Le 27 septembre 2023, Zero Day Initiative (ZDI) a publié six avis de sécurité \[1\] concernant des vulnérabilités de type zéro-jour affectant les versions antérieures à 4.96.1 ou 4.97 de l'agent de transfert de courriels (*Mail Transfer Agent* ou *MTA*) Exim. Le 1er octobre 2023, l'éditeur a...
Huntress is actively investigating numerous vulnerabilities affecting the WS_FTP Server Ad Hoc Transfer Module observed in the wild.
Huntress is tracking a new critical vulnerability seen in the wild that affects anything using the libwebp WebP image library. Here’s what we know so far.
Can AI ever fully replace humans in cybersecurity? We argue that human-powered security is the key to staying one step ahead of today’s threats.
No sleep until the Cybercrime Fighters Club is done with finding the answer as to who is behind this new ransomware-as-a-service affiliate.
The following is an analysis by the Huntress team of several recent intrusions connected to the Netscaler exploitation.
Group-IB analysts discovered and analyzed a cryptojacking campaign on a popular educational resource using Group-IB Managed XDR.
Read about Huntress' newest feature, Incident Notification, which allows us to instantly alert partners to critical incidents via SMS text or phone call.
Dive into the fundamentals of reverse engineering malware and understanding how malicious software works.
Actionable guide to hunting for the Windows Services abuse by using Group-IB MXDR.
Read expert tips about how MSPs in Australia and New Zealand can elevate their cybersecurity offerings and have better sales conversations with customers.
Researchers at Omegapoint identified two issues in AWS API Gateway authorizers: 1) A header rewrite feature could be abused to bypass authorization by overwriting headers after the authorizer lambda processed them. 2) Caching of authorization policies could be exploited to reuse cached policies with modified identification sources, bypassing the authorizer.
Customers can configure Chronicle to ingest data from customer-owned Cloud Storage buckets using an ingestion feed. Chronicle previously used a shared service account for all customers for granting permission to the bucket. Therefore, one customer's Chronicle instance could be configured to ingest data from another customer's Cloud Storage bucket. However, this required knowledge of the bucket URI.
Gather valuable insights on how incident response can be a make-or-break factor in securing your business.
Dive into the recent Las Vegas casino cyberattacks linked to Scattered Spider, and learn how organizations can defend against such identify-based attacks.
Credentials can be extracted from AppStream. When used, they obscure the sourceIP and userName of the initial user. The sourceIP appears as appstream.amazonaws.com.
Group-IB Digital Risk Protection uncovers malicious campaign leveraging almost 900 scam pages with potential financial damage estimated at $280,000 over four-month span
A deep dive into the USB-borne Raspberry Robin malware and how Huntress Managed EDR and Managed Antivirus can detect and mitigate this threat.
Uncover the vulnerabilities crippling the airline industry and learn how to implement appropriate countermeasures
Tips from a Mac expert. Discover the best practices users and administrators can use to secure your Mac devices or your Mac fleet.
The automated scam-as-a-service program designed to steal your money and data is still going strong four years after launch
The blog post discusses the evolution of Huntress' data analysis in response to scaling challenges and how we transitioned to a custom detection engine.
With the FBI's takedown of Qakbot malware, we're sharing how the Huntress team developed our own Qakbot vaccine and our commitment to defend forward.
Dive into the basics of threat hunting and tactical malware analysis, and learn how these two practices go hand in hand in cybersecurity.
Secureworks researchers discovered an Azure AD application with an abandoned reply URL related to Microsoft Power Platform. An attacker could leverage this URL to redirect authorization codes, exchange them for access tokens, and call Power Platform API via a middle-tier service to obtain elevated privileges. Microsoft quickly addressed the issue by removing the identified abandoned reply URL from the Azure AD application.
Spoof extensions help cybercriminals target users on trading forums as 130 devices still infected at time of writing
Read expert insights on how to strengthen your cybersecurity strategy with asset inventory and attack surface reduction.
Discover the truth about macOS security. The Huntress Mac Guy answers common macOS security questions like why you should protect your Mac computers.
Actionable guide to hunting for the DLL side-loading threat by using Group-IB MXDR.
Get an inside look at how threat actors use phishing and social engineering tactics to target users and infiltrate organizations.
