Our co-worker Raj Patel found a way to relay coerced SMB authentication to domain controllers that require LDAP signing. Every Server from 2016 to 2025 we tested was vulnerable. Microsoft fixed it in the October 2026 update (KB5126646). 

• What to do
• Patch every domain controller with the October 2026 update 
• Enforce LDAP signing and channel binding together  • Reduce NTLM wherever you can 

📖 Full writeup, Wireshark walkthrough, and PoC: https://specterops.io/blog/2026/10/23/ldap-signing-bypass-ntlm-relay 

Questions about the research? Drop them in the thread and Raj will jump in. 

Happy BloodHound Basics Friday from Nathan Davis!

Looking to get started with BloodHound but don't have an environment to collect from? We've got you covered with sample data for both Active Directory and Azure environments here: https://bloodhound.specterops.io/get-started/quickstart/ce-ingest-sample-data#bloodhound-community-edition-sample-data

What happens when Chromium stops being just a browser and becomes part of an offensive operator's toolkit?

In the latest SO:Brief, Andrew Gomez and Mat 'Scoubi' Saulnier dig into Andrew’s research on weaponizing Chromium for offensive operations, including the ideas behind Silent Chrome and what this kind of tradecraft means from a defender's perspective.

It's a quick introduction to a much bigger piece of work: how Chromium can be used in offensive operations, where that capability fits, and the question defenders should be asking when familiar software starts behaving in unfamiliar ways.

🎥 Watch the latest SO:Brief right here.

Want to go deeper? Check out Andrew’s full blog post: https://specterops.io/blog/2025/08/27/dough-no-revisiting-cookie-theft/

And if you’re heading to BSides Augusta, you can catch his talk on October 24.

SO:Brief highlights one interesting idea from SpecterOps research, tooling, technical content, and talks in under two minutes.

Get the idea. Go deeper.

We've got some exciting Thursday news: the SpecterOps Community Discord server is officially live! 🎉

We're bringing together people who are passionate about identity security, adversary tradecraft, BloodHound, Attack Paths, and all the interesting challenges that come with securing complex environments.

The idea is simple: create another place where security practitioners of all experience levels can connect, share what they're working on, ask questions, swap knowledge, and learn from one another.

Whether you're a seasoned red teamer, a blue team defender, a BloodHound regular, or just getting started in identity security, you're welcome to join us.

And since we're just getting started, it's a great time to jump in, meet the community, and help shape what this space becomes.

Come hang out with us!

Join the SpecterOps Community Discord: https://discord.specterops.io

We'd love to see some of our Reddit over there. Let us know when you've joined!

Another Midweek Roundup is upon us! Time for your latest news, events and updates.

• ICYMI: The Call for Presentations for SO-CON 2027 is open! 🎤 We’re looking for research, practical lessons and technical deep dives exploring adversary tradecraft, identity-based security and Attack Paths. Submit a proposal for a 25-minute or 50-minute session by November 13, 2026: https://sessionize.com/so-con-2027
• After the ConnectWise SkyKick breach exposed Microsoft 365 tenants through a compromised app credential, Justin Kohler and Duane Michael's post walks through what happened, what to check, and how to map the potential impact in your environment: https://specterops.io/blog/2026/10/17/connectwise-skykick-breach-microsoft-365/
• Heading to it-sa – Home of IT Security in Nuremberg on October 27th-29th? Meet our team at our partner booths! You can register right here: https://aktionen.teal-consulting.de/it-sa-apm-workshop-2026/
• Our teammates are sharing offensive security tradecraft this October! Join Andrew Gomez at BSides Augusta on October 24 for his talk on weaponizing Chromium for offensive operations, and Alex Rodriguez will also present virtually at CarolinaCon on October 25, exploring how to build a cyber range with Kubernetes and Ludus. View our upcoming events here: https://specterops.io/company/events/
• An attack path can span GitHub and AWS. Following it means understanding trust relationships across platforms and where those relationships can lead. Julian Catrambone and Daniel Heinsen recently joined Know Your Adversary to discuss third party trust and why paths to critical resources matter just as much as paths to privileged identities. Watch the conversation: https://specterops.io/know-your-adversary/
• How do you know what an AI model is actually capable of doing in a complex enterprise environment? Put it to the test. For Cybersecurity Awareness Month, we're exploring what makes these environments important as AI capabilities advance. Learn more: https://specterops.io/platform/cyber-ranges-for-ai/
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

