Rogue AI Agents Hit Wikipedia. Leash Yours Before They Act. On October 5, the Wikimedia Foundation confirmed something that sounds like science fiction. Unauthorized AI agents were running loose across Wikipedia and its sister sites. Not a person breaking in. Software, acting on its own. The scale was enormous. Millions of pages crawled, mostly on Wikidata and Wikimedia Commons. Millions of automated API requests. Hundreds of thousands of queries hammering the Wikidata Query

At Inception Security, our mission is to equip organizations with the knowledge and tools to combat advanced cyber threats. As experts in threat intelligence and incident response, we've conducted extensive research into numerous APT campaigns. This includes uncovering the NightEagle group—also tracked as APT-Q-95—for its precision and sophistication. Through our proprietary analysis and forensic investigations, we've determined that this North American-aligned APT has been l

The vulnerability CVE-2023-27350 enables remote actors to sidestep authentication and execute remote code on several versions of PaperCut installations, including: Version 8.0.0 up to 19.2.7 Version 20.0.0 up to 20.1.6 Version 21.0.0 up to 21.2.10 Version 22.0.0 up to 22.0.8 The susceptibility arises from inadequate access controls in the SetupCompleted Java class in PaperCut servers affected by CVE-2023-27350. This flaw enables malicious entities to circumvent user authentic

In today's digitally connected world, cybersecurity is no longer optional—it's a necessity. At Inception Security, we know that the only way to stay ahead of cybercriminals is to be informed and vigilant. In this blog post, we will discuss two common types of cyber attacks: phishing and social engineering, highlighting the signs to watch for and offering tips on preventing exploitation. Section 1: Understanding Phishing Attacks Phishing attacks are online scams in which cyber

In the rapidly evolving digital landscape, cybersecurity is paramount for businesses of all sizes. While organizations invest heavily in sophisticated technology solutions to protect their systems, the human factor remains critical to security. Employees can be the weakest link in your security chain, and educating them on best practices and creating awareness about cybersecurity threats is crucial. In this blog post, we'll discuss the essential elements of an effective emplo

The Dark Web can be daunting and mysterious, often associated with criminal activity and hidden dangers. As a business owner, it's essential to understand the Dark Web, its potential impact on your organization, and how to protect your company from hidden cyber threats. This comprehensive guide will explore the Dark Web's intricacies, common risks, and actionable steps to safeguard your business. 1. What is the Dark Web, and Why Should Business Owners Care? The Dark Web is a

In today's fast-paced digital world, businesses face numerous cybersecurity threats. One of the most prevalent and financially damaging is Business Email Compromise (BEC). BEC attacks target large corporations and small businesses, resulting in massive financial losses. Inception Security offers comprehensive BEC Assessments that help protect your organization from these cyber threats. In this blog, we'll explore why every business needs BEC Assessments from Inception Securit

Top Reasons Why Incident Response Table Top Exercises Are Important In today's digital world, cyber threats are becoming more sophisticated, frequent, and disruptive than ever before. As a result, organizations must take a proactive approach to manage cyber risks, and incident response (IR) tabletop exercises are a crucial part of that approach. In this blog post, we will explore why IR tabletop exercises are essential for businesses and organizations and how Inception Securi

In today's digital age, cybersecurity threats are on the rise, and it's more important than ever for businesses to take proactive measures to protect themselves. Cyberattacks can result in data breaches, financial losses, and reputational damage, which can be devastating for any business. One of the most effective ways to mitigate these risks is by conducting regular cybersecurity risk assessments. Here are 5 reasons why risk assessments are crucial for your business: Identif

ManageEngine's CVE-2022-47966 vulnerability is a critical issue that allows an attacker to gain remote code execution on the server running the ManageEngine software. The vulnerability is caused by two main factors: the validation order of SAML and XSLT injection. Firstly, the vulnerability is caused by how the software handles SAML information validation. SAML is a standard for exchanging authentication and authorization data between systems. In ManageEngine, the software fa

