Method of infection: Water-holing
OSIRIS used a Social Engineering method called “water holing” to attack German IP addresses.Β
How does water holing attack work?
- Β The victim enters the infected website.
- The website checks if the target IP is German.
- If it’s a German IP – few evasion techniques are used to bypass EDR
- And then the virus connects to its command server through the Darknet
Save Your Company from Social Engineering Attacks Like that
Register and Get your Personalized Free Exposure Report NOW,
And see where your Company is Exposed to Hackers
Recently Posted on AUMINT.io Blog
π Free API Security Tools Quietly Protecting Enterprises π
APIs are the backbone of modern applications β and theyβre a prime target for attackers. The best news? Several free tools help CISOs identify vulnerabilities, monitor traffic, and enforce security without breaking the budget.
Here are the top free API security tools every CISO should know:
1οΈβ£ OWASP ZAP β Open-source scanner for detecting vulnerabilities in REST and SOAP APIs.
π https://www.zaproxy.org/
2οΈβ£ Postman (Free Tier) β Test APIs and validate security workflows during development.
π https://www.postman.com/
3οΈβ£ Tyk Community Edition β Open-source API gateway with authentication, rate-limiting, and security policies.
π https://tyk.io/open-source/
4οΈβ£ Kong Gateway (OSS) β API management with built-in security features and traffic monitoring.
π https://konghq.com/kong/
5οΈβ£ WAF-FLE (ModSecurity) β Protects web-facing APIs from OWASP Top 10 attacks.
π https://www.modsecurity.org/
6οΈβ£ APImetrics Free Plan β Monitor API performance and detect anomalies.
π https://apimetrics.io/
7οΈβ£ Spectral (Open Source) β Linting tool for OpenAPI specs to catch insecure API definitions.
π https://stoplight.io/open-source/spectral/
β‘ With these tools, CISOs can scan, monitor, and enforce security on APIs while reducing risk exposure across enterprise applications.
At AUMINT.io, we go further β simulating how attackers exploit employees via APIs, social engineering, and phishing, exposing gaps that technical tools alone may miss.
π Curious about your teamβs human risk exposure to API attacks? Book a free demo
#APISecurity #CISO #CyberSecurity #ThreatDetection #AUMINT