SoS - مصادر أمن المعلومات

Three Microsoft Defender Zero-Day Vulnerabilities Being Actively Exploited (BlueHammer, RedSun, UnDefend)

2026-04-20T07:06:00.000+04:00

Three actively exploited zero-day vulnerabilities have been identified in Microsoft Defender: BlueHammer (CVE-2026-33825), RedSun, and UnDefend. BlueHammer has been patched; RedSun and UnDefend remain unpatched. BlueHammer and RedSun are Local Privilege Escalation (LPE) flaws; UnDefend is a Denial-of-Service (DoS) flaw that blocks Defender updates.

Exploitation began around April 10, 2026, with all three observed in active post-compromise campaigns. Attackers are executing reconnaissance commands (whoami /priv, cmdkey /list, net group), indicating hands-on-keyboard activity following initial access.

CVE-2026-33825 is confirmed publicly exploited. The combination of LPE and defense evasion capabilities makes this critical: attackers can gain full administrative control, disable protections, and achieve persistent, undetected access. The patch gap for RedSun and UnDefend means organizations remain exposed even after applying the latest update cycle.

PTTs:

T1068 — Exploitation for Privilege Escalation

T1562.001 — Impair Defenses: Disable or Modify Tools

T1033 — System Owner/User Discovery

T1069 — Permission Groups Discovery

T1087 — Account Discovery

T1078 — Valid Accounts

Recommendations:

Immediately apply the patch for CVE-2026-33825 (BlueHammer) across all managed endpoints.

Implement detection rules for post-exploitation reconnaissance commands: whoami /priv, cmdkey /list, and net group.

Alert on Defender update failures or abnormal Defender service behavior as a potential indicator of UnDefend exploitation.

Restrict local administrative privileges using the principle of least privilege to limit the impact of LPE vulnerabilities.

Until patches are available for RedSun and UnDefend, apply compensating controls: enhanced logging, privileged access workstations (PAWs), and network segmentation.

Critical RCE in Fortinet FortiSandbox - CVE-2026-39808

2026-04-20T06:58:00.001+04:00

CVE-2026-39808 is a critical OS command injection vulnerability affecting Fortinet FortiSandbox versions 4.4.0 through 4.4.8. The flaw resides in the /fortisandbox/job-detail/tracer-behavior endpoint, where unsanitized user input in the jid GET parameter allows an unauthenticated attacker to inject arbitrary OS commands using the pipe symbol (|), resulting in root-level remote code execution (RCE).

The vulnerability was discovered in November 2025 and patched and publicly disclosed by Fortinet in April 2026 under advisory FG-IR-26-100. A working proof-of-concept (PoC) exploit has since been published on GitHub by researcher samu-delucas, reducing the barrier to exploitation to a single curl command — requiring no authentication, no special tooling, and no prior knowledge of the target environment.

Public exploitation: The PoC is freely available. Active exploitation in the wild should be assumed and treated as imminent.

Potential impact: Full host compromise, sensitive file exfiltration, malware deployment, lateral movement from within sandbox infrastructure — a high-value target given FortiSandbox's role in threat analysis pipelines.

TTPs:

T1190 - Exploit Public-Facing Application

T1059 - Command and Scripting Interpreter

T1068 - Exploitation for Privilege Escalation

T1105 - Ingress Tool Transfer

T1505 - Server Software Component

T1083 - File and Directory Discovery

Recommendations:

Immediately upgrade FortiSandbox to a version beyond 4.4.8 as per Fortinet advisory FG-IR-26-100; do not defer — a weaponized PoC is publicly available

Verify all deployed FortiSandbox instances and confirm version; prioritise internet-facing or management-accessible deployments

Apply network segmentation to restrict access to FortiSandbox administrative and management interfaces to trusted IP ranges only; these interfaces should never be exposed to untrusted networks or the public internet

Audit firewall rules and WAF policies to block or alert on GET requests containing pipe symbols (|) targeting the /fortisandbox/job-detail/tracer-behavior endpoint

Review access logs for suspicious GET requests to /fortisandbox/job-detail/tracer-behavior as indicators of active exploitation attempts

Implement monitoring and alerting for anomalous outbound connections or new file creation in the web root of FortiSandbox hosts

If patching is not immediately possible, consider taking vulnerable FortiSandbox instances offline or placing them behind strict access controls as a temporary mitigation

Iran War - Cyber Threat Outlook

2026-04-20T06:50:00.001+04:00

A SOCRadar threat intelligence assessment covering the month of the Iran-Israel/US war (Feb 28 – Mar 31, 2026) documents 1,357 verified cyber incidents across 25+ countries, 15+ sectors, and 40+ distinct threat actor groups. The campaign is structured across five phases with distinct threat profiles at each stage.

Phase 1 (Feb 28 – Mar 6): Kinetic strikes were immediately accompanied by cyber operations. Iranian government sites, IRNA, and IRGC-affiliated media were taken offline or defaced. Iran-aligned hacktivist coalitions formally organized on Telegram within 72 hours. OT/ICS intrusion claims appeared within 96 hours.

Phase 2 (Mar 7–15): Geographic expansion beyond Israel, The defining event was the Stryker Corporation attack on March 12, where Handala (MOIS-linked) abused Microsoft Intune administrator access to remotely wipe 200,000+ devices across 79 countries. Stryker filed an SEC 8-K confirming the incident. This demonstrated that a state-linked actor can leverage compromised cloud MDM infrastructure for destructive global impact against non-combatant civilian companies.

