The Deep Purple Sec – August 2025
A monthly round-up of interesting articles, reports and tools for tech experts, covering both offensive and defensive topics.
🔴 Red Team
📝 Beyond the Horizon: Uncovering Hosts and Services Behind Misconfigured Firewalls
This study thoroughly examines the risks posed by poorly configured stateless firewalls, which allow incoming traffic if the source port matches an outgoing rule. A vulnerability discovered in 2014 affected Microsoft and Apple, prompting researchers to scan the IPv4 address space a decade later. They discovered nearly 2.5 million newly accessible services on over 2 million previously hidden IP addresses, many of which exhibited poor security: outdated systems, weak encryption and known vulnerabilities.
To assess exploitation by attackers, researchers deployed honeypots behind stateless firewalls. The results show that this method is rarely used today, but is set to regain popularity. The study highlights the need to review firewall rules, apply patches and strengthen authentication, whilst the exclusion of IPv6 poses future risks for devices behind NATs and stateless firewalls.
📌 Source: Thinkst Scapes Q2 https://thinkst.com/ts/
📝 APT36: Targets Indian BOSS Linux systems with weaponised autostart files
CYFIRMA’s article outlines a cyber-espionage campaign by APT 36 (Transparent Tribe) that targets the Indian government and various sectors. The attack uses phishing emails containing malicious «.desktop» files which, when opened on BOSS Linux, download custom payloads, exploiting BOSS’s auto-start feature to gain persistent access. CYFIRMA emphasises that this demonstrates APT 36’s increasing sophistication. Recommendations include raising awareness of phishing, filtering «.desktop» attachments, and implementing BOSS-specific defences.
📝 Storm-0501’s evolving techniques have led to cloud-based ransomware
The Microsoft article outlines the evolution of the techniques used by Storm-0501, which has moved from traditional ransomware to cloud-based attacks. Storm-0501 effectively exploits cloud capabilities to exfiltrate data, destroy backups and extort victims without deploying malware. Their strategy utilises compromised hybrid identities to escalate privileges to global administrator rights. Once in the cloud, they use AzureHound to map resources, bypass security measures and delete critical data whilst encrypting the remainder. These attacks exploit gaps between local and cloud environments, particularly when security solutions fail to cover all endpoints.
To defend against these threats, Microsoft strongly recommends strengthening cloud identity security, protecting Azure resources, and actively monitoring for suspicious activity. The article emphasises the need to adopt a zero-trust approach and to correct default configurations.
🔵 Blue Team
📝 An Introduction to the Forensic Investigation of Salesforce Security Incidents
The article clearly outlines how to conduct a forensic investigation into Salesforce security incidents using three essential elements: logs, permissions and backups. It emphasises the importance of analysing logs with tools such as Event Monitoring to detect anomalies, particularly suspicious API activity. In cases of data exfiltration, log details and Field History Tracking are crucial for reconstructing incidents. Automating responses using Transaction Security Policies (TSP) significantly enhances security by blocking risky actions. Proactive preparation — including monitoring, permission management and backups — is essential to limit the impact of incidents and speed up resolution.
📌 Source: https://www.salesforce.com/blog/a-primer-on-forensic-investigation-of-salesforce-security-incidents/
🛠️ Public Availability of the Thorium Platform
CISA, in collaboration with Sandia National Laboratories, has launched Thorium, an open-source platform for automated large-scale file analysis. This platform enables cybersecurity teams to automate workflows by integrating commercial, open-source or custom tools for malware analysis, digital forensics and incident response. Thorium offers scalability (over 10 million files per hour), rapid search performance, and features such as result tagging and full-text search. Users can define event triggers and control the platform via a RESTful API.
CISA strongly encourages teams to adopt Thorium to enhance their analysis capabilities and provide valuable feedback. The platform is available on GitHub with comprehensive resources for deployment and use.
📌 Source: https://www.cisa.gov/news-events/alerts/2025/07/31/thorium-platform-public-availability
📝 RDP Forensics Part 1: Fingerprinting Attacks Using Keyboard Layout Data
The article clearly explains how keyboard input data from the Remote Desktop Protocol (RDP) can be effectively exploited to profile an attacker. By analysing the client’s «local input», investigators can accurately identify the corresponding keys in the remote system’s registry and determine whether the setting was introduced during the RDP connection or was already present. The author presents compelling scenarios in which an attacker uses a keyboard layout that is not installed on the system, thereby revealing the client’s language in the Windows event log and providing geographical clues. If the layout is available within the user profile, this complicates the process of distinguishing between legitimate input and remote origin. The article also highlights the method’s limitations and confidently proposes best practices to enhance RDP forensic investigations.
Never trust, always check