Real-world cyber attacks, expert analysis, and the latest security trends from the IONSEC incident response team.https://www.ionsec.ioen-ushttps://www.ionsec.io/resources/ionsec-trace-ai-harness-forensicshttps://www.ionsec.io/resources/ionsec-trace-ai-harness-forensicsIONSEC TRACE is an open-source, forensically sound collector and analyzer for AI harness evidence — now shipping a Python CLI and a Go binary with near-identical capabilities, a 103-rule secret detector, and conversation secret hunting.Thu, 13 Aug 2026 00:00:00 GMTToolsopen-sourcedfirai-forensicsshadow-aivelociraptorsecret-detectionIONSEC DFIR Divisionhttps://www.ionsec.io/resources/xss2shell-wordpress-pre-auth-xss-to-rcehttps://www.ionsec.io/resources/xss2shell-wordpress-pre-auth-xss-to-rceCVE-2026-64638 is a reflected XSS on the WordPress login page — the finding most teams close as medium. Six gadgets sit between it and a PHP shell, and every one of them was already in core. Here is the chain, the log signatures, and what to harden after you patch.Fri, 07 Aug 2026 00:00:00 GMTArticleresearchthreat-intelligencewordpressweb-securityxssincident-responsecve-2026-64638IONSEC Teamhttps://www.ionsec.io/resources/xss2shell-wordpress-pre-auth-xss-to-rce-hehttps://www.ionsec.io/resources/xss2shell-wordpress-pre-auth-xss-to-rce-heCVE-2026-64638 היא חולשת XSS מוחזר בעמוד ההתחברות של וורדפרס — בדיוק הממצא שרוב הצוותים סוגרים כבינוני. בין החולשה הזו לבין הרצת PHP על השרת עומדים שישה שלבים נוספים, וכולם כבר היו בליבת המערכת. הנה השרשרת המלאה, חתימות הזיהוי בלוגים, וההקשחה שצריך לעשות אחרי העדכון.Fri, 07 Aug 2026 00:00:00 GMTArticleresearchthreat-intelligenceisraelwordpressweb-securityxssincident-responsecve-2026-64638IONSEC Teamhttps://www.ionsec.io/resources/ai-agent-runtime-forensicshttps://www.ionsec.io/resources/ai-agent-runtime-forensicsForensic readiness for AI agent runtimes — Cloudflare Computer, NVIDIA OpenShell, and the collapse of the endpoint as an evidence source.Tue, 04 Aug 2026 00:00:00 GMTArticledfiragentic-aiagent-runtimesevidence-engineeringNir Halfonhttps://www.ionsec.io/resources/coercion-to-krbtgt-ntlm-relay-and-adcs-esc8-in-2026https://www.ionsec.io/resources/coercion-to-krbtgt-ntlm-relay-and-adcs-esc8-in-2026A full ESC8 walkthrough against a lab domain, then the forensic reconstruction — why the certificate serial, not the source IP, is the artifact that ties the whole chain together.Fri, 24 Jul 2026 00:00:00 GMTArticleadcsesc8ntlm-relayactive-directorydfirthreat-intelligenceIONSEC Teamhttps://www.ionsec.io/resources/cloudflare-drop-60-minute-phishinghttps://www.ionsec.io/resources/cloudflare-drop-60-minute-phishingCloudflare Drop publishes a site on a trusted workers.dev address with no account, then deletes it after an hour. That one-hour fuse burns your forensic evidence with it.Fri, 17 Jul 2026 00:00:00 GMTBlogphishingcloudflaredetection-engineeringthreat-huntingincident-responseIONSEC Teamhttps://www.ionsec.io/resources/maes-the-m365-analyzer-extractor-suitehttps://www.ionsec.io/resources/maes-the-m365-analyzer-extractor-suiteAt IONSEC, we’re excited to introduce MAES: The M365 Analyzer & Extractor Suite — an open-source platform purpose-built to simplify and accelerate Microsoft 365 (M365) forensic investigations.Wed, 20 Aug 2025 00:00:00 GMTToolsopen-sourcedfirmicrosoft-365cloud-forensicsIONSEC Teamhttps://www.ionsec.io/resources/tikun13checkerhttps://www.ionsec.io/resources/tikun13checkerTikun13 Checker הוא כלי קוד פתוח, מבוסס דפדפן, שפותח על ידי IONSEC כדי לסייע לארגונים בישראל ליישם את דרישות תיקון 13 לחוק הגנת הפרטיות.Sun, 17 Aug 2025 00:00:00 GMTToolsopen-sourcecomplianceprivacytikun-13israelIONSEC