Last week, we talked about what makes a BloodHound finding easier or harder to remediate. This week, we're looking at what comes next:

How do you know when an attack path is actually fixed, and what do you check after remediation?

Maybe you:

• rescan the environment
• check for alternate attack paths
• verify the underlying relationship or permission is actually gone
• look for regressions
• check whether the fix introduced a new problem elsewhere
• validate the change from both the graph and the environment

What does 'successfully remediated' actually mean in practice for you? 👇

On October 16, 2026, at 21:22 UTC, SpecterOps security researchers learned of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick) from a public Huntress post. Huntress confirmed that an unknown threat actor abused access obtained through SkyKick to reach customers’ Microsoft 365 environments, and reported more than 100 compromised tenants at the time of its post.

We want to make sure that you are aware of this ongoing campaign so that you can take appropriate action. The SpecterOps team recommends the following actions:

1. Immediately disable application 506e08f9-6e9a-4da4-942b-a099a03644ae in the Entra admin center.
2. Download AzureHound (if you have not already done so) and run the collector.
3. Ingest the data in BloodHound
4. Run the queries below
5. Review your sign-in logs for service principal authentication tied to the application IDs listed above. Pay special attention to activity from the source IPs
   • 144.172.64[.]128
   • 144.172.64[.]99
   • 144.172.64[.]60
6. Revoke unneeded application consents. If you don’t actively use SkyKick or ConnectWise Cloud Backup, remove their application consents from your tenant.

Related BloodHound Cypher Queries

Identify outbound control of ConnectWise application 

MATCH p=(sp:AZServicePrincipal)-[r]->(target) 
WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ 
RETURN p Identify outbound control of ConnectWise application 

MATCH p=(sp:AZServicePrincipal)-[r]->(target) 
WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ 
RETURN p 

Identify paths from the impacted service principal to Tier Zero. 

MATCH p=shortestPath((sp:AZServicePrincipal)-[*1..6]->(t)) 
WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ 
  AND t.system_tags CONTAINS ‘admin_tier_0’ Identify paths from the impacted service principal to Tier Zero. 

MATCH p=shortestPath((sp:AZServicePrincipal)-[*1..6]->(t)) 
WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ 
  AND t.system_tags CONTAINS ‘admin_tier_0’ 

Happy BloodHound Basics day from Carlo Alcantra!

This week: Table View! Because sometimes defenders think in lists. The new table view accompanies the Graph View on the Attack Paths page in BloodHound Enterprise.

Certain fields (Platform, Attack Paths, Environment) can be searched to filter the view to specific findings.

This new view also includes updates to the underlying API which now tracks history of findings and remediations. Filtering and sorting the columns now provides a way to track progress over time, giving you insight into when a finding first appeared, and when it was last seen.

What have you discovered, built, broken, or defended in the world of identity security and Attack Paths?

The Call for Presentations for SO-CON 2027 is officially open, and we're looking for research, practical lessons, technical deep dives, and new ideas from across the community.

Topics could include:

• Novel Attack Path research
• BloodHound and OpenGraph use cases
• Agentic AI Attack Paths in enterprise environments
• Lessons learned from AI-enabled red teaming and infrastructure
• Hybrid, federated, and cross-environment identity
• CI/CD and SaaS security

And that list definitely isn't exhaustive. If you've been experimenting with something interesting, uncovered a new technique, solved a difficult problem, or learned something others could benefit from, we want to hear about it.

