<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>War Room</title>
	<atom:link href="https://warroom.rsmus.com/author/patchwork/feed/" rel="self" type="application/rss+xml" />
	<link>https://warroom.rsmus.com</link>
	<description>Shells From Above</description>
	<lastBuildDate>Thu, 15 Feb 2024 19:22:50 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://warroom.rsmus.com/wp-content/uploads/2018/09/cropped-favicon-32x32.png</url>
	<title>War Room</title>
	<link>https://warroom.rsmus.com</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>TSA cybersecurity directives: What pipeline companies need to know</title>
		<link>https://warroom.rsmus.com/tsa-cybersecurity-directives-what-pipeline-companies-need-to-know/</link>
		
		<dc:creator><![CDATA[Ken Smith]]></dc:creator>
		<pubDate>Wed, 04 Aug 2021 17:01:44 +0000</pubDate>
				<category><![CDATA[Defense]]></category>
		<category><![CDATA[Physical]]></category>
		<category><![CDATA[Pipeline]]></category>
		<category><![CDATA[TSA]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=5474</guid>

					<description><![CDATA[After the Colonial Pipeline ransomware attack shut down the entire pipeline system for over a week, the Department of Homeland Security’s (DHS) Transportation Security Administration (TSA) issued a directive requiring all pipeline companies to take immediate actions to mitigate cyber risks. The first cybersecurity directive was issued on May 27 and the follow-up directive was [&#8230;]]]></description>
		
		
		
			</item>
		<item>
		<title>Mass Mailing Attack from NOBELIUM</title>
		<link>https://warroom.rsmus.com/mass-mailing-attack-from-nobelium/</link>
		
		<dc:creator><![CDATA[Ken Smith]]></dc:creator>
		<pubDate>Tue, 01 Jun 2021 21:09:23 +0000</pubDate>
				<category><![CDATA[Business Email Compromise]]></category>
		<category><![CDATA[Defense]]></category>
		<category><![CDATA[Phishing]]></category>
		<category><![CDATA[ransomware]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=5449</guid>

					<description><![CDATA[On May 25, 2021, the campaign escalated as NOBELIUM, the same group behind the 2020 SolarWinds attacks, leveraged the legitimate mass-mailing service, Constant Contact, to masquerade as a US-based development organization and distribute malicious URLs to a wide variety of organizations and industry verticals. Using the legitimate mass mailing service Constant Contact, NOBELIUM attempted to [&#8230;]]]></description>
		
		
		
			</item>
		<item>
		<title>Colonial Pipeline Ransomware</title>
		<link>https://warroom.rsmus.com/colonial-pipeline-ransomware/</link>
		
		<dc:creator><![CDATA[Ken Smith]]></dc:creator>
		<pubDate>Wed, 12 May 2021 18:49:50 +0000</pubDate>
				<category><![CDATA[Offense]]></category>
		<category><![CDATA[ransomware]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=5430</guid>

					<description><![CDATA[Ransomware attacks are no longer simply a malware infection. Today’s ransomware threat actor groups are comprised of skilled hackers who are well-versed in infiltrating their victims’ networks. Once inside the target network, these attackers perform reconnaissance to identify critical accounts, systems and even sensitive data stored within the network. Since the mid-2010s, we have observed [&#8230;]]]></description>
		
		
		
			</item>
		<item>
		<title>Building a Vulnerable Box: RemoteMouse</title>
		<link>https://warroom.rsmus.com/building-a-vulnerable-box-remotemouse/</link>
		
		<dc:creator><![CDATA[Ken Smith]]></dc:creator>
		<pubDate>Fri, 29 Jan 2021 19:14:36 +0000</pubDate>
				<category><![CDATA[Offense]]></category>
		<category><![CDATA[Research]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=5379</guid>

					<description><![CDATA[At the start of every year, I review my lab repository of intentionally vulnerable machines and do my best to add new ones to the list. I recently came across a particularly interesting flaw, from a teaching perspective, and thought it would be worth capturing. RemoteMouse is Windows/Linux/Mac compatible software that can be used in [&#8230;]]]></description>
		
		
		
			</item>
	</channel>
</rss>
