[Replay] Painfully Persistent Problems: Weak Passwords

What happens when your entire security investment means nothing? In this episode, Brad and Spencer break down how ShinyHunters and related groups like Scattered Spider and Lapsus$ keep getting in through social engineering, no exploit required. They call your users posing as real IT staff, sometimes with AI voices tuned to sound local, and walk them into handing over session tokens and cookies. The attackers already have a session, so MFA and conditional access don’t stop them.Spencer shares a lab test where a compliant device conditional access policy was bypassed by replaying cookies from an exported HAR file. Brad explains why the SSO handoff to third-party SaaS apps like Salesforce and document management systems leaves you relying on weaker session security. The hosts also cover why these intrusions are so hard to see in logs and what defenders can do about it.In this episode:Who ShinyHunters are and why they focus on data extortion, not ransomwareHow vishing and AI voice masking make these calls convincingWhy attackers are after session tokens, not credentialsHow the SSO handoff to third-party SaaS apps sidesteps Microsoft protectionsWhy law firm DMS platforms are a top target for bulk data theftWhy stolen sessions rarely show up in Entra sign-in logs or SaaS login recordsUsing deception assets as high-fidelity, low-cost detectionAuthentication brokers and named locations as a mitigationWhy tenant reviews and purple teaming beat assumptionsNeed help testing whether your environment can withstand session token theft? SecurIT360 offers penetration testing, purple teaming, and offensive security services. Visit securit360.com to learn more.Work with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpovFollow Spencer on social ⬇Spencer's Links: https://spenceralessi.com

One dangerous permission in Active Directory can be all it takes for an attacker to turn a single compromised account into full control of your domain. On our internal pen tests, that one misconfiguration is often the first domino. Everything after it is blast radius.In this episode, Spencer and Brad explain why dangerous permissions pile up in the first place, why they stay hidden for years, and what happens downstream when nobody finds them. They also cover where to start cleaning things up without buying a single new tool.In this episode:Why permissions accumulate through decommissions, upgrades, vendor installs, and “temporary” fixes that never get undoneHow a Citrix install wizard that needed domain admin left behind an over-permissioned messHow employee turnover and lost tribal knowledge make old access riskier to touchWhy inherited permissions, nested groups, and object ownership keep risk out of sightWhy BloodHound can surface tens of thousands of attack paths in one environmentActive Directory vs. Entra, and why the size of your attack surface is the better questionThe downstream risks: privilege escalation, unauthorized access, lateral movement, and service account abuseHow attackers cause serious damage without ever reaching domain adminWhere to start: audit what broad groups like Domain Users, Authenticated Users, and Everyone can reach, beginning with your Tier 0 assetsFree tools to get started, including ADeleginator, PingCastle, Purple Knight, and BloodHoundWorried about what’s hiding in your Active Directory? SecurIT360’s internal penetration testing finds the dangerous permissions and attack paths before threat actors do. Reach out at securit360.com.Work with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpovFollow Spencer on social ⬇Spencer's Links: https://spenceralessi.com

200 episodes! Thank you to everyone who has listened, watched, and shared The Cyber Threat Perspective along the way. To mark the milestone, Brad Causey and Jordan Natter are back with Part 6 of our OWASP Top 10 series, breaking down A06: Insecure Design. These flaws show up when an application does exactly what it was designed to do, but nobody stopped to ask how that functionality could be abused. Brad and Jordan walk through what insecure design looks like in practice, share real-world war stories from pen tests and beyond, and explain how to catch these flaws before they ever reach production.In this episode:Why insecure design fell from #4 to #6 in the OWASP Top 10, and why that isn’t good newsRate limiting, user enumeration, and why secret questions are a no goHow a teenager’s AOL trial CD experiment turned into a careerAbusing rewards programs, group bookings, and first-purchase couponsTaking over insurance accounts using publicly available census dataPrevention through misuse cases, threat modeling, and DevSecOpsWhy a flaw caught in the design phase costs a fraction of one found in a pen testNeed web app pen testing? Visit https://securit360.comWork with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpovFollow Spencer on social ⬇Spencer's Links: https://spenceralessi.com