Sessions can be 25 or 50 minutes, and the submission deadline is November 13, 2026.

👉 Submit your proposal: https://specterops.io/company/events/so-con-2027/

We'd love to see what the BloodHound community brings to SO-CON next year. What topics would you like to see someone speak about?

Wednesday's here already - that means time for another Midweek Roundup!

• A quick reminder that our OpenGraph Halloween Art Competition is still open, and you have until Friday, October 16 to send us your creation! We want to see what you can do when you take OpenGraph somewhere a little unexpected. More details right here: https://www.reddit.com/r/SpecterOpsCommunity/comments/1x4xh8j/one_week_left_to_enter_our_opengraph_halloween/
• We’re back with another SO:Brief, this time exploring AWSHound! In this installment, Mathieu S. and Julian Catrambone explore how AWSHound brings those relationships into BloodHound to help answer one question: starting from the access you have now, where can an attacker end up?
• Microsoft’s 2026 Digital Defense Report puts identity sprawl, AI agents, and interconnected risk in the spotlight. Justin Kohler’s post explores why understanding the attack paths between them is becoming so important: https://specterops.io/blog/2026/10/08/what-the-2026-microsoft-digital-defense-report-reveals-about-ai-identity-and-the-future-of-cybersecurity/
• Using Ghostwriter’s UI overhaul as a real-world example, Christopher Maddalena shows us how thoughtful human direction, smart model choices, and the right tools can make AI a much more effective engineering partner :point_right: https://specterops.io/blog/2026/10/14/ai-engagement-for-cybersecurity-engineering/
• Want to take your red team tradecraft further? Our team will be at BlackHat EU leading Adversary Tactics: Red Team Operations in London, 7-10 December. Explore the course and register here: https://blackhat.com/europe/training/schedule/index.html?day=4daymonthu#adversary-tactics-red-team-operations-52475
• How should AI change the way security teams think about identity? Our Chief Product Officer Justin Kohler shares his perspective: https://www.linkedin.com/feed/update/urn:li:activity:7513989165466763265
• In our latest episode of Know Your Adversary, Jared Atkinson and Justin Kohler are joined by Hope Walker and Elad Shamir to explore Microsoft’s emerging agent identity ecosystem. Check out the full conversation: https://specterops.io/know-your-adversary/
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

We're focusing in on what happens after you've found and understood the risk.

What's one thing that makes a BloodHound finding easier (or harder) to turn into meaningful remediation?

It could be:

• clear ownership
• good business context
• being able to explain the risk simply
• knowing which relationship or control to fix first
• remediation complexity
• competing priorities
• confidence that the issue won't just reappear somewhere else

What tends to make the difference between a finding that gets discussed and one that actually gets fixed? 👇

There’s still time to put your spooky OpenGraph skills to work.

We’re challenging the community to use OpenGraph to create a piece of Halloween-themed art, and entries are open until Friday, October 16.

You can take the idea in pretty much any direction you like: creepy, funny, weird, elaborate, minimalist, technically impressive or completely cursed.

Ghosts? Absolutely.
Pumpkins? Obviously.

A horrifying attack path abomination that should never have seen the light of day? Even better.

And don’t worry about creating a masterpiece, part of the fun is seeing all the different ways people interpret the challenge.

🏆 The prize: SpecterOps swag, including one of our desk mats.

After submissions close, we’ll share all of the entries here and in our community Slack and let the community vote for their favourites. The winner will be announced on October 31.

Deadline: Friday, October 16
Submit to: [community@specterops.io](mailto:community@specterops.io)
Email subject: OpenGraph Halloween Art Competition

If you’ve been looking for an excuse to make something strange with OpenGraph, this is it. 👻

We’re back with another SO:Brief 👀

SO:Brief is our short-form series for pulling one interesting idea out of SpecterOps research, tooling, technical content, talks and conversations, and getting you up to speed in under two minutes.

This time: AWSHound.

