Category Archives: Uncategorized

Article, Knowledge, News, Uncategorized

Another European Region Ditches Microsoft: Linux Adoption Accelerates

🇩🇪 Another European Region Ditches Microsoft: Linux Adoption Accelerates

Following Denmark’s recent move to transition its digital infrastructure to Linux and LibreOffice, a German federal state has now announced a similar plan — dropping Microsoft Windows and Office in favor of open-source alternatives. The shift is gaining momentum, and it’s starting to look like a growing European movement.

But what does this trend mean for the future of government IT, digital sovereignty, and cybersecurity?

A Growing Pattern Across Europe

First Denmark, now a German state — and this might just be the beginning. In the article published by PC för Alla, the German state has declared its intention to gradually move public institutions away from Microsoft products. The reasons are similar across the board:

  • Reducing dependence on foreign tech giants
  • Saving public money
  • Gaining control over software ecosystems
  • Ensuring long-term access and compatibility through open standards

Europe has long been debating digital sovereignty, especially as tensions rise globally over data protection and geopolitical control of tech infrastructure. Open-source software offers an escape from this vendor lock-in.

The Positive Outcomes

  • Economic Savings: No more massive license renewals for operating systems and productivity suites.
  • Customizability: Open-source allows tailoring to local needs — something large commercial vendors rarely provide.
  • Transparency: Anyone can audit the code, which is especially important for public institutions handling sensitive data.
  • Standardization Across Borders: If multiple EU countries use similar open-source stacks, it could lead to better interoperability and shared resources.

But Not Without Risk

Despite its advantages, the shift comes with challenges:

  • Learning Curve: Staff accustomed to Windows and Microsoft Office will need training and time to adapt.
  • Compatibility: Not all workflows or legacy systems migrate smoothly — especially in bureaucracy-heavy sectors.
  • Support Infrastructure: While Microsoft offers commercial support, governments must now rely on internal expertise or third-party support companies.
  • Security Target Shift: As mentioned in our earlier coverage of Denmark’s move — the more popular Linux becomes, the more attractive it becomes to attackers.

“Security through obscurity” is no longer an option. If Linux-based systems become the new standard in public administration, they must be secured with the same (or higher) rigor traditionally applied to Windows-based environments.

What the Future Might Hold

If this trend continues, we could see:

  • A cascade effect, with other regions and countries following suit
  • The development of new government-funded open-source distributions or tools
  • A more resilient, independent European digital landscape
  • But also, a potential rise in Linux-targeted malware, phishing campaigns, and zero-day exploits

Governments must prepare for both the benefits and the responsibilities that come with running an open-source infrastructure.

Final Thoughts

This isn’t just about software — it’s about sovereignty, transparency, and the future of public digital services. If properly managed, the move to Linux can empower governments and protect citizen data. But poor implementation or lack of preparation could lead to service disruptions, user frustration, and even new cyberattack vectors.

Europe is changing. The question is: will the rest of the world follow?

Article, Knowledge, News, Uncategorized

Anubis Ransomware

What is Anubis Ransomware?

Discovered in mid-2025, Anubis is a ransomware variant that takes its name from the Egyptian god of the dead—and for good reason. Instead of merely holding files hostage, it executes them. After encrypting a victim’s files, the malware demands a ransom (usually in cryptocurrency), promising a decryption key upon payment. However, analysis has revealed that the malware has no functional decryption routine—once the files are encrypted, they are irreversibly overwritten or deleted.

Security researchers believe this behavior is intentional, likely designed to cause maximum disruption and psychological damage rather than financial gain.

Who Are the Targets?

Anubis doesn’t discriminate by industry, but critical infrastructure and healthcare institutions appear to be prime targets. Several reported attacks have involved:

  • Hospitals and clinics, resulting in data loss and halted medical operations.
  • Municipal networks, affecting emergency response and civic services.
  • Educational institutions, erasing research and administrative records.
  • SMBs (small and medium-sized businesses) lacking proper backups.

The choice of targets seems tactical—disrupting organizations where downtime equals danger.

Technical Behavior

While the full technical breakdown is still ongoing, researchers have observed the following behavior:

  • Payload Delivery: Via phishing emails, malicious attachments, or vulnerable exposed services (e.g. RDP, VPN).
  • Encryption: Files are encrypted with strong algorithms, but without saving decryption metadata.
  • Destruction: Files are deleted or corrupted even if ransom is paid.
  • Anti-Recovery: It wipes shadow copies, disables backups, and often attempts to overwrite files with garbage data before deletion.

Anubis also prevents boot in some cases, corrupting system partitions or disabling key services to paralyze the system further.

How to Protect Yourself

Given Anubis’ non-negotiable nature, prevention is the only real defense. Here are critical steps to minimize your risk:

1. Backups Are King

  • Maintain regular, offline, and offsite backups.
  • Test recovery procedures monthly.
  • Avoid mapping backup storage directly to production systems.

