Search
Send enquiry
UP-TO-DATE

Blog

Our employees frequently engage in research projects to live up to the high standard. They analyze the latest topics, methods and tools in interesting information security areas and prepare them in this context. The results of these activities contribute, for example, to projects, lectures at conferences, market overviews and articles for technical journals as well in advisories and zero-day vulnerabilities.

Blog Overview
Advisories
Vulnerabilities
Podcast (German)

Blog Articles

Overview
Forensic

Analysis of a credential stealer malware campaign – Part II

June 23, 2026 – Researchers have uncovered an evolved credential-stealing malware campaign that lures Windows users through fake software download pages appearing in Bing search results. The updated malware deploys a malicious Chrome extension disguised as “Microsoft Teams Helper,” capable of keystroke logging, real-time screen recording, cryptocurrency clipboard hijacking, and full remote code execution on the victim’s machine.

Author: Colin Glätzer, Konrad Weyhing

Read more »
AD Security

Microsoft Defender for Identity evasions in 2026 – Part II

June 17, 2026 – The first blogpost highlighted the detection capabilities and the resulting evasion options for Microsoft Defender for Identity (DfI). To complement the first part, the second part will present some alternative detection possibilities for the defensive side to improve visibility and security, as well as the upgrade from DfI version 2.2 to DfI version 3.0.

Author: Jakob Scholz

Read more »
Red Teaming

Microsoft Defender for Identity evasions in 2026 – Part I

June 16, 2026 – Microsoft Defender for Identity (DfI) is one of Microsoft’s key solutions for detecting identity-based attacks in Active Directory environments – but how well does it hold up against a skilled attacker? This two-part blog post dives into DfI’s detection capabilities for high-impact attacks such as shadow credentials, pass-the-cert, ESC8, and DCSync. Additionally, it uncovers a spoofing and relaying vulnerability in DfI’s Network Name Resolution component that can be used to evade multiple alerts, and offers blue team perspectives on closing these gaps.


Author: Jakob Scholz

Read more »
Pentesting

Fuzzing vhosts with SNI(tch)

June 10, 2026 – Host header fuzzing stops at the HTTP layer and can’t find services hardened at the TLS handshake via SNI validation. SNItch fills that gap by fuzzing the SNI field directly – and doubles as a tool to verify your own servers don’t leak hostnames to IP-based reconnaissance.

Author: Felix Friedberger

Read more »
Forensic

Analysis of a credential-stealer malware campaign – Part I

May 20, 2026 – In March 2026, cirosec identified an ongoing malware campaign targeting developers, IT professionals, and power users who rely on popular open-source and productivity tools. The campaign is only accessible using the Bing search engine. Once executed, the malware exfiltrates browser credential stores, cryptocurrency wallet data, authentication tokens, VPN and SSH configurations, and sensitive documents.

Author: Colin Glätzer, Konrad Weyhing, Felix Friedberger

Read more »
Load More

Advisories

Overview

Vulnerability in Trend Micro Apex One (CVE-2024-55631)

January 8, 2025 – Our colleagues Frederik Reiter and Jan-Luca Gruber found a vulnerability in the Damage Cleanup Engine of Trend Micro Apex One, which allows and attacker to delete a folder with high privileges. This can be leveraged to escalate privileges in the context of SYSTEM.

Read more »
Load More

Vulnerabilities

cirosec conducts vulnerability research into products and services, which at times results in zero-day vulnerabilities being discovered.

cirosec follows a responsible disclosure policy when dealing with zero-day vulnerabilities found during research or customer projects. The goal is to balance the need of giving the vendor or open-source project enough time to develop and distribute a fix for the vulnerability with the need of the public to know about the security vulnerability. The policy is in accordance with industry-standard responsible disclosure practices. Our responsible disclosure policy can be found here.

Below is a list of CVEs vulnerabilities identified or assigned by cirosec and presented here for reference and cataloguing.

