Thanks to our #TurrisSentinel #security #research program, #CZNIC #CSIRT team discovered large scale #FTP #attack. Coming from 45.78.4.0/22, it is #bruteforcing #slowly - it takes it 19 day to get through it's #passwords. Big thanks to everybody who helps us by running our #minipots on their devices! Report in #Czech is available on CSIRT website https://csirt.cz/cs/kyberbezpecnost/aktualne-z-bezpecnosti/distribuovany-ftp-bruteforcer/

Over 22 real contributions and project outcomes came out of our two-day hackathon in Luxembourg, truly impressive work! The collaboration and energy were next-level.

Glad to share that we'll also be hosting a smaller hackathon at @firstdotorg’s annual conference in Copenhagen on Sunday 22nd June . See you there! #Hackathon #FIRSTcon25

#hackathon #opensource #csirt #cybersecurity

hackathon.lu 2025 - Outcome and results details https://hackathon.lu/2025/04/11/hackathon.lu-2025-outcome/

hackathon at FIRSTCON25 https://discourse.ossbase.org/c/hackathon-firstcon25/

A dedicated fediverse account has been created to follow the hackathon topics

@hackathonfirstcon25

@ddu and @gallypette will also coordinate the hackathon with me.

We are excited to announce that CIRCL has three open positions available.

As a team strongly oriented towards open-source development, we value contributions that drive innovation and strengthen the cybersecurity community. These roles are open to EU citizens, with the workplace based in Luxembourg. If you’re passionate about cybersecurity and open-source collaboration, we encourage you to apply and make a meaningful impact.

• CIRCL - Software Engineer and Intelligence Analyst (software-engineering-analyst)

https://www.circl.lu/projects/position/software-engineering-analyst/

• CIRCL - Security Analyst and Researcher (Security-Analyst-and-Researcher)

https://www.circl.lu/projects/position/security-analyst-researcher/

• CIRCL - Incident and Vulnerability Disclosure Coordinator/Analyst (nis2-incident-analyst)

https://www.circl.lu/projects/position/nis2-incident-analyst/

@circl

160,000 files with personal documents from semanai.tec.mx attendees exposed publicly.

Tried to notify multiple CSIRT teams and the University but in the end had to message a professor at Tec de Monterrey that follows my work to get some help closing this.

Read about it here: https://jltee.substack.com/p/server-from-university-tecmx-exposed-publicly

FIRST hosted another successful TF-CSIRT Meeting & FIRST Regional Symposium Europe in beautiful Monte Carlo, Monaco this month, co-organized by TF-CSIRT and hosted by CERT Monaco.

The event brought together incident response experts for intensive training, informative sessions and valuable networking opportunities, fostering collaboration within the global cybersecurity community.

Special thanks to FIRST CEO Chris Gibson and our Board of Directors who attended: Dr. Serge Droz, Carlos Leonardo, Michael Hausding, Olivier Caleff, Carlos Alvarez, Mona Elisabeth Østvang, Nadia Yousef, Tracy Bills, Yukako Uchida and Audrey Mnisi Mireku.

Learn more about the event here: https://go.first.org/J5Lnf

#FIRSTEU25 #cybersecurity
#IncidentResponse #CSIRT

One thing's clear: if you send an abuse notification to NiceNIC, it ends up being really 'nice' for the criminals.

This reminded me of an idea for proxy filtering: filtering based on the domain registrar. Another practical use case for the WHOIS history database.

Is there an open and public list of the worst registrars?

Die Landesregierung muss EU-Vorgaben zur IT-Sicherheit umsetzen. Damit lässt sich sich viel Zeit. Wie gefährlich ist das?

Die Landesregierung muss EU-Vorgaben zur IT -Sicherheit umsetzen. Damit lässt sich sich viel Zeit. Wie gefährlich ist das?#WDR #Landespolitik #Digitalisierung #IT-Sicherheit #CDU #Grüne #SPD #FDP #NIS2 #Ministerin #Scharrenbach #Opposition #Datenschutzbeauftragte #LDI #Datenschutz #CERT #CSIRT #EU-Kommission #EU-Richtline #Cyberangriff #Hacker #Informationssicherheit
Landesregierung sieht ihre IT-Sicherheit eher gemütlich

Forensic analysis of bitwarden self-hosted server

https://www.synacktiv.com/en/publications/forensic-analysis-of-bitwarden-self-hosted-server

TR-89 - Guidelines for Notifying CSIRT/CERT of Red Teaming and Penetration Testing Exercises - Enhancing Detection and Coordination

https://www.circl.lu/pub/tr-89/

#csirt #redteaming #cert cybersecurity

FIRST is proud to have partnered on a new guide for policymakers: 'Digital First Responders - The Role of CSIRTs in Developing Countries'

A collaboration with The World Bank, including expert review from AfricaCERT, NRD & World Bank specialists.

Download free: https://zurl.co/AruG

#CSIRT #CyberSecurity
#infosec #security

We're glad announce the release of Flowintel v1.2.0, a powerful and flexible case management tool written in Python! This version brings key enhancements to boost efficiency and streamline workflows, with new features like MISP-objects support, subtasks, and significant UI updates.

@misp

https://github.com/flowintel/flowintel/releases/tag/1.2.0

From Ruins to Resilience: How Developing and Utilizing Open Source Solutions Enhances CSIRT Capabilities

#csirt #cert #opensource #infosec

Blog post https://www.foo.be/2024/10/How_Developing_and_Utilizing_Open_Source_Solutions_Enhances_CSIRT_Capabilities

If you're interested in getting into #Linux #logging and evidence collection, this is an excellent write-up from @kostastsale that compares #EVTX logs on Windows with #Auditd, #SysMon for Linux, and native Linux logging.

#DFIR #LinuxForensics #SIEM #CSIRT

https://kostas-ts.medium.com/telemetry-on-linux-vs-windows-a-comparative-analysis-849f6b43ef8e

Good news for everyone involved in meetings where TLP classifications play a crucial role! I've just updated my repository with the latest, second edition of the TLP Classification Meeting Posters. These are handy tools to explicitly display the TLP classification in use during your meetings.

Grab the PDF and ODT versions here - https://git.foo.be/adulau/tlp-meeting

Updates are welcome, like better design, translation or alike.

Join the @firstdotorg Team & help design a collaborative #cybercapacitybuilding program with the Africa #incidentresponse community! Applications open until 4 Jan for a full-time Regional Liaison. Learn more & apply at https://www.first.org/about/jobs  #AfricaCyber #CSIRT #CCB

Notably, a well-documented case by Darktrace revealed how hackers exploited an internet-connected temperature sensor in a fish tank to breach a casino’s secure network.

#Cybersecurity #CSIRT #ENISA #Europe #Vulnerabilities

https://cybersec84.wordpress.com/2023/12/04/iot-vulnerability-reporting-becomes-mandatory-in-eu-from-2027/

@firstdotorg

I just want to say thank you and wow for offering FREE TRAINING & a CERTIFICATE for the new CVSS v4.0. You guys should promote this more. It really opened my eyes to the awesome potential in v4's base, threat, and environmental scoring (CVSS-BTE). Hope to see more tools supporting this.

Link: https://www.first.org/cvss/training