2. Patch and Harden

  • Keep systems, especially public-facing services, fully patched.
  • Disable unnecessary ports (like RDP) and use firewalls or VPNs to restrict remote access.
  • Harden configurations using CIS Benchmarks or similar guidelines.

3. Educate Your Team

  • Conduct regular phishing training.
  • Simulate attacks to build awareness.

4. Use EDR and Network Monitoring

  • Employ Endpoint Detection and Response (EDR) tools with behavioral detection.
  • Monitor traffic for unusual activity (e.g., outbound traffic spikes, command & control connections).

5. Zero Trust Principles

  • Limit permissions.
  • Segment networks.
  • Authenticate everything—especially internal access.

Should You Ever Pay?

No. Not with Anubis. This is not a ransomware that unlocks your files post-payment—it destroys them. Paying only funds further destruction and emboldens attackers.

Instead, report the attack to national cybersecurity authorities (like CERT-SE in Sweden or CISA in the U.S.), preserve any evidence, and isolate infected systems immediately.

Final Thoughts

Anubis is not just another ransomware strain—it represents a shift in cybercriminal mindset from extortion to pure sabotage. It also underlines the critical importance of preparedness over reaction.

“Hope is not a strategy. Backups, segmentation, and proactive defense are.”

Organizations—especially those in healthcare and critical infrastructure—must now treat ransomware not just as a financial threat, but as a destructive force. With no key, no mercy, and no trust, Anubis lives up to its mythological namesake—ushering victims straight to the digital underwo

Uncategorized

Common ports

The Most Common Network Port Attacks – And How to Defend Against Them

When it comes to cybersecurity, attackers rarely go in blind. They systematically scan for open ports—the digital doors and windows into your network. Some ports are more popular targets than others, simply because of the critical services running behind them. In this article, we break down the typical attacks seen on the most common ports and provide actionable defense strategies to help keep your systems secure.

1. FTP (Port 21) – File Transfer Protocol

Attacks:

  • Brute-force & Anonymous Login: Attackers attempt to guess passwords or exploit misconfigurations allowing “anonymous” access, gaining entry without credentials.
  • Directory Traversal: Malicious actors manipulate file paths to access directories and files outside the permitted scope, sometimes leading to full system compromise.

Defense:

  • Disable anonymous access unless absolutely necessary.
  • Enforce strong, unique passwords and limit failed login attempts.
  • Restrict FTP access to trusted IP addresses or internal networks.
  • Replace plain FTP with SFTP or FTPS for encrypted transfers.
  • Keep your FTP server updated with the latest security patches.

2. SSH (Port 22) – Secure Shell

Attacks:

  • Brute-force & Credential Stuffing: Attackers use automated tools to try common passwords or leaked credentials.
  • Exploiting Old Vulnerabilities: Outdated SSH software may have known exploits (e.g., CVEs).

Defense:

  • Disable password authentication; use SSH keys instead.
  • Change the default SSH port to a non-standard number (security through obscurity).
  • Use fail2ban or similar tools to block repeated failed login attempts.
  • Regularly patch your SSH server.
  • Allow SSH access only from trusted networks or via VPN.

3. Telnet (Port 23) – Unencrypted Remote Login

Attacks:

  • Brute-force: Attackers try various credential combinations.
  • Man-in-the-Middle (MitM): Data sent in plaintext can be intercepted.
  • Sniffing: Passwords and commands are easily captured on the network.

Defense:

  • Avoid Telnet. Use SSH instead.
  • If you must use Telnet, restrict access to local networks and use strong, unique passwords.
  • Monitor network traffic for unexpected Telnet activity.

4. SMTP (Port 25) – Simple Mail Transfer Protocol

Attacks:

  • Spamming & Open Relay Abuse: Misconfigured servers relay spam.
  • Phishing: Attackers send malicious emails that appear legitimate.

Defense:

  • Disable open relay functionality.
  • Implement SPF, DKIM, and DMARC to prevent email spoofing.
  • Use email filtering and anti-spam solutions.
  • Educate users about phishing risks.

5. DNS (Port 53) – Domain Name System

Attacks:

  • DNS Amplification: Attackers exploit open resolvers for DDoS attacks.
  • Cache Poisoning: Malicious responses trick DNS servers into saving false records.
  • Tunneling: DNS is abused as a covert channel to exfiltrate data.

Defense:

  • Disable recursion for external clients.
  • Use DNSSEC to protect against spoofing and cache poisoning.
  • Monitor DNS traffic for anomalies.
  • Harden your DNS server with regular updates.

