SpiderLabs Blog
Explore the latest threats, critical vulnerability disclosures, cutting-edge research, and intelligence from our elite global threat experts.
LevelBlue TTP Briefing Q3 2026: Trusted Access Fuels Data Theft
October 28, 2026
Stay Informed
Sign up to receive the latest security news and trends straight to your inbox from LevelBlue.
Securing the Software Development Lifecycle and Supply Chain in an AI-Forward World
October 22, 2026 | Pauline Bolaños
It’s no secret how artificial intelligence (AI)-powered tools and systems, ...
PHP2Shell: Critical RCE Vulnerabilities Affect a Large Majority of Web Servers
October 22, 2026 | Karl Sigler
Update Oct 22 2026: New sections were added for “Observed Threat Activity and ...
Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts
October 20, 2026 | Cris Tomboc and Kevin Adriano
LevelBlue SpiderLabs has been tracking multiple waves of Wazza, a newly ...
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign
October 07, 2026 | King Orande and Cris Tomboc
Key Takeaways
Filling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands
October 05, 2026 | Serhii Melnyk and Timmy Lister
A new proof of concept called BigDiskBuster, published on GitHub on September ...
TIKTOUK: Tracing a WordPress Credential Collection Toolkit
October 01, 2026 | Maor Gabay
TIKTOUK brings together WordPress probing, collection of exposed configuration ...
Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators
September 30, 2026 | Sean Shirley
With contributions from James Rodriguez, Gus Stamatinos, and Timmy Lister.
Citrix NetScaler Zero-Day Exploited Globally
September 29, 2026 | Karl Sigler
On Sept 27, Citrix released patches for two critical vulnerabilities being ...
File Acquisition May Be Recorded as “FileAccessed” in Microsoft 365 (“M365”)
September 24, 2026 | Jamie Mamroe and Matt Arbaugh & Joel Bowers
A recent trend has emerged where threat actor groups (e.g., ShinyHunters, PEAR, ...
Enumerating Users and MFA via Microsoft's Password Reset Portal
September 23, 2026 | Matthew Coady
Microsoft's Self-Service Password Reset (SSPR) portal is a legitimate feature ...
One Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed
September 16, 2026 | Serhii Melnyk and Timmy Lister
(Edit - Sept 17, 2026): The originally released PoC had issues that broke ...
Expanding the Attack Surface: Analyzing Nightmare-Eclipse's Latest PoCs
September 09, 2026 | Serhii Melnyk and Timmy Lister
In our previous blog, we explored a series of disclosures from the leak persona ...
Still Circling: Inside the Operator Behind Blind Eagle's GitHub Loader
August 28, 2026 | Serhii Melnyk
This is a collaborative follow-up to our original post, developed jointly with ...
Energy Disruption in UK Critical Infrastructure and the Growing OT Cyber Threat
August 25, 2026 | Nikita Kazymirskyi
A cyber incident affecting a small UK electricity generator in July 2026 ...
Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking
August 19, 2026 | Serhii Melnyk and Timmy Lister
Following GreenPlasma, YellowKey and MiniPlasma, RoguePlanet and GreatXML, and ...
Release the RAVEN: Destruction and Discipline
August 18, 2026 | Karl Biron
In Part 4, we stole every document from every index, planted a rogue superuser ...
Release the RAVEN: Data Heist and Persistence
August 14, 2026 | Karl Biron
We have access through port 9200. We have code execution through port 5601. ...
Release the RAVEN: Kibana Under Siege
August 13, 2026 | Karl Biron
In Parts 1 and 2, every command targeted port 9200. Every exploit, every ...
The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains
August 12, 2026 | Karla Agregado
To stay ahead of evolving threats, LevelBlue utilizes a machine-learning-based ...
CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain
August 10, 2026 | Rodel Mendrez
This post is the result of an investigation into a case we worked on, in which ...
Beyond ‘Fake Updates’: From Application Store-Themed Phishing to Large-Scale Distribution of ScreenConnect
August 07, 2026 | King Orande and Cris Tomboc
The LevelBlue OpsCTI Team recently identified a large-scale phishing campaign ...
Release the RAVEN: Exploiting the Cracks
August 06, 2026 | Karl Biron
In Part 1, we went from a single open port to a complete map of the target. ...
Release the RAVEN: First Contact
August 05, 2026 | Karl Biron
You are mid-engagement. Nmap finishes its sweep and port 9200 lights up on a ...
Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems
August 04, 2026 | Nikita Kazymirskyi
In light of the water-sector activity described below, we've increased ...
Release the RAVEN: An Offensive Reconnaissance and Attack Tool on Vulnerable Elasticsearch Nodes
July 29, 2026 | Karl Biron
You have almost certainly interacted with Elasticsearch today. The search bar ...
LegacyHive: Hunting Windows Profile Initialization Abuse Through Offline Registry Manipulation
July 27, 2026 | Serhii Melnyk and Timmy Lister
Following GreenPlasma, YellowKey and MiniPlasma, as well as RoguePlanet and ...
LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses
July 23, 2026
Explore the latest tactics, techniques, and procedures (TTPs) our incident ...