Censys

Censys Exposes DarkSword iOS Exploit Platform and Coruna Crypto Wallet Stealer

Censys has disclosed the inner workings of DarkSword, a commercial platform that sells remote access to iOS devices, along with its associated malware Coruna that targets cryptocurrency wallet recovery keys. The infrastructure was exposed between September 15 and 17, allowing researchers to analyze the full attack chain starting from a WebKit and JavaScriptCore exploit delivered through the browser. After escaping the Safari sandbox and reaching the kernel, the platform deploys three layers including a flag, controller, and main implant. Coruna then scans the device for BIP39-compliant seed phrases stored in photos and Apple Notes across 19 targeted wallet applications such as MetaMask, Phantom, Trust Wallet, Coinbase, Exodus, imToken, Bitpie, and BitKeep. The exposed server contained 11 victim recovery keys, 179 directories of extracted data, and 75 operator accounts, indicating a structured commercial operation with agent accounts, commissions, and device quotas. Confirmed infections affect devices running iOS 16.1 and 16.3.1, while Apple has extended patches to additional iOS 18 devices. Maintaining updated iOS versions remains the primary defense against this threat.

EASM Uncovers Forgotten Perimeter Assets Including 11-Year-Old Servers Invisible to Standard Scanners

EASM solutions continuously discover external attack surfaces by starting from public data such as company names, domains, WHOIS records, Certificate Transparency logs, and internet-wide scanners like Shodan and Censys. Unlike traditional vulnerability scanners that only check assets from a predefined list, EASM maps unknown shadow IT including forgotten test servers, abandoned marketing subdomains, exposed APIs, and cloud buckets left open to the internet. The technology follows the same reconnaissance path used by attackers and has become essential for mature vulnerability management programs after years of being considered exotic. Major vendors including Palo Alto Networks Cortex Xpanse, CyCognito, Qualys, Rapid7, and Tenable now lead the market, while Russian providers such as Positive Technologies PT EASM, BI.ZONE EASM, and CyberOK PenOps have grown rapidly since 2022. Without an established process for prioritization and remediation, EASM implementations risk generating overwhelming alert volumes rather than reducing risk. The approach is now viewed as a core component of Continuous Threat Exposure Management (CTEM) frameworks.

Recon in Bug Bounty: Spotting Anomalies Instead of Chasing Known Vulnerability Patterns

The article explains that effective reconnaissance in Bug Bounty programs goes far beyond automated subdomain enumeration with tools like subfinder or httpx. It emphasizes building a mental model of the target application by analyzing policy documents, infrastructure changes via Censys and Shodan, and identifying behavioral anomalies rather than matching textbook vulnerability patterns. A detailed case study describes how a hidden legacy endpoint on ibm.com was discovered during passive and active reconnaissance, leading to the identification of a time-based Blind SQL Injection vulnerability confirmed with sqlmap. The author stresses that recon is a continuous process involving hypothesis testing, understanding service trust boundaries, and evaluating real security impact for triage teams. Practical advice includes reviewing HackerOne reports for context, maintaining motivation through interesting targets, and revisiting programs as infrastructure evolves. The piece also covers how JavaScript analysis and direct endpoint interaction help map authorization flows and weak links between microservices.

Statistical Analysis in OSINT: Tools, Methods and Real-World Intelligence Applications

The article explains why statistical processing has become an essential component of professional OSINT work when analysts face large volumes of raw data. It outlines five core tasks that statistical methods solve: actor profiling, disinformation monitoring through time-series and graph analysis, financial intelligence, geospatial verification, and threat assessment. The text compares popular tools including Maltego, Gephi, Python, R, Power BI, Tableau and SpiderFoot, stressing that real investigations usually combine several of them. Detailed examples show how Pearson correlation, Louvain clustering and TF-IDF or BERT embeddings help identify coordinated botnets in social media. Famous leaks such as Panama Papers and Pandora Papers are presented as landmark cases where regression models, cluster analysis and network graphs exposed hidden ownership structures. The piece also lists open statistical sources from national agencies, international organisations and technical platforms, and reviews key mathematical techniques from basic descriptive statistics to ARIMA, CUSUM, DBSCAN and dimensionality reduction methods.

OSINT for the Lazy Part 17: Versatile Framework Acts as Swiss Army Knife for Investigators

The article continues the series on tools for lazy OSINT practitioners by reviewing a multifunctional online toolkit hosted at htdark.com. This minimalistic yet powerful platform aggregates data across usernames, email addresses, phone numbers, IP addresses, cryptocurrency, social networks, and media files. It wraps Censys search capabilities into a more convenient interface while adding features such as JSON report export and basic relationship graphing. The tool checks 20 social platforms including Reddit and Spotify but omits Chinese and Russian resources, marking absent accounts in red and requiring manual verification for others. An Advanced section functions as a dork builder supporting Baidu and Naver with time-range filters and exclusion operators. While no single toolkit replaces specialized solutions, this framework provides broad initial visibility and helps analysts choose focused follow-up directions based on accumulated data rather than random checks.

Russian Intelligence Hijacks Exposed Security Cameras in Europe and Ukraine for Military Surveillance

Dutch intelligence agencies AIVD and MIVD have revealed that Russian military intelligence is systematically compromising internet-connected security cameras across Europe and Ukraine. The attackers scan for exposed devices using brand fingerprints, then log in with default passwords and outdated firmware without needing zero-day exploits. In Ukraine, live camera feeds are used not only for reconnaissance of military transport routes and weapon deliveries but also to directly support targeting of Ukrainian forces and equipment. Censys identified over 87,000 vulnerable cameras in the EU, NATO countries, and Ukraine, with more than 4,000 located in Ukraine alone. While the actual number of confirmed compromises is smaller, the cameras are strategically positioned along key military logistics routes. The agencies issued basic but critical recommendations including disabling public exposure, changing default credentials, and applying patches for known vulnerabilities such as CVE-2016-7407 and CVE-2021-39275.