https://www.a1ops.com/, https://linktr.ee/AlphaONEOps

AlphaONE Operations, Birmingham, AL (2026)

08/26/2026

We started a recent engagement as a normal user on a company's network. By the afternoon we were reading its full database backups, a live AI model key, and its client account records, without exploiting a single application.

The way in was Kerberoasting, which is Kerberos working exactly as designed. A SQL service account had a password set in 2017 and flagged to never expire. We requested a ticket for that account, cracked it offline (the password was "Winter2017!"), and used it to log into the production database server.

Then it stopped being a normal server. It was also a workstation two people used to write code: an outside contractor with an AI coding assistant installed, and an internal IT generalist. On the same drive as 158 GB of backups sat a homegrown app that forwarded company data to a hosted AI model, kept its passwords in a plain text file, and contained a basic security flaw any code reviewer would have caught. Next to it were the client account workbooks, Social Security numbers, and mailing lists.

We did not exploit any of that. We read it. It was a file share.

The firm's stated position was that it had no development team, so it needed no secure coding standard. But it had people shipping production code, and generative AI made that feel like a reasonable afternoon project. The tool did not cause this. The absent rule did. If a contractor and a couple of IT staff are writing production code with an AI assistant, they are your development team, and they need the access model, the review, and the standard you would give a hired engineer.

07/07/2026

An IT admin searched for "PuTTY." One sponsored ad later, the machine was fully compromised. No exploit, no phishing email, no zero-day.

The user did the most ordinary thing an administrator does: searched for a tool by name and clicked the first download link. That link was a paid ad pointing at a typosquatted clone of the real PuTTY site. The installer was signed with a certificate for "NEW VISION MARKETING LLC" (later revoked) and deployed the Oyster backdoor. Within the hour it had registered a "Security Updater" scheduled task firing every 3 minutes and had copied the machine's SAM, SECURITY, and SYSTEM hives, the raw material for password cracking.

Two facts worth knowing: online ads accounted for more than 60% of the malware and phishing observed in 2025, overtaking email, and roughly 8,500 SMB users were hit in just the first four months of 2025 by malware disguised as everyday tools. This campaign has been tied to Rhysida ransomware.

The good news: every artifact was loud, and the fixes are neither expensive nor exotic. Source tools from official sites (chiark.greenend.org.uk for PuTTY, never putty.org), verify signatures, filter lookalike domains, and hunt for short-interval scheduled tasks running rundll32 from AppData.

07/04/2026

This Independence Day, we're celebrating the freedom to protect what matters most. Your digital independence is worth defending. Happy 4th of July! 🇺🇸 Ready to secure your future? Visit a1ops.com to learn how we can fortify your defenses.

06/30/2026

The Apple TV in Conference Room B had been there for eight months before we told the client it was ours.

IT assumed facilities installed it. Facilities assumed IT installed it. Nobody questioned it. And every night at 2 AM, it opened an encrypted tunnel to an IP address in Frankfurt.

On an authorized physical engagement, our team walked in wearing a maintenance uniform and left four devices behind: the Apple TV running a mesh VPN, a Raspberry Pi labeled "IT DEPT - DO NOT REMOVE" with its own cellular uplink, a $60 LAN Turtle that captured 17 password hashes on the first business day, and a rogue access point hidden above the ceiling tiles.

None of this shows up on a vulnerability scan. None of it has a CVE. It passes compliance audits every day, because the audit checks whether your controls exist, not whether an attacker can build their own infrastructure inside your walls.

The root cause is a single question most organizations cannot answer: what devices are connected to our network right now, and do all of them belong there?

06/24/2026

The tools that turn a sentence into a deployed app are revolutionary for speed, and the same defaults that make them effortless are exactly what leave you exposed. Bolt.new, Replit Agent, Lovable, Cursor, and v0.dev all optimize for getting you from idea to running app as fast as possible. Security pulls the opposite way, so the same holes show up almost every time: row-level security left off, secrets shipped to the browser, missing security headers and input validation, and hallucinated dependencies.

