According to a fresh intelligence report from Proofpoint, TA419 has been systematically hunting down artificial intelligence policy experts, researchers, and legal minds across U.S. think tanks, universities, and major institutions. Their goal? Extracting deep intelligence on how the West plans to govern, regulate, and secure the next generation of AI.

The Bait: Posing as Industry Elite

TA419 doesn’t launch noisy, automated spam blasts. Instead, they play a patient, high-stakes psychological game.

The campaigns begin with a harmless-looking networking outreach designed to build trust. Attackers have been spotted impersonating prominent economists, former White House science and technology leadership, and even real employees from top-tier AI labs like Anthropic.

In one targeted strike against a U.S. think tank expert, the lure arrived with a deceptively urgent subject line: “Request for Feedback on Military Integration of Claude.”

Once a target takes the bait and replies, the trap snaps shut.

The Weapon: Invisible, Framework-Free Phishing

If you think you’d spot a fake login page a mile away, think again. TA419 uses a sophisticated, custom-built attack chain that bypasses traditional warning bells.

1. The Handshake: A response from the attacker delivers a shortened URL that bypasses security scanners by using a Cloudflare Turnstile human verification check.

2. The Illusion: Victims are funneled to a Microsoft OneDrive-hosted page running a stealthy technique known as “Frameless BitB” (Browser-in-the-Browser). Unlike older phishing methods that rely on obvious iframe pop-ups, this technique uses precise HTML, CSS, and JavaScript injections to paint an entirely fake login prompt over a legitimate browser session, leaving no telltale frames or strange URL bars.

3. The Silent Heist: TA419 pairs this with a custom telemetry module that monitors the user’s Microsoft sign-in flow in real-time, siphoning credentials and session cookies while instantly relaying them to the real Microsoft infrastructure in the background.

To the victim, the login succeeds seamlessly. There are no error messages, no weird redirects, and zero indication that their entire digital workspace has just been compromised.

Why It Matters Now

Since at least April 2025, TA419 has cast a wide shadow over U.S. and Japanese defense, energy, and foreign policy sectors. But shifting their crosshairs directly onto the architects of U.S. AI policy marks a chilling escalation. As global superpowers race to control the technological high ground, state-sponsored espionage is no longer just about stealing source code, it’s about hijacking the minds and mailboxes of the people writing the rules.

How to Fight Back

Security analysts warn that standard user awareness isn’t enough to stop state-backed adversaries using custom adversarial-in-the-middle (AitM) infrastructure. Organizations and high-profile researchers are being urged to ditch vulnerable passwords entirely in favor of phishing-resistant authentication methods like passkeys and to treat any unsolicited, high-profile outreach with extreme skepticism.

Because in the high-stakes game of AI geopolitics, a single click on “Continue” might hand an adversary the keys to the entire kingdom.

Read the original research by Proofpoint: https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy

If you’re reading this article, use the discount code CQBLOG_AMSC27_FUTURE at checkout – a special offer created exclusively for readers of this article. The code applies to our flagship course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.

Want to learn more?

Join our FREE live webinar:

Secure Users: Designing Workstations for Threat Resistance

Workstation security depends on how privileged access, authentication, endpoint configuration, and monitoring work together.

Join Paula Januszkiewicz, Sami Laiho, and Artur Kalinowski for a practical session on designing and deploying Privileged Access Workstations (PAWs), implementing passkeys securely, and identifying workstation and identity misconfigurations that weaken security.

Through practical demonstrations, discover how to strengthen workstation defenses, identify the authentication events and security changes that matter, and connect endpoint and identity activity to actionable detections. You will also learn how to validate that security evidence is collected and alerts trigger as expected.

Leave with an actionable checklist for PAW design, passkey deployment, workstation hardening, configuration reviews, and monitoring validation.

Register for free:
https://luma.com/SecureUsers

The post The Quiet War for the Future of AI: How China-Aligned Spies Are Hunting U.S. Policy Experts appeared first on CQURE Academy.

The USN Journal is one of the most useful forensic artifacts on an NTFS volume, but it can also be extremely noisy.

From Raw Data to Actionable Findings

CQUSNDeepAnalyzer processes the raw $J stream and can optionally use the MFT for full path reconstruction.

It also includes built-in YARA rules, behavioral detection, and enrichment from EVTX and Prefetch data.

