What are the opening hours?

Monday 8am - 5pm Tuesday 8am - 5pm Wednesday 8am - 5pm Thursday 8am - 5pm Friday 8am - 5pm

DarkInvader

Home
United Kingdom
Leeds
DarkInvader

DarkInvader is an External Attack Surface Management (EASM) platform that provides continuous visibility across all internet-facing assets.

02/11/2026

Changing the RDP port is one of the oldest habits in UK infrastructure teams. 3390, 13389, 33890, all picked because they are easy to type into a client. The logs go quiet almost immediately, which feels like a result.

What actually happened is that the bots aimed at 3389 moved on. Service fingerprinting across the full port range still identifies RDP from its protocol negotiation, whatever number it sits behind. The real cost is closer to home: if your monitoring is configured as a port list, the host on 33890 reports clean, never enters triage, and the silence gets read as safety.

Keep the port change if you prefer the quieter logs. Just do not record it as a mitigation. That blind spot, and four others that leave remote access open, are set out here: https://www.darkinvader.io/blog/exposed-rdp-port-monitoring-blind-spots?utm_source=facebook&utm_medium=social

30/10/2026

$6.3 billion. Most of it moved in around 20 minutes.

One very expensive Thursday.

Yesterday, Binance suffered what could be the largest cryptocurrency theft in history, with blockchain investigators linking the attack to a North Korean hacking group.

Early investigations suggest a compromised engineer's laptop may have played a role, although the full cause is still being established.

And that's what makes this incident particularly interesting.

Attackers don't need every door to be open. They only need one way in.

Not every cyberattack starts with an exposed server. But every organisation should understand what attackers can discover about its external environment.

Unknown internet-facing assets. Forgotten subdomains. Exposed services. Vulnerabilities. Leaked credentials.

These are the kinds of risks that can remain unnoticed while attackers are actively looking for them.

External attack surface management won't prevent every attack. But it helps organisations find and reduce external exposure before it becomes an opportunity.

The question isn't just what you're protecting. It's what you're overlooking.

SEE WHAT ATTACKERS SEE.

https://www.darkinvader.io

30/10/2026

PHP2Shell gave most UK security teams a tidy emergency change window and a patched version number. The harder question starts after that window closes: what can an attacker still see and reach?

A fixed package version says nothing about three things. The hosts nobody inventoried. The runtime that was never restarted after the upgrade. And anything dropped during the days before the host got round to patching. Mass scanning for a new unauthenticated RCE tends to begin within days of a public fix, because the fix itself points attackers at the flaw.

So start from the outside, not from the asset register. Build the list from DNS records, certificate transparency data and external discovery, and map it geographically too, which is how regional hosting provisioned by a local marketing team surfaces before someone else's scanner finds it. The five checks worth running, in order: https://www.darkinvader.io/blog/php2shell-vulnerability-checks-after-patching?utm_source=facebook&utm_medium=social

29/10/2026

API keys rarely leak from the place you spend money protecting. They leave by one of three quieter routes, and each one can be checked from outside your network.

First, an infostealer on a developer's machine, where the evidence turns up as a stealer log entry holding saved browser credentials and live session data. Second, a config or environment file still being served by a forgotten staging host or old subdomain. Third, self-hosted developer infrastructure, such as a repository server sitting on a subdomain that never made it onto the asset register.

For each one, the order of rotation matters as much as the speed. Rotate the provider keys and service tokens before you patch or rebuild, because a patched box with working credentials is still an open door. An external view of your own estate is what tells you which of the three you are dealing with.

29/10/2026

In the ConnectWise Cloud Backup breach, there was no exploit chain against customer Microsoft 365 tenants and no brute force. An attacker obtained a credential or key and used the access the backup platform already held. Legitimate access, used by the wrong party, which is exactly why it looks like normal platform behaviour in the logs.

That creates a practical problem. A tenant that was genuinely accessed and a tenant that was merely reachable can be hard to separate after the event, and the difference matters when you are weighing up whether to notify. Microsoft has linked the activity to the China-aligned actor it tracks as Storm-0940, and reported tenant figures have been subject to revision, so check the vendor's current advisory before putting a number in a board paper.

The more useful exercise is auditing who already holds standing access into your environment: partner delegated admin relationships, service principals and OAuth consents granted during old migration projects, and backup or RMM agents that were never scoped back. Our write-up sets out the checks to run, starting from the external view: https://www.darkinvader.io/blog/connectwise-supply-chain-breach-vendor-access?utm_source=facebook&utm_medium=social

28/10/2026

Run infrastructure scanning and web application scanning against the same public host, which is exactly what dual scanning is designed to do, and the same weakness often surfaces twice. An outdated TLS configuration appears as a network finding and again as an application finding. An unpatched framework appears as a CVE on the host and a version disclosure in the application layer. The raw count looks alarming on a board slide.