Teamhttps://www.ionsec.io/resources/do-audit-log-scraper-v2-0https://www.ionsec.io/resources/do-audit-log-scraper-v2-0The DO Audit Log Scraper is a Chrome/Chromium extension that enables forensic-grade audit log extraction.Mon, 11 Aug 2025 00:00:00 GMTToolsopen-sourcedfiraudit-logsdigitaloceanIONSEC Teamhttps://www.ionsec.io/resources/flareinspecthttps://www.ionsec.io/resources/flareinspectFlareInspect is a CLI-based assessment framework designed to revolutionize how organizations evaluate and monitor their Cloudflare security posture.Sun, 03 Aug 2025 00:00:00 GMTToolsopen-sourcecloudflarecloud-securitysecurity-assessmentIONSEC Teamhttps://www.ionsec.io/resources/forti-dfir-open-source-framework-for-fortinet-forensics-incident-responsehttps://www.ionsec.io/resources/forti-dfir-open-source-framework-for-fortinet-forensics-incident-responseAt IONSEC, we’re proud to introduce Forti-DFIR — an open-source initiative created to give security teams the tools they need for forensic investigations and incident response in Fortinet environments.Fri, 01 Aug 2025 00:00:00 GMTToolsopen-sourcedfirfortinetnetwork-forensicsincident-responseIONSEC Teamhttps://www.ionsec.io/resources/when-research-meets-realityhttps://www.ionsec.io/resources/when-research-meets-realityHow Threat-Actor Campaigns Cast a Shadow on Legitimate npm Binaries (and What IONSEC IR Sees in the wild)Sun, 06 Jul 2025 00:00:00 GMTCase Studysupply-chainnpmthreat-intelligenceincident-responseIONSEC Teamhttps://www.ionsec.io/resources/how-a-weaponized-zoom-installer-opened-the-door-for-bluenoroffhttps://www.ionsec.io/resources/how-a-weaponized-zoom-installer-opened-the-door-for-bluenoroffIONSEC investigates a BlueNoroff intrusion that began with a weaponized Zoom installer, combining deepfakes, social engineering and evasive scripting.Thu, 03 Jul 2025 00:00:00 GMTCase Studybluenoroffaptsocial-engineeringincident-responsemacosIONSEC Teamhttps://www.ionsec.io/resources/iranian-threat-actor-hijacks-dnshttps://www.ionsec.io/resources/iranian-threat-actor-hijacks-dnsקבוצת התקיפה האיראנית פתח אלקודס פרצה לרשם דומיינים ישראלי ושינתה רשומות DNS ו-MX של יותר מ-1,000 דומיינים, והפנתה אותם לשרת זדוני ולדף תעמולה.Wed, 02 Jul 2025 00:00:00 GMTCase Studydns-hijackingiranaptincident-responseisraelIONSEC Teamhttps://www.ionsec.io/resources/ransomprotect---open-source-defense-against-ransomware-wipershttps://www.ionsec.io/resources/ransomprotect---open-source-defense-against-ransomware-wipersRansomProtect is our open-source tool that detects and blocks ransomware and wipers early in the infection chain, where built-in OS defenses fall short.Tue, 01 Jul 2025 00:00:00 GMTToolsopen-sourceransomwarewiperendpoint-securityIONSEC Teamhttps://www.ionsec.io/resources/ionsec-at-the-improvate-ciso-summithttps://www.ionsec.io/resources/ionsec-at-the-improvate-ciso-summitTwo months ago, IONSEC had the privilege of participating in the CISO Summit by IMPROVATE — a premier platform for connecting with Israel’s leading cybersecurity executives and security professionals.Mon, 30 Jun 2025 00:00:00 GMTNewseventsconferencecisoIONSEC Teamhttps://www.ionsec.io/resources/gisec-2025https://www.ionsec.io/resources/gisec-2025IONSEC is proud to showcase an exclusive preview of our next-generation Digital Forensics and Incident Response (DFIR) platform at GISEC Global 2025, one of the world’s premier cybersecurity events in Dubai.Tue, 06 May 2025 00:00:00 GMTNewseventsgisecconferenceIONSEC Teamhttps://www.ionsec.io/resources/why-malware-analysis-training-is-vital-lessons-from-real-world-cyber-attackshttps://www.ionsec.io/resources/why-malware-analysis-training-is-vital-lessons-from-real-world-cyber-attacksPicture