In the ever-evolving landscape of cybersecurity threats, Microsoft SharePoint servers have become a prime target for sophisticated exploits. As of July 2025, a zero-day vulnerability chain dubbed "ToolShell" is being actively exploited. This vulnerability allows unauthenticated remote code execution (RCE) on on-premises SharePoint installations. It poses significant risks to organizations relying on SharePoint for collaboration and data management. In this technical blog, we'

At Inception Security, our mission is to equip organizations with the knowledge and tools to combat advanced cyber threats. As experts in threat intelligence and incident response, we've conducted extensive research into numerous APT campaigns. This includes uncovering the NightEagle group—also tracked as APT-Q-95—for its precision and sophistication. Through our proprietary analysis and forensic investigations, we've determined that this North American-aligned APT has been l

Top Reasons Why Incident Response Table Top Exercises Are Important In today's digital world, cyber threats are becoming more sophisticated, frequent, and disruptive than ever before. As a result, organizations must take a proactive approach to manage cyber risks, and incident response (IR) tabletop exercises are a crucial part of that approach. In this blog post, we will explore why IR tabletop exercises are essential for businesses and organizations and how Inception Securi

ManageEngine's CVE-2022-47966 vulnerability is a critical issue that allows an attacker to gain remote code execution on the server running the ManageEngine software. The vulnerability is caused by two main factors: the validation order of SAML and XSLT injection. Firstly, the vulnerability is caused by how the software handles SAML information validation. SAML is a standard for exchanging authentication and authorization data between systems. In ManageEngine, the software fa

In recent months, we have seen a surge in attacks targeting Exchange Servers. These attacks have been made possible by exploiting the CVE-2022-41040 and CVE-2022-41082. This post will delve into the details of these vulnerabilities and how attackers exploit them to gain access to Exchange Servers. Exploiting CVE-2022-41040: The first step in this attack is exploiting CVE-2022-41040 to gain access to the PowerShell API endpoint of the Exchange Server. This vulnerability arises

The Play ransomware group has been making headlines recently due to its use of a new method to exploit vulnerabilities in Microsoft Exchange. Dubbed the ProxyNotShell vulnerabilities (CVE-2022-41080 and CVE-2022-41082), this method exploits the Outlook Web Application frontend to reach the Powershell remoting service in Exchange. Researchers at CrowdStrike discovered this method while investigating recent Play ransomware incidents and dubbed it OWASSRF. The Play group is a ne

Citrix is a global leader in providing digital workspace solutions, and as such, it is a popular target for cyber attackers. One such attack is the recently discovered vulnerability known as CVE-2022-27518. In this blog, we will discuss the details of this vulnerability, how it affects Citrix and the technical workings of this exploit. First, let's define what a CVE is. Common Vulnerabilities and Exposures (CVE) is a standardized way of identifying and categorizing vulnerabil

CVE-2022-27516 is a severe vulnerability recently discovered in Citrix, a widely-used software program. This vulnerability has the potential to wreak havoc on Citrix users, and it is important for individuals and organizations that use the program to take steps to protect themselves against it. The vulnerability in question lies within Citrix's handling of certain types of data inputs. Specifically, the program fails to properly validate and sanitize user-supplied input, allo

CVE-2022-42475 is a recently discovered vulnerability in the software that powers Fortinet, a popular cybersecurity company. This vulnerability has the potential to be exploited by hackers to gain unauthorized access to sensitive information, making it a serious concern for both Fortinet and its customers. The vulnerability is a type of flaw known as a "buffer overflow" error. This occurs when a computer program attempts to store more data in a temporary memory buffer than it

A critical vulnerability CVE-2022-22965 (Spring4Shell or SpringShell) was found on March 29, 2022, in an open-source Java framework while testing named Spring. This vulnerability allows the attacker to execute arbitrary code on a web server. Spring is a widely used framework, so this vulnerability can be highly lethal. The data binding feature of Spring Framework was used to bind data in an HTTP request to some of the objects being used in an application. The vulnerability ex

Pandora ransomware came into the spotlight in March of 2022 after posting some high-profile victims on its leak site. The ransomware group announced its first victim on Feb 21st, 2022. Their biggest victim was Denso, a car parts manufacturer. After an attack on one of its offices in Germany, Denso confirmed that cybercriminals leaked stolen, classified information from the Japan-based car-components manufacturer. Pandora claims to have exfiltrated 1TB of data from Denso. So w