VulnerabilityCVECVSS ScorePublication DateMore Details
Vulnerability in Two App Studio JourneyCVE-2025-414597.8 (CVSS v3.1)July 21, 2025Advisory
Vulnerability in Two App Studio JourneyCVE-2025-414585.5 (CVSS v3.1)July 21, 2025Advisory
Vulnerability in SYNCPILOT LIVE CONTRACTCVE-2025-23065.9 (CVSS v3.1)May 15, 2025Advisory
Vulnerability in SYNCPILOT LIVE CONTRACTCVE-2025-23058.6 (CVSS v3.1)May 15, 2025Advisory
Vulnerability in Elaborate Bytes Virtual Clone Drive [ext]CVE-2025-18657.8 (CVSS v3.1)April 4, 2025Changelog
Vulnerability in Mobatek MobaXtermCVE-2025-07146.5 (CVSS v3.1)February 17, 2025Advisory
Vulnerability in Intel AMTCVE-2024-383077.7 (CVSS v3.1)February 11, 2025Intel
Vulnerability in G DATA Management Server [ext]CVE-2025-05427.8 (CVSS v3.1)January 24, 2025Advisory
Vulnerability in G DATA Security Client [ext]CVE-2025-05437.8 (CVSS v3.1)January 24, 2025Advisory
Vulnerability in Trend Micro Apex OneCVE-2024-556317.8 (CVSS v3.1)January 8, 2025Advisory, Trend Micro
Vulnerability in HP Hotkey SupportCVE-2024-274588.8 (CVSS v3.1)October 4, 2024Advisory, HP
Vulnerability in AVG Internet SecurityCVE-2024-65107.8 (CVSS v3.1)September 12, 2024Advisory
Vulnerability in OverwolfCVE-2024-78347.8 (CVSS v3.1)September 4, 2024Advisory
Vulnerability in baramundi Management AgentCVE-2024-66897.8 (CVSS v3.1)July 15, 2024Advisory, baramundi
Vulnerability in Trend Micro Apex OneCVE-2024-363027.8 (CVSS v3.1)July 1, 2024ZDI-Advisory, Trend Micro
Vulnerability in Checkpoint HarmonyCVE-2024-249127.8 (CVSS v3.1)May 1, 2024Advisory, Checkpoint
Vulnerability in Webroot AntivirusCVE-2023-72417.8 (CVSS v3.1)May 1, 2024Advisory, Webroot
Vulnerability in BitdefenderCVE-2023-61547.8 (CVSS v3.1)April 1, 2024Advisory, Bitdefender
Vulnerability in neo42 Sumatra PDF Package 7.8 (CVSS v3.1)November 7, 2023Advisory
Vulnerability in Bytello Share 7.8 (CVSS v3.1)November 6, 2023Advisory
Vulnerability in Kiteworks OwnCloudCVE-2023-72736.8 (CVSS v3.1)November 4, 2023Advisory
Vulnerability in VMware WorkstationCVE-2023-208547.8 (CVSS v3.1)February 3, 2023Advisory, VMware
Vulnerability in Remote Access Software from RealVNCCVE-2022-419757.8 (CVSS v3.1)September 30, 2022Advisory, RealVNC

