Emerging situation to be aware of - some of the #CitrixBleed2 session hijacking victims are also victims of webshell implants via a different vuln, CVE-2025-6543.

Script to check for Netscaler implants: https://github.com/NCSC-NL/citrix-2025/blob/main/TLPCLEAR_check_script_cve-2025-6543-v1.6.sh

New ASN to block. But again, the firewall vendors don't give a fuck about your feature requests so you'll have to block the networks instead.

Silent Push reports that there has been a migration from the OFAC sanctioned Aeza Group's AS210644 to AS211522 which is listed as operated by Hypercore, Ltd.

https://www.silentpush.com/news/iofa-detects-aeza-group-infrastructure/

Here are the networks in AS211522 that you may want to block:

83.147.216.0/24
91.186.216.0/22
91.186.212.0/23
83.147.222.0/24
83.147.192.0/24
83.147.254.0/24
83.147.252.0/23
150.241.64.0/19
178.253.55.0/24

#threatIntel

As promised, our #SharePoint adventure with CVE-2025-53770 and CVE-2025-53771, including payloads and vulnerability checker!

https://blog.leakix.net/2025/07/using-their-own-weapons-for-defense-a-sharepoint-story/

Mildly cursed factoid about UNC paths:

- UNC Paths can contain IP addresses such as \\192.168.1.1\share
- IPv6 addresses are supported as well
- IPv6 addresses contain colons
- can't have colons in Windows paths since colons are reserved for drive letters

So Microsoft came up with the the ipv6-literal.net domain that's special-cased by Windows so you can to write IPv6 addresses in UNC paths as 2a0e-3c0--21.ipv6-literal.net without it hitting any resolvers.