On September 12, 2025, the Federal Bureau of Investigation (FBI) issued a FLASH alert detailing the operations of two cybercriminal groups, UNC6040 and UNC6395, which are targeting Salesforce instances to exfiltrate data and extort organizations. This alert, intended for cybersecurity professionals (CERTs, SOC analysts, CISOs), outlines the initial access vectors, data exfiltration techniques, authentication bypass…
On September 9, 2025, Microsoft released security updates addressing over 80 vulnerabilities across Windows operating systems and related software (81 vulnerabilities were patched on this date). Notably, there were no actively exploited “zero-day” vulnerabilities in this month’s update bundle. However, two publicly disclosed vulnerabilities (zero-days) were fixed, meaning they were known to attackers or researchers…
Executive Summary The Russian state-sponsored threat group APT-C-53 (Gamaredon), active since 2013, continues its espionage operations against Ukrainian governmental and military institutions. In 2025, its campaigns have evolved to include dynamic migration of command-and-control (C2) infrastructures to legitimate cloud services (Microsoft Dev Tunnels, Cloudflare Workers) and the use of advanced obfuscation techniques to bypass detection.…
I want to alert you to a major security incident that is currently making waves in the JavaScript community. We are dealing with a software supply chain attack in the npm ecosystem: no fewer than 18 highly popular packages (including chalk and debug) were compromised through a hijacked maintainer account. As a result, malicious versions…
I propose an article on Scattered Spider, the name given by a security vendor (CrowdStrike) to a group of cybercriminals that has recently emerged in the cybercrime landscape. I tried to keep it short, but far too much information gets lost—happy reading. Scattered Spider is the name given by cybersecurity researchers (notably CrowdStrike) to a…
A recent supply-chain attack targeting Salesloft – the provider of a popular AI chatbot integrated with Salesforce – has compromised data from hundreds of companies. Tracked by Google as threat group UNC6395, the attackers stole OAuth access tokens for Salesloft’s Drift chatbot integration and used them between August 8 and August 18, 2025 to illicitly…
Executive SummaryFollowing the actively exploited vulnerability in Citrix NetScaler (CVE-2025-7775), this summary provides an overview of the technical details and the associated risks. The flaw, a critical memory overflow, has been added by CISA to its Known Exploited Vulnerabilities (KEV) catalog due to confirmed in-the-wild exploitation. It allows unauthenticated remote code execution on vulnerable appliances,…
I use the label “APT29,” also known as Cozy Bear, The Dukes, NOBELIUM, and—under Microsoft’s taxonomy—Midnight Blizzard. Public reporting predominantly attributes this actor to Russia’s Foreign Intelligence Service (SVR), and the multiple aliases reflect vendor naming schemes. Objectives and targeting I observe a primary espionage focus on governments, diplomatic missions, think tanks, IT/Cloud providers, and…
I had long wanted to examine the intelligence employed during the Second World War. Drawing on the training I received at the École de Guerre Économique (EGE), I present here a neutral, factual synthesis, accompanied by full references as well as the original document that served as my source. This article synthesizes the report Secret…
I am sharing an analysis of two groups making headlines in the cybersecurity landscape, along with the sp1d3rhunters malware.All information comes from open sources, so you can verify every detail presented in this article. I wish you an excellent read. 1. General overview and history: ShinyHunters is a financially motivated hacking group that emerged in…
On August 6, 2025, Microsoft and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) sounded the alarm on a newly disclosed high-severity vulnerability affecting Microsoft Exchange Server in hybrid deployment scenarios. Tracked as CVE-2025-53786, the flaw allows a threat actor with administrative access to an on-premises Exchange server to escalate privileges in the organization’s Exchange…
Summary: I analyzed the Vulnerability Summary for the Week of July 21, 2025 published by CISA. This bulletin lists 176 new vulnerabilities discovered that week. In this article, I present all these vulnerabilities in a factual and structured manner, organized by affected product or vendor. For each product, you’ll find the CVE identifier, CVSS severity…
I remember a typical morning in our CERT team: a hundred alerts were already piling up in the SIEM console, my phone was flashing with urgent messages, and a critical incident report still needed to be finalized. Staying focused in this chaos was a constant challenge. It was in this high-pressure context that I decided…