In the demo, we run the tool against a real journal dump and immediately uncover several interesting findings:

1. More than 1,500 rename records in a burst.

2. Nearly 50,000 file deletions.

3. Fifteen new file extensions appearing only in the last part of the timeline.

4. Search for known cryptominer binaries.

5. Nearly 400 related events across 53 files.

The combination of mass renames, mass deletes, and newly appearing extensions is especially interesting because it can be associated with early-stage ransomware activity.

Interactive Forensic Analysis

The tool deals with huge amounts of records and presents the findings in an interactive HTML report.

Instead of manually reviewing thousands of raw entries, investigators can explore:

1. An activity timeline.

2. Severity-ranked findings.

3. Reason flags over time.

4. An hour-by-day heatmap.

5. A Sankey diagram connecting reasons, file extensions, and paths.

6. File extension statistics.

7. A path treemap showing where suspicious activity occurred.

Every underlying record remains searchable and filterable, and the results can be exported to CSV for further analysis.

Why It Matters

During investigation, the biggest challenge is often not collecting forensic data, but finding the important activity hidden inside it.

CQUSNDeepAnalyzer helps transform a raw USN Journal into a structured timeline that makes suspicious file operations, malware indicators, and behavioral patterns much easier to investigate. From a raw journal blob to an investigation-ready timeline. That is CQUSNDeepAnalyzer.

If you’re reading this article, use the discount code CQBLOG_AMSC27_HACKS85 at checkout – a special offer created exclusively for readers of this article. The code applies to our flagship course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.

Want a sneak peek at our AMSC course?

Join our FREE live webinar:

Secure Users: Designing Workstations for Threat Resistance

Workstation security depends on how privileged access, authentication, endpoint configuration, and monitoring work together.

Join Paula Januszkiewicz, Sami Laiho, and Artur Kalinowski for a practical session on designing and deploying Privileged Access Workstations (PAWs), implementing passkeys securely, and identifying workstation and identity misconfigurations that weaken security.

Through practical demonstrations, discover how to strengthen workstation defenses, identify the authentication events and security changes that matter, and connect endpoint and identity activity to actionable detections. You will also learn how to validate that security evidence is collected and alerts trigger as expected.

Leave with an actionable checklist for PAW design, passkey deployment, workstation hardening, configuration reviews, and monitoring validation.

Register for free:
https://luma.com/SecureUsers

Want to know more?

The post CQURE Hacks #85: CQUSNDeepAnalyzer: Turn the USN Journal into a Forensic Timeline appeared first on CQURE Academy.

What happens when the guardian of the network, the security appliance itself gets broken into? 

On September 27, 2026, an alert went out that should put every cybersecurity professional on high alert. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added two vulnerabilities in Citrix NetScaler ADC and Gateway (CVE-2026-88771 and CVE-2026-88772) to its “Known Exploited Vulnerabilities” (KEV) catalog. This isn’t routine paperwork, it’s a global threat notice backed by hard evidence: attackers are actively exploiting these flaws in real time, seizing remote code execution (RCE) on unpatched devices. 

This isn’t just about two “high-severity bugs.” It’s a battle over the digital front door of the enterprise. 

Why NetScaler Is So “Tempting” 

Citrix NetScaler (formerly NetScaler ADC and Gateway) isn’t just another server. It’s the aorta of enterprise networking – distributing traffic between applications and users and serving as the “front door” for remote work VPNs and authentication at many organizations. 

Think of it as the drawbridge of a heavily fortified castle. If the drawbridge falls, an attacker doesn’t just see the moat, they walk straight across it and into the great hall. Because NetScaler appliances are typically exposed directly to the internet to deliver services, they’re naturally a high-value “crown jewel” in attackers’ eyes. 

The “Kill Power” and “Ease of Use” of These Flaws 

These two vulnerabilities were flagged as “critical” by CISA not just because of their staggering CVSS score of 9.5 out of 10, but because of how they’re exploited: 

CVE-2026-88771 (Unauthenticated Input Validation Error): What makes this one terrifying is that it requires no preconditions. It affects NetScaler ADC and Gateway across all affected versions – even default configurations aren’t spared. That means an unauthenticated remote attacker can craft a specific request and execute arbitrary commands directly on the appliance. 

CVE-2026-88772 (Memory Buffer Overflow): Exploiting this one requires DTLS (Datagram Transport Layer Security) to be enabled. But here’s the deadly trap – DTLS is on by default on VPN virtual servers. That puts the vast majority of NetScaler Gateway deployments in the danger zone. Attackers can leverage the memory overflow to achieve the same remote code execution or launch denial-of-service attacks. 

