🔺 New oss vuln: MessagePack is vulnerable to Denial of Service (DoS) 🔺
Medium 🟡 / Dotnet
intel.aikido.dev/cve/AIKIDO-…
7
🔺 New oss vuln: MessagePack is vulnerable to Denial of Service (DoS) 🔺
Medium 🟡 / Dotnet
intel.aikido.dev/cve/AIKIDO-…
2
COUNT(*) got smaller after compaction?
Not a bug. That’s deduplication.
New deep-dive on how #Arc handles it:
→ Ingestion stays append-only (millions of records/sec)
→ Dedup rides on compaction, free-riding on work you’re already doing
→ Same series same microsecond timestamp = collapse. Anything else stays.
→ Caveat we put front and center: runs on Line Protocol, not on MessagePack writes
basekick.net/blog/deduplicat…
48
くり返し同じデータを送信する場合に効率が良いと。実際のところMessagePackで送信するデータに同じデータを繰り返し送るシチュエーションがどれぐらいあるかだな。現実的な生データでどうなのか確認してみたいところ。 / “「同じJSONを256件送ると約73%小さくなる」— Mess…” htn.to/3kevvXbtHK
7
12
1,887
ZANCUDO and the Future of Practical IoT Security Testing
IoT security work often exposes a hard truth: the protocols that power connected devices do not always have the same mature testing ecosystem we rely on in web application security. MQTT is a clear example. It is widely used, efficient, and well suited for embedded environments, yet deep inspection and manipulation of MQTT traffic can still require too much manual effort.
That is why VerSprite open sourced ZANCUDO.
Built from real world engagement experience, ZANCUDO gives security testers a more practical way to intercept, inspect, decode, and manipulate MQTT traffic during IoT and embedded device assessments.
What makes this important:
• MQTT security testing needs purpose built tooling
Testing IoT devices is not just web testing with a different protocol. Embedded systems often introduce custom certificate chains, proprietary payload formats, constrained environments, and device specific trust assumptions.
• Visibility is foundational to risk discovery
ZANCUDO helps transform opaque MQTT payloads into readable intelligence by supporting common text and binary formats such as JSON, XML, YAML, JWT, Protobuf, BSON, MessagePack, CBOR, and more.
• Certificate based controls still need to be tested realistically
With its gen_certs utility, ZANCUDO supports TLS MITM workflows by helping testers generate proxy certificates and mimic certificate authority behavior in controlled assessment conditions.
• Scriptability turns observation into validation
Through JavaScript based logic, testers can analyze custom payload formats, decrypt proprietary message structures when authorized, modify packets, drop traffic, and test authorization boundaries with precision.
• Open source raises the standard for the security community
Tools born in the field often solve the problems practitioners actually face. By releasing ZANCUDO, VerSprite is contributing not only code, but operational knowledge shaped by hands on AppSec and IoT security research.
At VerSprite, this reflects how we approach cybersecurity: understand the system, model the threat, test with discipline, and share meaningful capability back with the community.
ZANCUDO is more than a proxy. It is a reminder that strong security research should make complex testing more accessible, repeatable, and useful for defenders, builders, and breakers alike.
Read the full blog and explore the project here:
hubs.la/Q04hVGTr0
#ApplicationSecurity #IoTSecurity #CybersecurityResearch #PenetrationTesting #EmbeddedSecurity #MQTT #OpenSourceSecurity #ThreatModeling #AppSec #VerSprite
3
6
89
May 23
「同じJSONを256件送ると約73%小さくなる」— MessagePackの次を狙う Twilic を公開しました！
zenn.dev/minagishl/articles/…
#zenn
1
7
547
May 21
🚨 THREAD | Threat Intelligence
We have identified KAIDO RAT v3.0, a sophisticated Remote Access Trojan variant with a strong focus on the Brazilian market, particularly the financial sector.
The threat uses a custom C2 framework, over 60 plugins, and an exclusive Brazilian banking suite.
Below, we detail its main observed capabilities.
