CIRCL Publications and Presentations

Publications and Presentations

Publications

Description Last update
TR-100 - Multiple Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway 27th September 2026
TR-99 - Phishing Campaign Targeting Hotel Customers in Luxembourg 1st June 2026
TR-98 - Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2026-1281 & CVE-2026-1340) - Active Exploitation 9 February 2026
TR-97 - Supply Chain Compromise Propagating Through the npm Ecosystem (Shai-Hulud) 28 November 2025
TR-96 - Multiple Vulnerabilities in F5 Devices and Products - Impact and Mitigation 15 October 2025
TR-95 - Critical vulnerability - Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. CVE-2025-53770 - CVE-2025-53771 20 July 2025
CIRCL AI Strategy 20 June 2025
TR-94 - Ongoing Phishing Campaigns Targeting Microsoft 365 Tenants Lacking Multi-Factor Authentication 22 May 2025
TR-93 - Financial transaction fraud after system compromise via Remote Management and Monitoring tools 26 February 2025
TR-93 (de) - Finanzbetrug nach Systemkompromittierung über Remote-Management- und Monitoring-Tools 26 February 2025
TR-93 (fr) - Fraude financière après compromission du système via des outils de gestion et de surveillance à distance 26 February 2025
TR-92 - Unused Domain Names and the Risks of Missing DNS SPF Records 22 January 2025
TR-91 - Vulnerability identified as CVE-2024-0012, affecting Palo Alto Networks PAN-OS software 20 December 2024
TR-90 - Vulnerability identified as CVE-2023-34990, affecting Fortinet FortiWLM 20 December 2024
TR-89 - Guidelines for Notifying CSIRT/CERT of Red Teaming and Penetration Testing Exercises 12 November 2024
TR-88 - Motivation, procedure and rationale for leaked credential notifications 30 August 2024
Learning from the Recent Windows/Falcon Sensor Outage: Causes and Potential Improvement Strategies in Linux Using Open Source Solutions 23rd July 2024
TR-87 - CrowdStrike Agent causing BSOD loop on Windows - Faulty Update on Falcon Sensor 19th July 2024
TR-86 - Check Point VPN Information Disclosure (CVE-2024-24919) - Actively Exploited 31st May 2024
TR-85 - Three vulnerabilities in Cisco ASA software/appliance and FTD software being exploited 25th April 2024
TR-84 - PAN-OS (Palo Alto Networks) OS Command Injection Vulnerability in GlobalProtect Gateway - CVE-2024-3400 12th April 2024
TR-83 - Linux Boot Hardening HOWTO 3rd April 2024
TR-82 - backdoor discovered in xz-utils - CVE-2024-3094 30th March 2024
TR-81 - Critical FortiOS vulnerabilities in sslvpnd and fgfmd 9 February 2024
TR-80 - Targeted SMS and fake phone center call targeting financial/banking services 7 February 2024
TR-79 - AnyDesk Incident and Potential Associated Supply Chain Attack 5 February 2024
TR-78 - CVE-2023-46805 (Authentication Bypass) & CVE-2024-21887 (Command Injection) for Ivanti Connect Secure and Ivanti Policy Secure Gateways 11 January 2024
TR-77 - Spear phishing and voice call scams targeting corporate executives and their accounting department 30 August 2023
TR-76 - Multiple high severity vulnerabilities in CODESYS V3 SDK could lead to RCE or DoS 14 August 2023
TR-75 - Unauthenticated remote code execution vulnerability in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) - CVE-2023-3519 21 July 2023
TR-74 - A heap-based buffer overflow vulnerability (CWE-122) in FortiOS - CVE-2023-27997 5 July 2023
TR-73 - Ransomware FAQ 7 March 2023
TR-72 - Vulnerable Microsoft Exchange server metrics leading to alarming situation 21 February 2023
TR-71 - FortiOS - heap-based buffer overflow in sslvpnd (exploited) - FortiOS SSL-VPN - CVE-2022-42475 13 December 2022
TR-70 - Vulnerabilities in Microsoft Exchange CVE-2022-41040 - CVE-2022-41082 30 September 2022
TR-69 - How to choose an ICT supplier from a security perspective 13 June 2022
TR-68 - Best practices in times of tense geopolitical situations 28 February 2022
TR-67 - local privilege escalation vulnerability in polkit’s pkexec utility 26 January 2022
TR-66 - Webservers with mod_status like debug modules publicly available leak information 15 December 2021
TR-65 - Vulnerabilities and Exploitation of Log4j (Remote code injection in Log4j) 10 December 2021
TR-64 - Exploited Exchange Servers - Mails with links to malware from known/valid senders 10 November 2021
TR-63 - Vulnerabilities and Exploitation of Pulse Connect Secure 21 April 2021
TR-62 - Leak of Facebook Data from 533 Million Users 6 April 2021
TR-61 - Critical vulnerabilities in Microsoft Exchange 12 March 2021
TR-60 - Phishing - Effects and precautions 26 June 2020
TR-59 - Remote Work - In times of a crisis 18 March 2020
TR-58 - CVE-2020-0796 - Critical vulnerability in Microsoft SMBv3 - status and mitigation 11 March 2020
