Sys-Admin InfoSec

Open SysConf'26 - Доклад: поиск уязвимостей в эпоху AI

Кибербезопасность, AI - сегодня идут нога в ногу, в качестве союзников, иногда в качестве врагов.

Доклад от @Thatskriptkid - Malware analyst, threat hunter, vulnerability researcher, автора множества интерейснейших ресерчей и интересных докладов, автора канала Order of Six Angles - https://t.me/orderofsixangles, хорошего друга, человека, который поддерживает и с первого Open SysConf с нами.

Рассказ автора про свою хоум лабу, про проекты которые крутятся на ней, как были найдены баги в Pixel, Xiaomi, Mediatek в результате подготовки ресерча, опыт автора с локальными ЛЛМ, Android Exploitation, Фаззинг драйверов Windows и не только...

10 Октября, в 10 утра, SmartPoint зал "Freedom Amphitheatre", Алматы.

https://sysconf.io/2026

An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

injecting backdoor in to terraform

https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/

Threat Spotlight: Phishing pages that exist only inside the victim’s browser

https://blog.barracuda.com/2026/09/09/browser-based-phishing-blob-urls-microsoft-redirects

Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended

The CERT Polska team has identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS. Combining two of them allows an attacker to take full control of the device without authentication if the device supports remote access using the SSH protocol. To make this chain easier to identify, we have given it a common name, MikroTrick:

https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/

🦄️️️️️️ Open SysConf'26. Спикер - ты нам нужен.

Начало сентября означает не только начало учебного года, но и, что Open SysConf'26 ближе чем ты думаешь!

Мы ищем доклады и докладчиков, заявки оставлять здесь.

В этом году места ограничены, поэтому фиксируйся, что бы точно попасть здесь.

Какие доклады мы ищем - интересные, бизнесовые, технические, ресерчи - все то, что поможет каждому развиться и сделать шаг вперед.

Передай друзьям, знакомым - мы рады видеть всех, кто готов развиваться и показывать дела, а "не пиздеть - не мешки ворочить".

Будут вопросы - смело пиши.

Всем Мир ✌️

Building Linux eBPF/XDP apps on macOS (Apple Silicon)

I spend a lot of time building high-performance DNS filters and network tools in Go. My primary development machine is an Apple Silicon Mac, but all the production deployments target Linux/AMD64 servers.

Recently, I started heavily integrating eBPF and XDP to drop abusive traffic (like random subdomain attacks) before it even hits the Go networking stack. However, compiling C eBPF code locally on macOS has always been a pain due to the missing Linux headers and the architectural differences...

I wrote down the exact step-by-step process, including a workaround for the notorious Debian multiarch header issue (asm/types.h) and a neat little smoke test using bpftool inside the container..:

https://openbld.net/blog/build-xdp-ebpf-macos-guide/

Manic: Blend between Banking Malware & Spyware

is a new Android banking malware and mobile spyware:

https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware

Clop Returns with Custom Implant in Mass-Extortion Campaign

..“Clop's” exploitation of CVE-2026-12569 in PTC Windchill has returned the group to mass exploitation, delivering a custom web shell that provides full data-theft capability from the moment of deployment, with no additional tooling required..:

https://reliaquest.com/blog/clop-returns-with-custom-implant-in-mass-extortion-campaign/

3 BILLION DNS queries.

Almost +1 billion in one week.

OpenBLD started in 2019 as a homegrown project handling around 35K DNS queries a day.

Today:

→ ~15M queries/hour
→ 4K+ queries/second
→ servers distributed around the world
→ billions of DNS queries processed

And it still runs mostly on regular VPS infrastructure - with plenty of performance headroom left.

Getting here required years of optimizing the entire stack: networking, DNS processing, caching, filtering, load balancing, observability, and the Go code itself.

Now the growth is public too:

Real-time OpenBLD network statistics are live on OpenBLD.net.

From 35K/day to 3 billion.

Still building. 🚀

Fast. Private. Open.

7-Zip Leaves Extracted Malware Without Mark-of-the-Web, Bypassing Windows SmartScreen

evil 7-zip)

https://cyberpress.org/7-zip-bypasses-smartscreen-protections/

Threat Actors Abuse Trusted Software Lures and Cloudflare Tunnels to Deploy ScreenConnect RMM Agents Across Windows and macOSScreenConnect RMM Agents Across Windows and macOS

Analyzing SMOKE#SCREEN:

https://www.securonix.com/blog/smoke-screen-screenconnect-rmm-abuse-cloudflare-tunnels/

Welcome to Danglegeddon

Silent Push Simulation Demonstrates Why Dangling Dns Domains Continue To Pose Global Threats..:

https://www.silentpush.com/blog/danglegeddon/

ClickLock Stealer: Paste Once, Lose Everything

Upon execution of the ClickFix command, the malicious script shows a terminal-based loading animation mimicking Cloudflare progress bar with browser verification flow..:

https://www.group-ib.com/blog/clicklock-stealer-macos-malware/

Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories

https://www.stepsecurity.io/blog/compromised-next-branch-pushes-malicious-asyncapi-generator-generator-helpers-and-generator-components-to-npm

Cursor 0day: When Full Disclosure Becomes the Only Protection Left

https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left

Inside Forg365: A Telegram-Distributed Sneaky 2FA-Style PhaaS Targeting

https://zerobec.com/blog/inside-forg365-telegram-distributed-sneaky2fa-style-phaas