INCEPTION SECURITY

IMPROVING CYBERSECURITY FROM THE GROUND UP!

Many of the breaches we read about could have been prevented. It is time to get a step ahead of the hackers.

ABOUT INCEPTION SECURITY

We Provide High Quality Cybersecurity Solutions...

Inception Security™ is a cybersecurity consulting organization committed to helping your business prioritize what matters to reduce risk. Our team has industry experts that have worked in many information security disciplines. We understand that small and medium-sized businesses face the same problems as large businesses but do not always have the staffing to focus on the controls that enhance the organization's security posture.

We offer services that will help you understand your attack surface, advisory services to help you build and enhance your security program, managed detection and response, security awareness training, digital forensics, and incident response. As cybersecurity threats continue to become more sophisticated and complex, trying to keep up can mean falling behind. Strengthening your cybersecurity posture requires extreme foresight into when, where, why, and how attacks will occur.

Are you experiencing an incident? When your organization is under attack, it can be frightening and impact your business operations. Let the team at Inception Security™ identify, contain and eradicate the threats from your environment. We are experts in incident response, incident recovery, and digital forensics. We have handled many types of incidents and have been toe to toe with many hacker groups facilitating the attacks that make the headlines.

Team of Professional Computer Data Science Engineers Work on Desktops with Screens Showing

ABOUT US

about

Cyber Security Services

African-American IT worker sitting in server room behind workplace working with database o

Advisory Services

We offer advisory services. So whether you need guidance on building a robust security program, holistic security posture, focused assessments, or need a security professional to turn to, we have you covered.

LEARN MORE

cyber, attack,hacked word on screen binary code display, hacker.jpg

Incident Response

Our response team will facilitate the incident response process, preserve evidence, identify how the threat actor gained unauthorized access, unravel what happened, contain, and eradicate the threat from your environment.

LEARN MORE

Projection of programming code on Indian software developer.jpg

Managed Detection & Response

MDR services provide customers with modern security operations center (MSOC) functions. These functions allow organizations to rapidly detect, analyze, investigate and actively respond through threat mitigation and containment.

LEARN MORE

Photo of Out of Focus IT Technician Turning on Data Server..jpg

Vulnerability Assessments

Are you lacking the resources to conduct routine vulnerability scans on your own? Are you worried vulnerabilities are going overlooked? We can manage this for you and assist with prioritizing the results.

LEARN MORE

Young woman working with computer at table. Concept of cyber attack.jpg

Web Application Assessments

Your websites are available to the world, are they secure? Can hackers break into your websites? We can test your websites to ensure they are secure. Protect your data, your reputation, and your brand.

LEARN MORE

Digital Forensics

The more critical the evidence, the more likely the hacker will try to hide it, delete it, compromise or disguise it. We know all the tricks and techniques for recovering your hard-to-get digital evidence.

LEARN MORE

Security training concept. Top view of laptop, phone, glasses and pencil with card with in

Security Awareness Training

Human error is the cause of many data breaches. Your first line of cybersecurity defense should be your employees. Do they know how to shut down and report social engineering scams and phishing requests?

LEARN MORE

services

Latest From Blog

Hunt the Check Point root that arrived before login

A pre-authentication stack overflow in Check Point's login path gives an unauthenticated attacker root on Security Management Server, Multi-Domain, and Log Server. What it means for policy and log trust, how to patch, and hunt queries you can run today.

7 min read

What Windows execution artifacts actually prove

Shimcache, Amcache, Prefetch, BAM and SRUM all get called evidence of execution. Only some earn the name. What each artifact proves, what it does not, and the four ways analysts reach the wrong conclusion.

5 min read

Hunt the Cisco ISE login that never needed a password

Cisco ISE CVE-2026-76460 is on CISA KEV with a 19 September deadline, and the API it abuses never asked for an admin session. Patch the branch, then hunt the access logs for what arrived before you did: unauthenticated API calls, root, and credentials that moved.

