In the ever-evolving landscape of cybersecurity threats, Microsoft SharePoint servers have become a prime target for sophisticated exploits. As of July 2025, a zero-day vulnerability chain dubbed "ToolShell" is being actively exploited. This vulnerability allows unauthenticated remote code execution (RCE) on on-premises SharePoint installations. It poses significant risks to organizations relying on SharePoint for collaboration and data management. In this technical blog, we'

ManageEngine's CVE-2022-47966 vulnerability is a critical issue that allows an attacker to gain remote code execution on the server running the ManageEngine software. The vulnerability is caused by two main factors: the validation order of SAML and XSLT injection. Firstly, the vulnerability is caused by how the software handles SAML information validation. SAML is a standard for exchanging authentication and authorization data between systems. In ManageEngine, the software fa

In recent months, we have seen a surge in attacks targeting Exchange Servers. These attacks have been made possible by exploiting the CVE-2022-41040 and CVE-2022-41082. This post will delve into the details of these vulnerabilities and how attackers exploit them to gain access to Exchange Servers. Exploiting CVE-2022-41040: The first step in this attack is exploiting CVE-2022-41040 to gain access to the PowerShell API endpoint of the Exchange Server. This vulnerability arises

Citrix is a global leader in providing digital workspace solutions, and as such, it is a popular target for cyber attackers. One such attack is the recently discovered vulnerability known as CVE-2022-27518. In this blog, we will discuss the details of this vulnerability, how it affects Citrix and the technical workings of this exploit. First, let's define what a CVE is. Common Vulnerabilities and Exposures (CVE) is a standardized way of identifying and categorizing vulnerabil

CVE-2022-27516 is a severe vulnerability recently discovered in Citrix, a widely-used software program. This vulnerability has the potential to wreak havoc on Citrix users, and it is important for individuals and organizations that use the program to take steps to protect themselves against it. The vulnerability in question lies within Citrix's handling of certain types of data inputs. Specifically, the program fails to properly validate and sanitize user-supplied input, allo

CVE-2022-42475 is a recently discovered vulnerability in the software that powers Fortinet, a popular cybersecurity company. This vulnerability has the potential to be exploited by hackers to gain unauthorized access to sensitive information, making it a serious concern for both Fortinet and its customers. The vulnerability is a type of flaw known as a "buffer overflow" error. This occurs when a computer program attempts to store more data in a temporary memory buffer than it

What are Jump Lists? Jump Lists are windows features introduced with Windows 7, and they contain information about recently accessed applications and files. They allow files and applications to be pinned to the taskbar. There are two forms of jump list that can be created in windows. The first form is called AUTOMATICDESTINATIONS-MS. Like its name, these jump lists are created automatically when the users open a file or an application. This jump list is located in the followi

We have recently observed threat actors evolving their procedures in light of Microsoft disabling macros by default in office documents. This new technique would allow threat actors to continue to bypass security controls to infect one or more hosts in an environment. In light of the latest Microsoft Office vulnerabilities, we will likely see broad adoption of macro-less infected documents that will lead to many organizations getting hacked. While Microsoft has shared mitigat

What is Cyber Insurance? A cyber insurance policy is commonly called "cyber risk insurance" or "cyber liability insurance" coverage. It is a product that allows businesses to transfer the costs involved with cyber recovery from a cyber incident or similar event. Typically, the critical aspect of cyber insurance will be network security coverage. This coverage is leveraged in a network security failure, such as data breaches, malware, ransomware attacks, business accounts, an

What are Profile Lists? Windows keeps track of user-profiles and their locations in the registry. The profile location is stored under the key below: HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList This registry key contains one subkey for each user profile on a Windows machine. Inside of each of these subkeys is a registry value called ProfileImagePath that includes the profile path for all users. You can obtain information on user profiles such as profile las

CVE-2022-1388 is a critical CVE (CVSS 9.8) in F5 Networks’ BIG-IP solution management interface. This CVE will allow threat actors to bypass F5’s iControl REST authentication to gain remote code execution. This is not the first significant vulnerability we have seen with the BIG-IP platform. In 2021, security practitioners worldwide observed attacks against the iControl REST API as well. This was tracked as CVE-2021-22986. The vulnerability is what security researchers call a

Business continuity and disaster recovery (BCDR or BC/DR) is a collection of processes and procedures that assist a company in recovering from a disaster and returning to normal business operations. It is a broad approach that encompasses both IT and commercial operations and tasks in the aftermath of a disaster. BCDR frequently integrates business operations and information technology to decrease catastrophic risks and support organizations in swiftly resuming normal operati

What is Windows Prefetch? Windows Prefetch creates files when a user opens an application on a Windows host. The Windows Operating system will make a prefetch record when an application is run from a specific area for the absolute time. Microsoft introduced prefetch with the Windows XP operating system. The idea behind the prefetch is that it would accelerate the boot process and start-up process. In older versions of Windows, prefetch files were limited to 128 files. With ne

Phishing attacks remain the number one technique used in cyberattacks. Some of the most common phishing attacks leveraged attachments to facilitate the initial infection chain. We disproportionally see Microsoft Office documents and PDF files used to embed the malicious code as far as the attachments themselves go. When we say Microsoft Office documents, we refer to files created by the Microsoft Office suite such as Microsoft Word, Excel, PowerPoint, etc. Historically we wou

A critical vulnerability CVE-2022-22965 (Spring4Shell or SpringShell) was found on March 29, 2022, in an open-source Java framework while testing named Spring. This vulnerability allows the attacker to execute arbitrary code on a web server. Spring is a widely used framework, so this vulnerability can be highly lethal. The data binding feature of Spring Framework was used to bind data in an HTTP request to some of the objects being used in an application. The vulnerability ex

On patch Tuesday, April 12, 2022, Microsoft released patches for CVE-2022-26809. A vulnerability that is a zero-click exploit targeting Microsoft RPC services. As of right now, there is not a PoC out in the wild. However, the scanning for the vulnerability has increased. Based on the impact of this vulnerability, it is likely that there will be a PoC in the wild soon. Patch your servers now before the PoC come out. What is RPC? The Remote Procedure Call (RPC) service is used

As we look across the landscape, we see that cyberattacks continue to succeed in all business sectors. In the cases we have observed, the cyberattack leveraged weak security controls and, as a result, could have been prevented by organizations adopting security best practices. A new study shows that ransomware, phishing, social engineering, denial of service (DoS) attacks, and the business fallout of a data breach rank as the top concerns of global organizations. The recently

Considering today's attack surface's massive and hyper-dimensional nature, we begin to see how challenging it is to manage this attack surface in a modern enterprise. The risk surface of the enterprise is constantly expanding. Threats are finding their way into enterprises, constantly morphing and adapting to network defenses. It is thus a daunting task to bring the vast scope of an organization's enterprise attack surface into focus. Many security leaders lack awareness of a

Endpoint Detection & Response (EDR) A critical task for most organizations has become setting up advanced threat protection as cyberattacks have skyrocketed and become more sophisticated. Starting with a robust endpoint detection and response system is the first step in this process. Detecting and responding to endpoint threats, also known as EDR, is a cybersecurity process that gathers and analyses data collected by endpoints, usually workstations and servers. As a result, s

QBot, also known as Qakbot or pinkslipbot, is an information stealer that has been active since 2007. It is malware software that can monitor the browser's activities and lots of information on the victim's computer. It is also known as a banking trojan capable of stealing finance-related data from the infected device and loader by using c2 servers to target payload and downloads. Other important information that QBot can steal from a system are: Name of the account City Coun