2022-10-19 11:52 UTC
Other
Other
Deadbolt ransomware decryption: unlock your data
The Group-IB Incident Response Team investigated an incident related to a DeadBolt attack and analyzed a DeadBolt ransomware sample
P15
LATEST
Aggregated cybersecurity reporting, advisories and research. 4,787 matching records.
AUTO-POLL // 2026-10-12 07:00 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P0 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 12
CLEAR
P0
COOL // 2 ARTICLES
SUN
Oct 11
ACTIVE EXPLOITATION
P5
COOL // 6 ARTICLES
SAT
Oct 10
RANSOMWARE
P1
COOL // 11 ARTICLES
FRI
Oct 9
RANSOMWARE
P4
COOL // 67 ARTICLES
THU
Oct 8
RANSOMWARE
P3
COOL // 62 ARTICLES
WED
Oct 7
RANSOMWARE
P5
COOL // 86 ARTICLES
TUE
Oct 6
RANSOMWARE
P3
COOL // 61 ARTICLES
2022-10-19 00:00 UTC
Other
Other
BlueBleed
In September 22', SOCRadar discovered an insecure public Azure blob storage owned by Microsoft (olyympusv2.blob.core.windows[.]net). This blob storage was used for storing emails and other documents from interactions with their customers (such as contracts and purchase orders). In total, the blob storage contained 2.4TB of data with information concerning thousands of Microsoft customers across dozens of countries, dated between 2017 and August 22'. Following disclosure, Microsoft reconfigured …
P0
2022-10-18 00:00 UTC
Security Journalism
Security Journalism
Making Cybersecurity Accessible for Women | Huntress
We’ve got a problem in cybersecurity that needs to be addressed—and it has to do with accessibility to women.
P0
2022-10-17 14:19 UTC
Other
Other
Scam is rising
With well-set digital marketing campaigns and professional call-centres
P0
2022-10-11 00:00 UTC
Other
Other
FabriXss
Service Fabric Explorer (SFX) is a tool for inspecting and managing Azure Service Fabric clusters. An attacker with existing access to a "Deployer" type user with CreateComposeDeployment permissions in a given cluster could create a malicious application with a specially-crafted name. This would lead to client-side template injection (CSTI) and storing a malicious XSS payload in a dashboard shared between users of the same cluster. If a victim user with administrative permissions logged into th…
P0
2022-10-11 00:00 UTC
Other
Other
Azure Arc-enabled Kubernetes privilege escalation
Azure Arc allows customers to connect on-premises Kubernetes clusters to Azure. This is facilitated by middleware (the Azure Arc-enabled Kubernetes agent) which includes a "cluster connect" feature in the form of a reverse proxy. A vulnerability in this feature could allow an unauthenticated user to elevate their privileges and potentially gain remote administrative control over any Azure Arc-enabled cluster, as long as they know its randomly generated external DNS endpoint. Azure Stack Edge de…
P10
2022-10-04 00:00 UTC
Security Journalism
Security Journalism
A Sneak Peek at hack_it 2022 | Huntress
Our workshop dedicated to hacker tradecraft is back November 14-16. Mark your calendars, sign up today and don't forget your hacker hat!
P0
2022-09-29 00:00 UTC
Security Journalism
Security Journalism
New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress
The Huntress team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers, piggybacking on ProxyShell and ProxyLogon.
P25
2022-09-28 14:13 UTC
Other
Other
Take control of your shadow IT
How Group-IB Attack Surface Management ensures full mastery of your external attack surface
P0
2022-09-27 00:00 UTC
Security Journalism
Security Journalism
Bug Bounties for the 99%
Bug bounty programs are everywhere for enterprise organizations. But where does that leave the 99%—those under-resourced small to mid-sized businesses?
P0
2022-09-20 00:00 UTC
Other
Other
AttachMe
Any unattached storage volume, or attached storage volumes allowing multi-attachment, could have been read from or written to as long as an attacker knew their Oracle Cloud Identifier (OCID), allowing sensitive data to be exfiltrated or even more impactful attacks to be initiated via executable file manipulation in the target tenant's environment.
P0
2022-09-20 00:00 UTC
Other
Other
Azure Cloud Shell access token theft
An issue in Azure Cloud Shell could have allowed an attacker to take over an Azure App Service domain and leverage it to inject and execute commands in other tenants' terminals if they navigated to the domain while logged into their account. Using this method, an attacker could query the Azure IMDS on other tenants' behalf and thereby obtain their access tokens.
P0
2022-09-20 00:00 UTC
Security Journalism
Security Journalism
Back to Basics: Protecting Your Endpoints With Managed EDR and ITDR
Protecting your servers just isn’t enough to keep bad actors out. Protecting the workstation is often an overlooked but critical step to security.
