What do a copyright infringement, mistakenly uploaded ProcMon logs, and a Rust InforStealer have in common? Find out in this first part of the blog post "Iranopasmigirim", where we uncover an Iran-based threat actor that targets dissidents using ParsaStealer. In this first part, we highlight the lures used, OpSec failures, and delivery tactics. The second part will highlight a wide arsenal of unused malware and the evolution of ParsaStealer (eta October) labs.infoguard.ch/posts/iran…

New Post from our Pentest Team: One pentest turned into 22 CVEs in TeamDavid®. From an unauthenticated single-request DoS all the way to fully unauthenticated account takeover. labs.infoguard.ch/posts/22-c…

New Advisory from our Pentest Team: We've identified a Local Privilege Escalation vulnerability in the Remote Monitoring & Management Servereye (CVE-2026-14551). Insecure Folder Permissions lead to NT/SYSTEM Details: labs.infoguard.ch/advisories…

We recently analyzed an interesting piece of malware that utilizes the legitimate JavaScript runtime, Deno. The malware was used as a first-stage implant after the user was tricked into downloading and running the malware. Read the full article here: labs.infoguard.ch/posts/anat…

Unveiling Ghost-Sender: a widespread and dangerous Microsoft Exchange Online default misconfiguration exposing thousands of targets (incl.F500) to arbitrary mail spoofing. Read on labs.infoguard.ch/posts/ghos… Assess yourself ghost-sender.com

New research: We audited SEPPmail's virtual appliance & found critical issues. Our post covers CVE-2026-2743 (RCE via syslog.conf) & CVE-2026-44128 (Perl injection) that let attackers read all mails or compromise the appliance. -> labs.infoguard.ch/posts/sepp…

New Advisory from our Pentest Team: We've identified a Local Privilege Escalation vulnerability in the remote management software pcvisit (CVE-2026-0539). Insecure file permissions allow low-privileged users to gain SYSTEM access. Details: labs.infoguard.ch/advisories…

New blog post is live: a deep dive into the BravoX ransomware group — covering their TTPs across the attack chain, from initial access to exfiltration and impact, with a closer look at their tooling and notably their negotiation approach. labs.infoguard.ch/posts/brav…

In this blog post, we share our research on the #VIPERTUNNEL Python backdoor found during a DragonForce Ransomware Incident. We'll examine infrastructure hunting, its code, and how its obfuscation has evolved (spoiler: it changed a lot). labs.infoguard.ch/posts/slit…

Another Security Agent, another Local Privilege Escalation! CVE-2026-3991: Symantec DLP Agent for Windows is affected by an LPE via a hardcoded OpenSSL configuration path. An easy way to get a SYSTEM shell directly into the DLP process. by @p0w1_ labs.infoguard.ch/advisories…

If you can read the detection rules, evading them becomes a lot easier. New write-up on decrypting Cortex XDR behavioral rules and abusing Global Whitelists by @p0w1_. TL;DR: just put ':\Windows\ccmcache' in your command line. Fixed in Agent 9.1. labs.infoguard.ch/posts/decr…

Abusing Cortex XDR Live Terminal as C2 We reverse-engineered the IR payload and found ways to route EDR traffic to attacker-controlled tenants or custom servers. Living off the Land #LOTL with EDRs. Full write-up by @p0w1_ 👇labs.infoguard.ch/posts/abus…

Need a SYSTEM shell? Just ask your EDR! CVE-2025-13176: ESET Inspect Connector looks for an OpenSSL config in a user-writable path. It’s an easy LPE that loads your payload directly into the EDR process. by @p0w1_ labs.infoguard.ch/advisories…

New blog: hunting reflected .NET assemblies at scale with Velociraptor, detecting CLR patching, and dumping in-memory payloads for triage by @mgreen27  #DFIR #Velociraptor labs.infoguard.ch/posts/clra…

We've published technical details for CVE-2025-51682 and CVE-2025-51683 – two vulnerabilities in the time management software mJobTime that lead to unauthenticated RCE via SQLi by @dario_weiss: labs.infoguard.ch/advisories…