6. HTTP (Port 80) – Web Traffic (Unencrypted)

Attacks:

  • Cross-Site Scripting (XSS): Attackers inject malicious scripts into web pages.
  • SQL Injection: Malicious input alters database queries.
  • Directory Traversal: Exploiting poor input validation to access sensitive files.

Defense:

  • Validate and sanitize all user input.
  • Implement Content Security Policy (CSP) for web applications.
  • Use Web Application Firewalls (WAFs).
  • Keep your web server and frameworks updated.
  • Migrate to HTTPS to prevent eThe Most Common Network Port Attacks – And How to Defend Against Them
  • By Jull3Haxor
  • When it comes to cybersecurity, attackers rarely go in blind. They systematically scan for open ports—the digital doors and windows into your network. Some ports are more popular targets than others, simply because of the critical services running behind them. In this article, we break down the typical attacks seen on the most common ports and provide actionable defense strategies to help keep your systems secure.
  • FTP (Port 21) – File Transfer Protocol
    Attacks:
  • Brute-force & Anonymous Login: Attackers attempt to guess passwords or exploit misconfigurations allowing “anonymous” access, gaining entry without credentials.
  • Directory Traversal: Malicious actors manipulate file paths to access directories and files outside the permitted scope, sometimes leading to full system compromise.
  • Defense:
  • Disable anonymous access unless absolutely necessary.
  • Enforce strong, unique passwords and limit failed login attempts.
  • Restrict FTP access to trusted IP addresses or internal networks.
  • Replace plain FTP with SFTP or FTPS for encrypted transfers.
  • Keep your FTP server updated with the latest security patches.
  • SSH (Port 22) – Secure Shell
    Attacks:
  • Brute-force & Credential Stuffing: Attackers use automated tools to try common passwords or leaked credentials.
  • Exploiting Old Vulnerabilities: Outdated SSH software may have known exploits (e.g., CVEs).
  • Defense:
  • Disable password authentication; use SSH keys instead.
  • Change the default SSH port to a non-standard number (security through obscurity).
  • Use fail2ban or similar tools to block repeated failed login attempts.
  • Regularly patch your SSH server.
  • Allow SSH access only from trusted networks or via VPN.
  • Telnet (Port 23) – Unencrypted Remote Login
    Attacks:
  • Brute-force: Attackers try various credential combinations.
  • Man-in-the-Middle (MitM): Data sent in plaintext can be intercepted.
  • Sniffing: Passwords and commands are easily captured on the network.
  • Defense:
  • Avoid Telnet. Use SSH instead.
  • If you must use Telnet, restrict access to local networks and use strong, unique passwords.
  • Monitor network traffic for unexpected Telnet activity.
  • SMTP (Port 25) – Simple Mail Transfer Protocol
    Attacks:
  • Spamming & Open Relay Abuse: Misconfigured servers relay spam.
  • Phishing: Attackers send malicious emails that appear legitimate.
  • Defense:
  • Disable open relay functionality.
  • Implement SPF, DKIM, and DMARC to prevent email spoofing.
  • Use email filtering and anti-spam solutions.
  • Educate users about phishing risks.
  • DNS (Port 53) – Domain Name System
    Attacks:
  • DNS Amplification: Attackers exploit open resolvers for DDoS attacks.
  • Cache Poisoning: Malicious responses trick DNS servers into saving false records.
  • Tunneling: DNS is abused as a covert channel to exfiltrate data.
  • Defense:
  • Disable recursion for external clients.
  • Use DNSSEC to protect against spoofing and cache poisoning.
  • Monitor DNS traffic for anomalies.
  • Harden your DNS server with regular updates.
  • HTTP (Port 80) – Web Traffic (Unencrypted)
    Attacks:
  • Cross-Site Scripting (XSS): Attackers inject malicious scripts into web pages.
  • SQL Injection: Malicious input alters database queries.
  • Directory Traversal: Exploiting poor input validation to access sensitive files.
  • Defense:
  • Validate and sanitize all user input.
  • Implement Content Security Policy (CSP) for web applications.
  • Use Web Application Firewalls (WAFs).
  • Keep your web server and frameworks updated.
  • Migrate to HTTPS to prevent eavesdropping.
  • HTTPS (Port 443) – Web Traffic (Encrypted)
    Attacks:
  • SSL/TLS Attacks: Outdated or misconfigured protocols can be exploited (e.g., Heartbleed).
  • Phishing & Credential Harvesting: Malicious websites using HTTPS trick users into entering sensitive data.
  • Defense:
  • Disable insecure SSL/TLS versions (use TLS 1.2+).
  • Use strong certificates from a trusted CA.
  • Enable HSTS (HTTP Strict Transport Security).
  • Monitor for phishing sites mimicking your domain.
  • SMB (Port 445) – Server Message Block (File Sharing, Windows)
    Attacks:
  • EternalBlue: A famous exploit used in ransomware attacks like WannaCry.
  • Ransomware Spreading: Malware moves laterally through open SMB shares.
  • Pass-the-Hash: Attackers reuse stolen password hashes to gain access.
  • Defense:
  • Disable SMBv1; use SMBv2/v3.
  • Patch systems regularly (especially Windows).
  • Restrict SMB access to local networks.
  • Segment your network and monitor lateral movement.
  • Use strong passwords and enable account lockout policies.
  • RDP (Port 3389) – Remote Desktop Protocol
    Attacks:
  • Brute-force: Attackers try to guess RDP credentials.
  • BlueKeep: A critical RDP vulnerability allowing remote code execution.
  • Defense:
  • Limit RDP exposure to the internet—use VPN for remote access.
  • Implement Network Level Authentication (NLA).
  • Use account lockout and two-factor authentication.
  • Patch Windows regularly.
  • Monitor RDP logs for suspicious activity.
  • Final Tips for Network Defense
  • Close all unnecessary ports.
  • Use a layered defense (firewalls, IDS/IPS, endpoint protection).
  • Conduct regular vulnerability scans and penetration tests.
  • Keep software and operating systems up to date.
  • Train users on cybersecurity best practices.
  • By understanding these common port-based attacks and applying strong, multi-layered defenses, you significantly reduce your risk of compromise—no matter the size of your network.
  • Stay secure. Patch often. Hack the hackers!
  • Did you enjoy this article? For more tips and deep dives, check out jull3.netavesdropping.