Post 2/6
Web Panel and C2 Framework
•Headless server based on .NET 9
•“Lain” web panel featuring dashboard, client list, remote shell, and file manager
•HVNC with GPU capture support
•Remote Desktop webcam streaming
•Integrated builder KaidoKrypter (FUD)
•Loot browser isolated by operator and role
•Delivery methods: LNK Stomping, ClickFix, and HTML Smuggling
High operator usability with emphasis on persistence and controlled data exfiltration.
Post 3/6
Evasion Modules (10 modules)
The variant includes advanced bypass techniques:
•ETW Patch (5 functions) and patchless AMSI Bypass via VEH2
•Direct Syscalls (Hell’s Gate Indirect)
•Sleep Obfuscation using XOR PAGE_NOACCESS
•Stack Spoofing, Thread Pool Execution, and Callback Execution (6 methods)
•PPID Spoofing, API Hashing, and Anti-VM with 19 checks
Strong capability to evade modern EDR solutions and virtualized environments.
Post 4/6
Exclusive Brazilian Banking Suite (8 plugins)
This is the most relevant module of the threat:
•Real-time Bank Detector covering 28 Brazilian banks
•Fullscreen overlay with 19 banking themes
•PIX Clipper (supports CPF, CNPJ, email, EVP, and copy-paste)
•EMV QR Poisoner (rewrites QR Code and recalculates CRC16)
•PIX Ghost via UI Automation (no clipboard usage)
•Screen Locker (locks keyboard, mouse, and Task Manager)
•Selective keylogger that only activates inside banking windows
•Notification Silencer
Direct risk to the PIX ecosystem and Open Banking.
Post 5/6
Stealers, Reconnaissance and Post-Exploitation
Stealers (18 features):
Cookies from 23 browsers, passwords, tokens (Discord, Telegram, Steam, Spotify), sessions (WAL lock bypass), NTLM hashes, in-memory LSASS dumping, crypto wallets (13 extensions MetaMask), SSH/RDP/Cloud access, ICP-Brasil A1 certificates with private keys, and Open Banking access for 12 banks.
Reconnaissance (7 modules): Network Mapper, VPN Detector, Document Radar, Form Phantom CDP, DB Dumper (SQL Server SQLite), Certificate Store Enumeration, and Crypto Memory Drainer.
Post-Exploitation (9 modules): EDR Killer v2.0 (no PowerShell/cmd), UAC Bypass (3 methods), LPE exploits including miniPlasma and CVE-2026-40369, Kerberoasting AS-REP Roasting, COM Hijack persistence, and Process Hollowing.
Post 6/6
AI Targeting Infrastructure Recommendation
AI Targeting (5 modules):
Credential harvesting targeting Anthropic, OpenAI, Gemini, xAI, and Groq. Implants via Claude CLI C2 (Discord/Telegram), MCP Hijack on Claude Desktop, Git Hook Implant, and Jupyter IPython Startup Hook.
Infrastructure:
.NET 9 headless server, .NET 4.8 client, single DLL plugins (~7MB), AES-256-CBC crypter with native stub and ML evasion, 6-pass obfuscator, TLS-based C2 with MessagePack and jitter, Discord token Pastebin fallback, and nginx socat redirector.
Recommendation:
Financial institutions, fintechs, and organizations handling PIX or ICP-Brasil should strengthen behavioral detection, review EDR policies, and monitor social engineering techniques such as ClickFix and HTML Smuggling.
We will continue monitoring the evolution of this threat.
#KAIDORAT #RAT #Malware #Cybersecurity #PIX #OpenBanking #ThreatIntelligence #InfoSec #Brazil
1
18
94
7,923
May 18
自作バイナリフォーマット「Twilic」、MessagePack より 72% 小さいデータが出た！
MessagePack: 19,505 bytes
Twilic: 5,316 bytes ← 自作
スキーマを動的共有してキーを丸ごと省く設計なので、同構造のデータが続くほど効く
#TypeScript #自作ツール
3
6
24
2,157