this: airport metal detectors efficiently catch large, obvious weapons, but small components slip through unnoticed. Once inside, attackers assemble them into a complete weapon.Wed, 11 Dec 2024 00:00:00 GMTArticlemalware-analysistrainingawarenessincident-responseIONSEC Teamhttps://www.ionsec.io/resources/ionsec-at-hackexpo-2024---breach-at-the-frontlinehttps://www.ionsec.io/resources/ionsec-at-hackexpo-2024---breach-at-the-frontlineAt HackExpo 2024, IONSEC CEO Nir Halfon shared practical strategies for responding to exploits in fintech first-party applications under live pressure.Thu, 28 Nov 2024 00:00:00 GMTNewseventsconferenceincident-responsefintechIONSEC Teamhttps://www.ionsec.io/resources/reverse-engineering-godpotato-msascui-exehttps://www.ionsec.io/resources/reverse-engineering-godpotato-msascui-exePrivilege escalation is a critical technique employed by attackers to gain unauthorized access to higher system privileges, often leading to significant security breaches.Sun, 10 Nov 2024 00:00:00 GMTBlogreverse-engineeringprivilege-escalationwindowsmalware-analysisIONSEC Teamhttps://www.ionsec.io/resources/clearing-the-mist-unveiling-fog-ransomwarehttps://www.ionsec.io/resources/clearing-the-mist-unveiling-fog-ransomwareA full analysis of the Fog Ransomware Group: the malware it deploys, the TTPs it relies on to infiltrate high-tech firms, and how defenders can disrupt it.Sun, 25 Aug 2024 00:00:00 GMTBlogransomwaremalware-analysisthreat-intelligencettpsIONSEC Teamhttps://www.ionsec.io/resources/ionsec-joins-the-3rd-mirror-forum-with-incdhttps://www.ionsec.io/resources/ionsec-joins-the-3rd-mirror-forum-with-incdOn June 28, IONSEC proudly participated in the third MIRROR Forum — a unique gathering of 15 Incident Response (IR) companies across Israel, convened by the Israel National Cyber Directorate (INCD).Fri, 28 Jun 2024 00:00:00 GMTNewseventsincdcollaborationIONSEC Teamhttps://www.ionsec.io/resources/ionsec-shares-wiper-malware-research-with-czech-delegation-in-israelhttps://www.ionsec.io/resources/ionsec-shares-wiper-malware-research-with-czech-delegation-in-israelIONSEC hosted a Czech delegation in Israel to present our Wiper malware research, including the campaign we track as Operation HANDALA.Sun, 02 Jun 2024 00:00:00 GMTNewswipermalware-analysisoperation-handalathreat-intelligenceeventsIONSEC Teamhttps://www.ionsec.io/resources/ionsec-at-gpec-2024---showcasing-apt-research-on-the-global-stage-98do0-brms0https://www.ionsec.io/resources/ionsec-at-gpec-2024---showcasing-apt-research-on-the-global-stage-98do0-brms0Wow — what a journey GPEC (General Police Equipment Exhibition & Conference) was this year. Standing among 471 exhibitors from 32 different countries was nothing short of inspiring. The scale, the diversity, and the energy of the event made it a true highlight of 2024.Wed, 08 May 2024 00:00:00 GMTNewseventsconferenceaptthreat-intelligenceIONSEC Teamhttps://www.ionsec.io/resources/sovateam---new-state-sponsored-apthttps://www.ionsec.io/resources/sovateam---new-state-sponsored-aptHow IONSEC and White-Hat traced the Sova Team threat actor through a ransom note to uncover a state-sponsored APT operating past strict security controls.Sun, 31 Mar 2024 00:00:00 GMTBlogaptransomwarethreat-intelligenceincident-responseIONSEC Teamhttps://www.ionsec.io/resources/sqyrh-mvdy-ynyt-2024-opisraelhttps://www.ionsec.io/resources/sqyrh-mvdy-ynyt-2024-opisraelIONSEC הינה חברת בוטיק לשירותי אבטחת מידע ותגובה לאירועי סייבר (24/7) העוסקת במחקר ותגובה לאיומים מתקדמים ומספקת פתרונות אבטחה מותאמים אישית לחברות ברחבי העולם.Sun, 24 Mar 2024 00:00:00 GMTBlogopisraelthreat-intelligencehacktivismisraelIONSEC Team