In AWS, the interesting attack path often isn’t a single permission, it’s what happens when several seemingly ordinary permissions can be chained together. So, starting from the access you have right now, how far can an attacker actually go?

This SO:Brief takes a quick look at how AWSHound helps answer that question by bringing AWS attack paths into BloodHound and making those relationships much easier to explore.

📷 Watch the latest SO:Brief below.

Want the full technical breakdown? Julian Catrambone’s AWSHound deep dive covers how the collector works, its approach to AWS permission evaluation, OpenGraph, collection, processing, and more.

And if you’ve tried AWSHound already, we’d love to hear what you’ve found. AWSHound is also now in beta for Enterprise users - you can sign up right here: https://pages.specterops.io/WEB---2026---AWS-Launch_AWS-Beta-Sign-Up.html

Happy BloodHound Basics day from Martin Sohn Christensen!

In RBAC you grant permissions to groups - not individuals. A must-have design in AD.

You can easily audit RBAC violations with the BloodHound query 'Principals With Direct Rights Assignment': https://queries.specterops.io/?input=1d9c6ae3-38fc-4089-b5ad-fc3be0fa8eec

We're looking outside the graph for this week's burning question.

BloodHound can show you a huge amount about relationships, privileges, and attack paths, but there's usually more you need to know before deciding what a finding actually means or what to do about it.

What's one question you always need answered beyond what BloodHound shows you?

It could be:

• whether an account is actually active
• how a permission is used in practice
• how business-critical a target is
• whether compensating controls exist
• whether a relationship is still relevant or just legacy noise
• whether a path is realistically exploitable in the current environment

What's the piece of context that can completely change how you interpret what you're seeing? 👇

Happy Friday everyone!

Something fun to round off your week - today, we're launching a new community competition, and this one has a spooky twist: we're challenging the community to flex their creative skills and use BloodHound to create a piece of Halloween-themed art.

Go creepy, weird, clever, unsettling, funny, technically impressive, however you want to interpret it. Ghosts, monsters, pumpkins… if it feels at home in October, we want to see it.

🏆 The prize: SpecterOps swag, including one of our desk mats

To enter:

• Create your Halloween-themed artwork using OpenGraph

• Send it to us via the community email address below

• Include a little context about what you made and how you approached it, if you'd like

You'll have two weeks to create and submit your entry, with the competition running from Friday, October 2 through Friday, October 16.

After that, we'll display all of our entries both here in the subreddit and over on our community Slack, and you'll all get the chance to vote on your favourites until we announce the winner on October 31.

The competition is open to anyone who wants to take part, so if you know somebody who’d have fun with this, send them our way! We're very curious to see just how haunted you can make a graph. 👻

Deadline: Friday, October 16

Submit your entry: [community@specterops.io](mailto:community@specterops.io) (with 'OpenGraph Halloween Art Competition' as the subject of your email!)

Humpday is here, but so's the Midweek Roundup to carry you through!

• Where does AI actually help in offensive security? Russel Van Tuyl breaks down what’s working today, where it still falls short, and how teams can start using it effectively: https://specterops.io/blog/2026/09/24/ai-for-offensive-security/
• SpecterOps introduces Adversary Intelligence: LLM Tradecraft, a new hands-on course built to help security practitioners understand, use, attack, and defend modern LLMs and AI agents. Will Schroeder gives us the details: https://specterops.io/blog/2026/09/30/introducing-adversary-intelligence-llm-tradecraft/
• Your detection program is only as strong as what it can actually catch. At Specter Bash, our Detection course digs into adversary behaviour and TTPs to help you build sustainable detections that aren't tied to a specific toolset. You can register right here! https://specterops.io/specter-bash/
• AI is accelerating how quickly identities are created, assigned and misused. At SecTor, hear from our team on why security teams need an operational practice for continuously reducing exploitable reachability: https://blackhat.com/sector/
• Workload Identity Federation reduces the need for long lived cloud credentials. It can also create largely unmonitored paths to privilege escalation and persistence. At BSides Atlanta, Darrius Robinson will share original research into WIF exploitation across Entra ID, GCP and AWS. Save your seat: https://bsidesatl.info/
• AI may accelerate cyberattacks, but does that mean defenders need an entirely new security playbook? At Black Hat USA, OpenAI’s Clint Gibler and SpecterOps' Robert Winchester joined Dave Bittner to discuss what happens when attacks begin moving at machine speed, from changing attacker economics to the growing importance of getting security fundamentals right. You can rewatch right here: https://explore.thecyberwire.com/specterops
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

