Pinned Tweet
We analyzed 400 DDoS-Stresstests from 2022 and gathered very interesting insights into the current state of protection/mitigation-solutions, what works (well), what doesnt, and especially: WHY.
zero.bs/optimization-of-ddos…
#ddos #dfir #cybervandals
ZeroBS_GmbH retweeted
Now that we can point machines at everything we’ve built over the last 40 years, I’m starting to think a lot of it was “security by obscurity” all along.
There just weren’t enough skilled people looking at how broken it actually was.
ZeroBS_GmbH retweeted
My quick write-up on NoName057(16) & Z-Pentest's claim that they are involved with Danfoss freezer cyber attacks
TL;DR: they did make this claim, the posts are still online, but I don't buy it & neither should you
fromcyberia.substack.com/p/d…
ZeroBS_GmbH retweeted
CyberSec Trends Q4/26 🔮
⬆️ AI-driven attacks (ARTEX, Cairn)
⬆️ 0day / critical RCE disclosures
⬆️ Software supply-chain attacks
⬆️ Token/OAuth app abuse & cloud persistence
↗️ EDR blinding / killing (vulnerable or malicious signed drivers)
↗️ Persistence on systems outside EDR coverage
↗️ Abuse of legit RMM / tunneling tools
ZeroBS_GmbH retweeted
Interesting finding from my colleagues for anyone following #PHP2SHELL activity
They found a Linux botnet sample that already has code targeting CVE-2026-109618 integrated into its existing exploit routines, alongside eight other CVEs
#PHP2SHELL is already making its way into active Linux botnet arsenals.
Spotted a THOR-detected sample with PHP2SHELL-VULN-CVE-2026-109618 integrated alongside 8 existing CVE exploit references.
Botnets are adapting fast.
Patch ASAP and assess your systems for signs of compromise. Don't assume you're safe just because you've patched.
virustotal.com/gui/file/a75f…
ZeroBS_GmbH retweeted
php2shell is one of the most impactful bugs in recent times, yet threat actors aren’t mass exploiting it
the bug is so complex that even porting the exploit between targets takes serious skill, human or ai
so i benchmarked how well open and frontier models can do it. 🧵
ZeroBS_GmbH retweeted
Sometimes it seems security is drifting back towards a "Prevent Breach" mindset.
Prevent breach was never enough. Patch faster, of course.
But offensive AI is about a lot more than finding bugs!
Invest in Assume Breach!
Grow an internal Red Team. Automate offensive AI. Learn with defenders what matters
Exploit yourself before someone else does it for you.
In the end, you will not patch your way out of this.
ZeroBS_GmbH retweeted
Clean lab environment for local testing. Lab and PoCs for the PHP session.upload_progress memory-corruption bugs, CVE-2026-109618 and CVE-2026-109619. Five exploitation chains from one root cause. Each phase has its own folder with a self-contained Docker lab and a PoC. github.com/TheCyberGeek/php2…
ZeroBS_GmbH retweeted
Just published our high fidelity scanner for php2shell: github.com/assetnote/php2she…
See our detection logic here: slcyber.io/research/high-fid…
We've taken care in our detection logic and hope it helps defenders. Congrats to @calif_io and @lcfr_hax for the discovery.
ZeroBS_GmbH retweeted
See how the exposure of Danfoss refrigerators has changed over time: trends.shodan.io/search?quer…
Excellentes Post-Mortem von @nine_ch über den DDoS-Angriff auf Threema im August.
nine.ch/uploads/Postmortem_D…
ZeroBS_GmbH retweeted
Ein DDoS-Angriff auf einen Kunden hat auch uns getroffen.
Wir betreiben seine Internetanbindung, deshalb sind die Angriffswellen vom 11. bis 13. August auch bei uns angekommen. In der Spitze waren es geschätzt 500 bis 600 Gbit/s, 260 Gbit/s davon haben uns zwei Upstream-Provider direkt bestätigt. Getroffen hat es Applikationen auf Deploio, unsere Website, das Cockpit und unser Ticketsystem. Einen unbefugten Zugriff auf Daten hat es nicht gegeben. 🔒
Im Postmortem legen wir offen, welche drei Lücken der Angriff in unserer Abwehr aufgedeckt hat und was wir seither an unserer Infrastruktur geändert haben. Dazu gibt es eine konkrete Empfehlung, falls du eigene Domains auf Deploio betreibst. 🔍
Eines haben wir bewusst nicht gemacht: unsere eigenen Dienste von Deploio abgezogen. Wir nutzen weiterhin dieselbe Plattform wie unsere Kundinnen und Kunden, machen sie aber robuster.
Das ganze Postmortem: nine.ch/de/blog/ddos-angriff… 👈
#ddos #postmortem #incidentresponse #deploio #cloud #nineinternetsolutions #cloudnavigators #nine
ZeroBS_GmbH retweeted
easily the best video on the Hugging Face incident I've seen. By @NielsProvos
youtu.be/B7SGWOtt9rA
ZeroBS_GmbH retweeted
By the time Anthropic and OpenAi roll out a working CVP/TAC for verified cybersecurity professionals, most will have already migrated to local models and will never come back.
ZeroBS_GmbH retweeted
The FBI and DOJ are announcing the seizure of internet domains associated with NightmareStresser, one of the world’s longest running Distributed Denial of Service (DDoS) for-hire services. Since 2022, the NightmareStresser Booter service was used to launch hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide. These actions were taken in conjunction with Operation PowerOFF, an ongoing effort among international law enforcement agencies aimed at dismantling criminal DDoS-for-hire infrastructure worldwide.
The seizures announced today were performed by @FBIAnchorage in coordination with the Royal Canadian Mounted Police.
🔗justice.gov/usao-ak/pr/fbi-s…
ALT Seized website notice displaying seals of the Department of Justice, FBI, and Royal Canadian Mounted Police with a warning about illegal DDoS-for-hire services.
ZeroBS_GmbH retweeted
We recently sinkholed a DDoS #botnet of 200,000 compromised Android TV boxes infected with #CECbot malware 🕵️♀️. Shortly after, the threat actor responded by registering a rather specific botnet C2 domain 👇
📡 spamhaushackers .at
Nice try, but their new C2 domain is already flagged🛑. Its authoritative DNS runs on DNSPod (*.dnspod.com), which has carried a poor reputation for years! 💡
⤵️⤵️⤵️⤵️
hunting.abuse.ch/hunt/6aa7e8…
ALT abuse.ch Hunting
The first major botnet with HTTP/2 attacks are spotted.
unit42.paloaltonetworks.com/…
We will update our Botnet-Tracking Blogpost soon.
#ddos #dfir #aisuru #kimwolf