TR-57 - Ransomware - Effects and precautions 10 December 2019
TR-56 - HTTP Strict Transport Security 19 March 2019
TR-55 - SquashFu - an alternate Open Source Backup solution, resilient to Crypto Ransomware attacks 12 September 2018
TR-54 - Sextortion scam emails - I know your password 3 August 2018
TR-53 - Statement about WHOIS and GDPR 12 April 2018
TR-52 - Forensic Analysis of an HID Attack 5 February 2018
TR-51 - How to react to fraudulent acts of third party invoicing or requesting funds without showing any purchase order 23 November 2017
TR-50 - WPA2 handshake traffic can be manipulated to induce nonce and session key reuse 16 October 2017
TR-49 - CVE-2017-7494 - A critical vulnerability in Samba - remote code execution from a writable share 26 May 2017
TR-48 - Cyber-Threats Indicators Sharing, security-related actionable information and future of Personal Data Protection framework in the EU - MISP and GDPR 6 March 2017
TR-47 - Recommendations regarding Abuse handling for ISPs and registrars 23 February 2017
TR-46 - Information Leaks Affecting Luxembourg and Recommendations 17 February 2017
TR-45 - Data recovery techniques 12 May 2016
TR-44 - Information security - laws and specific rulings in the Grand Duchy of Luxembourg 15 March 2016
TR-43 - Installing MPSS 3.6.1 to use a Intel Xeon Phi Coprocessor on Ubuntu Trusty 14.04 LTS 11 January 2016
TR-42 - CVE-2015-7755 - CVE-2015-7756 - Critical vulnerabilities in Juniper ScreenOS 21 December 2015
TR-41 (de) - Crypto Ransomware - Vorsichtsmaßnahmen und Verhalten im Infektionsfall 19 May 2016
TR-41 (fr) - Crypto Ransomware - Défenses proactives et de réponse sur incident 19 May 2016
TR-41 - Crypto Ransomware - Proactive defenses and incident response 13 May 2017
TR-40 - Allaple worm activity in 2015 and long-term persistence of worm (malware) in Local Area Networks 24 September 2015
TR-39 - CIRCL-SOPs Standard Operational Procedures 30 July 2015
TR-38 - Attacks targeting enterprise banking solutions - recommendations and remediations 9 May 2017
TR-37 - VENOM / CVE-2015-3456 - Critical vulnerability in QEMU Floppy Disk Controller (FDC) emulation 14 May 2015
TR-36 - Example setup of WordPress with static export 28 April 2015
TR-34 - How to view and extract raw messages in common email clients 13 March 2015
TR-33 - Analysis - CTB-Locker / Critroni 17 February 2015
TR-32 - key-value store and NoSQL security recommendations 10 February 2015
TR-31 - GHOST / CVE-2015-0235 - glibc vulnerability - gethostbyname 29 January 2015
TR-30 - Acquisition Support Tools for Local Incident Response Teams (LIRT) 16 December 2020
TR-29 - NTP (Network Time Protocol) daemon - ntpd - critical vulnerabilities 2 January 2015
TR-28 - The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, are vulnerable to critical padding oracle attack - CVE-2014-3566 15 October 2014
TR-27 - GNU Bash Critical Vulnerability - CVE-2014-6271 - CVE-2014-7169 10 October 2014
TR-26 - Security Recommendations for Web Content Management Systems and Web Servers 28 April 2015
TR-25 - Analysis - Turla/Pfinet/Snake/Uroburos/Pfinet 10 July 2014
TR-24 - Analysis - Destory RAT family 3 June 2014
TR-23 - Analysis - NetWiredRC malware 26 November 2014
TR-22 - Practical Recommendations for Readiness to Handle Computer Security Incidents 15 December 2020
TR-21 - OpenSSL Heartbeat Critical Vulnerability 17 April 2014
TR-20 - Port evolution: a software to find the shady IP profiles in Netflow  18 February 2014
Training And Technical Courses Catalogue 2014  29 January 2014
TR-19 - UDP Protocols Security - Recommendations To Avoid or Limit DDoS amplification  8 July 2015
TR-18 - PBX and VoIP Security - Recommendations  19 February 2014
TR-17 - Java.Tomdep (Apache Tomcat Malware) - Information, Detection and Recommendation  22 November 2013
TR-16 - HoneyBot Services - Client Data Collection  14 October 2013
TR-15 - Hand of Thief/Hanthie Linux Malware - Detection and Remediation  29 August 2013
TR-14 - Analysis of a stage 3 Miniduke malware sample  3 July 2014
TR-13 - Malware analysis report of a Backdoor.Snifula variant 29 May 2013 
TR-12 - Analysis of a PlugX malware variant used for targeted attacks 17 January 2014
TR-11 - Security Flaws in Universal Plug and Play (UPnP) 30 January 2013
TR-10 - Red October / Sputnik malware 16 January 2013
TR-09 - Malware Discovery and potential Removal (Windows 7) 31 August 2012
CIRCL 2011 trend report 29 August 2012
TR-08 - CIRCL automatic launch object detection for Mac OS X 23 January 2015
TR-07 - HOWTO find SMTP headers in common Email clients 13 March 2015
TR-06 - DigiNotar incident and general SSL/TLS security consequences 7 September 2011
TR-05 - SSL/TLS Security of Servers in Luxembourg 22 August 2011

