CVE-2009-0556: The 2009 PowerPoint But that Refuses to Die
January 23, 2026 | Messiah Dela Cruz
Stay Informed
Sign up to receive the latest security news and trends straight to your inbox from LevelBlue.
Ni8mare on Automation Street: When Workflows Turn Into an Attack Path
January 15, 2026 | Nikita Kazymirskyi
CVE-2026-21858 (Ni8mare) is a maximum-severity vulnerability in self-hosted n8n ...
A 2025 Threat Trends Analysis
December 22, 2025 | Andrea Martinez and Peter Connolly
As 2025 winds down and cruises into the holiday season, it’s a good time to ...
Holiday Fraud 2025: Gift Card Schemes Exploiting Seasonal Shopping
December 19, 2025 | Serhii Melnyk
Children with a vision of a huge payout from Santa Claus are not the only ones ...
A Rising Tide of Threats: The Offshore Energy Industry’s Threat Landscape
December 12, 2025
Key Findings:
Threat Intelligence News from LevelBlue SpiderLabs December 2025
December 12, 2025
LevelBlue SpiderLabs is the threat intelligence unit of LevelBlue and includes ...
Sha1-Hulud: The Second Coming of The New npm GitHub Worm
December 03, 2025 | Karl Sigler
Sha1-Hulud is back with a new evolution of its supply-chain attack that targets ...
SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp
November 19, 2025 | Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi
LevelBlue SpiderLabs researchers have recently identified a banking Trojan we ...
Bolstering Cybersecurity Resilience in the Public Sector
October 29, 2025
With digital transformation continuing unabated, the prevalence of legacy ...
Notepad++ DLL Hijacking (CVE-2025-56383): CVSS 8.4 or CVSS 0.0?
October 03, 2025
A vulnerability on a popular source-code editor has been recently released ...
Lights Out and Stalled Factories: Using M.A.T.R.I.X to Learn About Modbus Vulnerabilities
May 06, 2025 | Karl Biron
Let’s explore the critical role of Modbus in energy and manufacturing systems, ...
Bring Your Own Installer: Bypassing EDR Through Agent Version Change Interruption
May 05, 2025 | John Ailes and Tim Mashni
Bring Your Own Installer is a technique which can be used by threat actors to ...
Fort Knox for Your Data: How Elasticsearch X-Pack Locks Down Your Cluster – Part 2
March 20, 2025 | Karl Biron
In Part 1 of Fort Knox for Your Data: How Elasticsearch X-Pack Locks Down Your ...
2025 Trustwave Risk Radar Report: Top Cyber Threats Targeting the Manufacturing Sector
February 26, 2025
2025 Trustwave Risk Radar Report Unveils Top Cyber Threats to Manufacturing: ...
Cracking the Giant: How ODAT Challenges Oracle, the King of Databases
January 27, 2025 | Karl Biron
In the past decade, Oracle Database (Oracle DB) has reigned supreme in the ...
Lessons from a Honeypot with US Citizens’ Data
November 13, 2024 | Radoslaw Zdonczyk and Nikita Kazymirskyi
Prior to last week’s US Presidential Election, the Trustwave SpiderLabs team ...
The Mounted Guest EDR Bypass
November 11, 2024 | Colin Meek
The Mounted Guest EDR Bypass is a tactic used in cyber attacks to evade ...
How Threat Actors Conduct Election Interference Operations: An Overview
October 18, 2024 | Pauline Bolaños
The major headlines that arose from the three most recent US presidential ...
Bypassing EDR through Retrosigned Drivers and System Time Manipulation
September 13, 2024 | John Ailes
The Retrosigned Driver EDR Bypass is a novel modification of a technique ...
Exploring an Experimental Windows Kernel Rootkit in Rust
September 09, 2024
Around two years ago, memN0ps took the initiative to create one of the first ...
Hypervisor Development in Rust for Security Researchers (Part 1)
September 06, 2024
In the ever-evolving field of information security, curiosity and continuous ...
Responding to the CrowdStrike Outage: Implications for Cyber and Technology Professionals
July 19, 2024
This client alert provides an overview of the current global IT outage that is ...
Cracking Into Password Requirements
April 16, 2024 | Ethan Wilkins
This blog post discusses new hashcat rule sets designed to crack passwords with ...
Financially Motivated Criminal Group Targets Telecom, Technology & Manufacturing
September 20, 2023 | Stroz Friedberg DFIR
This client advisory provides an overview of techniques and tactics attributed ...
Mac systems turned into proxy exit nodes by AdLoad
August 10, 2023 | Fernando Martinez
AdLoad malware is still infecting Mac systems years after its first appearance ...
Command Injection and Buffer Overflow in Multiple Sharp NEC Displays
July 06, 2022 | Howard McGreehan
CVE-2021-20698, CVE-2021-20699: Command Injection and Buffer Overflow ...
Command Injection in Multiple Snap One Araknis Networks Products
June 07, 2022 | Howard McGreehan
CVE-2021-40144, CVE-2021-40844, CVE-2021-42661: Command Injection ...
Yours Truly, Signed AV Driver: Weaponizing an Antivirus Driver
February 26, 2022 | Eduardo Mattos and Rob Homewood
In 2021, Stroz Friedberg observed novel indicators of compromise (IOCs) and a ...