SOC Analyst: Go beyond triage with endpoint investigations

🚨 The npm registry has been compromised with a malicious package delivering the AdaptixC2 post-exploitation framework, targeting Windows, Linux, and macOS systems according to Kaspersky researchers. 🔍 This supply chain attack represents a significant escalation in threat actor tactics, exploiting the trust developers place in package repositories. The AdaptixC2 agent provides attackers with comprehensive system access once deployed, enabling lateral movement and persistent access across multiple operating systems. 🛠️ The malicious npm package demonstrates how threat actors are increasingly weaponizing legitimate software distribution channels. With over 2.1 million packages in the npm registry and billions of weekly downloads, even a single compromised package can impact thousands of development environments within hours. 📊 Supply chain attacks through package repositories have increased by 742% since 2019, with npm being a particularly attractive target due to its widespread adoption in enterprise environments. The cross-platform nature of AdaptixC2 makes this threat especially concerning for organizations running hybrid infrastructure. The convergence of trusted package repositories and sophisticated C2 frameworks signals a fundamental shift in how attackers compromise development pipelines and enterprise networks. #ThreatIntelligence #SupplyChainAttack #npm #AdaptixC2 #PostExploitation #InfoSec #CyberThreat #MITREATTACK #DevSecOps #PackageRegistry source: https://lnkd.in/dDSHVst4

🔐 Linux Disables TPM Bus Encryption by Default for Performance Gains Linux 6.18 will disable TCG_TPM2_HMAC (TPM bus encryption / integration protection) by default on x86_64 builds — a decision driven by performance considerations. Why this matters The TPM bus encryption feature was introduced in Linux 6.10 to protect against TPM sniffing attacks and key recovery from hardware-level exploits. However, maintainers now believe the runtime overhead is too high relative to its security benefit when enabled by default. It will remain available for users who want to explicitly enable it — so it’s not being removed, just made opt-in. Takeaways & reflections Security vs. performance is still a tightrope. Even security-focused features must justify their cost in system overhead. Flexibility is key. Having a feature opt-in (rather than forced) allows users to choose based on their threat model and hardware. Continuous validation matters. It’s possible that with more optimization or hardware support, this feature might one day make a return as a default. I’m curious how embedded and security-focused teams view this change do you see it as a pragmatic decision or a weakening of the default security posture? #Linux #TPM #Security #OpenSource #KernelDevelopment #PerformanceTradeoffs

KB5066835, the recent update for Windows 11, disrupted localhost by affecting the Http.sys component, leading to user complaints and rollback attempts. Localhost serves as a network hostname for accessing local computer services, bypassing network hardware. Issues include HTTP/2 errors in environments like Visual Studio, prompting some users to uninstall both the October and September updates for solutions. Unaffected systems emerged from freshly patched new installations, with some users editing the Windows Registry or disabling services as fixes. #Software #Cybersecurity #Web https://lnkd.in/gZbfvrwZ

Cyberattacks exploit unpatched systems every 60 seconds, and 70% of ransomware incidents start with missing updates.   Is your patching process ready to defend your endpoints?   Join our free training on automated patch management with 𝗘𝗻𝗱𝗽𝗼𝗶𝗻𝘁 𝗖𝗲𝗻𝘁𝗿𝗮𝗹 and discover how to: ✔️ Automatically deploy patches for Windows, Mac, Linux, and third-party apps ✔️ Protect remote teams and hybrid work setups ✔️ Minimize downtime with off-hours scheduling ✔️ Easily roll back patches if something goes wrong   Stop waiting for breaches to strike - 𝗿𝗲𝗴𝗶𝘀𝘁𝗲𝗿 𝗻𝗼𝘄 and keep your endpoints secure. https://lnkd.in/gn2bY4JW Nivedhitha Damodaran #ManageEngine #UEM #patch #patchmanagement #EndpointCentral #endpointsecurity

Windows Under Attack: Critical Deno Vulnerability (CVE-2025-61787) Enables Command Injection on All Windows Devices Read the full report on - https://lnkd.in/etGqQv2y

Quick Bite: #41 Hashcat Both security experts and fans utilize Hashcat, a potent password recovery program. By rapidly trying a large number of potential combinations, it assists in recovering forgotten or lost passwords. Hashcat may be used to test the strength of passwords because it supports a variety of password hashes. It is compatible with a number of operating systems, including Windows, Linux, and macOS, and it can accelerate the process by utilizing the CPU or GPU capabilities of your computer. It's an excellent tool for enhancing security by detecting weak passwords, but it should always be used sensibly and in accordance with the law. Hashcat is a useful tool for understanding how passwords can be broken and why strong passwords are important, regardless of your level of experience. Check out the following website: https://lnkd.in/dvZjhTH4

Schools and Colleges - Upgrade now! Windows 10 is no longer supported, meaning it will not receive security updates, leaving devices vulnerable to attacks. Windows 11 builds upon the strengths and familiarity of Windows, offering you a modern, secure and highly efficient computing experience that meets the current demands for heightened security by default and by design. With integrated and enhanced security features, high customer satisfaction and notable productivity improvements — be it for work, school or play — new Windows 11 PCs are more secure, more productive and higher performing than Windows 10 PCs.

Now is the time to refresh your IT fleet, especially if your devices don't support Windows 11. Holding onto devices running Windows 10 can create huge security concerns, and the risks will mount as time goes on.

Secure Boot bypass risk threatens nearly 200,000 Linux Framework laptops Around 200,000 Linux computer systems from American computer maker Framework were shipped with signed UEFI shell components that could be exploited to bypass Secure Boot protections. An attacker could take advantage to load bootkits (e.g. BlackLotus, HybridPetya, and Bootkitty) that can evade OS-level security controls and persist across OS re-installs. Powerful mm command According to firmware security company Eclypsium, the problem stems from including a 'memory modify' (mm) command in legitimately signed UEFI shells that Framework shipped with its systems. https://lnkd.in/eTpkU_Zs