Academic Publications

Publication Authors Date
Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion (PDF) Cédric Bonhomme, Alexandre Dulaunoy 28 July 2026
GCVE: A Decentralized Model for Vulnerability Identification, Publication, and Operational Enrichment (PDF) Alexandre Dulaunoy 30 May 2026
Modeling Sparse and Bursty Vulnerability Sightings: Forecasting Under Data Constraints (PDF) Cédric Bonhomme, Alexandre Dulaunoy 17 April 2026
VLAI: A RoBERTa-Based Model for Automated Vulnerability Severity Classification (PDF) Cédric Bonhomme, Alexandre Dulaunoy 4 July 2025
Active and Passive Collection of SSH key material for cyber threat intelligence (PDF, DOI) Alexandre Dulaunoy, Jean-Louis Huynen, Aurélien Thirion 11 April 2022
Taxonomy driven indicator scoring in MISP threat intelligence platforms (PDF) Sami Mokaddem, Gérard Wagener, Alexandre Dulaunoy, András Iklódy 8 February 2019
Decaying Indicators of Compromise (PDF) András Iklódy, Gérard Wagener, Alexandre Dulaunoy, Sami Mokaddem, Cynthia Wagner 29 March 2018
MISP: The design and implementation of a collaborative threat intelligence sharing platform (PDF) Cynthia Wagner, Alexandre Dulaunoy, Gérard Wagener, András Iklódy 2016
Torinj: Automated Exploitation Malware Targeting Tor Users (PDF) Gérard Wagener, Alexandre Dulaunoy, Radu State 14 August 2012

