter.com/... [image]
2023-06-03 View on X
BleepingComputer

Rapid7 and Mandiant: hackers are actively exploiting a zero-day vulnerability in Progress' MOVEit Transfer file transfer tool to steal data from organizations

Hackers are actively exploiting a zero-day vulnerability in the MOVEit Transfer file transfer software, tracked as CVE-2023-34362, to steal data from organizations.

2023-06-02
A big advantage of a BYOD policy is that these devices use the orgs infra at some point & may create interesting log entries (DNS, proxy) Sigma Rules for - DNS logs - Proxy logs https://github.com/... #EquationGroup Reports https://securelist.com/... https://www-fsb-ru.translate.goog/ ... [image]
2023-06-02 View on X
The Record

The FSB claims Apple helped the NSA hack Russian diplomats' iPhones; Kaspersky: unknown malware leveraged zero-click exploits on iPhones running up to iOS 15.7

Russia's Federal Security Service (FSB) is accusing U.S. intelligence of hacking “thousands of Apple phones” to spy on Russian diplomats.