The Iron Rule: “Forensics First, Then Patch” 

Unlike the usual “patch immediately” response flow, CISA offered a critical and easily overlooked piece of guidance in this alert: If possible, check whether the device has already been compromised before patching. 

This isn’t busywork. Both Citrix and CISA emphasize that patching or rebooting a device can destroy or wipe out valuable forensic evidence (such as malicious payloads in memory or access logs). If an attacker is already lurking in your network, a hasty reboot may only sever your trail of evidence, letting them hide deeper in the system. 

The correct order is: 

1. Forensics first: If compromise is suspected, preserve evidence first (memory dumps, logs). 

2. Hunt for IoCs: Citrix has published Indicators of Compromise (IoC) through NetScaler Console to help organizations determine whether they’ve been hit. 

3. Isolate and rotate: If compromise is confirmed, isolate the device immediately. But the job is far from over – NetScaler stores a wealth of sensitive credentials, session information, and SSL keys. You must rotate all related local passwords, Key Encryption Keys (KEK), and replace all recovered SSL certificates. 

As Citrix advises, once compromise is suspected, the safest path may be to rebuild the appliance from a known-good backup after preserving evidence, rather than simply applying a patch on top of an infected system. 

An Action Guide for Defenders 

If you or your organization uses Citrix NetScaler ADC or Gateway, here’s what you should do right now: 

Step One: Check Your Version 

Immediately verify your appliance version. Affected versions include: 

1. NetScaler ADC and Gateway 14.1 (below 14.1-73.37) 

2. NetScaler ADC and Gateway 13.1 (below 13.1-64.23) 

3. NetScaler ADC FIPS 14.1 (below 14.1-73.37 FIPS) 

4. NetScaler ADC FIPS and NDcPP 13.1 (below 13.1-37.279) 

Watch for a critical trap: even if you installed the August 2026 fix for CVE-2026-19490, that does not mean you’re protected that build still falls below the new remediation threshold.

Step Two: Upgrade to a Safe Version

Move appliances to: 

1. 14.1-73.37 or later 

2. 13.1-64.23 or later (note: check Citrix guidance regarding potential reboot loops) 

3. The corresponding FIPS/NDcPP versions 

Step Three: Check and Harden Configurations 

1. Verify whether DTLS is enabled (it’s on by default for VPN virtual servers). 

2. For SAML authentication, validate that identity providers issue signed SAML assertions (new NetScaler versions no longer accept unsigned assertions). 

3. For CVE-2026-88778 (a related vulnerability), enable enhanced initial sequence number generation under Citrix’s guidance. 

Step Four: Review Your Exposure 

Never expose the NetScaler management interface directly to the public internet. Restrict management access to a trusted management network or VPN. 

The Bottom Line: Security Is Never “Patched and Done” 

The Citrix NetScaler crisis is yet another wake-up call: patching is only the baseline of security. Assuming a vulnerability may already have been exploited and that your system may already be breached is the survival rule in today’s threat landscape. 

From the infamous “Citrix Bleed” (CVE-2023-4966) in 2023, which enabled the LockBit ransomware gang to launch mass intrusions, to today’s two unpatched zero-days, NetScaler has consistently been a high-value target. Attackers won’t wait for you to schedule a comfortable maintenance window. They’re out there on the network right now, testing every door that might be unlocked. 

For security teams responsible for critical infrastructure, the coming hours matter enormously. This alert is not a drill. It demands immediate verification, deliberate action, and a serious embrace of the assumption that “the system may already be compromised.” In the world of cybersecurity, the most dangerous thing is rarely the vulnerability you know about it’s the one you think you’ve handled, but that’s already being exploited. 

This article is based on information published in CISA’s official alert: https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway 

If you’re reading this article, use the discount code CQBLOG_AMSC27_CITRIX at checkout – a special offer created exclusively for readers of this article. The code applies to our flagship course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.

Want to learn more?

Join our FREE live webinar:

Secure Users: Designing Workstations for Threat Resistance

Workstation security depends on how privileged access, authentication, endpoint configuration, and monitoring work together.

Join Paula Januszkiewicz, Sami Laiho, and Artur Kalinowski for a practical session on designing and deploying Privileged Access Workstations (PAWs), implementing passkeys securely, and identifying workstation and identity misconfigurations that weaken security.

Through practical demonstrations, discover how to strengthen workstation defenses, identify the authentication events and security changes that matter, and connect endpoint and identity activity to actionable detections. You will also learn how to validate that security evidence is collected and alerts trigger as expected.

Leave with an actionable checklist for PAW design, passkey deployment, workstation hardening, configuration reviews, and monitoring validation.

Register for free:
https://luma.com/SecureUsers

The post Two 9.5-Rated “Digital Front Doors”: Why Attackers Are Hammering Citrix NetScaler and Why You Need to Move Now appeared first on CQURE Academy.

Have you ever wondered how easy it is to launch an attack that can take down an entire website? The answer is unsettling: all it took was a visit to the right website and a payment in cryptocurrency. NightmareStresser was the perfect example: a digital weapons shop, open to anyone, anonymous, and devastatingly effective. 

A Digital “Weapons Shop” Shut Down 

The U.S. Department of Justice announced this week that the FBI has seized the internet domains associated with the notorious booter service. Visitors attempting to access sites like nightmare-stresser[.]com will now be greeted not by a tool for launching attacks, but by an official seizure banner. It’s a symbolic end to a service that authorities say was active since at least 2022, though security researchers suggest its roots go much deeper, possibly as far back as 2016. 

The scale of this operation is staggering. We’re talking about hundreds of thousands of DDoS attacks launched against victims worldwide. At its peak around 2025, the service had reportedly grown to nearly 1 million users. NightmareStresser could unleash between 3,000 and 4,000 attacks per hour, accepted cryptocurrency payments, and – in a bizarre twist – avoided targeting government, education, and hospital domains. 

Operation PowerOFF: A Global Reckoning 

The takedown of NightmareStresser wasn’t a stroke of luck, it was part of Operation PowerOFF, a coordinated global effort to dismantle DDoS-for-hire infrastructures worldwide and hold the individuals behind them accountable. This isn’t the first blow against the industry. Over the past eight years, U.S. authorities have charged 12 DDoS attack facilitators and seized over 100 domains linked to booter services. 

For the average internet user, this is welcome news. Services like “booters” or “stressers” are considered a gateway to more serious cybercrime. They offer a low barrier to entry for “cybercriminal-wannabes,” who (with just a few clicks and a small crypto payment) can cripple someone’s website or online service. 

Is This Really the End? 

History teaches us that nature abhors a vacuum. When rival services were disrupted in 2018, NightmareStresser only grew stronger, becoming the largest player on the market. Now that the giant has been toppled, we must ask: who will take its place? 

Despite the successes of operations like PowerOFF, the fight against DDoS-for-hire is a relentless game of cat and mouse. Law enforcement is not only tracking administrators but also pursuing the users of these services. But will this be enough to deter the next wave of digital vandals? 

One thing is certain: for NightmareStresser, the nightmare is finally over. For the rest of the world, it’s a reminder that even the most “nightmarish” services eventually meet their end. The only question is is the next nightmare already lurking around the corner? 

Based on the official announcement by the U.S. Department of Justice: Read the original announcement

If you’re reading this article, use the discount code CQBLOG_AMSC27_DDoS at checkout – a special offer created exclusively for readers of this article. The code applies to our flagsihp course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.

Want to learn more?

Join our FREE live webinar:

Uncovering New Identity Theft Vectors and How to Mitigate Them

Discover how identity theft no longer begins and ends with a stolen password.

Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.

Register for free:
https://luma.com/TheftVectors

The post The Nightmare Is Over: World’s Longest-Running DDoS Service Finally Shut Down  appeared first on CQURE Academy.

Event ID 4624 is one of the most important Windows events for monitoring successful logons.

We start by enabling detailed logon auditing on the Domain Controller and then generate several different logon scenarios, including:

1. Workstation unlocks, Logon Type 7

2. Local interactive logons, Type 2

3. Network authentication, Type 3

4. New logon session with alternate credentials for network connections, Type 9

5. RDP sessions, Types 7 and 10

6. Service logons, Type 5

We also demonstrate how SMB activity from Kali Linux appears on the Domain Controller and which fields are most useful during analysis, including:

1. Logon Type

2. Logon Process

3. Authentication Package

4. Source Network Address

The key takeaway is that Event ID 4624 becomes most valuable when you correlate its fields and understand the context behind the logon.

