Latest / ShadowTalk: Powered by ReliaQuest
SonicWall, MFA Bypass, IABs: Why Patched Devices Are Still Handing Attackers Initial Access
Your team patches the device. The firmware version matches the advisory. The ticket closes. The device comes off the remediation queue. What your workflow never tracked is that the advisory also required six manual LDAP configuration steps — and without them, the authentication bypass still works. An initial access broker authenticated through the VPN, reached a domain-joined file server, and was gone in under 40 minutes. Your dashboard still showed a clean queue.
With initial access brokers operating on disciplined, sub-hour timelines and patch-management workflows built around a single…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.