Collapse those findings by asset and weakness class and the picture changes. A retailer with twelve public-facing hosts can end up with a handful of distinct fixes, most tracing back to one outdated component pushed out by the same build process.

The deduplication logic that holds up matches on asset plus service plus CVE or weakness class, never on the alert title. Title matching merges genuinely different issues that share vendor wording, and misses the same issue described by two tools. That, plus five other noise sources and the cost of each fix: https://www.darkinvader.io/blog/reduce-security-alert-fatigue?utm_source=facebook&utm_medium=social

27/10/2026

LLMjacking is credential abuse with an expensive meter attached. Someone obtains an AI provider key, or finds a self-hosted model published to the internet with no authentication, and runs inference on your account until the bill gets noticed. No malware has to persist on your estate, no lateral movement is needed. The key works from anywhere, which is the design intent.

Cryptojacking trained security teams to expect slow theft that becomes visible over weeks. This is not that. Frontier models bill per token and attackers run high-volume batch workloads, so a spend pattern a crypto miner would take a quarter to reach can land inside a weekend. Sysdig's Threat Research Team, which named the technique in May 2024, estimated that abuse of a single set of compromised credentials could cost a victim in the region of tens of thousands of US dollars per day in Claude 2.x consumption.

Most guidance starts in the cloud console: rotate the key, set a budget alarm, check the logs. All sensible, all late. The credential was sitting in a stealer log, a public repository or a resale listing long before it was used, and that is where the looking should start. Where these keys surface, and what to do in the first 48 hours: https://www.darkinvader.io/blog/llmjacking?utm_source=facebook&utm_medium=social

26/10/2026

Under UK GDPR you have 72 hours to notify the ICO from the point you become aware of a personal data breach. That single word carries a lot of weight. If your notification says you found out from a customer, a journalist or an external researcher, you have told the regulator something about your detection as well as your incident.

It matters because a good share of staff mistakes does not stay inside the building. Credentials typed into unmanaged devices, documents that were never properly redacted, forgotten subdomains still answering in DNS. Those leave traces on the open internet and in criminal marketplaces, often well before an internal alarm goes off. Self-reported breach statistics undercount for the same reason: an incident only gets counted once somebody inside notices it.

The article works through the ICO's own incident categories and the five staff mistakes that show up externally, with what a security team can realistically do about each one: https://www.darkinvader.io/blog/human-error-data-breaches-what-26-000-ico-reports-tell-you?utm_source=facebook&utm_medium=social

26/10/2026

A mid-market group buys attack surface monitoring software, feeds it the three domains everyone agrees they own, and within a week it flags a legacy marketing subdomain pointing at an expired staging server and a forgotten test environment still serving an admin login page to the internet. Neither one is in the CMDB. Nobody in IT recognises the hostname.

That is the tool proving its worth. It is also the point where the actual work starts, because a list of findings is not the same as a decision. Someone has to confirm ownership, cut through the noise, and get the thing taken down or shut off.

So before you sign anything, it is worth pushing vendors on discovery, false positives, human triage, takedowns and reporting that a board will actually read. Which of those has caused you the most pain with a tool you already own?

Read the full article here: https://www.darkinvader.io/blog/attack-surface-monitoring-software-buyer-questions?utm_source=facebook&utm_medium=social

26/10/2026

Most ServiceNow security guidance stops at the CVE. Identifier, CVSS score, affected release, done. Useful, but it never answers the question that actually decides your risk: how many ServiceNow instances is your organisation running on the internet today, and who owns them?

Our new article walks through the practical side. How to inventory every exposed instance, how to attribute ownership so things do not sit unpatched forever, how to test without breaking production, and how to structure a response you can actually complete in 72 hours.

Be honest, could you list every ServiceNow instance your organisation owns right now, including the forgotten test environments? We would love to hear how you keep track.

Read the full article here: https://www.darkinvader.io/blog/servicenow-vulnerabilities?utm_source=facebook&utm_medium=social

Address

Platform 7D, New Station Street
Leeds
LS14BT

Opening Hours

Monday	8am - 5pm
Tuesday	8am - 5pm
Wednesday	8am - 5pm
Thursday	8am - 5pm
Friday	8am - 5pm

Website

https://www.darkinvader.io/

Alerts

Be the first to know and let us send you an email when DarkInvader posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.