CQURE

A website. A few clicks. A crypto payment. Hundreds of thousands of attacks.

That was the business model behind NightmareStresser, one of the longest-running DDoS-for-hire services.

Now, the FBI has seized its domains as part of Operation PowerOFF, bringing down a platform reportedly capable of launching up to 4,000 attacks per hour.

But the real story goes beyond the takedown.

When competing services were disrupted in 2018, NightmareStresser grew stronger and eventually became one of the biggest players in the market.

So what happens when the next major player disappears?

Our latest article takes a closer look at the operation, the scale of NightmareStresser, and why disrupting a DDoS-for-hire service doesn't necessarily mean eliminating the threat.

Read the full article: https://cqureacademy.com/blog/the-nightmare-is-over-worlds-longest-running-ddos-service-finally-shut-down/

And if you’d like to take your Microsoft security knowledge further, check out our Advanced Microsoft Security Course (AMSC) for 2027.

Ready to level up your skills? Learn more and join us: https://cqureacademy.com/cyber-security-training/advanced-microsoft-security-course-for-2027/

The Nightmare Is Over: World's Longest-Running DDoS Service Finally Shut Down Most incidents stem from predictable flaws in design and privilege flow, not breakthrough techniques.

What if the key to stronger Windows security lies in controlling what is allowed to run?

Next week, we’re bringing you CMAP Module 14: Configuring Application Whitelisting, led by Sami Laiho.

On October 7, we’ll explore how AppLocker can help organizations control application ex*****on, reduce attack surfaces, and strengthen their security posture.

Understanding how to restrict unwanted applications is one thing. Knowing how to approach it in practice, avoid common pitfalls, and troubleshoot configurations is where the real learning begins.

Join us for another module of the Cybersecurity Master Annual Program and take your Windows security knowledge further.

Join the next module: https://cqureacademy.com/cyber-security-training/cmap-2026-module-14-configuring-application-whitelisting/

Maintaining a 98% satisfaction rate in enterprise cybersecurity training requires relentless technical precision. When senior system engineers and SOC analysts finish AMSC, they don't just leave with a certificate - they leave with hands-on experience gained directly in live virtual labs.

What real-world scenarios that you practiced during the AMSC training have you also encountered in your daily work? 🤔

Join Advanced Microsoft Security Course for 2027 with Paula Januszkiewicz, Sami Laiho, Peter Kloep & more: 🔗 cqureacademy.com/cyber-security-training/advanced-microsoft-security-course-for-2027/

You know how to secure Windows. But do you know how to break it?

From network discovery and vulnerability assessment to exploitation and defense, understanding both sides of an attack is essential to securing enterprise environments.

Hacking and Securing Windows Infrastructure is a 5-day intensive training led by Paula Januszkiewicz and Amr Thabet, designed to take you deeper into the techniques, weaknesses, and defensive strategies behind Windows infrastructure security.

Expect a week packed with scenarios that go beyond simply identifying a vulnerability. The focus is on understanding how attacks work and what it takes to stop them.

October 12-16, 2026

Learn more and secure your spot: https://cqureacademy.com/cyber-security-training/lvc-hacking-and-securing-windows-infrastructure/

Want to understand what Windows Event ID 4624 can really tell you?

In our latest CQURE Hacks video, we break down different Windows logon types in a hands-on lab and show how to interpret them from a security monitoring perspective.

You’ll see how to analyze:
1. Logon Types 2, 3, 5, 7, 9, and 10
2. RDP and SMB activity
3. Alternate credentials for network connections
4. Source IPs and authentication packages
5. Patterns useful for threat hunting and lateral movement analysis

Event ID 4624 is much more than a successful logon record. When you correlate the right fields, it becomes a valuable source of context for investigating Windows authentication activity.

Watch the full video and read the blog post here:
https://cqureacademy.com/blog/cqure-hacks-84-understanding-event-id-4624-in-action/

CQURE Hacks #84: Understanding Event ID 4624 in Action Explore Event ID 4624 in a practical lab and demonstrate how different logon scenarios appear in Windows Security logs and how they can be analyzed from a threat hunting perspective.

CVE-2026-69836 was rated CVSS 10.0 Critical and affected Microsoft Entra ID, the identity platform behind Microsoft 365, Azure and thousands of federated applications.

The vulnerability involved unsafe deserialization of untrusted data and was fully mitigated by Microsoft on the server side, meaning no customer-side patch was required.