Blogs - Overview

TitleAuthorPublication DateCategory
Analysis of a credential stealer malware campaign – Part IIColin Glätzer, Konrad WeyhingJune 23, 2026Forensic
Microsoft Defender for Identity evasions in 2026 – Part IIJakob ScholzJune 17, 2026AD Security, Windows
Microsoft Defender for Identity evasions in 2026 – Part IJakob ScholzJune 16, 2026Red Teaming
Fuzzing vhosts with SNI(tch)Felix FriedbergerJune 10, 2026Pentesting
Analysis of a credential-stealer malware campaign – Part 1Colin Glätzer, Konrad Weyhing, Felix FriedbergerMay 20, 2026Forensic
Reife­grad für Sicherheits­über­prüfungenMichael BrüggeMay 11, 2026Pentesting
The seven seas of Kuber­netes sec­urityChristoffer AlbrechtMay 5, 2026Kubernetes
Penetration Testing LLM Web Apps: Common PitfallsFelix FriedbergerApril 14, 2026Pentesting
Auditieren von M365 und AzureConstantin WenzMarch 24, 2026Azure, EntraID
How Attackers Abuse Bubble­apps.io to Phish German BusinessesFelix FriedbergerFebruary 10, 2026Forensic
Windows Instrumentation Callbacks – Part 4Lino FaccoFebruary 10, 2026Red Teaming, Reverse Engineering, Windows
Windows Instrumentation Callbacks – Part 3Lino FaccoJanuary 28, 2026Red Teaming, Reverse Engineering, Windows
Die neue i-Kfz-App für den digitalen FahrzeugscheinJulian LemmerichDecember 3, 2025Digitalization, Identity, Mobile Security
Beacon Object Files for Mythic – Part 2Leon SchmidtNovember 27, 2025Red Teaming, Command-And-Control
A collection of Shai-Hulud 2.0 IoCsNiklas Vömel & Felix FriedbergerNovember 27, 2025Forensic, Incident Handling
Beacon Object Files for Mythic – Part 1Leon SchmidtNovember 19, 2025Red Teaming, Command-And-Control
Windows Instrumentation Callback – Part 2Lino FaccoNovember 12, 2025Red Teaming, Reverse Engineering, Windows
Windows Instrumen­tation Callbacks – Part 1Lino FaccoNovember 5, 2025Red Teaming, Reverse Engineering, Windows
IOCs of the npm crypto stealer supply chain incidentNiklas VömelSeptember 25, 2025Forensic, Incident Handling
Effektive Governance-Strategien im Red TeamingHannes AllmannJune 30, 2025Red Teaming
The Key to COMpromise – Part 4Alain Rödel and Kolja GrassmannFebruary 26, 2025Red Teaming
The Key to COMpromise – Part 3Alain Rödel and Kolja GrassmannFebruary 12, 2025Red Teaming
The Key to COMpromise – Part 2Alain Rödel and Kolja GrassmannJanuary 15, 2025Red Teaming
TLPT: Bedrohungsorientierte Penetrationstests nach DORAMichael BrüggeJanuary 24, 2025Red Teaming
The Key to COMpromise Part 1Alain Rödel and Kolja GrassmannJanuary 15, 2025Red Teaming
Wer hat das Elster-Zertifikat weitergegeben?Benjamin HäubleinDecember 3, 2024Identity
Google DoC2Frederik ReiterNovember 7, 2024Command-and-Control, Red Teaming
Abusing Microsoft Warbird for Shellcode ExecutionJan-Luca Gruber & Frederik ReiterNovember 7, 2024Red Teaming, Reverse Engineering, Windows
Inside the NAC PiLeon SchmidtJuly 5, 2024Red Teaming
Loader Dev. 5 – Loading our payloadKolja GrassmannMay 10, 2024Red Teaming
Loader Dev. 4 – AMSI and ETWKolja GrassmannApril 30, 2024Red Teaming
Loader Dev. 3 – Evading userspace hooksKolja GrassmannApril 10, 2024Red Teaming
Loader Dev. 2 – Dynamically resolving functionsKolja GrassmannMarch 10, 2024Red Teaming
Loader Dev. 1 – BasicsKolja GrassmannFebruary 10, 2024Red Teaming
Microsoft Tiering Model – Part 3/3Hagen MolzerJanuary 10, 2024AD Security
Microsoft Tiering Model – Part 2/3Hagen MolzerDecember 10, 2023AD Security
Microsoft Tiering Model – Part 1/3Hagen MolzerNovember 10, 2023AD Security

Your contact person

Daniela Strobel
daniela.strobel@cirosec.de
+49 7131 59455-60

Do you want to protect your systems? Feel free to get in touch with us.
Send Enquiry
Contact Details
Search
Search