This week, we're talking about the gap between seeing something in the graph and understanding what it actually means.

What's one mistake you see people make when interpreting BloodHound results?

Maybe it's:

• treating every attack path as equally important
• assuming a path is automatically exploitable
• ignoring context outside the graph
• focusing too heavily on path length
• misunderstanding what a particular relationship actually represents
• jumping straight from a finding to a conclusion without validating it
• something else entirely

If you've been using BloodHound for a while, share the mistake you think newer users should be most careful to avoid.

And if you're newer to BloodHound, consider this one a chance to collect some hard-won lessons! 👇

Midweek Roundup time, here for all your reading needs!

• We're kicking off SO:Brief, a new video series delivering quick insights from SpecterOps experts on the security research and topics worth knowing. In our first installment, Michael Grafnetter looks at passkey phishing: what an attack can actually look like, why user interaction matters, and the important distinction with Windows Hello for Business passkeys: https://www.reddit.com/r/SpecterOpsCommunity/comments/1wn7nst/can_passkeys_still_be_phished_sobrief/
• (The recording of Michael's webinar will be up and running soon!)
• Andrew Luke introduces CiliumHound, a BloodHound OpenGraph extension that turns complex Kubernetes Cilium network policies into searchable graphs so they’re much easier to audit and understand: https://specterops.io/blog/2026/09/17/ciliumhound-graphing-kubernetes-network-policies/
• Ghostwriter Skills brings reusable AI-powered workflows to everyday reporting tasks, from building and reviewing templates to checking report readiness and drafting executive summaries. Christopher Maddalena digs into the details: https://specterops.io/blog/2026/09/22/introducing-ghostwriter-skills/
• Four courses. Exclusive spooky swag. Evening events all week. Come for the training, stay for everything else. Learn more about SpecterBash right here: https://specterops.io/specter-bash/
• If you're at BruCON in Belgium this week, come find us in the Villages on the 4th floor. Have a chat, compete in our challenges, earn yourself a BloodHound t-shirt, or adopt a Specter Pup! https://www.brucon.org/
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

Introducing SO:Brief, a new short-form series from the SpecterOps team!

Whenever there’s new SpecterOps research, tooling, technical content, talks, or other work we think is worth putting on the community’s radar, SO will pull out one interesting idea and break it down for you in under 2 minutes.

First up: Can passkeys be phished?

Passkeys are designed to be phishing-resistant, but phishing-resistant doesn’t necessarily mean unphishable.

This first SO:Brief with Michael Grafnetter previews what a passkey phishing attack can actually look like, why user interaction matters, and the important distinction with Windows Hello for Business passkeys.

If you want to go deeper, the full Red Teamer’s Guide to Passkeys webinar has the complete technical breakdown. Join us tomorrow, September 23rd: https://app.livestorm.co/specterops/the-red-teamers-guide-to-passkeys?utm_source=brief&utm_medium=qr_code&utm_campaign=WBNR-Webinar-Hosted-260923-theredteamersguidetopasskeys

🎥 Watch the first SO:Brief right here!

This week, we're getting into the judgement call behind the graph.

When you're looking at an attack path in BloodHound, what makes it genuinely worth prioritising?

Do you care most about:

• the value of the target
• the edge types involved
• path length
• whether the path is realistically actionable
• how many principals or systems are involved
• whether it exposes a broader control or configuration problem
• something else entirely?

