Escalation to L2 on bubka hacks stuff

LD-Lumma Stealer - DLL Side-Loading via Click Fix Phishing

Tue, 14 Apr 2026 00:00:00 +0000

A Click Fix phishing email impersonating Microsoft lured Dylan into visiting a malicious site, which executed a disguised PowerShell command launching mshta.exe to download Lumma Stealer payload from overcoatpassably.shop. The host was contained before confirmed data exfiltration.

LD-Malicious Macro Executed

Tue, 14 Apr 2026 00:00:00 +0000

A phishing email from jake.admin@cybercommunity.info delivered a ZIP-archived Word macro document, which executed a PowerShell downloader fetching messbox.exe from greyhathacker.net. The host Jayne was contained after execution was confirmed.

LD-Possible IDOR Attack Detected

Thu, 02 Apr 2026 00:00:00 +0000

External IP enumerated the /get_user_info/ endpoint via sequential IDOR requests, all returning HTTP 200 - confirming successful data exfiltration across five user accounts.

LD-Whoami Command Detected in Request Body

Thu, 02 Apr 2026 00:00:00 +0000

An external attacker from a CHINANET-hosted IP (61.177.172.87) exploited a command injection vulnerability on WebServer1004, executing five OS commands via the ?c= parameter against /video/ - including cat /etc/passwd and cat /etc/shadow - all of which returned HTTP 200 with distinct response sizes, confirming successful remote code execution. The case was escalated to Tier 2.

LD-Arbitrary File Read on Checkpoint Security Gateway (CVE-2024-24919)

Tue, 31 Mar 2026 00:00:00 +0000

An attacker exploited CVE-2024-24919 against a Check Point Security Gateway, successfully reading /etc/passwd via a path traversal payload. A second request targeting /etc/shadow from a related IP was blocked. The attack succeeded and the endpoint was escalated to Tier 2.

LD-CVE-2025-53770 SharePoint ToolShell Auth Bypass and RCE

Sun, 22 Mar 2026 00:00:00 +0000

An attacker exploited CVE-2025-53770 against a SharePoint server, achieving unauthenticated RCE via .NET deserialization. The attacker extracted the MachineKey, compiled and dropped a payload, planted a webshell in the SharePoint layouts directory, and established a reverse connection to the attacker-controlled server.

LD-Deceptive Mail Detected

Tue, 17 Mar 2026 00:00:00 +0000

A phishing email with a password-protected ZIP delivered AsyncRAT via a SILENTBUILDER dropper. The victim executed the payload, establishing an active C2 channel and triggering full host reconnaissance before containment.