Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Timestamp desc
Baselining Windows To Blend In
Continuing along my theme of Malwareless Red Teaming and approach, today I'm going to dive into the wonderful world of windows baseline noise and blending in. I wanted to dive into the perspective from a red teamer but also to highlight some detection engineering fundamentals that many might overlook. There's a habit in red teaming of over-focusing on tooling.
Vulnerabilidad en token de identidad de Azure permite compromiso total en Windows Admin Center
Una vulnerabilidad de alta gravedad en la implementación de Azure Single Sign-On del Windows Admin Center ha expuesto máquinas virtuales de Azure y sistemas conectados a Arc a accesos no autorizados en inquilinos completos. Los laboratorios de investigación de Cymulate descubrieron el fallo, ahora registrado como CVE-2026-20965, que demuestra cómo una validación incorrecta de tokens puede derribar los límites de seguridad entre máquinas individuales y entornos completos de Azure.
Azure Identity Token Vulnerability Enables Tenant-Wide Compromise in Windows Admin Center Original
A high-severity vulnerability in Windows Admin Center’s Azure Single Sign-On implementation has exposed Azure virtual machines and Arc-connected systems to unauthorized access across entire tenants. Cymulate Research Labs discovered the flaw, now tracked as CVE-2026-20965, which demonstrates how improper token validation can collapse security boundaries between individual machines and complete Azure environments.
SharePoint Under Fire: What Every IT Team Needs to Know About…
If you're running SharePoint on-premises, you need to stop what you're doing and read this. A critical vulnerability is being actively exploited right now, and it's hitting organizations hard. The Problem CVE-2025-53770 scored an 8.8 on the severity scale for good reason. Attackers are targeting a specific component in SharePoint – the toolpane.aspx file – to steal cryptographic keys that protect your data.
Malvertising campaign leads to info stealers hosted on GitHub
In early December 2024, Microsoft Threat Intelligence detected a large-scale malvertising campaign that impacted nearly one million devices globally in an opportunistic attack to steal information. The attack originated from illegal streaming websites embedded with malvertising redirectors, leading to an intermediary website where the user was then redirected to GitHub and two other platforms.
Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage
Based on both Microsoft Threat Intelligence’s findings and those reported by governments and other security vendors, we assess that the Russian nation-state actor tracked as Secret Blizzard has used the tools and infrastructure of at least six other threat actors during the past seven years. They also have actively targeted infrastructure where other threat actors have staged exfiltrated data from victims with the intention of collecting this data for their own espionage program.
Investigate behaviors with advanced hunting (Preview) - Microsoft Defender for Cloud Apps
Read in English Read in English Edit Twitter LinkedIn Facebook Email Article 03/29/2023 4 minutes to read In this article Note Microsoft Defender for Cloud Apps (previously known as Microsoft Cloud App Security) is now part of Microsoft 365 Defender. The Microsoft 365 Defender portal allows security admins to perform their security tasks in one location. This will simplify workflows, and add the functionality of the other Microsoft 365 Defender services.
Guidance for investigating attacks using CVE-2023-23397
December 4, 2023 update – Microsoft has identified a nation-state activity group tracked as Forest Blizzard (STRONTIUM), based in Russia, actively exploiting CVE-2023-23397 to provide secret, unauthorized access to email accounts within Exchange servers.
Guidance for investigating attacks using CVE-2023-23397
December 4, 2023 update – Microsoft has identified a nation-state activity group tracked as Forest Blizzard (STRONTIUM), based in Russia, actively exploiting CVE-2023-23397 to provide secret, unauthorized access to email accounts within Exchange servers.
Guidance for investigating attacks using CVE-2023-23397
February 15, 2024 update – On January 20, 2024, the US government conducted a disruption operation against infrastructure used by a threat actor we track as Forest Blizzard (STRONTIUM), a Russian state-sponsored threat actor, as detailed here: https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian December 4, 2023 update – Microsoft has identified a nation-state activity group tracked as Forest Blizzard (STRONTIUM), based in Russia,...
Start having visibility in service accounts with defender for identity
Defender for Identity is a cloud-based security solution that leverages On-Premises Active Directory signals to identify and detect threats. It monitors Domain Controllers by capturing it’s network traffic to leverage it with Windows event logs to analyze data for attacks, that might occur on a network. Once the sensor of Defender for Identity has been installed on all the Domain Controllers. We can use the data telemetry that it provides, to query for information.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Timestamp
Contact Timestamp, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack