VulnCheck

There is still time to submit a CFP to VulnCheck's ThreatCon1 conference. The conference is October 5-7 in Reston, VA. I know a guy on the review board (it's me) if you want to reach out. Would love any exploit/CVE content you got! threatcon1.org/submissions

Opportunity to hack with an amazing team:

The @VulnCheckAI team added CVE-2025-2611 to VulnCheck KEV over the weekend after observing it being exploited in the wild: vulncheck.com/blog/ictbroadc…

We looked at a 90-day slice of the attacker infrastructure we continuously track at @VulnCheckAI to determine longevity. Some stuff burns fast. Some very slow. It was interesting to see some correlation between intent and uptime. vulncheck.com/blog/stillup-s…

The @VulnCheckAI team saw an attacker use "mount" as the primary GTFOBin for unauth RCE on Hikvision (CVE-2021-36260). I hadn't seen that before and thought it was pretty neat. I wrote it up and added the payload to go-exploit: vulncheck.com/blog/hikvision…

CFP for VulnCheck's ThreatCon1 Conference has been extended to July 31: threatcon1.org/showcase-trac…

VulnCheck is running a conference in September (in Reston, VA). We're doing a couple of talk tracks and one is for technical content (vulnerability research, exploits, attacks in the wild, etc). Submission deadline is July 10 - feel free to DM me if you have any questions!

We added a neat feature to go-exploit that allows detection and version scanning to work off of a cache. That allows us to scan things without connecting to them (using previously scanned data, or Shodan data, a pcap, etc). I put together a write-up here: vulncheck.com/blog/vulncheck…

(1/3) I spent some time looking at techniques to land a payload in memory using CVE-2023-22527 (Confluence). This writeup discusses three payloads, most importantly an in memory webshell, and has wider applicability outside of Confluence. vulncheck.com/blog/confluenc…

Based on past exploitation of Zyxel firewalls, I felt we had to dig into this, and I feel like my time was wasted. Certainly I was not owed a good explanation of the vulnerability, but it does leave me wondering why leave this stuff out? vulncheck.com/blog/zyxel-cve…

The team spent some time looking at systems infected by 7777-Botnet and inferred the CVE that were potentially used based on colocated services. We also noticed the botnet has been spinning up SOCKS5 servers. Pretty neat, I thought. @VulnCheckAI vulncheck.com/blog/ip-intel-…

We gathered @VulnCheckAI data on @CISACyber's 2022 top 12 most exploited vulnerabilities. More than half were on the 2021 most exploited list. All have @metasploit modules. They have been used by more than 100 threat actors, botnets, and ransomware. vulncheck.com/blog/2022-top-…