Upgrade your professional AV and monitoring projects with the FDVTR1003A 1-channel video installation kit!

This ST multimode fiber optic kit ensures reliable performance for security systems, integrator deployments, and single-channel video setups.

Perfect for seamless video conversion and rackmount installations.

Order today: https://www.versitron.com/products/fdvtr1003a-1channel-digital-fiber-optic-video-converter-installation-kit-1

#VideoKit #FiberVideo #AVIntegration #SystemIntegrator #SecurityMonitoring

Operational disruption alert.
Reddit faced a global outage, 15,000+ rapid reports, mobile app impact at 64%, CDN-origin connectivity errors observed.

Security-adjacent considerations:
• Traffic surge management gaps
• CDN dependency risk
• Authentication system resilience
• Opportunistic phishing during downtime
• Brand impersonation spikes during trending outages

When high-traffic platforms fail, attackers often exploit confusion windows.

Did you observe increased malicious domain registrations or phishing attempts during #RedditDown?

Source: https://www.newsx.com/tech-and-auto/reddit-hit-by-major-global-outage-over-15000-users-report-issues-as-company-admits-elevated-error-rates-war-news-174980/

Engage below.
Follow TechNadu for infrastructure, outage intelligence, and cybersecurity insights.
Repost to expand situational awareness.

#Infosec #PlatformOutage #ThreatIntel #CloudSecurity #CDN #SRE #DigitalInfrastructure #CyberRisk #IncidentResponse #ServiceDisruption #SecurityMonitoring #AdTechSecurity

NIS2 requires fast incident reporting. Infosec K2K delivers real-time monitoring and structured response to meet 24-hour compliance and reduce risk across critical business operations.

#NIS2 #IncidentReporting #SecurityMonitoring #CyberCompliance #InfosecK2K

This Punchbowl Phish Is Bypassing 90% Of Email Filters Right Now

997 words, 5 minutes read time.

If you have had three different analysts escalate the exact same email in your ticketing system in the last 72 hours, this one is for you.

This is not a Nigerian prince scam. This is not a fake Amazon order. This is right now, this week, the most successful, most widely distributed phishing campaign running on the internet. And almost nobody is talking about just how good it is.

What this scam actually is

You get an email. It looks exactly like an invitation from Punchbowl, the extremely popular digital invite and greeting card service. There’s no misspelled logo. There’s no broken grammar. There is absolutely nothing that jumps out as fake.

It says someone has invited you to a birthday party, a baby shower, a retirement. At the very bottom, there is one single line that almost everyone misses:

For the best experience, please view this invitation on a desktop or laptop computer.

If you click the link, you do not get an invitation. You get malware. As of this week, the payload is almost always a variant of Remcos RAT, which gives attackers full unrestricted access to your device, full keylogging, and the ability to dump all credentials and move laterally across your network.

And every single mainstream warning about this scam has completely missed the most important detail. That line about the desktop? That is not a throwaway line. That is deliberate, extremely well researched threat actor tradecraft.

Nearly all modern mobile email clients automatically rewrite and sandbox links. Most endpoint protection does almost nothing on desktop by comparison. The attackers know this. They are actively telling you to defeat your own security for them. And it works.

Why this is an absolute nightmare for security teams

Let me give you the numbers that no one is putting in the official advisories:

• As of April 2025, this campaign has a 91% delivery rate against Microsoft 365 E5. The absolute top tier enterprise email filter is stopping less than 1 in 10 of these.
• Most lure domains are less than 12 hours old when they are first used, so they do not appear on any commercial threat feed.
• This is not just targeting consumers. The campaign is now actively being sent to corporate inboxes, targeted at HR, finance and IT teams.
• Proofpoint reported earlier this week that this campaign currently has a 12% click rate. For context, the average phish has a click rate of 0.8%.

I have seen CISOs, SOC managers and professional penetration testers all admit publicly this week that they almost clicked this link. If you look at this and don’t feel even the tiniest urge to click, you are lying to yourself.

This is what good phishing looks like. This is not the garbage you send out in your monthly phishing simulation with the obviously fake logo. This is the stuff that actually works.

How to not get burned

I’m going to split this into two sections: the advice for end users, and the actionable stuff you can implement as a security professional in the next 10 minutes.

