Defused

624 posts

Defused banner
Defused

Defused

@DefusedCyber

Managed Honeypots for Early-warning Threat Intelligence 🍯 Access free honeypot intel: https://t.co/TTnxgi9Hv5

Katılım Ağustos 2023
1 Takip Edilen6.2K Takipçiler
Sabitlenmiş Tweet
Defused
Defused@DefusedCyber·
🚨 Two updates from the Defused honeypot lab 1️⃣ New FortiClient EMS decoy deployed CVE-2026-21643 (pre-auth SQLi, CVSS 9.1) - Bishop Fox just dropped a full exploitation writeup for FortiClient EMS 7.4.4. No public exploitation observed yet but with a detailed writeup now out, it's a matter of time. We've added a FortiClient EMS honeypot stream to catch early exploitation attempts 🍯 2️⃣ SharePoint CVE-2026-20963 added to CISA KEV Microsoft SharePoint deserialization flaw - actively exploited in the wild. RCE via crafted network requests, no auth required. Track exploitation attempts against our SharePoint decoys on the platform. 👉 console.defusedcyber.com/signup
Defused tweet media
English
1
9
26
3.6K
Defused
Defused@DefusedCyber·
⚠️ We are observing an active exploitation campaign targeting Citrix NetScaler instances We have observed 500+ exploit attempts of both CitrixBleeds (CVE-2025-5777 and CVE-2023-4966) against our NetScaler decoys across multiple regions: 193.24.211.86 AS215929 🇧🇬 Data Campus Limited 173.164.73.25 AS7922 🇺🇸 Comcast Cable Communications 91.92.243.126 AS202412 🇳🇱 Omegatech LTD 194.31.223.238 AS215439 🇩🇪 PLAY2GO INTERNATIONAL LIMITED Highly elevated exploit activity against older vulnerabilities can often precede a zero-day vulnerability Monitor exploitation of edge devices like Citrix NetScaler in real time 👉 console.defusedcyber.com/signup
Defused tweet media
English
1
25
66
10.9K
Defused retweetledi
Simo
Simo@SimoKohonen·
Shipped a number of improvements for finding the crucial intel from the @DefusedCyber TI - Filtering by attacker noise index (remove mass & scanners very easily) - Keyword, IP, attack type exclusions Check 'em 👉console.defusedcyber.com/intel
Simo tweet media
English
0
4
18
2K
Defused
Defused@DefusedCyber·
🚨 Note to people using systems like OpenClaw - bots are continuously crawling the internet for any leaking pathways, configurations and credentials. If it's on the internet, they will eventually find and abuse it 🤖 Ensure you have removed attack surface before deploying!
Defused tweet media
English
1
5
19
2.6K
CYDEX Security
CYDEX Security@CydexSecurity·
#Cybersecurity
Defused@DefusedCyber

🚨 Cisco SD-WAN CVE-2026-20127 is under active exploitation by multiple attackers Exploit activity is decently heavy with attackers trying to implement multiple persistence mechanisms Attacker in screenshot implements a gsocket/gs-netcat based backdoor connected to a Telegram bot, using kernel thread name spoofing ([kswapd0], [ksmd]) to hide processes. Patch immediately. If on an affected version, assume compromise and hunt. Track exploitation 👉 console.defusedcyber.com/intel

QHT
1
0
2
301
Defused retweetledi
Simo
Simo@SimoKohonen·
Webshells be flowing into Cisco SD-WAN honeypots now.. Exploitation of CVE-2026-20127 is looking pretty heavy, new actors popping up by the hour
Simo tweet media
English
2
19
65
16K
Defused retweetledi
mRr3b00t
mRr3b00t@UK_Daniel_Card·
we are inside the @DefusedCyber honeypots looking at : Cisco Catalyst SD-WAN (vManage) we are using @ipinfo for enrichment..... CVE-2026-20127 exploitation ..... let's take a peek! #Cyber #Baddies #CyberCrime
mRr3b00t tweet media
English
2
4
16
2.4K
Defused
Defused@DefusedCyber·
🚨 Cisco SD-WAN CVE-2026-20127 is under active exploitation by multiple attackers Exploit activity is decently heavy with attackers trying to implement multiple persistence mechanisms Attacker in screenshot implements a gsocket/gs-netcat based backdoor connected to a Telegram bot, using kernel thread name spoofing ([kswapd0], [ksmd]) to hide processes. Patch immediately. If on an affected version, assume compromise and hunt. Track exploitation 👉 console.defusedcyber.com/intel
Defused tweet media
English
4
22
57
18.1K
Defused
Defused@DefusedCyber·
⚠️We are noting potentially novel exploit variants against Fortinet honeypots 🍯 Attacker source AS12975 (PALTEL Autonomous System) 🇵🇸 Various fabric endpoints are being exploited similar to CVE-2025-25257 (supplying malicious SQL code through authorization headers) 👉 console.defusedcyber.com/intel
Defused tweet media
English
0
10
25
5K
VulnTracker
VulnTracker@vuln_tracker·
CVSS 10.0 authentication bypass and threat actors are already fingerprinting exposed instances. China, Sweden, Russia — global interest. No PoC public yet but Nuclei templates are already being weaponized for enumeration. The window between scanning and exploitation is shrinking. Full CVE details: vulntracker.io/cves/CVE-2026-…
English
1
0
0
156
Defused
Defused@DefusedCyber·
⚠️Cisco SD-WAN (CVE-2026-20127) enumeration slowly on the increase We have observed fingeprinting attempts against vulnerable Cisco SD-WAN instances - involving either utilizing Nuclei templates for older CVE's (such as CVE-2020–26073) or probing various SD-WAN REST API authentication endpoints. No observed POC candidates as of yet Some IPs involved from the past 24 hours: 111.194.48.235 China Unicom Beijing Province 🇨🇳 158.174.210.97 Bahnhof AB 🇸🇪 95.215.0.144 Petersburg Internet Network ltd. 🇷🇺
Defused tweet media
English
1
13
33
5.3K
Defused retweetledi
Eli Woodward
Eli Woodward@ElijahWoodward9·
Cisco SD-WAN scanning is picking up. This kind of reconnaissance is usually a precursor to active exploitation. Interestingly there's no public POC available yet, but the advisory reported this has been exploitation for 3 years already. I imagine it's just a matter of time before this is public.
Defused@DefusedCyber

⚠️Cisco SD-WAN (CVE-2026-20127) enumeration slowly on the increase We have observed fingeprinting attempts against vulnerable Cisco SD-WAN instances - involving either utilizing Nuclei templates for older CVE's (such as CVE-2020–26073) or probing various SD-WAN REST API authentication endpoints. No observed POC candidates as of yet Some IPs involved from the past 24 hours: 111.194.48.235 China Unicom Beijing Province 🇨🇳 158.174.210.97 Bahnhof AB 🇸🇪 95.215.0.144 Petersburg Internet Network ltd. 🇷🇺

English
0
4
14
1.9K
mRr3b00t
mRr3b00t@UK_Daniel_Card·
Ok this is insane, we post IPs all the time here, @Support can someone look into this please? 🙏
mRr3b00t tweet media
English
10
5
80
8.6K

Keşfet

@AdolfoUsier @CydexSecurity @ipinfo @techspence @UK_Daniel_Card @vuln_tracker @elonmusk @BarackObama