In the ever-evolving landscape of cybersecurity threats, Microsoft SharePoint servers have become a prime target for sophisticated exploits. As of July 2025, a zero-day vulnerability chain dubbed "ToolShell" is being actively exploited. This vulnerability allows unauthenticated remote code execution (RCE) on on-premises SharePoint installations. It poses significant risks to organizations relying on SharePoint for collaboration and data management. In this technical blog, we'

Cybersecurity is a lot like a game of chess. You must anticipate your opponent's moves and devise strategies to stop them. But what happens when the opponent changes the rules of the game? A new threat called the Mockingjay malware shows us how crucial foresight is in cybersecurity. Recently, a new process injection technique, Mockingjay, has been discovered, making waves in cybersecurity. This malware can bypass security solutions to execute malicious code on compromised sys

On May 31, 2023, Progress released a security advisory for their MOVEit Transfer application detailing a SQL injection vulnerability leading to remote code execution. Customers were urged to update to the latest version. This vulnerability, CVE-2023-34362, was believed to have been exploited in the wild as a 0-day dating back at least 30 days. Threat intelligence reports suggested that exploitation activity could be traced back to 2021. The attacks were attributed to the cl0p

Top Reasons Why Incident Response Table Top Exercises Are Important In today's digital world, cyber threats are becoming more sophisticated, frequent, and disruptive than ever before. As a result, organizations must take a proactive approach to manage cyber risks, and incident response (IR) tabletop exercises are a crucial part of that approach. In this blog post, we will explore why IR tabletop exercises are essential for businesses and organizations and how Inception Securi

In today's digital age, cybersecurity threats are on the rise, and it's more important than ever for businesses to take proactive measures to protect themselves. Cyberattacks can result in data breaches, financial losses, and reputational damage, which can be devastating for any business. One of the most effective ways to mitigate these risks is by conducting regular cybersecurity risk assessments. Here are 5 reasons why risk assessments are crucial for your business: Identif

The Play ransomware group has been making headlines recently due to its use of a new method to exploit vulnerabilities in Microsoft Exchange. Dubbed the ProxyNotShell vulnerabilities (CVE-2022-41080 and CVE-2022-41082), this method exploits the Outlook Web Application frontend to reach the Powershell remoting service in Exchange. Researchers at CrowdStrike discovered this method while investigating recent Play ransomware incidents and dubbed it OWASSRF. The Play group is a ne

What are Jump Lists? Jump Lists are windows features introduced with Windows 7, and they contain information about recently accessed applications and files. They allow files and applications to be pinned to the taskbar. There are two forms of jump list that can be created in windows. The first form is called AUTOMATICDESTINATIONS-MS. Like its name, these jump lists are created automatically when the users open a file or an application. This jump list is located in the followi

A user account is created in Active Directory for each user in your environment. Over time as users leave the organization, their accounts do not always get removed from Active Directory. As a result, many organizations have an excessive amount of stale user accounts in Active Directory. You can identify a stale account using the last time the password was changed or the user's last login timestamp. Stale user accounts in Active Directory pose a significant risk to the organi

CVE-2022-1388 is a critical CVE (CVSS 9.8) in F5 Networks’ BIG-IP solution management interface. This CVE will allow threat actors to bypass F5’s iControl REST authentication to gain remote code execution. This is not the first significant vulnerability we have seen with the BIG-IP platform. In 2021, security practitioners worldwide observed attacks against the iControl REST API as well. This was tracked as CVE-2021-22986. The vulnerability is what security researchers call a

What is Windows Prefetch? Windows Prefetch creates files when a user opens an application on a Windows host. The Windows Operating system will make a prefetch record when an application is run from a specific area for the absolute time. Microsoft introduced prefetch with the Windows XP operating system. The idea behind the prefetch is that it would accelerate the boot process and start-up process. In older versions of Windows, prefetch files were limited to 128 files. With ne

A critical vulnerability CVE-2022-22965 (Spring4Shell or SpringShell) was found on March 29, 2022, in an open-source Java framework while testing named Spring. This vulnerability allows the attacker to execute arbitrary code on a web server. Spring is a widely used framework, so this vulnerability can be highly lethal. The data binding feature of Spring Framework was used to bind data in an HTTP request to some of the objects being used in an application. The vulnerability ex

A Russian-based Conti Ransomware gang chat leak has started a new debate. The massive chat leak from inside has provided a clearer picture of cybercriminal motives to the cyber researchers. Furthermore, it has made it evident that the Russian Ukraine war has divided the criminals who work for ransomware. Some of the lessons that cyber researchers can learn are: Hacking computers for ransomware groups is a boring job One of the most prevalent comments about chat leaks is that

Just over a month after the details of the initial Apache Log4j vulnerability surfaced, attacks against infrastructure running vulnerable versions of the application are continuing, including a recent furry of attacks targeting VMware Horizon servers by an unidentified threat actor group. VMware Horizon server versions 8.x and 7.x are vulnerable to two of the Log4j vulnerabilities (CVE-2021-44228 and CVE-2021-45046), and officials with the UK’s National Health Service Digital

In Microsoft Exchange, the three known vulnerabilities that threat actors use to get initial access are often referred to collectively as Proxyshells. These three known vulnerabilities are CVE-2021-34473, CVE-2021-34523, and CVE-2021- 31207. The attackers use these three vulnerabilities by bypassing the authentication and running a remote code as a privileged user. Microsoft has classified the Proxyshell vulnerabilities as critical. However, the proxyshell vulnerability is re

Access controls are a security technique that determines who or what may view or utilize resources in a computing environment controlled by a particular policy. Below is a list of Access controls used to minimize risk in businesses and organizations. Types of access control: Physical access control: It limits access to Campus buildings, rooms, and physical IT assets. Logical access control: It limits access to computer networks, systems, and data. Therefore, an enterprise mu

A recent MIT Technology Review Report revealed that 66 zero-day attacks in 2021 were recorded in 2021, nearly double the attacks in 2020. For example, security researchers discovered a security flaw in Fortinet's web application firewall that permits attackers to run arbitrary malicious codes on severs and devices protected using the security solution. Attackers can compromise the vulnerability to compromise devices, escalate privileges, and control them. For example, they

Despite the depth of implemented protection measures, cyber incidents are bound to happen at some time. An incident analysis process comprises carefully structured and orchestrated operations to determine the incident's root cause and prevent it from reoccurring in the future. Incident analysis is critical to responding and recovering from an adverse cyber event. The following are recommended incident analysis phases: Detection and observation IT security teams use various t

2021 has been an interesting year for the information security community. According to the Identity Theft Research Center, the total privacy and data breaches recorded in the third quarter of 2021 have already surpassed those recorded in the whole of 2020. Specifically, the publicly reported breaches as of 30th September 2021 have increased by 17% compared to the total events reported in 2020. Notably, cybersecurity experts blame the COVID-19 pandemic as the leading cause of

The year is drawing to an end, and numerous organizations are still reeling from the impacts of various security threats and attacks. For example, up to 1500 businesses have been victims of different ransomware attacks in the US alone. In addition, thousands more have been victims of other forms of attacks, including social engineering state-sponsored attacks. Furthermore, with business owners having to contend with a new working normal, most notably due to the global COVID-1