Learn why traditional antivirus falls short against today's cyber threats on its own and how Huntress offers proactive, effective protection.
Uncover the disruptive nature of Gigabud malware and take proactive measures to mitigate the associated risks
The Huntress team investigated a ransomware attack of a new INC Ransom threat actor group. Here is the activity we observed.
We’ve entered the era of identity security. Are you ready? Explore how to counter evolving threats and protect identities with confidence.
Discover how Huntress caught an attempted business email compromise (BEC) scam that would have cost the company more than $100,000 had it gone undetected.
Discover how today's businesses can conquer security challenges, strengthen defenses and evolve their security beyond traditional antivirus measures.
Huntress is tracking a new PaperCut vulnerability, CVE-2023-39143, which allows full remote code execution on unpatched servers.
Fighting cybercrime is more effective when we work together. Find out more about how you can work with Group-IB to document emerging threats.
A vulnerability in Power Platform could lead to unauthorized access to Custom Code functions used for custom connectors, thereby allowing cross-tenant information disclosure of secrets or other sensitive information if these were embedded in a Custom Code function. The issue occurred as a result of insufficient access control to Azure Function hosts, which are launched as part of the creation and operation of custom connectors in Microsoft’s Power Platform. An attacker who determined the hostna…
Analysis of a highly active hacktivist group with global reach
Dive into how Huntress caught a threat actor adding several legitimate email apps to maintain persistent access to a compromised Microsoft 365 environment.
Discover the key phases of the threat hunting process and how threat hunters structure their hunts to proactively seek out threats.
Is it worth switching to Microsoft Defender Antivirus? Spoiler alert: We think yes! Explore why Defender is a solid AV solution.
Explore how Huntress stopped a massive business email compromise (BEC) attack targeting multiple user accounts within a single organization.
This blog post provides a comprehensive overview of the importance, benefits and challenges of cyber insurance that every MSP should be aware of.
Dive into the improvements and progress we’ve made with Huntress Security Awareness Training since acquiring Curricula one year ago.
An information disclosure vulnerability in the Google Cloud Build service could have allowed an attacker to view sensitive logs if they had gained prior access to a GCP environment and had permission to create a new Cloud Build instance (cloudbuild.builds.create) or permission to directly impersonate the Cloud Build default service account (which is highly privileged by design and therefore considered to be a known privilege escalation vector in GCP). An attacker could then potentially use this…
In this blog, explore how Huntress caught an attempt at financial fraud through business email compromise (BEC) in Microsoft 365.
Discover how organizations unwittingly create vulnerabilities by misconfiguring their cloud infrastructure
In this blog, we explore the long-term impact of the MOVEit exploitation and how defenders can stay vigilant and learn from the past.
Key findings and full report from the 6th year of the Active Cyber Defence (ACD) programme.
Can we use anomalous user agents to detect potential business email compromise (BEC) in Microsoft 365? Explore what we found through threat hunting for BEC.
Do you need third-party security for macOS? Discover if Apple’s malware prevention products, XProtect and XProtect Remediator, are good enough solutions to keep users safe.
A client-side desync vulnerability was discovered in Front Door, one of Azure's CDN solutions, caused by mishandling of the 'Content-Length' header in HTTP requests. Exploiting this vulnerability would most likely require user interaction through social engineering (such as clicking on a malicious link), but could allow an attacker to steal session cookies or forge responses to victim requests.
Discover how Huntress Managed Identity Threat Detection and Response identified three business email compromise (BEC) attacks within 72 hours of each other.
An updated report from the NCSC explaining how UK law firms - of all sizes - can protect themselves from common cyber threats.
A critical authentication bypass vulnerability was discovered in Google Cloud API Gateway, affecting its JWT authentication method. The flaw, stemming from a business logic bug in the ESPv2 service proxy, allowed attackers to bypass authentication controls by manipulating HTTP methods. This vulnerability impacted various authentication methods including Firebase, Auth0, Okta, and Google ID tokens.
Descope identified a possible misconfiguration in Azure AD which could lead to misuse of the "Log in with Microsoft" authentication method on a web app. If an application relies on email attribute claims for authentication (which is against best practice) and also merges user accounts without proper validation, an attacker could falsify an email claim to gain full control over the target account. Descope and Microsoft Microsoft identified several popular multi-tenant applications with users tha…
Need help approaching the security sales conversation? Use these tips to walk into your next client meeting armed with points for selling cybersecurity.
Get all the undisclosed details that our investigators uncovered on CryptosLabs' full scope of fraudulent schemes