6 min read

Spain’s Reported AI Agent Data Breach: Could Your Business Stop the Same Attack?

A reported AI-driven intrusion in Spain raises a harder question than which model was used: what could one successful login reach? Our analysis examines attack hypotheses, evidence gaps, preventive controls, and a practical SMB response plan.

11 min read

Comic illustration of the PasteSwitch ClickFix chain from a trusted-looking ad to pasted commands and a stealer.

PasteSwitch ClickFix: Hunt the Paste That Turns a Brand Ad Into a Stealer

A trusted-looking brand ad can lead to a dangerous paste. Learn how PasteSwitch ClickFix works, what to hunt across four security platforms, and how to contain endpoint and identity exposure.

7 min read

Comic illustration of shadow AI exposing a small business’s confidential data, with an Inception Security defender.

Is AI Putting Your Business at Risk? 10 Things SMBs Need to Do Now

A helpful AI tool can become a data exposure risk when access and rules are unclear. Follow these 10 AI security steps for small businesses, plus a practical 30-day plan for protecting data and managing compliance.

8 min read

Sogou CVE-2026-51990: How to Hunt for GRAYRABBIT

ACTION BRIEF • WINDOWS ENDPOINTS If your organization uses Sogou Input Method for Windows, verify its version and investigate suspicious activity from before it was patched. A malicious link can exploit a vulnerable installation to deliver GRAYRABBIT, a backdoor that gives an attacker access in the signed-in user’s context. Your first three actions: identify affected devices, update the software, and check whether attackers used it before the update. Patching closes the repor

7 min read

Hunt Artifactory token chain: CVE-2026-42018 to admin

JFrog Artifactory: How Tokens Become Admin and How to Hunt the Abuse

A software repository sits between the people who build software and the systems that run it. When that repository is compromised, the investigation needs to answer more than whether someone accessed a server. It needs to establish whether the company can still trust the identities, credentials, and artifacts passing through it. Recent Artifactory exploitation illustrates why. Two vulnerabilities allow an attacker to obtain a token and escalate its authority. A separate vulne

8 min read

Comic hunt of a GitLab commits POST that reads file.path

Hunt the commits POST that reads the GitLab box

Hunt GitLab CVE-2026-85706: unauth commits API path traversal. POST /repository/commits with file.path. watchTowr ITW Sep 11. CISA KEV due Sep 14.

7 min read

Hunt BlueMoon: Chrome curl msgbox EdgeCore

Hunt the Chrome-to-curl BlueMoon chain

The process tree still sitting on the box is not a closed Chrome patch ticket. It is chrome.exe (or msedge.exe / brave.exe) spawning cmd.exe, which spawns curl.exe, which writes %TEMP%\msgbox.exe or %TEMP%\ChromeUpdate.exe and runs it. Proofpoint tracks that default BlueMoon breakout, and the follow-on loaders are what operators actually keep. A hot stable build does not rewrite a curl stub that already ran from the broker. This hunt shop is not a second CVSS recap, and it is

8 min read

Hunt Cisco FMC: home.jsp, license.tmp, socks5

Hunt the FMC shell that opens AD for Qilin

The traces still on the management plane are not a closed patch ticket. They are a Tomcat JSP named home.jsp that Base64-decodes F6C1F0E7, a package_info.pl line that runs /var/tmp/license.tmp --lsm as root, and a Python socks5.py reverse-SSH tunnel that forwards LDAP, Kerberos, SMB, and WinRM out of Secure Firewall Management Center into Active Directory. Cisco Secure Firewall Management Center centrally manages your Secure Firewall estate. CVE-2026-20079 is a critical authe

4 min read

Hunt the Magento payment email that runs PHP for you

The leftover is not a failed checkout ticket. It is a process that looks like time sync, a cron line that restarts twice an hour, and a Payment Transaction Failed Reminder that already ran PHP while Magento rendered it. Nobody needed to open the message. Delivery can fail, and the planted code still executes. That is StyleSmuggler after the styles poison, not another Magento zero-day recap. Here is the plain version before the product jargon. An unauthenticated attacker poiso

