MIxmode Blog

The latest stories on Cybersecurity, AI, and everything in between from MixMode

Understanding the Cookie-Bite MFA Bypass Risk

By MixMode Threat Research | May 27, 2025

The Cookie-Bite attack is an advanced evolution of Pass-the-Cookie exploits. This tactic bypasses Multi-Factor Authentication (MFA) by leveraging stolen authentication cookies—such as Azure Entra ID’s ESTSAUTH and ESTSAUTHPERSISTENT—to impersonate users.

Read More

Safeguarding SAP Systems Amid Rising Financial Fraud and Economic Stress

By MixMode Threat Research | May 14, 2025

SAP systems are the backbone of enterprise finance—and they’re under attack. As economic pressures rise, so do attempts to exploit financial platforms. From insider threats to ransomware and zero-day vulnerabilities, SAP’s critical role in handling billions of dollars daily makes it a high-value target. The recent disclosure of CVE-2025-31324, a critical zero-day in SAP NetWeaver (CVSS 10.0), exposed just […]

Read More

WarGames – it’s not 1983 anymore

By MixMode Threat Research | April 29, 2025

China’s state-sponsored cyber operations, driven by groups like Volt Typhoon, Salt Typhoon, Brass Typhoon, and APT41, and amplified by techniques like Fast Flux DNS, are not chasing Hollywood apocalypse—they’re seizing America’s networks, turning our infrastructure into a weapon against us.

Read More

Why the 2025 PyPI Attack Signals a New Era in Cloud Risk

By MixMode Threat Research | April 16, 2025

The 2025 PyPI supply chain attack is a stark reminder of just how vulnerable cloud ecosystems remain to sophisticated, stealthy, and evolving threats.

Read More

Why Zero-Day Attacks Bypass Traditional Firewall Security: Defending Against Zero-Day’s like Palo Alto Networks CVE-2024-0012

By MixMode Threat Research | December 5, 2024

Recently, Palo Alto Networks identified and patched a critical zero-day vulnerability in their next-generation firewalls (NGFWs). This vulnerability, tracked as CVE-2024-0012, allowed attackers to execute code on vulnerable devices remotely. This vulnerability has been actively exploited in attacks dubbed “Operation Lunar Peek.”

Read More

Alarming Intrusion: Chinese Government Hackers Target US Internet Providers

By MixMode Threat Research | August 29, 2024

A recent Washington Post report sent shockwaves through the cybersecurity landscape, revealing that Chinese government-backed hackers have infiltrated at least two major US internet service providers (ISPs) and several smaller ones.

Read More

Critical Microsoft Zero-Day Vulnerability Exploited in the Wild for Over a Year

By MixMode Threat Research | July 25, 2024

A severe zero-day vulnerability in Microsoft Windows, tracked as CVE-2024-38112, has been actively exploited by threat actors for at least 18 months. This security flaw in the Windows MSHTML Platform allows remote code execution, potentially compromising numerous organizations worldwide.

Read More

Nation-States and Zero-days Cranking Up the Heat

By MixMode | July 18, 2024

Summertime isn’t just for vacations and barbecues—it’s also prime season for zero-day attacks. These attacks, launched by malicious actors exploiting previously unknown vulnerabilities in software, are a significant concern for national security and cybersecurity professionals.

Read More

Zero-Day Nightmare: Palo Alto, Cisco, and MITRE Under Attack

By MixMode | May 1, 2024

Zero-day threats continue to wreak havoc on organizations worldwide, with recent attacks targeting corporate and government networks. In the last few weeks, government-sponsored threat actors have targeted Palo Alto Networks and Cisco ASA (Adaptive Security Appliance).

Read More

Zero-Day Attacks on the Rise: Google Reports 50% Increase in 2023

By MixMode | April 9, 2024

There’s bad news and not-so-bad news in the world of cybersecurity. In a recent report, Google revealed a significant rise in zero-day attacks, those exploiting previously unknown software vulnerabilities. However, despite the increase, there’s a silver lining.

Read More

About MixMode

MixMode is the first to bring a third-wave, context-aware AI approach that automatically learns and adapts to dynamically changing environments. MixMode’s monitoring platform, PacketSled, better understands network behavior as it adapts to baseline changes and enables both misuse detection and anomaly detection, as well as predictive maintenance. Used by enterprises and MSSPs for real-time network analysis, threat hunting and incident response, the platform leverages continuous stream monitoring and retrospection to provide network forensics and security analytics. Security teams can integrate PacketSled into their orchestration engine, SIEM, or use PacketSled independently to dramatically reduce false positive alerts and the resources required to respond to persistent threats, malware, insider attacks and nation state espionage efforts.

The company has been named an innovator in leading publications and by security analysts, including SC Magazine, earning a finalist award in 2018 and 2019 for "Best Computer Forensic Solution.” Based in Santa Barbara, with offices in San Diego, the company is backed by Keshif Ventures and Blu Venture Investors. For case studies, continuous product updates and industry news, please visit us at www.mixmode.ai.