Risk – Trackr.Live

§ Tag

GRIDTIDE’s C2 Is a Google Sheet You Don’t Own. Your Workspace Audit Log Is Blind to It

UNC2814’s GRIDTIDE backdoor runs command-and-control through an attacker-controlled Google Sheet — reached via the attacker’s own service account and Cloud project, not the victim’s Workspace tenant — so the victim’s Workspace audit logs never see it. The detection has to come from egress and the host, and the real fix is default-deny outbound from your server tiers.

Static Tundra Pulls Your Startup-Config Over Smart Install. The Switch That Leaks It Breaks Its Own Audit Trail

FSB Center 16’s Static Tundra crew is still working a 2018 Cisco Smart Install bug to steal startup-configs from end-of-life gear, then modifying TACACS+ so the box stops narrating the theft. The detection has to live off the device.

Cyber Tools

Your Edge Router Is Someone Else’s Exit Node. UAT-7810 Conscripts It With an n-Day, and the IOCs Have a 31-Day Shelf Life

A China-nexus actor is compromising unpatched Ruckus edge gear (and, via associated infrastructure, ASUS AiCloud) to build relay meshes for other APTs — and the published network IOCs can rot in as little as a month. The durable defense is edge-device hygiene and relay-behavior detection over blocklists.

A Wildcard in Your OIDC Trust Policy Trusts Every Repo in the Org. CloudTrail Logs the One That Used It

GitHub-to-AWS keyless auth moved secrets out of your CI, but the sub-claim wildcard most trust policies ship with trusts far more than the author intended. Here is what the detection actually looks like in CloudTrail, and why your allowlist breaks in July 2026.

CVE-2026-3055 Bleeds Session Tokens Your NetScaler Barely Logs. The Detection Lives Off the Box

The NetScaler memory-overread class has a third sequel. CVE-2026-3055 leaks session tokens through an endpoint the appliance barely logs — so its own logs won’t prove you’re clean, and the detection has to move upstream to the response size and downstream to the reused token, while patching does nothing to the sessions already bled.

Cyber Tools

The IKEv1 Bypass Is Client-Controlled. Check Point Logs the Login, Not the Vendor ID That Forged It

CVE-2026-50751 lets an unauthenticated client flip a Check Point gateway’s certificate-verification flag using a crafted IKEv1 vendor ID payload. The catch for defenders: the forged payload isn’t in your normal VPN security logs. The only artifact is a VPN session that came up when it shouldn’t have.

Your Device Code Flow Alert Fires on Every az login. The Signal Is the Broker Token, Not the Prompt

Device code phishing doesn’t defeat MFA — it redirects a legitimately MFA-completed sign-in — and the naive detection drowns in legitimate CLI traffic. The durable signal is the Authentication Broker redemption and the device registration that follows, and the real fix is a Conditional Access authentication-flows block.

ESXi Can Write Its Logs to a RAM Disk. Ransomware Counts on It

On an ESXi host without persistent scratch, /var/run/log lives on an in-memory ramdisk and evaporates at the next boot. Ransomware crews get the same effect for free — they power off, kill, or reboot the workloads before encrypting — which means your entire forensic timeline had to be forwarded off-box before the incident or it never existed at all.

A Federated Identity Credential Adds No Secret. Your Service Principal Persistence Alert Never Fires

Most SOCs detect service principal persistence by watching for “Add service principal credentials.” Federated identity credentials reach the same persistence with a different audit operation, on a different object, sometimes in a log source you never ingested.

Strong Certificate Mapping Only Helps If the CA Owns the SID. ESC16 Takes It Away

Microsoft’s strong certificate mapping enforcement finally landed, and where it’s genuinely in force it does close the naive implicit-mapping hole that made ADCS escalation trivial — a certificate with only a weak name is denied. ESC16 strips the CA-issued SID so the mapping decision falls to whatever’s left: on a compatibility-mode DC that’s weak SAN mapping, and even on a fully-enforced DC it’s an attacker-supplied SID-in-SAN URI the KDC treats as strong. The audit events you’d hunt it with are off by default.