Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders.
Summary: Cisco Talos reported an increase in high-sophistication attacks on network infrastructure, with threat actors running commands such as 'show config,' 'show interface,' 'show route,' 'show arp table' and 'show CDP neighbor' to orient themselves after gaining a foothold. Thinkst gives away free canary tokens that alert when lures such as fake AWS keys, DNS hostnames, sensitive Windows commands or Excel and Word files are touched, and founder Haroon Meer said attackers who land on a server and find a cloud key find it hard not to try it once.
What you should know: Meer's point is that the difference is between catching a compromise in week one, before attackers dig in, and learning about the attack on CNN - and the tripwires that buy that time are free.
Read the original at Krebs on Security ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026