Search
Send enquiry
UP-TO-DATE

Blog

Our employees frequently engage in research projects to live up to the high standard. They analyze the latest topics, methods and tools in interesting information security areas and prepare them in this context. The results of these activities contribute, for example, to projects, lectures at conferences, market overviews and articles for technical journals as well in advisories and zero-day vulnerabilities.

Blog Overview
Advisories
Vulnerabilities
Podcast (German)

Blog Articles

Overview
Forensic

Analysis of a credential-stealer malware campaign – Part 1

May 20, 2026 – In March 2026, cirosec identified an ongoing malware campaign targeting developers, IT professionals, and power users who rely on popular open-source and productivity tools. The campaign is only accessible using the Bing search engine. Once executed, the malware exfiltrates browser credential stores, cryptocurrency wallet data, authentication tokens, VPN and SSH configurations, and sensitive documents.

Author: Colin Glätzer, Konrad Weyhing, Felix Friedberger

Read more »
Kubernetes

The seven seas of Kuber­netes sec­urity

May 5, 2026 – Today a single malicious container image could be enough to take over a larger fleet of machines and grant an attacker control over confidentiality, integrity and availability of all the workloads running in a Kubernetes cluster and potentially beyond, since clusters often hold secrets and credentials for external services and infrastructure. In this article we outline a set of key security domains that organizations should address to secure Kubernetes effectively.

Author: Christoffer Albrecht

Read more »
Azure

Auditieren von M365 und Azure

March 24, 2026 – Entra ID und Azure sind ein eigener Kosmos, der viele Möglichkeiten aber auch viele Stolperfallen hinsichtlich der Sicherheit mit sich bringt. Entra ID und Azure sicher zu betreiben, ist eine Kunst für sich und stellt viele IT-Abteilungen vor große Herausforderungen. In diesem Blogpost soll es darum gehen, wie man diesem Problem Herr werden kann.

Author: Constantin Wenz

Read more »
Load More

Advisories

Overview

Vulnerability in Trend Micro Apex One (CVE-2024-55631)

January 8, 2025 – Our colleagues Frederik Reiter and Jan-Luca Gruber found a vulnerability in the Damage Cleanup Engine of Trend Micro Apex One, which allows and attacker to delete a folder with high privileges. This can be leveraged to escalate privileges in the context of SYSTEM.

Read more »
Load More

Vulnerabilities

cirosec conducts vulnerability research into products and services, which at times results in zero-day vulnerabilities being discovered.

cirosec follows a responsible disclosure policy when dealing with zero-day vulnerabilities found during research or customer projects. The goal is to balance the need of giving the vendor or open-source project enough time to develop and distribute a fix for the vulnerability with the need of the public to know about the security vulnerability. The policy is in accordance with industry-standard responsible disclosure practices. Our responsible disclosure policy can be found here.

Below is a list of CVEs vulnerabilities identified or assigned by cirosec and presented here for reference and cataloguing.

VulnerabilityCVECVSS ScorePublication DateMore Details
Vulnerability in Two App Studio JourneyCVE-2025-414597.8 (CVSS v3.1)July 21, 2025Advisory
Vulnerability in Two App Studio JourneyCVE-2025-414585.5 (CVSS v3.1)July 21, 2025Advisory
Vulnerability in SYNCPILOT LIVE CONTRACTCVE-2025-23065.9 (CVSS v3.1)May 15, 2025Advisory
Vulnerability in SYNCPILOT LIVE CONTRACTCVE-2025-23058.6 (CVSS v3.1)May 15, 2025Advisory
Vulnerability in Elaborate Bytes Virtual Clone Drive [ext]CVE-2025-18657.8 (CVSS v3.1)April 4, 2025Changelog
Vulnerability in Mobatek MobaXtermCVE-2025-07146.5 (CVSS v3.1)February 17, 2025Advisory
Vulnerability in Intel AMTCVE-2024-383077.7 (CVSS v3.1)February 11, 2025Intel
Vulnerability in G DATA Management Server [ext]CVE-2025-05427.8 (CVSS v3.1)January 24, 2025Advisory
Vulnerability in G DATA Security Client [ext]CVE-2025-05437.8 (CVSS v3.1)January 24, 2025Advisory
Vulnerability in Trend Micro Apex OneCVE-2024-556317.8 (CVSS v3.1)January 8, 2025Advisory, Trend Micro
Vulnerability in HP Hotkey SupportCVE-2024-274588.8 (CVSS v3.1)October 4, 2024Advisory, HP
Vulnerability in AVG Internet SecurityCVE-2024-65107.8 (CVSS v3.1)September 12, 2024Advisory
Vulnerability in OverwolfCVE-2024-78347.8 (CVSS v3.1)September 4, 2024Advisory
Vulnerability in baramundi Management AgentCVE-2024-66897.8 (CVSS v3.1)July 15, 2024Advisory, baramundi
Vulnerability in Trend Micro Apex OneCVE-2024-363027.8 (CVSS v3.1)July 1, 2024ZDI-Advisory, Trend Micro
Vulnerability in Checkpoint HarmonyCVE-2024-249127.8 (CVSS v3.1)May 1, 2024Advisory, Checkpoint
Vulnerability in Webroot AntivirusCVE-2023-72417.8 (CVSS v3.1)May 1, 2024Advisory, Webroot
Vulnerability in BitdefenderCVE-2023-61547.8 (CVSS v3.1)April 1, 2024Advisory, Bitdefender
Vulnerability in neo42 Sumatra PDF Package 7.8 (CVSS v3.1)November 7, 2023Advisory
Vulnerability in Bytello Share 7.8 (CVSS v3.1)November 6, 2023Advisory
Vulnerability in Kiteworks OwnCloudCVE-2023-72736.8 (CVSS v3.1)November 4, 2023Advisory
Vulnerability in VMware WorkstationCVE-2023-208547.8 (CVSS v3.1)February 3, 2023Advisory, VMware
Vulnerability in Remote Access Software from RealVNCCVE-2022-419757.8 (CVSS v3.1)September 30, 2022Advisory, RealVNC

