2022-03-31 00:00 UTC
Security Journalism
Security Journalism
What’s Your Backup Plan? | Huntress
This year for World Backup Day, we’ve asked our friends and backup/disaster recovery experts at Servosity to share their best “backup” tips.
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 4,789 matching records.
AUTO-POLL // 2026-10-12 08:40 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P0 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 12
CLEAR
P0
COOL // 4 ARTICLES
SUN
Oct 11
ACTIVE EXPLOITATION
P5
COOL // 6 ARTICLES
SAT
Oct 10
RANSOMWARE
P1
COOL // 11 ARTICLES
FRI
Oct 9
RANSOMWARE
P4
COOL // 67 ARTICLES
THU
Oct 8
RANSOMWARE
P3
COOL // 62 ARTICLES
WED
Oct 7
RANSOMWARE
P5
COOL // 86 ARTICLES
TUE
Oct 6
RANSOMWARE
P3
COOL // 61 ARTICLES
2022-03-29 00:00 UTC
Security Journalism
Security Journalism
A Day in the Life of a Security Researcher | Huntress
Take a behind-the-scenes look at what our security researchers do in this Q&A session.
P0
2022-03-28 13:33 UTC
Other
Other
P0
2022-03-22 12:00 UTC
Government
Government
Vendor Security Assessment
Assessing the security of network equipment.
P0
2022-03-22 00:00 UTC
Other
Other
GKE Sandbox side channel attack
There was a misconfiguration with Simultaneous Multi-Threading (SMT), also known as Hyper-threading, in GKE Sandbox images, causing nodes to be potentially exposed to side channel attacks such as Microarchitectural Data Sampling (MDS).
P0
2022-03-22 00:00 UTC
Security Journalism
Security Journalism
A Day in the Life of a Threat Analyst | Huntress
Hop behind the proverbial shoulders of one of our ThreatOps analysts and vicariously experience a day in his life.
P0
2022-03-15 13:56 UTC
Other
Other
Lost & Found: Group-IB Unveils Attack Surface Management (ex. AssetZero)
Intelligence-Driven Attack Surface Management
P0
2022-03-15 00:00 UTC
Security Journalism
Security Journalism
What Is Endpoint Detection and Response? | Huntress
What is endpoint detection and response (EDR) and why is it important? Dive into what EDR is, its history and what to look for in EDR solutions today.
P0
2022-03-14 00:00 UTC
Security Journalism
Security Journalism
Ending the Culture of Silence in Cybersecurity | Huntress
Learn how to break the silence in cybersecurity culture and promote open communication to enhance your organization's security posture.
P0
2022-03-10 00:00 UTC
Other
Other
AWS RDS does not enforce SSL/TLS encryption
The AWS RDS service does not enable secure transport layer security by default, allowing clients to connect insecurely. Additionally, for the more commonly used MySQL and MariaDB RDS engine types, this setting cannot be enabled at all.
P0
2022-03-09 00:00 UTC
Other
Other
Logic Apps privilege escalation to root
Azure Logic Apps use API Connections to authenticate actions to services. Having Contributor access to an Azure Resource Manager (ARM) API Connection would allow someone to create arbitrary role assignments as the connected user. This was supposed to be limited to actions at the Resource Group level, but an attacker could escape to the Subscription or Root level with a path traversal payload. The root cause of this behavior was that such a payload would meet the Swagger API definition, and it w…
P10
2022-03-08 00:00 UTC
Other
Other
Autopilot node compromise via allowlisted workload masquerade
Unit 42 researchers disclosed several vulnerabilities and attack techniques in GKE Autopilot to Google, the root cause being insufficient verification of allowlisted workload image names. An attacker with permissions to create a pod could have abused these vulnerabilities to (1) escape their pod and compromise the underlying node, (2) escalate privileges and become full cluster administrators, and (3) covertly persist administrative access through backdoors that are completely invisible to clus…
P0
2022-03-08 00:00 UTC
Security Journalism
Security Journalism
An Inside Look at Huntress’ Platform Vision and Mission | Huntress
In this blog, we get candid about our view of today’s security space. Plus, we share all the details on how and why we build security products the Huntress way.
P0
2022-03-07 00:00 UTC
Other
Other
AutoWarp
An exposed endpoint in the Azure Automation Service allowed to steal Azure API credentials from other customers
P0
2022-03-01 00:00 UTC
Security Journalism
Security Journalism
Targeted APT Activity: BABYSHARK Is Out for Blood | Huntress
We discovered malicious, targeted advanced persistent threat (APT) activity on a partner's system. Here, we dive into the BABYSHARK malware strain.