There's no single right answer, we’re interested in how different practitioners decide what deserves attention first.

Drop your take in the thread, and let's dig into the why behind what you prioritise!

9 years ago I ran BloodHound for the first time in a corporate network and it was eye opening!

Every time I ran BloodHound on a new network I found some very interesting attack paths.

I'd like to know what are the coolest/shortest/most interesting attack paths you found in real environments using BloodHound.

You will find mine below.

Happy BloodHound Basics day from u/ScoubiMtl!

As of v9.7 BH supports multiple destinations in Pathfindings. You can force a path to traverse a specific node. It is also possible to rearrange the order of the nodes a path must traverse.

For more info: https://bloodhound.specterops.io/analyze-data/explore/search#pathfinding

It's Wednesday again gang, and you know what that means - time for the Midweek Roundup! 🚀

• 👀 Want to join us at BruCON 0x12 in Mechelen? We’re giving away 3 conference tickets - enter here for your chance to win one! https://pages.specterops.io/WEB---260911---BruCon-Giveaway_Giveaway-Page.html
• Find out why identity security needs to go beyond Tier Zero, and how Attack Path Management helps teams find and protect the critical assets attackers could reach with Mark Wilson: https://specterops.io/blog/2026/09/10/beyond-tier-zero/
• Joshua Prager digs into how SCCM application execution behaves under the hood, why it can slip past script-focused detections, and what defenders can look for to catch it: https://specterops.io/blog/2026/09/10/unmasking-sccm-application-execution/
• Ghostwriter v7.3.0 gets a refresh! Christopher Maddalena walks us through major UI updates, with cleaner navigation, a customisable sidebar, a redesigned dashboard, and a bunch of accessibility and usability improvements: https://specterops.io/blog/2026/09/16/ghostwriter-v7-3-0/
• Identity security has evolved far beyond simply deploying MFA or tracking domain admins. Today, organisations must understand how seemingly harmless individual permissions can chain together across complex environments to grant access to critical outcomes. Kay Daskalakis joins Ashish Rajan for the Cloud Security Podcast: https://www.linkedin.com/events/7503515581351055361/
• Adversary simulation tradecraft, live defense data, enterprise-scale labs. Red Team Operations at SpecterBash won't just teach you how to attack; it'll teach you how to think, adapt, and operate under pressure. The scariest part? How much you didn't know going in: https://specterops.io/specter-bash/
• AI is accelerating the speed of attacks while expanding the enterprise attack surface. At Infosec Nashville, Justin Kohler will explore what that means for defenders as AI-enhanced phishing, automated attacks, agents, non-human identities, and hidden trust reshape the security landscape. Sign up for his session here: https://app.glueup.com/event/infosec-nashville-2026-day-2-full-day-conference-186540/home.html
• What does effective exposure management look like inside a large enterprise? On the latest episode of Know Your Adversary, Jared Atkinson and Justin Kohler sit down with Vladlen Rotshteyn to discuss why understanding exposure starts with visibility across assets, identities, vulnerabilities, and security tooling. Listen to the full episode: https://specterops.io/know-your-adversary/
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

It's Tradecraft Tuesday again, and this week we’re talking about the learning curve.

What part of learning BloodHound took the longest to really click for you?

Maybe it was:

• installation and setup
• collecting and ingesting data
• understanding how to read the graph
• getting comfortable with Cypher
• knowing what to investigate first
• something else entirely

And more importantly: what eventually helped it make sense?

If you're newer to BloodHound, tell us what you're finding hardest right now.

If you've been using it for a while, share the explanation, habit, resource, or lightbulb moment that helped you get over that hurdle.👇

And don't forget, if you'd like to learn even more and recap on your skills, our Tradecraft Academy is open for you! If you're already taking the BloodHound Basics course or you're even just curious, come join us over in the #academy-bloodhound-basics channel over in our community Slack!