Blogs - Overview

TitleAuthorPublication DateCategory
Analysis of a credential-stealer malware campaign–Part 1C. Glätzer, K. Weyhing, F. FriedbergerMay 20, 2026Forensic
Reife­grad für Sicherheits­über­prüfungenMichael BrüggeMay 11, 2026Pentesting
The seven seas of Kuber­netes sec­urityChristoffer AlbrechtMay 5, 2026Kubernetes
Penetration Testing LLM Web Apps: Common PitfallsFelix FriedbergerApril 14, 2026Pentesting
Auditieren von M365 und AzureConstantin WenzMarch 24, 2026Azure, EntraID
How Attackers Abuse Bubble­apps.io to Phish German BusinessesFelix FriedbergerFebruary 10, 2026Forensic
Windows Instrumentation Callbacks – Part 4Lino FaccoFebruary 10, 2026Red Teaming, Reverse Engineering, Windows
Windows Instrumentation Callbacks – Part 3Lino FaccoJanuary 28, 2026Red Teaming, Reverse Engineering, Windows
Die neue i-Kfz-App für den digitalen FahrzeugscheinJulian LemmerichDecember 3, 2025Digitalization, Identity, Mobile Security
Beacon Object Files for Mythic – Part 2Leon SchmidtNovember 27, 2025Red Teaming, Command-And-Control
A collection of Shai-Hulud 2.0 IoCsNiklas Vömel & Felix FriedbergerNovember 27, 2025Forensic, Incident Handling
Beacon Object Files for Mythic – Part 1Leon SchmidtNovember 19, 2025Red Teaming, Command-And-Control
Windows Instrumentation Callback – Part 2Lino FaccoNovember 12, 2025Red Teaming, Reverse Engineering, Windows
Windows Instrumen­tation Callbacks – Part 1Lino FaccoNovember 5, 2025Red Teaming, Reverse Engineering, Windows
IOCs of the npm crypto stealer supply chain incidentNiklas VömelSeptember 25, 2025Forensic, Incident Handling
Effektive Governance-Strategien im Red TeamingHannes AllmannJune 30, 2025Red Teaming
The Key to COMpromise – Part 4Alain Rödel and Kolja GrassmannFebruary 26, 2025Red Teaming
The Key to COMpromise – Part 3Alain Rödel and Kolja GrassmannFebruary 12, 2025Red Teaming
The Key to COMpromise – Part 2Alain Rödel and Kolja GrassmannJanuary 15, 2025Red Teaming
TLPT: Bedrohungsorientierte Penetrationstests nach DORAMichael BrüggeJanuary 24, 2025Red Teaming
The Key to COMpromise Part 1Alain Rödel and Kolja GrassmannJanuary 15, 2025Red Teaming
Wer hat das Elster-Zertifikat weitergegeben?Benjamin HäubleinDecember 3, 2024Identity
Google DoC2Frederik ReiterNovember 7, 2024Command-and-Control, Red Teaming
Abusing Microsoft Warbird for Shellcode ExecutionJan-Luca Gruber & Frederik ReiterNovember 7, 2024Red Teaming, Reverse Engineering, Windows
Inside the NAC PiLeon SchmidtJuly 5, 2024Red Teaming
Loader Dev. 5 – Loading our payloadKolja GrassmannMay 10, 2024Red Teaming
Loader Dev. 4 – AMSI and ETWKolja GrassmannApril 30, 2024Red Teaming
Loader Dev. 3 – Evading userspace hooksKolja GrassmannApril 10, 2024Red Teaming
Loader Dev. 2 – Dynamically resolving functionsKolja GrassmannMarch 10, 2024Red Teaming
Loader Dev. 1 – BasicsKolja GrassmannFebruary 10, 2024Red Teaming
Microsoft Tiering Model – Part 3/3Hagen MolzerJanuary 10, 2024AD Security
Microsoft Tiering Model – Part 2/3Hagen MolzerDecember 10, 2023AD Security
Microsoft Tiering Model – Part 1/3Hagen MolzerNovember 10, 2023AD Security

Your contact person

Daniela Strobel
daniela.strobel@cirosec.de
+49 7131 59455-60

Do you want to protect your systems? Feel free to get in touch with us.
Send Enquiry
Contact Details
Search
Search