Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CVE-2025-53770 and CVE-2025-53771 are critical remote code execution vulnerabilities (CVSS base score 9.8) impacting Microsoft SharePoint, a widely deployed enterprise collaboration and content management platform. In this blog, we will simulate the exploitation of this SharePoint RCE vulnerability and analyze the resulting telemetry inside Graylog.

Driving along on a dark highway late at night, you feel a jolt and hear a metallic crushing sound as your car hits an unknown object in the road. You nervously continue on your journey, until you see a bright light flashing on your dashboard. Your oil pressure is low because your car has been leaking oil since you hit that unknown object on the highway. Much like an unknown object in the road that leads to a slow leak, a network vulnerability can lead to a devastating data leakage or breach.

Cybersecurity teams worldwide have been fighting against ransomware attacks on ESXi infrastructure for years. ESXi is a lightweight, bare-metal hypervisor developed by VMware that allows multiple virtual machines to run on a single physical server. ESXi is widely used in enterprise environments, often hosting virtual machines that support essential services for an entire organization.

Steganography is the art of hiding information inside a seemingly ordinary, legitimate object so that no one suspects anything is hidden. The technique T1027.003 has been around for a long time and is increasingly used by malware authors and threat actors to avoid detection. This involves hiding malicious payloads inside innocent-looking files such as images, audio, or documents. By embedding malware in these files, attackers can bypass traditional security tools that scan for obvious threats.

Financial institutions face a harsh reality. As cyberattacks have become more sophisticated and move with greater velocity, a single incident can ripple across IT systems, payment networks, and customer accounts long before the organization can respond. The problem? Most security, fraud, IT operations, and risk teams still operate in silos. Each team monitors their own consoles, works from its own data, and follows its own playbooks.

Welcome, Chefs! Today we are excited to announce the release of The Threat Hunter’s Cookbook: a practitioner’s guide to learning, expanding, and applying your analysis repertoire for threat hunting. In this kitchen, our main ingredient is data!

What if I told you that compromised credentials still remain the number one avenue of initial access in all cyber security breaches? It’s no exaggeration — according to the Cisco Talos IR Trends report for Q1 2025, over half of all incidents reported involved the use of valid credentials. The 2025 Verizon Data Breach Investigations Report claims credential abuse accounted for 22% of all confirmed breaches.

Imagine a tireless, ever-learning army that never sleeps and never makes mistakes—an army of AI agents, not humans. What began as simple bots has evolved into sophisticated, autonomous entities operating in perfect sync at machine speed. This is no longer science fiction: autonomous AI is accelerating fraud, turning slow, manual crimes into rapid, relentless attacks. Agentic AI fraud isn’t coming—it’s here. Most organizations remain unprepared.