There’s also an unusual part to the story.

Microsoft initially marked the vulnerability as “Exploited: Yes” before correcting the advisory to state that there was no confirmed exploitation in the wild.

So what should security teams focus on?

Not just the CVSS score.

Our latest article breaks down CVE-2026-69836 and provides KQL queries for investigating potential post-exploitation activity in Microsoft Entra ID.

If you use Entra ID, this is a good opportunity to review your audit and sign-in logs and look for activity that doesn’t belong.

Read the full article from CQURE:

CVE-2026-69836 Most incidents stem from predictable flaws in design and privilege flow, not breakthrough techniques.

The CMAP series continues through the end of 2026! 🔐

CMAP is a complete cybersecurity training program, but you don't have to attend every single class to benefit from it. Each module can also be taken individually, giving you the opportunity to dive into a specific topic and learn directly from experts in a focused masterclass.

Here’s what’s coming up:

Module 13: Modern Windows Security Baselining: Standards, Settings and Solutions for Managing Safe Environment

October 1
With John O’Neill, Sr., Cybersecurity Expert, Microsoft MVP
From Windows security to hybrid cloud environments, John brings a practical perspective on securing modern IT infrastructure. This session explores security baselines, configuration standards and ways to maintain a secure Windows environment.

🔗 Learn more & register: https://cqureacademy.com/cyber-security-training/cmap-2026-module-13-modern-windows-security-baselining/

Module 14: Configuring Application Whitelisting

October 7
With Sami Laiho, Windows OS Expert & Microsoft MVP
Which applications should actually be allowed to run in your environment? Sami brings more than 25 years of Windows experience to a session focused on implementing, managing and troubleshooting application whitelisting with AppLocker.

🔗 Learn more & register: https://cqureacademy.com/cyber-security-training/cmap-2026-module-14-configuring-application-whitelisting/

Module 15: NTLMv2 Deprecation: Technical Preparation and Infrastructure Considerations

November 19
With Peter Kloep, AD Master, Cybersecurity Expert & Principal IT Architect
Moving away from NTLMv2 is not just a matter of changing a setting. This module looks at the technical dependencies, infrastructure considerations and preparation needed to approach authentication modernization.

🔗 Learn more & register: https://cqureacademy.com/cyber-security-training/cmap-2026-module-15-ntlmv2-deprecation

Module 16: Steps for Building Incident Response Readiness

December 10
With Paula Januszkiewicz, Founder & CEO of CQURE, Microsoft Regional Director & MVP
Having an incident response plan is one thing. Knowing how to use it when an incident happens is another. Paula will walk through the steps involved in building and improving incident response readiness.

🔗 Learn more & register: https://cqureacademy.com/cyber-security-training/cmap-2026-module-16-incident-response-readiness/

Four more opportunities to learn, ask questions and bring new knowledge back to your own environment.

Swipe through the carousel for more details about each session.

Explore the full CMAP program and choose the modules that fit your learning goals.

🔗 Discover CMAP and register: https://cqureacademy.com/

What an incredible day at AI-CONNECT 2026!

On Wednesday, Paula Januszkiewicz took the stage with her presentation „Cybersecurity in the AI Era”, exploring how artificial intelligence is transforming the cybersecurity landscape.

From emerging attack techniques and new threat vectors to the evolving role of defenders, the discussion highlighted why staying ahead has never been more important.

Thank you to the organizers, co-speakers and participants for the engaging discussions and valuable exchange of insights 🤝 Natalia Hatalska, Artur Kurasiński, Marcin Sawicki, Dr Ewelina Kurtys, Sebastian Kondracki, Dorota Sędek, MBA, Joanna Mercik, PhD, Paweł Gora, Paweł Wroblewski, Wojciech Kozicki, Agnieszka Rusak-Tyma, Radosław Zacha, Michał Olejarski, Łukasz Roszak, Daniel Czapiewski, Marcin Kaczmarek, Monika Sonta, Paweł Doniec, Łukasz Jędrzejczak, Marcin Madey, Paweł Kozłowski, Arkadiusz Kocikowski, Krzysztof Pietrusewicz, Piotr Kowalski, Magdalena Ławicka, Robert Sikora.

Ai Connect Klaster ICT Pomorze Zachodnie Kongsberg Maritime Pomorze Zachodnie Szczecin Floating Garden