Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
ioc.exchange is one of the many independent Mastodon servers you can use to participate in the fediverse.
INDICATORS OF COMPROMISE (IOC) InfoSec Community within the Fediverse. Newbies, experts, gurus - Everyone is Welcome! Instance is supposed to be fast and secure.

Administered by:

Server stats:

1.3K
active users

ioc.exchange: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#ssl

4 posts4 participants0 posts today
Replied in thread
Public
Kevin Karhan :verified:

@cR0w too many.

github.com/kkarhan/windows-ca-

So far testing by @ct_Magazin / @heiseonline (and myseof later on) revealed only few #Apps not vulnerable to this specifics #Govware:

Anything else that uses the CryptoAPI is, espechally *all #Chromium-Forks (aka. All Browsers except Firefox, Tor Browser, #dillo, #LynxBrowser…)

Fixes a critical backdoor in Windows' CryptoAPI, which allows to unconsenting Update of CA Certificates in the background. See https://www.heise.de/ct/ausgabe/2013-17-Zweifelhafte-Updates-gefae...
GitHubGitHub - kkarhan/windows-ca-backdoor-fix: Fixes a critical backdoor in Windows' CryptoAPI, which allows to unconsenting Update of CA Certificates in the background. See https://www.heise.de/ct/ausgabe/2013-17-Zweifelhafte-Updates-gefaehrden-SSL-Verschluesselung-2317589.htmlFixes a critical backdoor in Windows' CryptoAPI, which allows to unconsenting Update of CA Certificates in the background. See https://www.heise.de/ct/ausgabe/2013-17-Zweifelhafte-Updates-gefae...
Public
OTX Bot

Abusing Paste.ee to Deploy XWorm and AsyncRAT Across Global C2 Infrastructure

A sophisticated malware campaign has been discovered utilizing paste.ee to distribute XWorm and AsyncRAT. The attackers employ obfuscated JavaScript with Unicode characters to download and execute malicious code from paste.ee URLs. The infrastructure includes multiple C2 servers across Europe and the US, using specific ports and SSL certificates. XWorm, a stealthy RAT, captures keystrokes, exfiltrates data, and maintains persistent remote access. AsyncRAT, an open-source trojan, is also part of the campaign. The attackers use a network of IP addresses and domains, with some hosted by QuadraNet Enterprises LLC and dataforest GmbH. Defenders are advised to block identified domains, monitor suspicious connections, and update security software to detect unusual behavior.

Pulse ID: 6842cadffd8a660c92f9fecb
Pulse Link: otx.alienvault.com/pulse/6842c
Pulse Author: AlienVault
Created: 2025-06-06 11:02:55

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#AsyncRAT#CyberSecurity#Europe
Public
OTX Bot

ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.

A threat actor nicknamed ViciousTrap has compromised over 5,500 edge devices, transforming them into honeypots. The actor targets more than 50 brands of SOHO routers, SSL VPNs, DVRs, and BMC controllers, possibly to collect exploited vulnerabilities. The infection chain involves exploiting CVE-2023-20118 to deploy a script called NetGhost, which redirects incoming traffic to the attacker's infrastructure. The compromised devices, mostly end-of-life, are used to create a distributed honeypot-like network across Asia. The actor, likely of Chinese-speaking origin, may be attempting to observe exploitation attempts and collect non-public or zero-day exploits. The infrastructure uses servers in Malaysia, and the campaign has been ongoing since March 2025.

Pulse ID: 6830c0b98077133a71396f00
Pulse Link: otx.alienvault.com/pulse/6830c
Pulse Author: AlienVault
Created: 2025-05-23 18:38:49

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#Asia#Chinese#CyberSecurity
Public
mirabilos

Can’t wait for @jwildeboer ’s https://nerdcert.eu/ to take off and be included in the usual bundles like Debian ca-certificates as a big FU to Google, who mandate webbrowser-consumer-only key usages for certificates soon, and to Let’s Encrypt who are following Google mindlessly and try to argue people with these uses to death instead of standing up for people’s freedom and keep existing, working uses of SSL/TLS merely because those are not webbrowser-consumer uses.

nerdcert.eunerdcert.euFree certificates. For nerds. That offer more than just ServerAuth
#nerdcert#LetsEncrypt#SSL
Public *
Trusty

DNSSEC is a big deal. It’s complex, but it doesn’t have to be boring. So we figured, why not let a taco explain it? We’re demystifying DNSSEC in the most entertaining way possible, complete with quirky jokes and characters. We love sharing our knowledge of all things #DNS, #SSL certs, and #DNSSEC, and we hope you enjoy this interactive exploration of How DNSSEC Works!

howdnssec.works/

howdnssec.worksHow DNSSEC worksLearn why DNS needs security through tacos, crabs, and cryptographic laughs. How DNSSEC Works turns complex internet plumbing into an illustrated adventure.
ExploreLive feeds
About