2022-12-29 00:00 UTC
Security Journalism
Security Journalism
OWASSRF Explained | Huntress
Huntress' analysis of a new exploit chain (called OWASSRF) that can lead to critical remote code execution on unpatched Exchange hosts.
P15
LATEST
Aggregated cybersecurity reporting, advisories and research. 4,787 matching records.
AUTO-POLL // 2026-10-12 06:40 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P0 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 12
CLEAR
P0
COOL // 2 ARTICLES
SUN
Oct 11
ACTIVE EXPLOITATION
P5
COOL // 6 ARTICLES
SAT
Oct 10
RANSOMWARE
P1
COOL // 11 ARTICLES
FRI
Oct 9
RANSOMWARE
P4
COOL // 67 ARTICLES
THU
Oct 8
RANSOMWARE
P3
COOL // 62 ARTICLES
WED
Oct 7
RANSOMWARE
P5
COOL // 86 ARTICLES
TUE
Oct 6
RANSOMWARE
P3
COOL // 61 ARTICLES
2022-12-22 00:00 UTC
Other
Other
ACSESSED
Azure Cognitive Search (ACS) is a full-text search engine service. A new non-default feature allowed for a network control to bypassed, permitting an attacker to submit search queries to any other tenant's network-isolated ACS instance. However, abusing this required a valid API key to access the data plane of the target, along with a number of pieces of information about the target environment (such as the subscription ID and the name of the index to query).
P0
2022-12-21 13:38 UTC
Other
Other
Godfather Trojan – mobile banking malware that is impossible to refuse
Group-IB discovers banking Trojan targeting users of more than 400 apps in 16 countries
P0
2022-12-20 00:00 UTC
Security Journalism
Security Journalism
Using Shodan Images to Hunt Down Ransomware Groups | Huntress
In this blog, we’re going to focus on how Shodan helps us unveil some of the infrastructure that supports ransomware actors.
P15
2022-12-16 13:42 UTC
Other
Other
Scam-free Christmas
8 online scams to protect your customers from
P0
2022-12-15 00:00 UTC
Other
Other
Azure Serverless Functions escape to host
In Azure Serverless Functions, a new container is generated by the host for every function, which is then terminated and deleted after several minutes. Palo Alto discovered that an API call was available to bind one path to another within the container (called "init_server_pkg_mount_BindMount") that could be called by a low-privileged user but executed with root privileges. This could enable a malicious tenant to escalate their privileges to root, and then escape their container by abusing the …
P0
2022-12-14 00:00 UTC
Security Journalism
Security Journalism
Overblown Claims of Vulnerabilities, Exploits, & Severity | Huntress
Our team has been tracking conversations surrounding ConnectWise Control vulnerabilities and alleged exploitation. We politely disagree with the threat and criticality presented by the security researcher.
P0
2022-12-13 00:00 UTC
Other
Other
ECR Public vulnerability in undocumented API
A vulnerability in Elastic Container Registry (ECR) Public could have allowed a malicious actor to delete, update, or create ECR Public images, layers, or tags in registries and repositories belonging to any other AWS account, by abusing undocumented API calls. A malicious actor could have exploited this to delete any or all images in the Amazon ECR Public Gallery or update the content of any existing image to inject malicious code on any machine that would pull and run it.
P0
2022-12-13 00:00 UTC
Security Journalism
Security Journalism
The Value of Managed EDR for the Modern MSP | Huntress
Our partners at Clear Guidance Partners experienced the value of our EDR capabilities in real-time, pitting them against an active ransomware attack.
P15
2022-12-06 00:00 UTC
Security Journalism
Security Journalism
Defense Evasion: Defenders Strike Back! | Huntress
In the last blog of our defense evasion series, we'll cover granular advice for monitoring and detecting defense evasion.
P0
2022-12-01 00:00 UTC
Other
Other
Hell's Keychain
IBM Cloud Databases for PostgreSQL was vulnerable to an attack sequence comprised of PostgreSQL privilege escalation via SQL Injection and chaining of three secrets scattered in the service environment (a K8s service account token, a private container registry password, and CI/CD server credentials), which were abusable due to overly permissive network access to internal build servers. A malicious actor could have exploited this vulnerability to remotely execute code in other customers’ environ…
P10
2022-11-29 00:00 UTC
Security Journalism
Security Journalism
Incident Response: A Choose Your Own Adventure Exercise
Incident response is a lot like a choose your own adventure exercise. We cover the ground rules and talk about some incidents we’ve helped partners with.
P0
2022-11-28 13:47 UTC
Other
Other
Understanding Money Mules: The Hidden Link in Cybercrime
A money mule is someone who moves stolen funds across bank accounts on behalf of cybercriminals. Learn how money mules operate and how you can proactively counteract mule accounts.
P0
2022-11-22 00:00 UTC
Security Journalism
Security Journalism
Threat Advisory: Qakbot Activity Is Rising | Huntress
We're seeing a rise in Qakbot activity. Here's what you need to know to keep your environments safe.
