Hunting the Snake: An Overview of Threat Hunting with Velociraptor

In May 2023 the NCSC and CISA released a joint cyber security advisory addressing a piece of Russian malware called Snake. According to them, this malware has been gathering intelligence for the FS...

Jun 19, 2023 Incident Response

Ligolo: Quality of Life on Red Team Engagements

In recent months we, JUMPSEC’s red team, have been using a nifty little tool that we would like to share with you in this blog post. Ligolo-ng is a versatile tool that has been aiding our covert, a...

Jun 9, 2023 Jumpsec, Network Tools

Hunting for ‘Snake’

Following the NCSC and CISA’s detailed joint advisory on the highly sophisticated ‘Snake’ cyber espionage tool, JUMPSEC threat intelligence analysts have provided a condensed blueprint for organisa...

May 26, 2023 Detection, Jumpsec

Advisory CVE-2023-30382 – Half-Life Local Privilege Escalation

Software: Half-Life Affected versions: Latest (<= build 5433873), at the time of writing Vendor page: www.valvesoftware.com CVE Reference: CVE-2023-30382 Published: 23/05/2023 CVSS 3.1 Scor...

May 23, 2023 Jumpsec, Vulnerability

Butting Heads with a Threat Actor on an Engagement

At the time of writing I am enjoying some non-billable time in the wake of a demanding engagement spanning across several months. As such, I thought it would be a good time to write up a war story ...

Apr 17, 2023 Exploitation, Incident Response, Vulnerability, Windows

Advisory CVE-2022-37832 – Mutiny Network Monitoring Appliance hardcoded credentials

Software: Mutiny Network Monitoring Appliance Affected versions: <= 7.2.0-10855 Vendor page: www.mutiny.com CVE Reference: CVE-2022-37832 Published: 16/12/2022 CVSS 3.1 Score: 10.0 AV:N/AC:...

Dec 15, 2022 Jumpsec, Vulnerability

Online Machine Learning: how to integrate user feedback

When designing and implementing a machine learning model, ensuring it is continually updated is a challenge that all engineers encounter. In this article, I explore the online machine learning tec...

Dec 12, 2022 Research

Implementation and Dynamic Generation for Tasks in Apache Airflow

I recently worked on a project focused on log anomaly detection using manageable machine learning pipelines. The pipelines mainly include data collection — feature extraction — feature engineering ...

Nov 23, 2022 Detection, Research

QUEST KACE Desktop Authority Pre-Auth Remote Code Execution (CVE-2021-44031)

Software: QUEST KACE Desktop Authority Affected Versions: 11.1 and earlier. Vendor page: https://www.quest.com/products/kace-desktop-authority/ CVE Reference: CVE-2021-44031 Published: 19/11/2021 C...

Sep 8, 2022

Abusing SharedUserData For Defense Evasion and Exploitation

Over the past few weeks, I have been working on a custom packer in my spare time. In doing so, I needed to create a method of delaying execution within the unpacker stub that didn’t use any pre-def...

Aug 11, 2022