We’re halfway through the OWASP Top 10, and this one is a favorite. Brad Causey is joined by Jordan Natter, SecurIT360’s resident web app pen tester, to cover A05: Injection. They explain how injection flaws work, why it slipped two spots on the list but is no less dangerous, and what developers can do to shut it down.Along the way, they share real stories from the field. There’s a first-ever pen test that turned a blood drive gift card app into $25,000 in gift cards and a destroyed production database. There’s a harmless-looking hub status dropdown that became a reverse shell. And there’s a username field that handed over session cookies.In this episode:What injection is and why it can happen anywhere from the browser to the data layerReflected, stored, and DOM-based cross-site scripting, and how they differSQL, NoSQL, LDAP, and why no data layer is immune to injectionWhy injection moving to #5 doesn’t make it a lower priorityHow CSP, HttpOnly cookies, CSRF tokens, and SameSite attributes break attack chainsWhy client-side validation is a usability feature, not a security controlWhitelisting vs. blacklisting, parameterized queries, and output encodingThe case for never testing in production, and backing up your staging data tooResources mentioned: OWASP Input Validation Cheat Sheet and the OWASP Cheat Sheet SeriesNeed a web app pen test or have questions about application security? Reach out to the SecurIT360 team.Work with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpovFollow Spencer on social ⬇Spencer's Links: https://spenceralessi.com

It’s Cybersecurity Awareness Month, so we’re bringing back one of the most practical episodes in our catalog. Strong passwords are one of the basics of good security, but weak and reused credentials are still a common way attackers get in.In this episode, Brad and Spencer look at why weak passwords keep showing up in real-world compromises. They cover the habits and identity management gaps that cause them and what organizations can do to close those gaps.In this episode:Why weak passwords are still a painfully persistent problemHow poor password habits and identity gaps expose organizations to compromiseCommon mistakes attackers take advantage ofPractical defensive measures you can put in placeOriginally released November 2024.Sources:Verizon 2023 Data Breach Investigations Report: https://www.verizon.com/about/news/2023-data-breach-investigations-report1Password, Challenges of Shadow IT: https://blog.1password.com/challenges-of-shadow-it/Microsoft Digital Defense Report 2024: https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/microsoft-digital-defense-report-2024Links:Work with us: https://securit360.comBlog: https://offsec.blog/YouTube: https://www.youtube.com/@cyberthreatpovX/Twitter: https://x.com/cyberthreatpovSpencer Alessi: https://spenceralessi.coWork with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpovFollow Spencer on social ⬇Spencer's Links: https://spenceralessi.com

Users will get compromised. Someone will click the link, and credentials will get stolen. The question that really matters is what happens next.In this episode, Spencer and Brad walk through the Post-Compromise Risk Framework (PRID), a simple, repeatable way for IT and security teams to judge how exposed their environment is once an attacker gets in. Using a real-world-style ClickFix scenario involving "Susie in accounting," they trace how one compromised account can lead to lateral movement, credential dumping and sensitive data exposure. They also cover why so many of those steps go undetected.In this episode:Why the assume breach mindset is the best way to measure your securityPrivileges: what can a compromised user actually do?Reach: where can they go with that access?Impact: how bad would it be?Detection: would you even know it happened?How least privilege and network segmentation map to each stepWhy PS Remoting to a domain controller goes undetected nine times out of 10Why "that couldn't happen here" is not proof, and how to verify your controls"Inspect what you expect": testing your EDR instead of trusting itPick a user, assume they're compromised, and walk the path. You'll learn more about your environment, and you'll likely find issues you didn't know were there.Work with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpovFollow Spencer on social ⬇Spencer's Links: https://spenceralessi.com

One threat actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, using AI to run the same playbook at scale. The fastest path to domain admin took five minutes. But out of hundreds of organizations hit, the attacker only got domain admin at 12 of them.Spencer and Tyler use GreyNoise's recent PaperCut report to make the case that the basics matter more now than they ever have. The attack itself was not novel. It used a known vulnerability, a lab environment built to test exploits, an internet scanning service, and familiar offensive tools. AI (Codex and DeepSeek) is what took it from one target to hundreds.In this episode:How the attacker built a PaperCut and Active Directory lab to test exploits before going wideWhy five minutes to domain admin is fast but not unheard of, and how certificate abuse makes it possibleThe Conti playbook comparison, and how LLMs are turning attack playbooks into automated campaignsThe toolkit: Certify, Rubeus, SpoolSample, Impacket, NetExec, BloodHound, Mimikatz, and AMSI bypassesWhy letting hosts reach GitHub directly is a red flag, and how DNS and category filtering slow attackers downThe one case where Cloudflare's WAF stopped the attackWhy the 12 domain admin compromises are a hopeful sign that hardening worksWhere to start with AD hardening: tier zero permissions, dangerous rights on broad groups, service accounts, and certificate templatesMoving past EDR alone with application control, NDR, and identity-based detectionsComparing what a security tool costs to what a compromise costsSpencer and Tyler are penetration testers at SecurIT360.If you get something out of the show, subscribe and leave a rating or review. It helps more than you would think.Work with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpovFollow Spencer on social ⬇Spencer's Links: https://spenceralessi.com