P0
2022-09-13 12:11 UTC
Other
Other
Letting off steam
Hackers use the browser-in-the-browser technique to steal Steam accounts
P0
2022-09-13 00:00 UTC
Security Journalism
Security Journalism
Unraveling a Reverse Shell with Managed EDR | Huntress
Read about our journey to unravel a PowerShell reverse shell—and how our Managed EDR feature tipped us off that something wasn’t right.
P0
2022-09-01 00:00 UTC
Other
Other
Synapse Spark LPE
Azure Synapse Analytics is an analytics service for processing data using various runtimes, among them Apache Spark. Synapse provided users the capability to mount Azure File Shares to their Apache Spark Pools via a script called filesharemount.sh that would execute with elevated privileges. This script would mount the File Share to the /synfs directory. There was a race condition in the script where, if successfully exploited, a user could execute the chown command to change the ownership of a…
P0
2022-08-30 00:00 UTC
Security Journalism
Security Journalism
Evolving Endpoint Protection and the Next Iteration of Huntress
Discover how Process Insights brings new managed EDR functionality to The Huntress Managed Security Platform to help you detect cyberattacks as they happen.
P0
2022-08-25 09:02 UTC
Other
Other
Roasting 0ktapus: The phishing campaign going after Okta identity credentials
Over 130 organizations have been compromised in a sophisticated attack using simple phishing kits
P0
2022-08-23 00:00 UTC
Security Journalism
Security Journalism
How Progressive Computing Combated a Large-Scale Cyberattack | Huntress
Learn how Progressive Computing fought through a mass-scale attack and came out on the other side scarred, but wiser and stronger.
P0
2022-08-19 00:00 UTC
Other
Other
SNS SigningCertUrl improper validation
Amazon SNS' signature validation in the official SDK relied on a weak regex for default AWS certificate locations, that would incorrectly match an S3 bucket named `sns`. This bucket happened to be publicly readable and writeable, allowing an attacker to forge messages to any user of the official SDK SNS validator.
P0
2022-08-18 08:48 UTC
Other
Other
APT41 World Tour 2021 on a tight schedule
4 malicious campaigns, 13 confirmed victims, and a new wave of Cobalt Strike infections
P0
2022-08-17 12:14 UTC
Other
Other
P0
2022-08-17 00:00 UTC
Other
Other
Remote Code Execution via GitHub Import
A critical vulnerability in GitLab's GitHub import feature allows remote code execution. The issue stems from improper handling of Sawyer::Resource objects, enabling injection of Redis commands. This can be escalated to execute arbitrary bash commands on the SaaS managed service as well as self-hosted GitLab servers, potentially leading to full system compromise.
P25
2022-08-16 00:00 UTC
Security Journalism
Security Journalism
Gifting User Passwords to Adversaries With NPPSPY | Huntress
We unravel an investigation that details one way threat actors are able to gather cleartext passwords via NPPSPY.
P0
2022-08-12 00:00 UTC
Other
Other
Actions Core Delimiter Injection Vulnerability
The @actions/core package had a delimiter injection vulnerability in the exportVariable function. Attackers could use a known delimiter to break out of a specific variable and assign values to other arbitrary variables. This may have allowed modification of path or environment variables without the intention of workflow or action authors.
P0
2022-08-11 15:39 UTC
Other
Other
Challenge accepted
Detecting MaliBot, a fresh Android banking trojan, with a Fraud Protection solution
P0
2022-08-11 00:00 UTC
Other
Other
Cloud SQL escape to host
In GCP's case, they introduced a modification to the Cloud SQL's PostgreSQL engine allowing the role assigned to the tenant (cloudsqlsuperuser) to arbitrarily change the ownership of a table to any user or role in the database. Thus, an attacker could (1) create a new table, (2) create an index function with a malicious payload, and (3) change the table owner to GCP’s superuser role (cloudsqladmin). Next, by initiating an ANALYZE command, the malicious function is executed with GCP’s superuser …
P10
2022-08-10 00:00 UTC
Other
Other
Google Cloud Shell command injection
A vulnerability was discovered in Cloud Shell that enabled command injection and remote shell access. By manipulating the "project" parameter, an attacker could have cause an unencoded Python script execution flaw. Exploiting this flaw, they could inject a command to display the contents of the "/etc/passwd" file, successfully execute arbitrary commands and obtain remote shell access. However, the impact of this is unclear, as an attacker would seemingly only be able to gain such a remote shell…
P0
2022-08-09 00:00 UTC
Security Journalism
Security Journalism
Don’t Get Schooled: How to Catch a Phish | Huntress
This blog explores phishing and smishing, diving into how to analyze text messages for their validity and legitimacy.
P0
2022-08-02 00:00 UTC
Security Journalism
Security Journalism
Huntress’ Commitment to the Cybersecurity Community | Huntress
We founded Huntress with a commitment to elevating the cybersecurity community as a guiding principle. Here are some of the ways we strive to make a difference.
P0