Better prompting closes the easy holes, but verifying is what protects you. We ran the identical audit prompt past two AI assistants on the same naive app: one found five flaws, the other found ten, including a silent fallback that leaked a default customer's record to anyone who mistyped a URL. An automated review is a floor, not a ceiling.

06/23/2026

Type a sentence, get a deployed app. The tools work, and people who have never written code are shipping live software with real users and real data. The problem the demo hides is that "it works" and "it is secure" are two different measurements, and the people building this way can only see the first.

The numbers are not improving. Veracode found 45 percent of AI-generated code samples introduced an OWASP Top 10 vulnerability. Georgia Tech counted confirmed CVEs from AI-generated code climbing from 6 in January 2026 to 74 by the end of Q1. And a scan of roughly 380,000 of these apps found more than 5,000 actively leaking sensitive data, because new projects defaulted to public.

06/22/2026

One wrong checkbox voided an entire cyber insurance policy. In April 2022, a manufacturer attested on its application that it used multi-factor authentication. A month later, ransomware spread through servers that the MFA never covered. The insurer went to court, and the policy was declared null and void from the day it was signed.

Every "yes" on a security questionnaire is a legal representation, not a guess. In most US jurisdictions, an insurer can rescind the whole policy over a material misrepresentation, whether it was a lie, a guess, or an honest mistake. And it is not only insurance: the same wrong checkbox bites in regulatory safe harbors, vendor questionnaires, customer contracts, M&A diligence, and executive sign-off.

05/25/2026

22,468 password hashes.
12,016 recovered.
One afternoon.

After landing Domain Admin on a client network, we dumped every NTLM hash in Active Directory and fed them to our hashcat cluster. Before the day was out, we'd recovered the plaintext credentials for 53.48% of the domain. More than twelve thousand accounts, wide open.

The part that stings: nearly every recovered password was technically compliant. Eight characters minimum. Upper, lower, number, symbol. The audit tool never blinked once while we had the keys to the kingdom.

Here's where the policy fell apart:
-18.5% of recovered passwords hit exactly the 8-character floor, nothing more.
-49.8% had full complexity: letters, a special character, and a digit.
-Only 36% cleared the 12-character bar recommended by PCI DSS 4.0.
-Just 7.6% met the NIST 800-63B Rev 4 single-factor threshold of 15 characters.

Phase 1 used pure mask attacks against the policy requirements: 0.10% recovered. Phase 2 added rockyou with no rules: 1.50% cumulative. Phase 3 layered in the public d3ad0ne ruleset (34,000+ transformations): 13.91%. Phase 4 brought our internal wordlist and custom rules: 50.20% of accounts were unique, for a total of 53.48%.

That proprietary tooling delta tells the whole story. Off-the-shelf public tools left 7,621 passwords standing. Our internal corpus knocked them down in a single phase. No compliance scan, NIST checklist, or audit dashboard can see that gap.

The complete analysis is in the comments: all four phases with full hashcat syntax, length and pattern breakdowns, crack-time projections across five hardware tiers (from a single laptop GPU to our 12-GPU, 4.3 TH/s rig), and framework mapping.

When was the last time someone actually cracked your AD hashes? Not just reviewed the policy. Not just running an audit. Cracked the hashes.

05/22/2026

"We're fine with our 8-character minimum and complexity rules."
That's a statement that's showing up as a finding in 2026 security audits.
Both NIST SP 800-63B Rev 4 (2025) and Microsoft's 2025 Security Baselines have done away with forced complexity requirements and scheduled password resets. Today's standard sets the minimum at 15 characters for accounts without a second factor, or 14 characters when MFA is active. The days of 8-character passwords being acceptable are behind us.
We took the password policy remediation advice from every Active Directory pentest report we deliver and consolidated it into a single playbook. Give it to your helpdesk. Hand it to your GRC team. It's the same process we walk every client through after we've compromised a domain.
The most important thing in the playbook: get MFA deployed everywhere before you change a single password length or expiration setting. Everything else hinges on whether MFA is in place, because both NIST and Microsoft explicitly allow lighter password requirements when a strong second factor is present.
The steps below are ordered — that order is not optional:

