Tag: SANS Internet Storm Center, InfoCON: green

XORsearch: Searching With Regexes, (Mon, Apr 7th)

Xavier asked me a question from one of his FOR610 students: “how can you perform a regex search with XORsearch”? This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: XORsearch: Searching With Regexes,…

Read more →

New SSH Username Report, (Sun, Apr 6th)

As you may have noticed by some of my recent diaries, I have spent a bit more time on ssh and telnet credentials. These credentials are collected by Cowrie, the amazing full features SSH and Telnet honeypot maintained by Michel…

Read more →

Surge in Scans for Juniper “t128” Default User, (Wed, Apr 2nd)

Last week, I noticed a surge in scans for the username “t128”. This username, accompanied by the password “128tRoutes,” is a well-known default account for Juniper's Session Smart Networking Platform (or “SSR” for “Session Smart Routing”). The username and password…

Read more →

A Tale of Two Phishing Sites, (Fri, Mar 28th)

In phishing and in malspam, as in any other field, one can see certain trends develop over time. For obvious reasons, most threat actors like to use techniques and approaches that are novel and, thus, more effective. This commonly leads…

Read more →

Sitecore “thumbnailsaccesstoken” Deserialization Scans (and some new reports) CVE-2025-27218, (Thu, Mar 27th)

On March 6th, Searchlight Cyber published a blog revealing details about a new deserialization vulnerability in Sitecore [1]. Sitecore calls itself a “Digital Experience Platform (CXP),” which is a fancy content management system (CMS). Sitecore itself is written in .Net and…

Read more →