A single Type 3, Type 7, or Type 9 event may be completely legitimate. But when you combine the logon type with the account used, source IP address, authentication package, and surrounding activity, it becomes much easier to distinguish normal behavior from activity worth investigating. That is why Event ID 4624 is such a valuable source for Windows authentication analysis, threat hunting, and lateral movement investigations.

After restoring Bob’s original UPN, the certificate is used for authentication and is mapped by the KDC to the real Administrator account. This allows us to obtain an Administrator TGT and recover the Administrator NT hash.

With Domain Admin privileges, the demonstration concludes with DCSync, retrieving the krbtgt account hash.

The attack highlights why AD CS configuration, certificate mapping settings, and permissions to modify identity attributes such as userPrincipalName should all be carefully reviewed. A seemingly small certificate configuration issue can become part of a complete domain compromise.

Want to learn more?

Join our FREE live webinar:

Uncovering New Identity Theft Vectors and How to Mitigate Them

Discover how identity theft no longer begins and ends with a stolen password.

Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.

Register for free:
https://luma.com/TheftVectors

Want to know more?

The post CQURE Hacks #84: Understanding Event ID 4624 in Action appeared first on CQURE Academy.

The vulnerability stems from an unsafe deserialization of untrusted data, a class of flaw where an application reconstructs objects from attacker-supplied input without first validating it. 

Because Entra ID is a cloud-hosted service, Microsoft was able to remediate the vulnerability on the server-side, meaning customers did not need to install any patches.  

The disclosure itself became an unusual story. Microsoft initially marked the vulnerability as “Exploited: Yes” in its advisory, leading to widespread reports that the flaw was under active attack. However, the company reversed this designation the following day to “No” without a detailed public explanation. Microsoft later clarified that the change was informational and that there was no confirmed exploitation in the wild. 

Quick overview: 

Vulnerability: Deserialization of Untrusted Data (CWE-502) in Microsoft Entra ID. 

Impact: Allows an unauthenticated attacker to execute remote code over a network, which could lead to a complete compromise of the identity service. 

CVSS Score: 10.0 (Critical). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating it’s exploitable over the network with low complexity, no privileges, and no user interaction. 

Status: Microsoft has fully mitigated the vulnerability on its infrastructure. No patch is required from customers. Crucially, Microsoft has corrected its initial advisory to state that there is no evidence of active exploitation in the wild. The initial “Exploited: Yes” flag was a mistake. 

Takeaway for Threat Hunters: Because the vulnerability was server-side and already fixed, hunting should focus on detecting anomalous, suspicious, or unauthorized activities within Entra ID that could be indicative of an attacker leveraging this flaw before it was patched. The goal is to identify any lingering signs of compromise. 

KQL Queries for Threat Hunting 

The following KQL queries are designed to help you hunt for potential post-exploit activity in your Microsoft Entra ID tenant. 

1. Hunt for Suspicious Service Principal Activity 

Attackers gaining code execution could manipulate service principals and their credentials to maintain persistence. 

Hunt for unusual service principal credential additions or modifications 

AuditLogs
| where OperationName in (“Add service principal credentials”, “Add service principal”, “Update service principal”)
| where TimeGenerated > ago(XXd) // Adjust the time range as needed
| project TimeGenerated, OperationName, ActorDisplayName, TargetDisplayName, TargetResources, Result
| order by TimeGenerated desc

This query looks for the creation or modification of service principals and their credentials. A sudden surge or creation by a non-administrative user could be a sign of compromise. This is a critical area to monitor because persistence through service principals is a common attacker technique. 

In Microsoft Entra ID audit logs, operations track the creation, modification, and credential management of service principals (the local instance of an application object in a specific tenant). 

Add service principal 

A new service principal object was created in your directory. 

This happens when an application from the Microsoft Entra application gallery is added, an application is registered/instantiated in the tenant, or a managed identity is created. 

Add service principal credentials 

A new authentication credential such as a password/secret or a public certificate was added to an existing service principal. 

This is often logged as part of an Update service principal activity. Attackers frequently target this operation to maintain persistent, programmatic access to a compromised environment without needing a user account. 

Update service principal 

General properties or configurations of an existing service principal were modified. 

This includes changing settings like assignment requirements, homepage URLs, owners, or enabling/disabling the service principal. It also frequently acts as the parent operation category when credentials or role assignments are added 

2. Investigate Unusual and High-Risk Sign-ins 

Look for sign-in events with high risk levels or from unusual locations, especially from accounts with high privileges. 

