forensics Archives

Tech Optimizer

June 23, 2026

Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service

A critical security vulnerability, SVD-2026-0603 (CVE-2026-20253), has been identified in Splunk Enterprise versions 10.0.0 through 10.0.6 and 10.2.0 through 10.2.3. This flaw allows unauthenticated, remote attackers to create or truncate arbitrary files on the host system by exploiting the PostgreSQL Sidecar Service endpoints. The vulnerability is actively exploited, with public proof-of-concept code available, and has been added to the CISA Known Exploited Vulnerabilities (KEV) list. Successful exploitation can lead to full remote code execution (RCE) as the Splunk user. The vulnerability arises from inadequate authentication controls on the PostgreSQL Sidecar Service endpoints, specifically /v1/postgres/recovery/backup and /v1/postgres/recovery/restore, which are accessible without authentication. It is classified under CWE-306: Missing Authentication for Critical Function and has a CVSS v3.1 base score of 9.8 (Critical). Attackers can exploit the vulnerability by sending crafted HTTP POST requests to the exposed endpoints, allowing them to create or truncate files and potentially execute malicious scripts. Indicators of compromise include unexpected files in directories such as /tmp/ or /opt/splunk/var/run/supervisor/pkg-run/, modified Splunk Python scripts, and unusual outbound connections from Splunk to unknown PostgreSQL servers. The vulnerability aligns with several MITRE ATT&CK techniques, including T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter). Active exploitation of CVE-2026-20253 has been confirmed, and it is likely that both opportunistic cybercriminals and sophisticated threat actors will use this exploit. The affected versions of Splunk Enterprise are 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, with the issue resolved in versions 10.2.4 and 10.0.7. Organizations are advised to upgrade to fixed versions or disable the PostgreSQL Sidecar Service as a mitigation strategy.

AppWizard

May 13, 2026

Android Adds Intrusion Logging for Sophisticated Spyware Forensics

Google introduced a new opt-in feature for Android users called Intrusion Logging, which enhances the analysis of spyware attacks as part of the Advanced Protection Mode. Developed with Amnesty International and Reporters Without Borders, it logs daily device and network activities, including app activity, installations, network connections, file transfers, system certificate modifications, and device lock events. The log data is encrypted and stored securely, accessible only to the device owner. Logs are retained for 12 months and cannot be deleted by users before expiration, though they can be downloaded for offline storage. Intrusion Logging also records network events during Chrome's Incognito mode. This feature is beneficial for high-risk individuals who may be targets of surveillance. Users can access the logs through the Settings app, and the rollout is underway for devices with the Android 16 December update and newer. Additionally, Google announced other privacy and security features, including a verified financial call feature to combat scams, expansion of Live Threat Detection, evaluation of APK files for malware, revocation of accessibility services API access from non-designated apps, and enhancements to Find Hub's Mark as Lost feature. Other updates include improved device recovery options, enhanced privacy controls, introduction of AISeal with pKVM, expansion of Binary Transparency, protection against OTP theft, and strengthening data protection with post-quantum cryptography.

AppWizard

May 12, 2026

Your Android security and privacy got huge upgrades—The Android Show reveals all

Google announced significant security and privacy enhancements at the Android Show, including features in the upcoming Android 17. Users will have increased transparency regarding location access and can manage which apps track their location. New protections against banking scams and a "Mark as Lost" feature with biometric security will be introduced. A "temporary precise location" button will allow quick access to surroundings while preventing unwanted tracking. Live Threat Detection will receive an upgrade for 2026, focusing on harmful behaviors like SMS forwarding. Dynamic signal monitoring will alert users to suspicious app behavior. Improvements to the Advanced Protection program include USB Protection for all Pixel devices running Android 16 or higher and Intrusion Logging for all Android 16 devices with the December update. Chrome on Android will enhance Safe Browsing to analyze APKs for malware. The "Mark as Lost" feature will allow biometric locking of devices, hide Quick Settings, and disable new connections. Theft protections will be enabled by default in several countries, including Argentina, Chile, Colombia, Mexico, and the U.K.

Winsage

February 15, 2026

Windows remembers much more than you think: this is the ‘ghost’ ID it stores for every USB device you connect to your PC

Microsoft's Windows operating system retains a record of every USB device ever connected, storing this information in the Registry under USB or USBSTOR keys. This log includes unique identifiers, device names, and hardware specifications, remaining intact even after the device is disconnected. The stored information enhances the operating system's efficiency by allowing it to recognize devices upon reconnection, utilize previously installed drivers, and maintain prior settings. It also aids in system administration, diagnostics, and compatibility assessments, particularly in professional settings, and assists in digital forensics by reconstructing the history of hardware connections.

AppWizard

February 15, 2026

Max Messenger: A fake data breach with genuine consequences?

A user claimed to have breached Max but later clarified that no large-scale breach or critical vulnerabilities were found. False claims about data breaches can cause significant reputational damage, as demonstrated by a Russian hacking group that falsely claimed to have accessed Epic Games' data, which was later admitted to be a ruse. Similarly, EuroCar reported that fake breach reports may have been generated by ChatGPT, misleading customers. Russian users are distrustful of the Max app, perceived as buggy and insecure. The Russian Federal Security Service blocked its integration with government services due to encryption concerns. Although the government pressures citizens to adopt Max, many may install it without using it regularly. There is skepticism among Russian citizens regarding the app's security, making them susceptible to damaging rumors. Future claims about Max Messenger data breaches are anticipated. Recommendations for organizations to protect against misinformation include maintaining a good reputation, being transparent if a breach occurs, and investing in digital forensics to counter false claims.