P0
2022-02-24 00:00 UTC
Other
Other
Google Cloud Armor packet size bypass
Cloud Armor has a documented limitation of 8 KB as the maximum size of web request that it will inspect. The default behavior of Cloud Armor in this case can allow oversized malicious requests to bypass Cloud Armor and directly reach an underlying application. Moreover, Cloud Armor does not warn users of this limitation during policy creation or when configuring rules from within the web UI, and can only find a reference to the 8 KB limit in the [Cloud Armor documentation](https://cloud.google.…
P0
2022-02-18 11:59 UTC
Other
Other
Top 5 recommendations for preventing ransomware for 2022
With ransomware attacks on the rise, companies need to take a proactive approach to security. Group-IB has put together a list of actionable tips to help you protect your organization from the ransomware threats in 2022.
P15
2022-02-16 00:00 UTC
Security Journalism
Security Journalism
Hackers No Hashing | Huntress
Hackers could be outsmarting preventive tools by making trivial changes to default settings. We dive into our research in this blog.
P0
2022-02-15 00:00 UTC
Other
Other
Cognito User Group spoofing
Opsmorph discovered an improper access control vulnerability in authorization logic common in applications built on AWS. The vulnerability means a user with permission to create a new Cognito User Group could fool authorization checks into thinking that the user is in any other existing Cognito User Group in the same User Pool, referred to as user group spoofing. When API Gateway is secured with a Cognito User Pool Authorizer it concatenates group names from the identity token into a comma sepa…
P0
2022-02-09 00:00 UTC
Security Journalism
Security Journalism
Balancing the Scales of Cybersecurity and Insurance
As the importance of cybersecurity insurance grows, we examine how insurance policies have influenced cybersecurity stacks and visa versa.
P0
2022-02-08 00:00 UTC
Other
Other
Oracle Apiary SSRF
By misusing the Apiary web service and taking advantage of Apiary's use of IMDSv1, a remote attacker is able to retrieve sensitive information from various endpoints and use it to gain more access and sensitive data of other hosts in the same environment.
P0
2022-02-07 13:37 UTC
Other
Other
Cleaning the atmosphere
Weak points in modern-day corporate email security
P0
2022-02-03 00:00 UTC
Other
Other
Codebuild data exfiltration
When customers attach a CodeBuild project to their VPC, CodeBuild’s build container will apply the same network routing rules as defined in the customer’s VPC Security Group. However, CodeBuild EC2 hosts retained Internet connectivity via AWS's own VPC, thus allowing an attacker to bypass any custom VPC rules the customer had set up, and use CodeBuild for data exfiltration from the targeted environment. AWS later updated the CodeBuild service to block all outbound network access for newly creat…
P0
2022-02-03 00:00 UTC
Security Journalism
Security Journalism
Leaving the Silo: MSP Vendors Give Back | Huntress
Learn the latest about our initiative with the Dutch Institute for Vulnerability Disclosure and how you can get involved.
P0
2022-02-01 00:00 UTC
Security Journalism
Security Journalism
What Is Managed Detection and Response? | Huntress
What is managed detection and response (MDR) and why is it so important? Dive into the benefits of MDR services and how it can address critical security gaps.
P0
2022-01-28 13:42 UTC
Other
Other
Shedding light on the dark web
Cybersecurity analyst's guide on how to use machine learning to show cybercriminals' true colors
P0
2022-01-25 00:00 UTC
Security Journalism
Security Journalism
Threat Recap: Huntress Managed EDR Trial by Fire | Huntress
See how Huntress Managed Endpoint Detection and Response (EDR) helped combat follow-on attacks against VMware Horizon servers in real-time.
P0
2022-01-20 00:00 UTC
Security Journalism
Security Journalism
A Journey Back to the World of MSP Security | Huntress
Dima Kumets explains why he wanted to make his way back to the world of MSP security—and how he ended up as a Principal Product Manager at Huntress.
P0
2022-01-18 00:00 UTC
Security Journalism
Security Journalism
Hot Takes and Cyber Predictions for 2022 | Huntress
What cybersecurity trends will we see in this new year? In this blog, we share some hot takes and predictions for 2022.
P0
2022-01-15 00:00 UTC
Security Journalism
Security Journalism
VMware Horizon Servers Actively Being Hit With Cobalt Strike | Huntress
Huntress is monitoring an incident in which VMware Horizon Servers are being hit with Cobalt Strike. Read our up-to-date blog to learn more.
P0