Universal MFA (RADIUS / NPS / Entra ID).
Banned-password list enabled (Specops, nFront, or Azure AD Password Protection).
Minimum length increased — 14 chars with MFA, 15 chars without.
Complexity rules removed (only once steps 1–3 are done).
Password expiration removed (only once steps 1–3 are done); reset on breach stays permanent.
Service accounts migrated to gMSA.
Fine-Grained Password Policies applied to privileged accounts (minimum 20 characters).
SIEM alerting configured for events 4662, 4769, 4768, 4624, 4625, 4740, 4928, 4929, 5136.

Cut corners on the sequence, and you leave the domain weaker than before. Turn off complexity without first raising the length floor and activating a ban list, and your next pentest will crack more passwords, not fewer.
The full playbook — covering both on-prem AD and Entra ID, with framework mappings for auditors (NIST 800-53, NIST CSF 2.0, CIS Controls v8.1, CIS Windows Benchmark, ISO/IEC 27001:2022, Microsoft Security Baselines, and MITRE ATT&CK M1027/M1032/M1018) — is in the comments.
Where is your environment getting stuck?

05/21/2026

Twenty-year-old method, an engagement that wrapped up this week, a full pivot across the domain, and not one password cracked.

NTLM relay happens when the network passes a captured authentication off to a destination it was never supposed to reach. The underlying protocol weakness (NTLMSSP doesn't bind to a target SPN) has been documented since the early 2000s. The remedy (SMB signing) has been around almost the entire time. Yet the default has stayed server-side-optional for everything before Server 2025, which is precisely why this attack continues to land on the majority of internal engagements.

Here's the 2026 chain we walked through on a recent client engagement:

- Responder grabs a NetNTLMv2 hash inside of 60 seconds via LLMNR poisoning.
- NetExec `--gen-relay-list` enumerates every host on the segment with signing turned off.
- ntlmrelayx forwards the captured authentication into a file server that doesn't require signing. The relayed user comes through as a local admin.
- ntlmrelayx, by default, auto-dumps the local SAM. We notice matching NT hashes shared between `Administrator` and a `*-adm` secondary admin account, the classic password-reuse-on-the-same-box finding, and also a signal that the same build image has been deployed across the environment.
- `-socks` mode keeps the session resident in memory. proxychains-fronted tooling (secretsdump, evil-winrm, smbclient) runs through it without any password ever being handed to the tool. The SOCKS session itself serves as the credential.

When relay isn't an option (signing enforced across the board), the captured NetNTLMv2 still gets fed to hashcat mode 5600 against rockyou. We've yet to watch that come up empty.

The defender's priority list is short: require SMB signing everywhere, kill LLMNR / NBT-NS / mDNS, kill WPAD, deploy DHCP snooping along with DHCPv6 Guard plus RA Guard, roll out LAPS so local admin accounts aren't uniform, and finally move NTLM into audit-then-block. A single Group Policy change covers most of the relay attack surface.

The complete post, including the Responder.conf pre-flight tweaks, the full ntlmrelayx walkthrough (`-c`, default SAM auto-dump, `-socks` plus `-tf` plus proxychains), the offline-cracking fallback, the defender-side event correlation (4624 / 4625 / 8001 / 5145), and the Defender for Identity rule mapping, is linked in the comments.

If a real relay attempt has never been pointed at your network, the exposure is already running.

AlphaONE Operations

08/26/2026

07/07/2026

07/04/2026

06/30/2026

06/24/2026

06/23/2026

06/22/2026

05/25/2026

05/22/2026

05/21/2026

Address

Telephone

Website

Alerts

Shortcuts

Share

Category

Listing takedown request