https://activesoc.blackhillsinfosec.comDetection engineering and incident response from the BHIS SOC.http://www.rssboard.org/rss-specificationpython-feedgenWed, 07 Oct 2026 19:22:37 +0000https://activesoc.blackhillsinfosec.com/blog/the-gitlab-exploit-with-no-traversal-in-it/CVE-2026-85706 is being called a path traversal. It contains no traversal sequence at all, which is why detections written from the label match nothing. We built the exploit in a lab and worked out what to anchor on instead.https://activesoc.blackhillsinfosec.com/blog/the-gitlab-exploit-with-no-traversal-in-it/Mon, 14 Sep 2026 17:45:00 +0000https://activesoc.blackhillsinfosec.com/blog/disposable-domains-durable-hosting/Five months watching four distinct chains run out of one bulletproof hosting ASN (AS202412 / OMEGATECH LTD). The staging, the persistence and the C2 all varied. The one thing none of them changed was where the lure page came from.https://activesoc.blackhillsinfosec.com/blog/disposable-domains-durable-hosting/Thu, 10 Sep 2026 21:29:58 +0000https://activesoc.blackhillsinfosec.com/blog/teams-vishing-to-quick-assist-the-implant-you-cannot-hash-hunt/An implant hidden inside the install tree of a real, signed VPN client, where fourteen of the nineteen files are genuine and the launcher is validly signed. Why hash, publisher and certificate hunting all fail against it, and what to hunt instead.https://activesoc.blackhillsinfosec.com/blog/teams-vishing-to-quick-assist-the-implant-you-cannot-hash-hunt/Wed, 09 Sep 2026 08:22:08 +0000https://activesoc.blackhillsinfosec.com/blog/free-tenants-fake-help-desks/Over eight weeks we watched one email-bombing operator get their domains burned repeatedly and adapt — ending up on free Microsoft 365 tenants that carry no registration record, no WHOIS, and no reputation to score.https://activesoc.blackhillsinfosec.com/blog/free-tenants-fake-help-desks/Tue, 08 Sep 2026 20:14:26 +0000https://activesoc.blackhillsinfosec.com/blog/detecting-risky-log4j-event-deserialization/We reproduced a quiet Log4j deserialization bug in the lab. Here are four places a SOC can actually catch it, and one where we decided not to bother.https://activesoc.blackhillsinfosec.com/blog/detecting-risky-log4j-event-deserialization/Wed, 26 Aug 2026 19:36:45 +0000https://activesoc.blackhillsinfosec.com/blog/introducing-the-aur0ra-ransomware-group/The ActiveSOC responds to an Aur0ra intrusion: email bombing and vishing for access, a disguised Xray-core tunnel for C2, and a custom per-victim locker.https://activesoc.blackhillsinfosec.com/blog/introducing-the-aur0ra-ransomware-group/Tue, 18 Aug 2026 22:38:33 +0000