For everyone

• Real Punchbowl invites will only ever come from an address ending in @punchbowl.com. There are no exceptions. If it comes from anywhere else, delete it immediately.
• Any email, from any service, that tells you to open it on a specific device is a scam. Full stop. There is no legitimate service on the internet that cares what device you use to open an invitation. This is now the single most reliable red flag for active phishing campaigns.
• Do not go to Punchbowl’s website to “check if the invite is real”. If someone actually invited you to something, they will text you to ask if you got it.

For SOC Analysts and Security Teams

These are the steps you can go and implement right now before you finish reading this post:

1. Add an email detection rule for the exact string for the best experience please view this on a desktop or laptop. At time of writing this rule has a 0% false positive rate.
2. Temporarily increase the reputation score for all newly registered domains for the next 14 days.
3. Add this exact lure to your phishing simulation program immediately. This is now the single best baseline test of how effective your user training actually is.
4. If you get any reports of this being clicked, assume full device compromise immediately. Do not waste time triaging. Isolate the host.

Closing Thought

The worst part about this scam is how predictable it is. We have all been talking for 15 years about how the next big phish won’t have spelling mistakes. We all said it will look perfect. It will be something you actually expect. And now it’s here, and it is running circles around almost every security stack we have built.

If you see this email, report it. If you are on shift right now, go push that detection rule. And for the love of god, stop laughing at people who almost clicked it.

Call to Action

If this breakdown helped you think a little clearer about the threats out there, don’t just click away. Subscribe for more no-nonsense security insights, drop a comment with your thoughts or questions, or reach out if there’s a topic you want me to tackle next. Stay sharp out there.

D. Bryan King

Sources

• Krebs on Security: Fake Punchbowl Invites Are Delivering Malware
• CISA Advisory AA25-086A: Fake Punchbowl Phishing Campaign
• Mandiant: Analysis of the March 2025 Punchbowl Phishing Campaign
• Punchbowl Official Public Warning
• Bleeping Computer: Fake Punchbowl Party Invites Deploy Remcos RAT
• Proofpoint Threat Insight: Punchbowl Phishing Campaign
• MITRE ATT&CK T1566.001: Spearphishing Link
• Verizon DBIR 2025: Phishing Effectiveness

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

DORA requires rapid detection, classification, and reporting of ICT incidents. Infosec K2K strengthens IAM telemetry, access logging, and real-time monitoring to enable accurate impact analysis and compliant 24-hour reporting.

#DORA #IAM #SecurityMonitoring #InfosecK2K

Top Security Monitoring Companies for Businesses and Homes

Top Security Monitoring Companies 2025 Ranked

Best security monitoring companies ranked for 2025. Compare monitoring services, response times, & pricing ($200-$2,000 monthly). GCCTVMS 30-day free trial.

For More Details: https://gcctvms.com/top-security-monitoring-companies/

#SecurityMonitoringCompanies #SecurityMonitoring #MonitoringCompanies #SecurityServiceCompanies #SecurityMonitoringServices #BusinessSecurityMonitoring

Server Security Checklist — Essential Hardening Guide

Securing your servers isn’t optional — it’s your first line of defense against data breaches, ransomware, insider threats, and lateral movement. Use this checklist as a baseline for Linux, Windows, cloud, hybrid, or on-prem servers.

⸻

🔧 1. System & OS Hardening
• Keep OS & packages updated (apply security patches frequently).
• Remove / disable unused services & software.
• Enforce secure boot + BIOS/UEFI passwords.
• Disable auto-login and guest accounts.
• Use minimal OS images only (reduce attack surface).

⸻

🔐 2. Access Control
• Enforce strong passwords & MFA everywhere.
• Use RBAC & least privilege access.
• Disable root/Administrator login over SSH/RDP.
• Rotate credentials & keys regularly.
• Implement just-in-time access for privileged users.

⸻

🌐 3. Network Security
• Restrict inbound/outbound traffic via firewalls.
• Segment critical servers from general LANs/VLANs.
• Disable unused ports & protocols.
• Enable DoS/DDoS protection.
• Apply zero-trust network principles.

⸻

🔑 4. Secure Remote Access
• Use SSH key-based authentication (disable password login).
• Enforce VPN for admin access.
• Log & monitor all remote access sessions.
• Disable legacy protocols (Telnet, FTP, SMBv1).
• Require bastion/jump host for critical access.

⸻

📊 5. Logging & Monitoring
• Enable centralized logging (syslog / SIEM).
• Track failed login attempts & anomalies.
• Configure alerts for privilege escalation or config changes.
• Monitor log tampering.
• Retain logs securely for audits & forensics.