Phase 3 (Mar 16–31): Shift to persistent operations and reconnaissance. MuddyWater's Dindoor and Fakeset Python implants were confirmed pre-planted in a U.S. bank, airport, defense-adjacent software firm, and NGOs before Feb 28. Geo-doxxing surged (59 incidents in Weeks 3–4), targeting nuclear facilities, offshore gas platforms, military airbases, and refineries. Jordan's NCSC confirmed a thwarted APT attack on grain storage. Handala hacked FBI Director Kash Patel's personal Gmail account. FBI seized Handala's domain; Handala migrated within hours.

Phase 4 (Ongoing): Bifurcation point — either managed entrenchment (sustained espionage/coercion) or active escalation (activation of pre-positioned access into destructive operations). Pre-positioned implants remain resident regardless of ceasefire status.

TTPs:

T1498 - Network Denial of Service

T1485 - Data Destruction

T1078 - Valid Accounts

T1059.006 - Command and Scripting Interpreter: Python

T1133 - External Remote Services

T1567 - Exfiltration Over Web Service

T1588.002 - Obtain Capabilities: Tool

T1583.001 - Acquire Infrastructure: Domains

T1071.001 - Application Layer Protocol: Web Protocols

T1595 - Active Scanning / Reconnaissance

T1489 - Service Stop

T1496 - Resource Hijacking / Defacement

T1190 - Exploit Public-Facing Application

Recommendations:

Validate DDoS mitigation capacity on all public-facing portals and APIs and confirm upstream scrubbing coverage.

Audit all Microsoft Intune and cloud MDM administrator accounts for unauthorized access; enforce MFA on all admin accounts without exception and review bulk device action logs for unauthorized mass wipe or factory reset commands

Hunt for Dindoor and Fakeset implant indicators across all endpoints; prioritize banks, airports, defense-adjacent organizations, and NGOs

Review and audit all outbound connections to GitHub and Google Drive originating from non-developer endpoints as potential C2 indicators

Audit all installed RMM tools across client environments; remove or block Atera and ScreenConnect where not explicitly authorized

Review all OAuth app grants in Microsoft 365 and Google Workspace tenancies for unauthorized third-party access

For OT/ICS environments: immediately audit internet-facing PLCs, HMI panels, and SCADA systems; remove default vendor credentials and validate OT/IT network segmentation

Conduct a full audit of IP camera and CCTV infrastructure; isolate camera networks from enterprise IT, change all default credentials, and patch against CVE-2023-6895 and CVE-2025-34067

In 1983, Steve Jobs predicted the next 50 years of technology. His predictions: • iPhone • Internet • Softwares • App stores • Artificial Intelligence

2026-03-03T08:01:04.639+04:00

فخ الذكاء الاصطناعي: لماذا ستندم الشركات التي طردت المبرمجين؟.. الكارثة ...

2026-02-14T20:14:00.001+04:00

The Biggest Robot Exhibition in Las Vegas | CES 2026

2026-01-09T14:08:00.002+04:00

كيف ابدأ تعلم الامن السيبراني

2025-12-22T22:09:00.002+04:00

AI CEOs Are Disappearing - They Know Whats Coming

2025-12-15T20:10:00.001+04:00

محمد ثروث حسن: عالم مصري يبتكر ضوءا لا يخترق

2025-11-22T13:05:00.002+04:00

تحذيرات مرعبة: انهيار "حاد ومفاجئ" سيفجر فقاعة الذكاء الاصطناعي - اقتصاد...

2025-10-20T15:56:00.004+04:00

الجانب المظلم من تليجرام وكيف أصبح أخطر من الدارك ويب

2025-09-30T21:53:00.001+04:00

10 FREE OSINT Tools To Gather Info On Someone

2025-09-20T07:12:00.003+04:00

The Catastrophic Risks of AI — and a Safer Path | Yoshua Bengio | TED

2025-08-30T11:11:00.002+04:00

10 إلى 20% خطر فناء البشر.. "عرّاب" الذكاء الاصطناعي يوجه تحذيرًا قاتمًا بشأن المستقبل القريب

2025-08-18T20:26:00.004+04:00

Why is Airgap+ effective?

2025-08-12T07:19:00.004+04:00

Disconnected by default The backup NAS remains isolated from all network access—except when temporarily connected for scheduled backup jobs. Physically isolated Provides the most secure and stable protection with network isolation.

أخطر أسرار الأمن السيبراني في عصر الذكاء الاصطناعي - زياد حماد |كلام في البرمجة (37) |Hacking the AI…

2025-07-27T13:10:00.005+04:00

AI for Good Summit 2025

2025-07-12T07:24:00.005+04:00

Type of VPN - Virtual Private Networking

2025-07-01T07:48:00.000+04:00

كيف اسقط واتساب أخطر رجال إيران دون طلقة؟… مكالمة واحدة قلبت الموازين!

2025-06-21T13:37:00.000+04:00

Python Projects for H4cking

2025-06-10T06:34:00.003+04:00

AI Agents Tutorial For Beginners

2025-06-04T07:56:00.001+04:00

مستقبل الذّكاء الاصطناعي والبيانات في الأردن

2025-06-01T06:47:00.007+04:00

https://www.youtube.com/live/-DroJbBLbZE?si=681l_7le6viTCmRC

إبدأ من الدقيقة ٢٠ – البداية مشوشة فيها صدى – مهمة تذكر تفاصيل البحث العلمي والكفاءات اﻷردنية بالخارج …. بيحكوا عن التعليم الجامعي كمان بما يتعلق بالذكاء اﻹصطناعي .. الحديث بمستوى مقبول غير متكلف وبلغة مبسطة

Azure AI Foundry: The AI app and Agent Factory | BRK155

2025-05-30T06:11:00.003+04:00

Cybersecurity A Short Film

2025-05-22T08:16:00.000+04:00

Roadmap to learn Cyber Security

2025-05-21T07:45:00.002+04:00