Simo (@SimoKohonen)

Pinned

S

Simo@SimoKohonen · Jul 21

And here we go, first CVE-2025-53770 exploit hitting the honeypots I deployed. I guess there is a public exploit now somewhere? POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1 Host: xxxx User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64;…

SSimo@SimoKohonen · Jul 20

Brb deploying 25 sharepoint honeypots / decoys...

7

81

397

197

56.0K

Pinned

Simo Retweeted

B

BleepingComputer@BleepinComputer · 19 h

CISA flags PaperCut RCE bug as exploited in attacks, patch now - @serghei bleepingcomputer.com/news/security/…

1

12

30

3

5.0K

S

Simo@SimoKohonen · 50 m

Adding a functionality to the honeypots 🍯 that instafires a NMAP scan back at all connections

1

2

4

0

159

S

Simo@SimoKohonen · 57 m

Papercut NG honeypot fleets have been registered by @shodanhq AFAIK CVE-2023-2533 does not have a known/public POC yet, let's see if one manifests..

DDefused@DefusedCyber · 19 h

CISA warns of acute exploitation of PaperCut NG - CVE-2023-2533 PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability We've added a PaperCut NG decoy into the free decoys, go deploy yours now 👉console.defusedcyber.com/signup

0

1

11

1

1.0K

S

Simo@SimoKohonen · 1 h

0

2

0

44

S

Simo@SimoKohonen · 17 h

Looks so official. Lets see if its worth it 😅

0

6

0

255

Simo Retweeted

D

Defused@DefusedCyber · 19 h

CISA warns of acute exploitation of PaperCut NG - CVE-2023-2533 PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability We've added a PaperCut NG decoy into the free decoys, go deploy yours now 👉console.defusedcyber.com/signup

0

3

4

0

1.0K

S

Simo@SimoKohonen · 19 h

CISA warns of acute exploitation of PaperCut NG - CVE-2023-2533 PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability We've added a PaperCut NG decoy into the free decoys, go deploy yours now @DefusedCyber

SimoKohonen's tweet image. CISA warns of acute exploitation of PaperCut NG - CVE-2023-2533 PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

We've added a PaperCut NG decoy into the free decoys, go deploy yours now @DefusedCyber

1

6

0

399

S

Simo@SimoKohonen · 20 h

For non-rogue warmonger states, please leverage our free F5 BIG-IP decoy on @DefusedCyber

SSimo@SimoKohonen · 20 h

Re: Aeroflot hack - they have at least been running F5 BIG-IP which, being American software, falls under sanctions and consequently may be running a very outdated version. Plenty of critical vulns in BIG-IP in the last 2 year timespan allowing for remote code execution

0

1

5

1

295

S

Simo@SimoKohonen · 20 h

Re: Aeroflot hack - they have at least been running F5 BIG-IP which, being American software, falls under sanctions and consequently may be running a very outdated version. Plenty of critical vulns in BIG-IP in the last 2 year timespan allowing for remote code execution

SimoKohonen's tweet image. Re: Aeroflot hack - they have at least been running F5 BIG-IP which, being American software, falls under sanctions and consequently may be running a very outdated version.

Plenty of critical vulns in BIG-IP in the last 2 year timespan allowing for remote code execution

0

4

0

662

S

Simo@SimoKohonen · 22 h

Someone should tell the iranians SMB is not on port 443

SSimo@SimoKohonen · Jul 28

Bunch of 🇮🇷 IPs sending low‑effort SMB/NetBIOS scan/fuzz traffic to VMWare honeypots.. just putting them here for reference: 5.211.111.97 5.134.133.12 217.218.35.195 46.100.87.55 151.234.200.224

0

8

0

601

Simo Retweeted

D

Defused@DefusedCyber · Jul 28

Honeypot server activated: 14:49:08 GMT+3 1 minutes and 37 seconds later: The internet is a pretty hostile place 💀

0

1

4

2

429

S

Simo@SimoKohonen · Jul 28

Bunch of 🇮🇷 IPs sending low‑effort SMB/NetBIOS scan/fuzz traffic to VMWare honeypots.. just putting them here for reference: 5.211.111.97 5.134.133.12 217.218.35.195 46.100.87.55 151.234.200.224

1

0

5

1

804

Simo Retweeted

s

spencer@techspence · Jul 27

I literally write and make content on the topics I wish I had when I was a newbie in IT & Security. Read time: 4-5 minutes per week I promise I'll do my best every week to deliver value. Click the link to subscribe 👇 click.spenceralessi.com/mylinks p.s. it won't hurt my feelings if…

3

10

84

55

6.0K

S

Simo@SimoKohonen · Jul 27

Not sure whats going on here but feels like I should visit

1

0

4

0

154

S

Simo@SimoKohonen · Jul 27

Detections engineers, threat hunters, you should be putting controls in place for ‘Bring-Your-Own-EDR (BYOEDR)’ style attacks

MMike Manrod@CroodSolutions · Jul 27

EDR-on-EDR Violence 1/🧵 @BushidoToken called out that EDR products were being abused by threat actors. @Shammahwoods & I realized a free trial of an attacker controlled EDR can be used to kill the existing EDR. @techspence @UK_Daniel_Card @Jhaddix github.com/CroodSolutions…

2

8

67

28

17.0K

S

Simo@SimoKohonen · Jul 27

Interesting thread by @CroodSolutions on using EDR to kill EDR

MMike Manrod@CroodSolutions · Jul 27

🧵2/ We noticed a few problems immediately: - Multiple EDR/AV vendors allow for unverified free trials. - An attacker-controlled (trial) EDR can be used to kill the actual EDR (Cisco Secure Endpoint can kill Elastic Defend and Crowdstrike Falcon Protect). - Sometimes a new…

2

1

18

3

2.0K

S

Simo@SimoKohonen · Jul 25

Go go go 👉console.defusedcyber.com/signup

SSimo@SimoKohonen · Jul 25

The Sharepoint vulnerability (CVE-2025-53770) is being associated with a new strand of ransomware, the Warlock ransomware. If you run Sharepoint in any form: 1) Deploy a free Sharepoint decoy on @DefusedCyber 2) Chuck it's IP address into your public DNS under something like…

0

1

10

4

687

S

Simo@SimoKohonen · Jul 25

The Sharepoint vulnerability (CVE-2025-53770) is being associated with a new strand of ransomware, the Warlock ransomware. If you run Sharepoint in any form: 1) Deploy a free Sharepoint decoy on @DefusedCyber 2) Chuck it's IP address into your public DNS under something like…

SimoKohonen's tweet image. The Sharepoint vulnerability (CVE-2025-53770) is being associated with a new strand of ransomware, the Warlock ransomware.

If you run Sharepoint in any form:

1) Deploy a free Sharepoint decoy on @DefusedCyber
2) Chuck it's IP address into your public DNS under something like…

7

29

141

81

13.0K

S

Simo@SimoKohonen · Jul 25

Nice, a cheap airport hotel with a 4.8 star rating (it was 4.8/10)

0

5

0

135