Presentations

Description Last update
GCVE at Vulnopticon 2026 28th September 2026
GCVE Workshop before Vulnopticon 2026 - slides and materials 23rd September 2026
CSIRT Tooling: Best Practices in Developing, Maintaining and Distributing Open Source Tools 8th November 2018
Fail frequently to avoid disaster or how to organically build a threat intel sharing standard 7th December 2017
How to better understand DDoS attacks from a post-mortem analysis perspective using backscatter traffic Luxembourg Internet Days 2017 15th November 2017
DDoS and Attribution: Observations of Attacks against North Korea 15th November 2017
IoT dinosaurs - don’t die out 24 October 2017
An extended analysis of an IoT malware from a blackhole network 1st June 2017
Challenges for law firms: IT security threats and incidents for law firms - practical examples 12 May 2017
Honeypots Observations and Their Usefulness 15 March 2017
Introduction to Forensic at the #cybersecurity4success conference 3 October 2016
Data Mining in Incident Response - Challenges and Opportunities 13 May 2016
Experiences with Paste-Monitoring 18 March 2016
Four years of practical information sharing MISP & Threat Sharing 25th February 2016
Information Sharing and Taxonomies Practical Classification of Threat Indicators using MISP 26th January 2016
Improving Data Sharing to Increase Security Research Opportunities 2nd November 2015
cve-search - a free software to collect, search and analyse common vulnerabilities and exposures in software 9th October 2015
Protect your data, protect your life. Data Destruction Day 22nd September 2015
New ZeroMQ functionality in MISP 2nd July 2015
Sharing Threat Indicators and Security Ranking, an opportunity for the Internet Community 18 November 2014
Attackers benefit from sharing information. How can you benefit, too? at ICTSpring 4 July 2014
The void - An interesting place for network security monitoring Cynthia Wagner, Marc Stiefer (RESTENA), Alexandre Dulaunoy, Gérard Wagener (CIRCL) at TNC 2014 19 May 2014
Information Sharing Cornerstone in Incident Detection and Handling at DBIR presentation in Paris 15 May 2014
Darknet and Black Hole Monitoring a Journey into Typographic Errors at Honeynet Project Workshop in Warsaw 12 May 2014
An Overview of Security Incidents Targeting Citizen How the Attackers Are Deceiving Us? 15 March 2014
Passive DNS - Common Output Format 14 February 2014
Who targets the journalists? and how? A review of the attack surface in our digital society 7 February 2014
MISP or How to Share Efficiently IOCs Within a Country 26 July 2013
BGP Ranking Scoring ASNs Based on Their Potential Maliciousness 23 June 2013
ASMATRA: Ranking ASs Providing Transit Service to Malware Hosters 29 May 2013
Another Perspective to IP-Darkspace Analysis 29 January 2013

The Digital First Aid Kit

The Digital First Aid Kit aims to provide preliminary support for people facing the most common types of digital threats. The Kit offers a set of self-diagnostic tools for citizen, human rights defenders, bloggers, activists and journalists fac ing attacks themselves, as well as providing guidelines for digital first responders to assist a person under threat.

Description Last update
Digital First Aid Kit - Account Hijacking 2nd September 2014
Digital First Aid Kit - DDoS Mitigation 2nd September 2014
Digital First Aid Kit - Devices Lost? Stolen? Seized? 2nd September 2014
Digital First Aid Kit - Glossary 2nd September 2014
Digital First Aid Kit - Malware 2nd September 2014
Digital First Aid Kit - Secure Communication 2nd September 2014

The Digital First Aid Kit (German Edition)

Description Last update
Digital First Aid Kit - Konto-Diebstahl 18th March 2015
Digital First Aid Kit - Devices Lost? Stolen? Seized? 26th March 2015

Security Advisories

The latest CIRCL security advisories are published by Vulnerability-Lookup.

Loading the latest security advisories…

    Browse all vulnerabilities on Vulnerability-Lookup

    Other publications

    Description Last update
    Coordinated Vulnerability Disclosure (CVD) Policy 18th June 2025
    CIRCL Taxonomy - Schemes of Classification in Incident Response and Detection 15th March 2018
    Responsible Vulnerability Disclosure 10th January 2015
    Traffic Light Protocol (TLP) - Classification and Sharing of Sensitive Information March 2014
    CIRCL - Request for Proposals Regularly Updated
    Top