In recent months, we have seen a surge in attacks targeting Exchange Servers. These attacks have been made possible by exploiting the CVE-2022-41040 and CVE-2022-41082. This post will delve into the details of these vulnerabilities and how attackers exploit them to gain access to Exchange Servers. Exploiting CVE-2022-41040: The first step in this attack is exploiting CVE-2022-41040 to gain access to the PowerShell API endpoint of the Exchange Server. This vulnerability arises

The Play ransomware group has been making headlines recently due to its use of a new method to exploit vulnerabilities in Microsoft Exchange. Dubbed the ProxyNotShell vulnerabilities (CVE-2022-41080 and CVE-2022-41082), this method exploits the Outlook Web Application frontend to reach the Powershell remoting service in Exchange. Researchers at CrowdStrike discovered this method while investigating recent Play ransomware incidents and dubbed it OWASSRF. The Play group is a ne

Citrix is a global leader in providing digital workspace solutions, and as such, it is a popular target for cyber attackers. One such attack is the recently discovered vulnerability known as CVE-2022-27518. In this blog, we will discuss the details of this vulnerability, how it affects Citrix and the technical workings of this exploit. First, let's define what a CVE is. Common Vulnerabilities and Exposures (CVE) is a standardized way of identifying and categorizing vulnerabil

CVE-2022-27516 is a severe vulnerability recently discovered in Citrix, a widely-used software program. This vulnerability has the potential to wreak havoc on Citrix users, and it is important for individuals and organizations that use the program to take steps to protect themselves against it. The vulnerability in question lies within Citrix's handling of certain types of data inputs. Specifically, the program fails to properly validate and sanitize user-supplied input, allo

CVE-2022-42475 is a recently discovered vulnerability in the software that powers Fortinet, a popular cybersecurity company. This vulnerability has the potential to be exploited by hackers to gain unauthorized access to sensitive information, making it a serious concern for both Fortinet and its customers. The vulnerability is a type of flaw known as a "buffer overflow" error. This occurs when a computer program attempts to store more data in a temporary memory buffer than it

What are Jump Lists? Jump Lists are windows features introduced with Windows 7, and they contain information about recently accessed applications and files. They allow files and applications to be pinned to the taskbar. There are two forms of jump list that can be created in windows. The first form is called AUTOMATICDESTINATIONS-MS. Like its name, these jump lists are created automatically when the users open a file or an application. This jump list is located in the followi

Let's talk about remote assistance tools! As you would expect, a remote assistance tool is used to assist end-users from a remote location. These tools are great and are widely used by helpdesk and IT support staff to help users with various workstations issues. If allowed within the settings of the host computer, the remote user can also share control of the host computer, opening files, accessing information, and inputting data by mouse and keyboard. This is extremely helpf

We have recently observed threat actors evolving their procedures in light of Microsoft disabling macros by default in office documents. This new technique would allow threat actors to continue to bypass security controls to infect one or more hosts in an environment. In light of the latest Microsoft Office vulnerabilities, we will likely see broad adoption of macro-less infected documents that will lead to many organizations getting hacked. While Microsoft has shared mitigat

A user account is created in Active Directory for each user in your environment. Over time as users leave the organization, their accounts do not always get removed from Active Directory. As a result, many organizations have an excessive amount of stale user accounts in Active Directory. You can identify a stale account using the last time the password was changed or the user's last login timestamp. Stale user accounts in Active Directory pose a significant risk to the organi

What is Cyber Insurance? A cyber insurance policy is commonly called "cyber risk insurance" or "cyber liability insurance" coverage. It is a product that allows businesses to transfer the costs involved with cyber recovery from a cyber incident or similar event. Typically, the critical aspect of cyber insurance will be network security coverage. This coverage is leveraged in a network security failure, such as data breaches, malware, ransomware attacks, business accounts, an