Himaja retweeted
You asked and we listened!
@censysio now offers subscription based plans!
If you are an independent researcher, a small team, or a business just getting its legs under it you don’t have to choose between having the best data and spending your coins elsewhere.
censys.com/blog/introducing-…
Last month was a lot. Wrote up some thoughts on the Vulnpocalypse, what PHP2Shell can tell us about vulnerability response using data from @censysio, and how we can better prepare for the next big incident without adding to the FUD censys.com/blog/thoughts-on-…
Himaja retweeted
Internet-exposed AI infrastructure grew 63% in nine months.
Download the 2026 State of the Internet Report: bit.ly/4iuKwCs
Watch the full episode here: bit.ly/4hVa3Vq
Himaja retweeted
Censys VP of Research, Security and IT @schwartzonsec
is presenting during the @SANSInstitute ICS Solutions Track on June 9 from 2:00-2:30pm.
Watch his virtual session to learn about detection methodology and a practical framework for thinking about protocol-era OT systems.
Register here for free: go.sans.org/ics-solutions-tr…
Himaja retweeted
New episode 📢
Ep 172 "SuperBox"
What if there was a device which gave you endless movies and TV shows without ads? Ok great sign me up! In this episode we interview "D3ada55", who found such a device, but as she gazed into it, she discovered it gazing back at her.
darknetdiaries.com/episode/1…
Himaja retweeted
🪶Censys ARC has identified a new threat campaign: BrewJack
Key findings:
• Non-traditional network transport
• C2 over IPoAC (RFC 2549)
Full advisory: hubs.ly/Q049fHXY0
#CensysARC #BrewJack
Himaja retweeted
Introducing Censys ARC (Advanced Research Collective) — the same world-class team behind Censys’ Internet threat research, now formally recognized.
Their work has already made real impact:
💧 Secured 96%+ of exposed U.S. water facility systems
🤖 Discovered thousands of exposed LLM instances
🚨 Delivered rapid analysis on critical vulnerabilities
🔎 Learn more: hubs.ly/Q0466QjS0
Himaja retweeted
📚 In our latest research, we examined ErrTraffic, a ClickFix attack panel powering GlitchFix campaigns. These campaigns create visual page glitches to prompt the user to initiate a fake update, unknowingly running malicious commands and/or downloading malware.
🔎 In the process of this investigation, our researchers found a misconfigured instance of ErrTraffic that revealed its source code. Get the code breakdown, attack techniques, infrastructure mapping, and IOCs in the full article: hubs.ly/Q03_wfZn0
Himaja retweeted
Signal is pretty easy to use out of the box, but there are a variety of things that can go wrong if you don’t spend some time learning how it works. Here’s our guide to help you get started. ssd.eff.org/module/how-to-us…
Himaja retweeted
🆕 REPORT: Our first investigation into Israel-based spyware company Paragon Solutions reveals multiple threads linked to the proliferation of its mercenary spyware operations across the globe.
citizenlab.ca/2025/03/a-firs…
Himaja retweeted
Our researchers dove into the scope of the recent #DigiCert compliance issue, identifying top companies and industries affected. We see 26k+ impacted certs still in use on public-facing hosts - and nearly 99% have been revoked #CensysRapidResponse censys.com/the-digicert-dcv-…
Himaja retweeted
If you have VMware ESXi and Active Directory in your environment, take 5 minutes now & create a group in each AD domain called "ESX Admins".
Make sure that the "ESX Admins" group is in a top-level administrative OU that only your AD admins manage.
#QuickFix
In today's WTF?!?!? moment
When a ESXi server is domain-joined, it assumes any "ESX Admins" group & its members should have full admin rights.
So.... anyone who can create & manage a group in AD, can get full admin rights to the VMware ESX hypervisors!
microsoft.com/en-us/security…
Himaja retweeted
📊 Live dashboard tracking #TellYouThePass ransomware infections actively exploiting #PHP hosts vulnerable to CVE-2024-4577: lookerstudio.google.com/s/mh…. As of June 11, we’ve detected ~1,700 public-facing infected hosts online.
Censys Search cheat sheet ✨ including lots of practical examples cheatography.com/himajedi/ch…
Himaja retweeted
Here's a full IP list to check against your ASA/Flow logs for the ArcaneDoor Cisco ASA Compromises (361 IPs): drive.google.com/file/d/1wlK…
This list was put together from information in the Talos Intelligence blog which stated that the actor came from ASA devices but with cert details that suggest a OpenConnect VPN.
The JA4X of the known IOCs is 711618dec96d_711618dec96d_0a4d69c180a3.
Searching against this in Driftnet.io produces 7,330 IPs in the last few months, fairly rare.
Narrowing down the search in Hunt.io to include the cert details observed by Talos, "CN=ocserv VPN" and we now have a list of 481 IPs (all time). Deduplicating that brings it to 361 IPs in total.
Running this list of IPs past GreyNoise.io shows that 110 of the IPs are known internet scanners. So you may have hits on your flow logs but so long as there's no data transfer, then it was just a scan: viz.greynoise.io/analysis/d2…
See the Talos blog on the ASA compromises here:
blog.talosintelligence.com/a…
Read more about how JA4X works here:
blog.foxio.io/ja4%2B-network…
Thanks to @ChrisUeland and Jonathan Reiter!
Himaja retweeted
#Sisense, a top choice for enterprise BI & analytics, rocked by a #DataBreach!🚨Using our data, we discovered 120 Sisense instances. Major sectors affected include Sales, Healthcare, with notable presence in Tech, Logistics, and Energy. Read here for more➡️censys.com/sisense-a-look-at…
Himaja retweeted
Storm⚡️Watch | AI Crime Warnings & NVD Slowdown nitter.gq/i/broadcasts/1ynKOyWQY…
Himaja retweeted
Interested in tracking malicious infrastructure but don't know where to start? Come join us March 21st at 2 PM ET where @embee_research will step through some examples of how to do so using Censys. Sign up here! cnys.io/iu6hzj
#happyhunting #malware
Himaja retweeted
Did You Know?💡A recent study finds that Censys detects new services that come online six times faster than the nearest competitor.🔥Learn more about how we compare to the competition on time-to-discovery and coverage: censys.com/the-results-are-c…