P0
2022-11-21 00:00 UTC
Other
Other
AWS AppSync confused deputy via ServiceRoleArn
The AWS AppSync service could be coerced to assume arbitrary roles in other customers' accounts which trusted the AppSync service. This was due to insufficient validation of a serviceRoleArn parameter (caused by a case-sensitivity parsing issue). With this vulnerability, if an adversary knew the ARN of the role associated with AppSync in the target account, they could use it invoke arbitrary AWS API calls.
P0
2022-11-17 00:00 UTC
Security Journalism
Security Journalism
Tradecraft, Shenanigans and Spice: hack_it 2022 Recap | Huntress
hack_it 2022 was jam-packed with hacker tradecraft, shady shenanigans, and—as always—a little spice. Check out our favorite moments and highlights!
P0
2022-11-15 00:00 UTC
Security Journalism
Security Journalism
Do You Have a Security Hygiene Checklist in Place?
A strong security foundation is the cornerstone of any MSP’s success. Learn how to build this foundation—even if you're new to cybersecurity.
P0
2022-11-09 13:54 UTC
Other
Other
Hired hand: Scammers mimic Saudi manpower provider
Group-IB uncovers one thousand (and one) fake domains part of a scam campaign targeting users in KSA
P0
2022-11-08 00:00 UTC
Security Journalism
Security Journalism
Creating macOS Ransomware | Huntress
With the beta release of the Huntress macOS agent, we wanted to share some of the Apple-y stuff we’ve been up to behind the scenes.
P15
2022-11-07 00:00 UTC
Other
Other
Azure Devops account takeover via dangling subdomain takeover
Binary Security discovered and registered two dangling cloudapp.azure.com subdomains corresponding to subdomains at visualstudio.com. Had these been discovered and registered by an attacker, this would have been equivalent to a 1-click vulnerability for Azure DevOps: the attacker could have crafted a URL referring to the sign-in API for Azure DevOps Services (app.vssps.visualstudio.com) using one of the two subdomains in the "reply_to" field (since subdomains of visualstudio.com would be allowe…
P0
2022-11-03 13:30 UTC
Other
Other
Armés et dangereux : une soif d’argent inextinguible L’APT OPERA1ER en Afrique
En 2019, l'équipe Threat Intelligence de Group-IB a détecté une série d'attaques ciblant des organisations financières en Afrique.
P0
2022-11-03 11:26 UTC
Other
Other
Financially motivated, dangerously activated: OPERA1ER APT in Africa
The French-speaking gang managed to carry out over 30 successful attacks on banks, financial services and telecommunications companies, mainly located in Africa.
P0
2022-11-01 00:00 UTC
Other
Other
CosMiss
Cosmos DB notebooks lacked an authentication check, meaning that if an attacker somehow had prior knowledge of a notebook’s temporary ‘forwardingId’ (a 128bit cryptographically random GUID assigned to a short-lived workspace that expires after an hour), they could gain full permissions on the notebook, including read and write access and the ability to modify the file system of the container running the notebook. These permissions would suffice for an attacker to obtain remote code execution (R…
P15
2022-11-01 00:00 UTC
Security Journalism
Security Journalism
macOS Support Is Here! | Huntress
We're excited to announce the general availability of the Huntress macOS agent! And don't worry – Persistent Footholds are just the beginning.
P0
2022-10-31 00:00 UTC
Security Journalism
Security Journalism
ConnectWise/R1Soft RCE & Supply Chain Risks | Huntress
Huntress has validated an initial report for an authentication bypass and sensitive file leak present in the Java framework “ZK”, used within the ConnectWise R1Soft software Server Backup Manager SE.
P25
2022-10-27 00:00 UTC
Security Journalism
Security Journalism
Huntress Myths and Misconceptions | Huntress
We’ve been seeing some misinformation being spread around with regards to the Huntress technology stack/capabilities we possess today. We’re here to provide clarity.
P0
2022-10-25 00:00 UTC
Other
Other
Azure CLI code injection vulnerability
Azure CLI contained a code injection vulnerability that could be exploited in a scenario where the host runs a command where parameter values have been provided by an external untrusted source - these could be specially crafted in such a way as to exploit the vulnerability, leading to remote code execution on the host. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the `&` or `|…
P15
2022-10-25 00:00 UTC
Security Journalism
Security Journalism
Cybersecurity Basics: A Chat With Syncro | Huntress
Read our webinar recap to learn what Henry Washburn of Huntress and Ian Alexander of Syncro outlined to help MSPs protect SMBs from cybersecurity threats.
P0
2022-10-24 07:31 UTC
Other
Other
Treasure trove. Alive and well point-of-sale malware
Analysis of months-long MajikPOS and Treasure Hunter campaign that infected dozens of terminals
P0
2022-10-24 00:00 UTC
Other
Other
Docker Command Escaping in GitHub Actions Runner
A vulnerability in the GitHub Actions Runner allowed untrusted inputs in environment variables to escape and modify docker command invocations. This affected jobs using container actions, job containers, or service containers. The issue has been patched in multiple versions of the runner.
P0