Find high-risk sign-ins or sign-ins from unfamiliar locations/IPs 

SigninLogs
| where TimeGenerated > ago(XXd) // Adjust the time range as needed
| where RiskLevelDuringSignIn in (“high”, “medium”) // Adjust risk level as needed
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, RiskLevelDuringSignIn, RiskEventTypes
| order by TimeGenerated desc

This query identifies sign-ins that Microsoft’s risk engine has flagged as high or medium risk. While the vulnerability itself is server-side, any successful exploitation could lead to token theft or account takeover for a specific user. Investigating these risky sign-ins can uncover such activity. 

3. Monitor for Anomalous Privileged Role Assignments 

Check for any unauthorized or unusual changes to privileged roles, which could be the final stage of an attack to gain control. 

Detect any new additions to highly privileged roles 

AuditLogs
| where OperationName == “Add member to role”
| where TimeGenerated > ago(XXd) // Adjust the time range as needed
| extend Role = tostring(parse_json(TargetResources)[0].displayName)
| where Role in (“Global Administrator”, “Privileged Role Administrator”, “Exchange Administrator”, “Conditional Access Administrator”)
| project TimeGenerated, Role, TargetUser = tostring(parse_json(TargetResources)[0].modifiedProperties[1].newValue), Result
| order by TimeGenerated desc

This query specifically monitors for membership additions to high-privilege roles within the last XX days. Any unexpected addition to these roles is a significant red flag and should be investigated immediately. 

Role Details in Microsoft Entra ID: 

Global Administrator: Has access to all administrative features and tenant-wide settings in Microsoft Entra ID. 

Privileged Role Administrator: Can manage role assignments, audit logs, and role definitions in Microsoft Entra ID. 

Conditional Access Administrator: Can manage Conditional Access policies and settings within Microsoft Entra ID. 

Exchange Administrator: Can manage all aspects of the Exchange organization, available as an integrated role assignable through Microsoft Entra ID or the Exchange admin center. 

Recommended Next Steps for Incident Response 

1. Review Entra ID Audit and Sign-in Logs: Focus on the period before August 20, 2026 (the NVD published date and the date Microsoft first disclosed the flaw), as this is when the vulnerability was unpatched and potentially exploitable. Look for any of the anomalies identified in the queries above. 

2. Enforce Least Privilege: Review all privileged accounts and ensure they adhere to the principle of least privilege. Use Privileged Identity Management (PIM) to enforce just-in-time access. 

3. Strengthen Conditional Access Policies: Re-evaluate and enhance Conditional Access policies to block sign-ins from risky or unfamiliar locations. 

4. Stay Informed: Monitor (CVE), official Microsoft communications (MSRC), CISA Known Exploited Vulnerabilities (KEV) catalog and NIST National Vulnerability Database (NVD). 

If you’re reading this article, use the discount code CQBLOG_AMSC27_CVE at checkout – a special offer created exclusively for readers of this article. The code applies to our flagsihp course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.

Want to learn more?

Join our FREE live webinar:

Uncovering New Identity Theft Vectors and How to Mitigate Them

Discover how identity theft no longer begins and ends with a stolen password.

Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.

Register for free:
https://luma.com/TheftVectors

The post CVE-2026-69836  appeared first on CQURE Academy.

In the first half of 2026, nearly 36,000 CVEs were published. That’s a 49% jump from the year before. But here’s the twist that should change your entire security strategy: Fewer than 500 were actually exploited in the wild.
We have a massive vulnerability problem, but a much smaller action problem. The traditional model of treating every “Critical” CVSS score as a five-alarm fire is broken. It’s impossible to keep up, and frankly, it’s the wrong strategy.

Why CVSS Isn’t Enough?

A CVE might affect hundreds of assets, but the impact is rarely the same. A critical flaw on an isolated, air-gapped server is a very different beast than the same flaw on a public-facing, business-critical database.
CVSS gives you a generic severity baseline, but it cannot tell you:
If the asset is actually reachable?
If your existing security controls block the exploit?
If the business relies on that specific system to function?

You need evidence from your environment, not just a global score.

The New Standard.

To cut through the noise, leading security teams are moving toward a unified validation program. It’s not about replacing one tool; it’s about combining three distinct methods to get a definitive answer on what is actually exploitable.