⸻

🔒 6. Data Protection
• Encrypt data at rest (LUKS, BitLocker, etc.).
• Encrypt data in transit (TLS 1.2+).
• Strict database access policies.
• Regular, offline, immutable backups.
• Test restore procedures (don’t assume backups work).

⸻

🔁 7. Application & Patch Management
• Keep middleware, frameworks, and apps patched.
• Delete default credentials & sample files.
• Enable code signing for software packages.
• Use secure coding practices (OWASP Top 10).
• Implement dependency scanning (Snyk, Trivy, etc.).

⸻

🛡️ 8. Malware & Intrusion Defense
• Deploy EDR/AV on endpoints.
• Enable IDS/IPS at network edge.
• Automatic vulnerability scans (schedule weekly/monthly).
• Monitor persistence techniques (cron, startup scripts).
• Block known malicious IP ranges & TLDs.

⸻

🏢 9. Physical & Cloud Security
• Restrict physical access to server racks/rooms.
• Enable provider security tools (AWS Security Groups, Azure NSG, IAM).
• Harden cloud images (CIS benchmarks).
• Review cloud logging & audit trails regularly.
• Disable unused cloud API keys / roles.

⸻

📜 10. Policy & Compliance
• Use CIS / NIST / ISO-27001 benchmarks.
• Track & document every access change.
• Force annual access reviews & key rotation.
• Perform regular security training for admins.
• Maintain disaster recovery & incident plans.

⸻

➕ Additional 5 Critical Controls (Advanced Hardening)

🧠 11. Privileged Access Management (PAM)
• Use jump hosts & session recording.
• Just-In-Time access for admins.
• Store keys in secure vaults (HashiCorp Vault, CyberArk).

🚨 12. Real-Time Threat Detection
• Use behavioral analytics → UEBA/XDR.
• AI-based anomaly detection recommended.
• Block suspicious IPs automatically.

🧪 13. Red Team & Pentesting
• Run regular internal pentests.
• Validate configuration weaknesses.
• Simulate phishing + lateral movement scenarios.

🧱 14. Container / VM Isolation
• Use AppArmor, SELinux, Seccomp profiles.
• Limit Docker socket access & root containers.
• Scan images before deployment.

📦 15. Automated Configuration Management
• Use IaC (Terraform, Ansible, Puppet) for repeatable and secure builds.
• Detect drift using compliance scanning.
• Version control all infrastructure.

⸻

🧠 Core Reminder

A server is only as secure as the team who maintains it.
Hardening isn’t one task — it’s an ongoing

#ServerSecurity #SystemHardening #InfoSec #CyberSecurity #BlueTeam
#DevSecOps #SysAdmin #ThreatDetection #AccessControl #NetworkSecurity
#LinuxSecurity #SecureArchitecture #RiskMitigation #SecurityChecklist
#CloudSecurity #InfrastructureSecurity #ZeroTrust #SecurityMonitoring

🌡️ Operating in extreme environments? Our Wide-Temperature Industrial Ethernet Switches ensure uninterrupted connectivity from -40°C to 85°C!

Whether it’s safe city projects, intelligent transportation, or perimeter monitoring — our switches deliver
✅ Industrial Grade-4 EMC protection
✅ Redundant DC power input
✅ IP40 protection & efficient aluminum heat dissipation

Perfect for #SmartCity #IndustrialIoT #VideoSurveillance #IT

#IndustrialEthernet #Networking #SecurityMonitoring #EthernetSwitch

One of our favorite things is to connect you with security professionals around the world, #FIRSTNorway is doing just that at the #TechnicalColloquium in Oslo! 🌎 We love a full house! 🏠 #ColdIncidentResponse #SecurityMonitoring

Why Your Security Team Needs Geographic Threat Intelligence Visualization 🗺️
Traditional security dashboards show you WHAT happened, but not WHERE it's happening or HOW threats are connected geographically. Your SOC analysts are drowning in isolated alerts while missing the bigger picture - attack campaigns that span multiple IPs and locations. This geographic blind spot is costing companies millions in delayed detection and response times.
🎯 Five Reasons to Use Geographic Threat Intelligence:
Faster Incident Response - See attack patterns immediately, not after hours of analysis
Better Resource Allocation - Focus security resources on high-risk geographic areas
Enhanced Threat Hunting - Spot attack campaigns across multiple IPs and locations
Improved Prioritization - Group related threats by geography and risk level
Better Communication - Show executives the threat landscape visually
Don't let your security team fight blind. Give them the geographic intelligence they need to win the battle against cyber threats.
#Cybersecurity #ThreatIntelligence #SOC #IncidentResponse #SecurityOperations #CyberDefense #ThreatHunting #SecurityAnalytics #InfoSec #CyberThreats #SecurityTools #DataVisualization #SecurityInnovation #CyberAwareness #SecurityLeadership #RiskManagement #SecurityMonitoring #ThreatDetection #CyberResilience #SecurityStrategy

https://chickenpwny.github.io/AzureOrder365/

Welcome Recon Wave as an organizing partner of the Honeynet Project Workshop 2025 in Prague!