Winsage

October 30, 2025

What Windows 10 EOS Means for Security

Microsoft will cease support for most versions of Windows 10 on October 14, 2025, while offering temporary Extended Security Updates (ESU) for version 22H2. Approximately 40% to 45% of Windows users globally still rely on Windows 10. The end of support raises cybersecurity concerns as Microsoft will stop issuing updates for vulnerabilities and bugs. Organizations using Windows 10 need to devise migration plans to Windows 11, but the transition can be costly and time-consuming, especially for those dependent on legacy software. Delaying migration poses risks such as regulatory violations, increased IT burdens, escalating ESU costs, and exposure to cyber threats. Organizations should prioritize migrating critical systems, review application support, and evaluate ongoing costs for legacy systems. Bitdefender offers security solutions for Windows 10 environments, including risk management, application control, cloud security, and monitoring services.

Winsage

October 18, 2025

Windows Rust-based Kernel GDI Vulnerability Leads to Crash and Blue Screen of Death Error

A vulnerability has been identified in Microsoft’s Rust-based kernel component for the Graphics Device Interface (GDI) within Windows, which can cause a system-wide crash (BSOD). The issue was discovered during a fuzzing campaign by Check Point, which revealed crashes and potential code execution risks. The vulnerability is linked to an out-of-bounds array access in the win32kbasers.sys driver during the path-to-region conversion in NtGdiSelectClipPath, triggered by a malformed EmfPlusDrawBeziers record. A proof-of-concept demonstrated that embedding a crafted metafile could lead to a BSOD from low-privilege sessions on Windows 11. Microsoft addressed the flaw in OS Build 26100.4202 through an update released on May 28, 2025. Despite being classified as a non-critical denial-of-service issue, this incident highlights the challenges of integrating memory-safe programming languages into operating systems.

Tech Optimizer

October 6, 2025

Ransomware Gangs Exploit Remote Access Tools to Stay Hidden and Maintain Control

Modern ransomware operations have evolved into complex, multi-stage campaigns that utilize legitimate Remote Access Tools (RATs) to maintain stealth and persistently dismantle organizational defenses. Ransomware encrypts critical data and demands ransom for restoration, with current operations being highly targeted compared to earlier mass phishing attacks. Attackers exploit trusted administrative software like AnyDesk, UltraViewer, RustDesk, and Splashtop to establish backdoors, escalate privileges, and deploy payloads across networks, moving laterally and evading detection. The ransomware kill chain consists of several stages: 1. Initial Access: Attackers gain access through credential compromise, often targeting administrator accounts. 2. Remote Tool Abuse: Attackers deploy RATs either by hijacking existing tools or performing silent installations. 3. Persistence & Privilege Consolidation: They maintain persistence using registry keys and scheduled tasks while escalating privileges. 4. Antivirus Neutralization & Anti-Forensics: Attackers stop antivirus services, manipulate policies, and clear logs to evade detection. 5. Payload Deployment & Execution: Ransomware is delivered and executed within remote sessions to avoid suspicion. Commonly abused RATs include AnyDesk, UltraViewer, AppAnywhere, RustDesk, Splashtop, and TightVNC, which have been associated with various ransomware campaigns. Understanding the tactics and techniques used by adversaries is crucial for effective defense, as they exploit legitimate tools to bypass security measures. Emerging trends include AI-driven RAT deployment, cloud-based RAT abuse, and the integration of RATs in ransomware-as-a-service offerings. A comprehensive defense strategy involves multiple layers of security, including virus protection, behavior-based detection, and application control, to counter the risks posed by RAT abuse in ransomware attacks.

AppWizard

August 26, 2025

Kremlin-Mandated Messaging App Constantly Spies On Users

Russia has mandated that all new smartphones and tablets sold within its borders come pre-installed with a messaging application called Max, developed by VK. Security experts have raised concerns about Max's functionality, describing it as a potential privacy risk due to its "excessive tracking" of user activities. The app lacks cryptography and is considered insecure by design, serving the purpose of surveillance. Max, which launched in March, is available to users with Russian and Belarussian phone numbers and features an AI chatbot, GigaChat 2.0, as well as functionalities for travel bookings and bank transfers. It requests permissions to access standard device features like the camera and microphone and is largely based on the earlier messaging service TamTam. Starting September 1, it will be required that Max is pre-installed on all mobile devices sold in Russia, alongside the domestic app store RuStore on Apple devices. Additionally, the government plans to enforce the installation of Lime HD TV on all smart televisions beginning January 1 of the following year.

AppWizard

July 15, 2025

Google is doubling down on cybersecurity using AI

Google's AI security agent, Big Sleep, has identified a vulnerability in SQLite, designated as CVE-2025-6965, which was being exploited by hackers. Enhancements have been made to Google's open-source forensics tool, now operating on the upgraded Sec-Gemini platform for improved log analysis and threat detection. Google is set to unveil FACADE, an insider threat detection system that has monitored billions of daily events since 2018 using contrastive learning. At DEF CON 33, Google will co-host a Capture the Flag event with Airbus, involving AI assistants in security challenges. Google is contributing data from its Secure AI Framework to the Coalition for Secure AI to enhance research in cybersecurity. The AI Cyber Challenge, a DARPA-led competition supported by Google, is nearing its conclusion, with winners showcasing AI tools for identifying and rectifying vulnerabilities in open-source software.