A deep dive into GoldFactory’s evolving mobile fraud campaigns across APAC, including modified banking apps, new malware variants such as Gigaflower, shared criminal infrastructure, and insights from the Group-IB Fraud Matrix, with recommendations for organizations and end users.
Huntress reports an uptick in threat actors abusing the Velociraptor open-source DFIR tool, linked to incidents involving WSUS exploitation, VS Code tunnels, and more.
Rodney Petersen has served as the Director of NICE at the National Institute for Standards and Technology (NIST) for the past eleven years where his focus has been on advancing cybersecurity education and workforce development. He will be retiring from federal government service at the end of the 2025 calendar year. Prior to his role at NIST, he has worked in various technology policy and leadership roles with EDUCAUSE and the University of Maryland. The NICE program, led by the National Instit…
MuddyWater targets critical infrastructure in Israel and Egypt, relying on custom malware, improved tactics, and a predictable playbook
Do you know where identity attacks come from? It’s not just location or VPNs, but there’s a "secret third thing" in identity attacks. See how a new AS-based detection system closed this critical visibility gap.
Discover how real-time fraud intelligence sharing prevents APP fraud before losses. Stop mule accounts already during warm-up with GDPR-compliant technology.
What is cyber threat hunting, and what do threat hunters do? In this blog, we define what threat hunting actually is and the strategy and skill behind it.
From LinkedIn to X, GitHub to Instagram, there are plenty of opportunities to share work-related information. But posting could also get your company into trouble.
Data exposure by top AI companies, the Akira ransomware haul, Operation Endgame against major malware families, and more of this month's cybersecurity news
Online disagreements among young people can easily spiral out of control. Parents need to understand what’s at stake.
Huntress CEO Kyle Hanslovan's live hack demo: modern hacker playbook, with stolen credentials, MFA bypass, and M365 token hijacking. Get defense tips, stay protected.
Since late June 2025, Group-IB analysts observed a surge in spear-phishing emails across Central Asia. The attackers impersonate government agencies to gain the trust of their victims. This blog describes the techniques, tools and ongoing activity of the threat group known as Bloody Wolf.
Social media influencers can provide reach and trust for scams and malware distribution. Robust account protection is key to stopping the fraudsters.
On 24th Nov 2025, our Internet-scale monitoring systems detected a sharp and anomalous spike in newly indexed Git commits matching highly uniform characteristics. The volume of commits containing the message “Add file” surged from a baseline average of approximately 200/day to more than 13,000 within a single hour. This deviation breached automated anomaly-detection thresholds and initiated an urgent investigation. Subsequent analysis confirmed the emergence of a new variant of the Shai-Hulud N…
Explore the top benefits of cybersecurity outsourcing and learn how it can bolster defenses while freeing up time, energy, and resources for your team.
Huntress uncovered an attack utilizing a ClickFix lure to initiate a multi-stage malware execution chain. This analysis reveals how threat actors use steganography to conceal infostealers like LummaC2 and Rhadamanthys within seemingly harmless PNGs.
Posted by Dave Kleidermacher, VP, Platforms Security & Privacy, Google Technology should bring people closer together, not create walls. Being able to communicate and connect with friends and family should be easy regardless of the phone they use. That’s why Android has been building experiences that help you stay connected across platforms. As part of our efforts to continue to make cross-platform communication more seamless for users, we've made Quick Share interoperable with AirDrop, allowin…
Huntress has seen an uptick in threat actors abusing the Velociraptor open-source DFIR tool in a range of attacks, including a recent incident involving WSUS exploitation.
Huntress acquired Inside Agent to bolster identity security with a new ISPM solution. The move enhances proactive defense against cyberattacks.
Huntress is now on the Microsoft Marketplace. Combine our protection with Microsoft 365 and Defender, get 24/7 monitoring, and enjoy enterprise-grade security without the hefty price tag.
In this blog, we dive into the critical layers that make up a solid cybersecurity stack and provide tips for getting buy-in from decision makers.
Posted by Jeff Vander Stoep, Android Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we look at how this approach isn’t just fixing things, but helping us move faster. The 2025 data continues to validate the approach, with memory safety vulnerabilities falling below 20% of total vulnerabilities for the first time. Updated data for 2025. This data covers first-party and third-party…
Group-IB researchers uncovered a professional phishing framework that mimics trusted brands with remarkable precision. Using layered evasion, CAPTCHA filtering, and Telegram-based data exfiltration, attackers harvest credentials and bypass automated detection. The findings highlight how phishing-as-a-service operations are scaling through automation, lowering technical barriers for cybercriminals, and industrializing one of the oldest yet most effective forms of digital fraud.
Threat actors are targeting the education sector with data breaches, phishing emails, ransomware hits, brute force RDP attacks, and more.
MFA for business isn’t a silver bullet. But it’s close! Learn the benefits, MFA methods, and how to make it work without the usual headaches.
11,000+ hackers—one epic challenge. See who the winners are and key insights from this year's massive Huntress Capture the Flag competition. Read the full breakdown!
Gootloader returns with new obfuscation techniques, including custom WOFF2 fonts and updated persistence mechanisms, while continuing its partnership with Vanilla Tempest for ransomware deployment. Dive in and discover what Huntress is seeing.
Huntress and DEFCERT partnered to help with CMMC compliance. Use their Shared Responsibility Matrix and operation plans to streamline your Level 2 assessment
Discover how attackers could manipulate the Linux /proc filesystem to hide malicious processes and distort forensic timelines. This technical deep dive highlights examples of command-line substitution and start time corruption, and offers detection and defense strategies for incident responders and security analysts.
Learn how cybercriminals bypass Microsoft 365 MFA and steal credentials in a live hacking demo. Discover defense strategies to protect your systems.