Recon Wave is a powerful attack surface monitoring platform that requires no installation or internal access. From continuous risk tracking to subdomain takeover prevention, they help organizations stay ahead of threats before attackers do.

📅 June 2–4, 2025
📍 NTK, Prague
🔗 https://prague2025.honeynet.org

#Honeynet2025 #Cybersecurity #ThreatDetection #SecurityMonitoring #SOC #Deception

What if you could catch vulnerabilities before they cost millions? Discover how Wazuh seamlessly embeds security into every phase of DevSecOps, automating threat detection and compliance like never before. Curious about the game-changing integration?

https://thedefendopsdiaries.com/enhancing-devsecops-with-wazuh-a-comprehensive-guide/

#devsecops
#wazuh
#securitymonitoring
#threatdetection
#siem

Security Monitoring — Threat Modelling and Data Sources: https://detect.fyi/security-monitoring-threat-modeling-and-data-sources-fa216f3a206d

#SecurityMonitoring #threatmodeling #siem

Security Monitoring Antipatterns: https://www.infernux.no/SecurityMonitoringAntipatterns/

#securityarchitecture #SecurityMonitoring #antipatterns

Pitfalls of relying on eBPF for security monitoring (and some solutions): https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/

#ebpf #SecurityMonitoring

Recommendations for implementing an effective security monitoring strategy in AWS: https://cloudonaut.io/2023-08-04-aws-security-monitoring/

#aws #awssecurity #SecurityMonitoring

With regard to enterprise security monitoring, many folks agree that it's best to be able to monitor from the top down, passively gathering network telemetry from a SPAN port or network TAP.

While there is ETW, Sysmon DNS and network connection logs, and more, how much of an impact has it been to not have more verbose network telemetry available during your investigations?

#DFIR
#IncidentResponse
#SecurityMonitoring
#SOC

We got together with security professionals a while ago to talk about security monitoring strategies.

But could they be more effective if combined with robust risk scenarios, aligned to your organisation?

https://cydea.com/blog/the-link-between-risk-scenarios-and-detection-use-cases/

#PositiveSecurity #RiskManagement #SecurityMonitoring #RiskScenarios

We're getting into "silly season" at the end of the year. With that in mind, I've thought about the things I did in 2022 that I found most interesting, helpful, or potentially impactful.

First, there's the paper on #CTI-driven #ThreatHunting I wrote and presented on at several events:
https://www.gigamon.com/content/dam/resource-library/english/white-paper/wp-intelligence-driven-threat-hunting-methodology.pdf

Then, there was my @VirusBulletin paper on the #XENOTIME actor responsible for the #Triton event, which I thought was neat as a deep-dive into organizational relationships that get masked in our tracking a single "adversary:"
https://www.virusbulletin.com/uploads/pdf/conference/vb2022/papers/VB2022-Zeroing-in-on-XENOTIME-analysis-of-the-entities-responsible-for-the-Triton-event.pdf

On a personal front, I wrote up some prelimianry analysis on the #Industroyer2 attempted (?) #ICS #OT incident as part of the conflict in #Ukraine - and there are still some items raised there for which we don't have answers several months after the incident was discovered:
https://pylos.co/2022/04/23/industroyer2-in-perspective/

Finally, I wrote a blog for my employer diving into the idea of the #FalsePositive in #DetectionEngineering and #SecurityMonitoring that I think is helpful for analysts from #IR to the #SOC
https://blog.gigamon.com/2022/08/05/revisiting-the-idea-of-the-false-positive/

I need to think this over a bit, but look for something covering the most insightful work of others, from my perspective, from the past year!

Cynet Offers Free Threat Assessment for Mid-Sized and Large Organizations - Cynet Free Threat Assessment spotlights critical, exposed attack surfaces and provides actionable ... more: https://threatpost.com/cynet-offers-free-threat-assessment-for-mid-sized-and-large-organizations/153006/ #freethreatassessment #securitymonitoring #websecurity