7. HTTPS (Port 443) – Web Traffic (Encrypted)

Attacks:

  • SSL/TLS Attacks: Outdated or misconfigured protocols can be exploited (e.g., Heartbleed).
  • Phishing & Credential Harvesting: Malicious websites using HTTPS trick users into entering sensitive data.

Defense:

  • Disable insecure SSL/TLS versions (use TLS 1.2+).
  • Use strong certificates from a trusted CA.
  • Enable HSTS (HTTP Strict Transport Security).
  • Monitor for phishing sites mimicking your domain.

8. SMB (Port 445) – Server Message Block (File Sharing, Windows)

Attacks:

  • EternalBlue: A famous exploit used in ransomware attacks like WannaCry.
  • Ransomware Spreading: Malware moves laterally through open SMB shares.
  • Pass-the-Hash: Attackers reuse stolen password hashes to gain access.

Defense:

  • Disable SMBv1; use SMBv2/v3.
  • Patch systems regularly (especially Windows).
  • Restrict SMB access to local networks.
  • Segment your network and monitor lateral movement.
  • Use strong passwords and enable account lockout policies.

9. RDP (Port 3389) – Remote Desktop Protocol

Attacks:

  • Brute-force: Attackers try to guess RDP credentials.
  • BlueKeep: A critical RDP vulnerability allowing remote code execution.

Defense:

  • Limit RDP exposure to the internet—use VPN for remote access.
  • Implement Network Level Authentication (NLA).
  • Use account lockout and two-factor authentication.
  • Patch Windows regularly.
  • Monitor RDP logs for suspicious activity.

Final Tips for Network Defense

  • Close all unnecessary ports.
  • Use a layered defense (firewalls, IDS/IPS, endpoint protection).
  • Conduct regular vulnerability scans and penetration tests.
  • Keep software and operating systems up to date.
  • Train users on cybersecurity best practices.

By understanding these common port-based attacks and applying strong, multi-layered defenses, you significantly reduce your risk of compromise—no matter the size of your network.

Stay secure. Patch often. Hack the hackers!

Uncategorized

Welcome to Jull3Hax0r Blog – Enter the Terminal

Leave a comment

Welcome to my brand new blog!If you’re reading this, you’ve found your way to a small corner of the internet dedicated to hacking, cybersecurity, and digital curiosity.

I go by Jull3Hax0r. I’m a penetration tester, CTF enthusiast, and Linux tinkerer based in Sweden. Here you’ll find everything from guides and write-ups to project logs, hacking tips, and the occasional cyber-meme. I spend most of my days breaking things (legally), building scripts and tools in Python and Bash, and hunting for vulnerabilities in networks, web apps, and embedded devices.

What to expect on this blog:

  • Deep dives into penetration testing techniques
  • OSINT investigations and tool development
  • Write-ups from Hack The Box, TryHackMe, and other CTFs
  • Linux tips, server security, and privacy tricks
  • Scripts, code snippets, and automation ideas
  • Stories from real-world hacking labs

I believe in learning by doing, sharing knowledge, and having fun along the way. Whether you’re a seasoned pentester, a hobbyist, or just starting out, I hope you’ll find something useful (or at least entertaining) here.

Feel free to reach out via the contact form or connect with me on GitHub or Jull3.se.
Stay anonymous. Stay curious. Happy hacking!

— Jull3Hax0r