4 min read

Hunt the ScreenConnect Guest that runs your scripts: 1.vbs through 4.vbs

The alert is wscript.exe, four short script names, and a Run key that looks like a Windows service helper. ScreenConnect is already on the box. Someone says helpdesk has a session. There is no ransomware family on the page, and the brand name on the client is the same one your techs use every day. That is when this chain wants you to call it a rogue RMM install and move on. Here is the plain version before the product jargon. A modified ScreenConnect client on one host watche

7 min read

Hunt the MP4 that never plays: NetSupport in an ISO-BMFF uuid box

You know the ticket. Someone downloaded a video. The ticket says media. The player refuses to open it. Antivirus already shrugged and called it an MP4. There is no ransomware family name on the alert, and the user swears they never watched anything. That unfair case is when this chain wants you to close it and move on. Here is the plain version before the box jargon. The file is a fake video shell. It is stuffed with a script. It is not a clip you failed to open. It is a carr

7 min read

Spring Ring: hunt the Teams helpdesk that never hits email

Unit 42 published Spring Ring today, 31 August 2026. The activity in the report is from January through April. This is leftover tradecraft, not a weekend outbreak. If you are hunting it because the write-up is new, you are hunting a gap that has been sitting in Teams since winter. The gap is Chat with anyone plus a voice call that never hits the mail gateway. They are not phish-mailing IT. A throwaway .onmicrosoft.com tenant named like a helpdesk opens a Teams chat. Then a 10

5 min read

PaperCut CVE-2026-81578: hunt the emergency patch that did not stay a patch

You have seen this ticket. Print is still working. Someone applied the first emergency PaperCut patch when it dropped, the queue came back, and they closed it. The Application Server web UI is still on the internet because print admins do not like taking that box down twice in one week. That is the hunt. Not the CVE number. The hunt is the emergency patch that did not stay a patch. CISA put CVE-2026-81578 and CVE-2026-82078 on KEV on 31 August 2026. If you only ran Patch 1, y

5 min read

LATEST PROJECTS

Experiencing a Cyber Incident? +1 (888) 427-2937

INCEPTION

INCEPTION SECURITY

IMPROVING CYBERSECURITY FROM THE GROUND UP!

ABOUT INCEPTION SECURITY

We Provide High Quality Cybersecurity Solutions...

Cyber Security Services

Advisory Services

Incident Response

Managed Detection & Response

Vulnerability Assessments

Web Application Assessments

Digital Forensics

Security Awareness Training

Latest From Blog

Hunt the Check Point root that arrived before login

What Windows execution artifacts actually prove

Hunt the Cisco ISE login that never needed a password

Spain’s Reported AI Agent Data Breach: Could Your Business Stop the Same Attack?

PasteSwitch ClickFix: Hunt the Paste That Turns a Brand Ad Into a Stealer

Is AI Putting Your Business at Risk? 10 Things SMBs Need to Do Now

Sogou CVE-2026-51990: How to Hunt for GRAYRABBIT

JFrog Artifactory: How Tokens Become Admin and How to Hunt the Abuse

Hunt the commits POST that reads the GitLab box

Hunt the Chrome-to-curl BlueMoon chain

Hunt the FMC shell that opens AD for Qilin

Hunt the Magento payment email that runs PHP for you

Hunt the ScreenConnect Guest that runs your scripts: 1.vbs through 4.vbs

Hunt the MP4 that never plays: NetSupport in an ISO-BMFF uuid box

Spring Ring: hunt the Teams helpdesk that never hits email

PaperCut CVE-2026-81578: hunt the emergency patch that did not stay a patch

INCEPTION SECURITY™

NAVIGATION

GET IN TOUCH