One French-speaking hacktivist targeted 42 organizations and got internal access to 14 of them, working alone. That is the kind of detail Anthropic's September 2026 threat intelligence report put on the record, with data spanning December 2025 through August 2026. Spencer and Tyler walk through all six generative threat groups named in it and what actually changes for defenders.Their read: the attacks themselves are familiar. Stolen credentials, unpatched edge devices, exposed services, phishing, SQL injection. What AI changed is speed, automation, and scale, and that is enough to matter.In this episode:The skill floor for hacking has dropped, and solo operators are now running campaigns that used to take a teamThreat actors vibe coding phishing kits, credential dashboards, and custom toolingAutomated vulnerability discovery and exploit development, including one workflow that produced more than a dozen potential zero-day findings in a monthWhy older models with looser guardrails are showing up in operations while frontier models refuse the same requestsCustom harnesses and multi-agent pen testing frameworks that chain traditional offensive tools under an LLMStolen AI credentials and API keys as a high-priority target, plus resellers advertising discounted access to frontier modelsOn-the-fly obfuscation and retooling that breaks signature-based detectionWhy baselining, behavioral detection, application control, and external attack surface hygiene matter more than they did a year agoGroups covered: GTG-2006, GTG-50014, GTG-10007, GTG-50020, GTG-50021, and GTG-50029.Spencer and Tyler are penetration testers at SecurIT360. If you get something out of the show, subscribe and leave a rating or review. It helps more than you would think.Work with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpovFollow Spencer on social ⬇Spencer's Links: https://spenceralessi.com

Replay of Episode 178, originally published April 22, 2026.We are re-running this one because it is the question we get asked moston internal pen test debriefs: of everything on the list, what actuallyslows an attacker down? Spencer and Tyler answer it from the attackerside, using what has and has not stopped them on real engagements.What's covered:- Application control done right, including where ThreatLocker and WDAC  actually block a payload and where they get bypassed- MFA, the Protected Users group, and least privilege as attacker-facing  controls rather than compliance checkboxes- Why mismanaged admin privileges and service accounts remain the fastest  route from foothold to domain admin- Network segmentation and zero trust, and what separates a real  implementation from a diagram- Deception techniques and EDR baselining for catching activity that  looks legitimateIf you are deciding where the next dollar of your security budget goes,this is the episode that tells you what attackers hope you skip.Work with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpovFollow Spencer on social ⬇Spencer's Links: https://spenceralessi.com

Interested in a pen test? Visit securit360.com.Every organization has a Joe. He is the long tenured engineer or admin who built half the environment, maintains the other half, and keeps most of it in his head. Everybody depends on him and nobody wants to challenge him.Spencer and Tyler break down key man risk in IT, drawing on hundreds of internal pen tests across law firms, banks, credit unions, manufacturing, municipalities, and SaaS organizations.In this episode:Why tribal knowledge is a security risk, not just an operations problemHow word of mouth process handoffs turn into a game of telephoneThe reason remediations stall for an extra 30 daysShadow IT that originates inside the IT teamPrivilege creep and the single account that owns the environmentWhen Joe's resistance to change is the correct callCross training that does not add more work to Joe's plateIncentives, clear ownership, and update deadlines that actually stickSeparating fact gathering from decision making so seniority does not win by defaultThis is not a knock on senior admins. It is a look at the risk that accumulates when one person carries everything, and what IT leaders can do about it.All of our content can be found at Offsec.blog. Interested in a pen test? Visit securit360.com.Work with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpovFollow Spencer on social ⬇Spencer's Links: https://spenceralessi.com