https://umbrasec.dev/research/ Independent defensive security research - detection engineering, threat analysis, and open-source tooling. en-us Sat, 20 Jun 2026 12:00:00 +0000 https://umbrasec.dev/research/safepay-australian-smb.html https://umbrasec.dev/research/safepay-australian-smb.html Sat, 20 Jun 2026 12:00:00 +0000 Threat Analysis SafePay is a centralized (non-RaaS) ransomware crew now claiming Australian victims, and real-estate SMBs fit its target profile almost perfectly: data-rich, cash-handling via trust accounts, thinly defended, and spread across franchise offices under one brand. The playbook stage by stage - unpatched edge devices, infostealer-harvested logins reused over RDP/VPN, PsExec/WinRM movement, rclone and FileZilla exfiltration, backup and shadow-copy deletion - mapped to the Essential Eight controls that break each link. Built entirely from public vendor reporting, naming no individual victim. https://umbrasec.dev/research/inc-ransom-australian-smb.html https://umbrasec.dev/research/inc-ransom-australian-smb.html Mon, 15 Jun 2026 12:00:00 +0000 Threat Analysis INC Ransom is a ransomware-as-a-service crew actively claiming Australian victims, and the firms it lands on look a lot like a typical SMB. The affiliate playbook stage by stage - phishing, unpatched edge devices, bought credentials, living-off-the-land movement, commodity exfiltration with rclone and MEGAsync - mapped to the Essential Eight controls that break each link in the chain. Built entirely from public reporting, including the ACSC/CERT NZ advisory. https://umbrasec.dev/research/securing-ai-agents.html https://umbrasec.dev/research/securing-ai-agents.html Sun, 14 Jun 2026 12:00:00 +0000 AI & LLM Security A chatbot that gets prompt-injected says something wrong; an agent that gets prompt-injected does something wrong. The agent threat surface - excessive agency, indirect injection via tool output, the MCP supply chain, the confused-deputy identity problem - what to log, and the detections and containment architecture that keep one bad instruction from becoming an incident. https://umbrasec.dev/research/detecting-litellm-command-injection.html https://umbrasec.dev/research/detecting-litellm-command-injection.html Sat, 13 Jun 2026 12:00:00 +0000 Detection Engineering CVE-2026-42271 turns LiteLLM's MCP preview endpoints into authenticated command execution on the proxy host, and chains with the Starlette "BadHost" bug (CVE-2026-48710) into unauthenticated RCE. In CISA KEV and actively exploited - the mechanism at a defender's depth, what to log, and two runnable Sigma rules with tuning notes. https://umbrasec.dev/research/owasp-llm-top-10-for-defenders.html https://umbrasec.dev/research/owasp-llm-top-10-for-defenders.html Thu, 11 Jun 2026 12:00:00 +0000 AI & LLM Security The OWASP LLM Top 10 read as a defender's checklist: why prompt injection has no patch, the "lethal trifecta" behind incidents like EchoLeak (CVE-2025-32711), what to log in LLM-integrated apps, and canary, egress, and behavioral detections you can deploy today. https://umbrasec.dev/research/detecting-oauth-consent-phishing.html https://umbrasec.dev/research/detecting-oauth-consent-phishing.html Thu, 11 Jun 2026 12:00:00 +0000 Detection Engineering The phishing class that never asks for a password and sails through MFA - illicit OAuth consent grants (MITRE ATT&CK T1528) in Microsoft Entra ID, the audit-log artifacts they leave, and KQL detections with tuning notes. https://umbrasec.dev/research/detecting-kerberoasting.html https://umbrasec.dev/research/detecting-kerberoasting.html Wed, 10 Jun 2026 12:00:00 +0000 Detection Engineering How Kerberoasting (MITRE ATT&CK T1558.003) works, why RC4 service tickets give it away, and three layered Sigma detections - RC4 downgrade, request fan-out, and a honeypot SPN - with tuning and false-positive notes you can run against your own logs.