Exploitability Validation: This determines if an exposure is real, even for CVEs with no public exploit yet. It covers the blind spots where you can’t safely run a live test (like on critical or restricted assets).
Security Control Validation: This shows whether your firewalls, EDR, and other defenses can actually stop the attack.
Agentic Pentesting: This safely runs real exploits to chain vulnerabilities together and show you exactly how far an attacker could move through your network.

Stop Chasing Ghosts.

The gap between disclosure and exploitation is narrowing. Attackers are using AI to speed up their process, and defenders need to match that speed with precision, not panic. The goal isn’t to patch everything. The goal is to validate what matters. By integrating exploitability checks, control validation, and automated pentesting into one workflow, you stop guessing and start making decisions based on evidence.

This article is based on: AI Changed the Exposure Problem. Validation Needs to Change With It., published by The Hacker News.
Read the original article on The Hacker News

If you’re reading this article, use the discount code CQBLOG_AMSC27_CVSS at checkout – a special offer created exclusively for readers of this article. The code applies to our flagsihp course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.

Want to learn more?

Join our FREE live webinar:

Uncovering New Identity Theft Vectors and How to Mitigate Them

Discover how identity theft no longer begins and ends with a stolen password.

Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.

Register for free:
https://luma.com/TheftVectors

The post The Problem of 35,800 Vulnerabilities: Why Your CVSS Score is Lying to You appeared first on CQURE Academy.

ESC16 occurs when a Certificate Authority is configured not to include the SID security extension in issued certificates. This extension provides a strong binding between a certificate and the Active Directory account for which it was issued. If the extension is absent and the Domain Controller permits weak certificate mapping, certificate identities such as the UPN can potentially be used to map the certificate to another account.

In the demonstration, a low-privileged user named bob is able to modify his userPrincipalName. We temporarily change his UPN to Administrator and request a standard user certificate. Because the CA does not add the SID security extension, the issued certificate contains the Administrator UPN without being strongly bound to Bob’s SID.

After restoring Bob’s original UPN, the certificate is used for authentication and is mapped by the KDC to the real Administrator account. This allows us to obtain an Administrator TGT and recover the Administrator NT hash.

With Domain Admin privileges, the demonstration concludes with DCSync, retrieving the krbtgt account hash.

The attack highlights why AD CS configuration, certificate mapping settings, and permissions to modify identity attributes such as userPrincipalName should all be carefully reviewed. A seemingly small certificate configuration issue can become part of a complete domain compromise.

Want to learn more?

Join our FREE live webinar:

Uncovering New Identity Theft Vectors and How to Mitigate Them

Discover how identity theft no longer begins and ends with a stolen password.

Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.

Register for free:
https://luma.com/TheftVectors

Want to know more?

The post CQURE Hacks #83: Attack on Active Directory Certificate Services (AD CS) – ESC16 appeared first on CQURE Academy.

Conditional Access decides which device platforms it trusts based on the User-Agent, a value the client controls. Windows, Linux, iPhone all get blocked. So, we try something the policy never accounted for: Xbox Series X. The result is a Microsoft Graph access token, issued without ever triggering MFA.

With that token we go straight to Graph, enumerating users, groups and roles with GraphRunner, completely bypassing the portal restrictions. A custom script then scans directory objects for secrets and finds a clear-text password sitting in a group description. It belongs to a break-glass account with Global Administrator.

One policy gap and one badly stored secret, chained into a full tenant compromise.

Blocking the admin portal is not enough. Conditional Access has to cover the underlying APIs and token acquisition paths, security decisions must not rely on client-controlled signals like the User-Agent, MFA belongs on every sensitive path, and secrets must never live in directory attributes a standard user can read.

Want to learn more about Attack Reconstruction & Defense Evasion?

Join our FREE live webinar:

Close the Attack Visibility Gap: Detecting Defense Evasion and Reconstructing Attacks in Microsoft Environments

Discover how attackers create gaps in security visibility and how defenders can reconstruct what happened from fragmented evidence across Microsoft environments.

Paula Januszkiewicz and Amr Thabet will look at the challenge from both sides, from reconstructing attacks and finding the evidence attackers leave behind to understanding how modern defense evasion techniques can make malicious activity harder to detect.

Register for free:
https://luma.com/uylurofs

Want to know more?

The post CQURE Hacks #82: Microsoft Entra ID Conditional Access Bypass via User-Agent Policy Gap appeared first on CQURE Academy.