BI.ZONE

Avito and BI.ZONE Launch Cyberdetective CTF for Non-Technical Employees Focused on Phishing and Social Engineering

Avito's Security Awareness team, in partnership with BI.ZONE, created the Cyberdetective jeopardy-style CTF competition specifically for non-technical staff who do not write code. The three-day event targeted 104 registered participants, with 44 completing tasks and 16 achieving maximum scores across scenarios involving phishing, OAuth consent abuse, file metadata analysis, and prompt injection. Tasks awarded flags not only for investigation but also for refusing risky actions such as granting excessive application permissions or clicking suspicious links. The design incorporated MITRE ATT&CK techniques including T1566.002 Spearphishing Link, T1528 Steal Application Access Token, and T1204.004 Malicious Copy and Paste. Organizers emphasized indirect hints to help participants recognize when an object required action, avoiding the common barrier where employees fail to understand that a strange string or domain needs examination. Feedback highlighted the value of hands-on decision-making over passive lectures, though some technical employees completed the set rapidly.

BI.ZONE Mail Security 3.0 Enhances Detection of Password-Protected Archives and Spam Variants

BI.ZONE has released Mail Security 3.0, introducing new mechanisms to detect email threats and improved tools for administrators. The updated system now assigns additional risk scores to password-protected archives when their contents cannot be unpacked, without automatically classifying the archive itself as malicious. It also compares message texts to identify near-identical emails used in spam campaigns where attackers slightly alter wording to evade filters. Administrators can now incorporate SPF and DKIM verification results into delivery rules to better distinguish legitimate senders from impersonators. According to BI.ZONE statistics, phishing accounted for 90 percent of illegitimate email traffic in the first half of 2026. Additional protections include CAPTCHA challenges after repeated failed login attempts on administrative accounts. The release also adds bulk management of rules, improved logging with a side panel for message details, a new Events section, and Syslog export to external SIEM systems.

SCCM Misconfigurations Expose Organizations to Full Infrastructure Takeover

BI.ZONE expert Alexander Kuznetsov details how Microsoft Configuration Manager (SCCM) deployments in 25% of Russian organizations can grant attackers complete control over corporate infrastructure when misconfigured. The article outlines critical risks including administrative privilege escalation, lateral movement, data collection, persistence, and policy manipulation that allow attackers to blend with legitimate maintenance operations. Key recommendations focus on infrastructure isolation, placing Site Server, SMS Provider, and Site Database Server roles in Tier 0 segments, and avoiding single SCCM hierarchies across multiple Active Directory forests or security tiers. The report emphasizes eliminating Network Access Account (NAA) usage in favor of HTTPS or Enhanced HTTP, strictly limiting Client Push Account and domain join account privileges, and auditing computer accounts for site servers. Additional guidance covers PXE deployment risks, database access restrictions, and role-based administrative controls to prevent credential extraction via tools such as SharpSCCM and mimikatz. Overall, the publication provides actionable hardening steps aligned with the principle of least privilege to reduce the attack surface of widely deployed SCCM environments.

2.2 Million Line Vulnerability Report: What Happens After Discovery and How to Turn Findings Into Action

A massive vulnerability scan produced an 1,819-page report and a 2.2-million-row Excel file that exceeded spreadsheet limits, highlighting the gap between detection and remediation. The article explains that finding vulnerabilities accounts for only 10 percent of the work, while the remaining 90 percent involves prioritization, remediation, verification, and ensuring issues do not reappear. Research from BI.ZONE, Sber, Qualys, Cyentia Institute, Kenna Security, and Hadrian shows that organizations can typically remediate only one in ten open vulnerabilities per month and that Time-to-Exploit has dropped dramatically, with many edge-device flaws exploited on the day of disclosure. The piece stresses that continuous scanning, full infrastructure coverage including shadow IT, and separate high-frequency perimeter scans are essential because 85 percent of KEV-vulnerable assets remain unpatched at disclosure time. It recommends replacing bulky reports with concise, role-specific registries that answer four questions: what to do, where to do it, by when, and the consequences of inaction. Three legitimate outcomes for every vulnerability are outlined: patching, compensating controls, or formal risk acceptance with defined review dates, while false positives such as orphaned OpenSSL libraries must be cleaned rather than ignored.