Ransomware marks a lucrative business in today’s cyber-driven world. Learn more about ransomware and why it’s a favorite among hackers.
BlackMatter and their victims
It’s amazing what you can learn by thinking like a hacker! We share our top tips and takeaways from our third hack_it security training event.
Group-IB uncovers largest networks of fake shops – phishing websites disguised as card shops
We discovered an information disclosure vulnerability in survey software designed for MSPs. We detail how we worked with the Crewhu team to responsibly disclose and remedy the vulnerability.
Learn about Host Isolation, a new feature that's just been added to The Huntress Security Platform.
Huntress discovered threat actors abusing a blind SQL injection vulnerability in BillQuick Web Suite. Follow our analysis and latest findings in this blog.
Multiple vulnerabilities were found in Google Cloud SQL, including config file injection leading to RCE, information disclosure in the Cloud SQL Auth Proxy, and a design issue in Postgres IAM authentication allowing access token theft. Other issues included GCR permission misconfigurations and potential for terminal escape sequence injection attacks via gcloud.
Learn about Huntress’ newest platform and service updates, including Managed Antivirus, Host Isolation and 24/7 ThreatOps coverage.
Azure App Service had an insecure default behavior that exposed the source code of customer applications written in PHP, Python, Ruby, or Node, that were deployed using “Local Git”.
After months of rigorous beta testing, we’re excited to announce the addition of our Managed Antivirus service to the Huntress Security Platform.
In honor of National Cybersecurity Awareness Month, here are four critical tips to help you take both your cybersecurity hygiene and knowledge up a notch.
Teach employees not to leave computers unlocked with this tool by Huntress, the fun cyber security awareness training provider.
Azure Active Directory Seamless Single Sign-On feature allowed single-factor brute-force attacks against Azure AD without generating sign-in events in the targeted organization’s tenant.
There is a known issue where updating a BackendConfig resource using the v1beta1 API removes an active Google Cloud Armor security policy from its service. If you do not configure Google Cloud Armor on your Ingress resources via the BackendConfig, then this issue does not affect your clusters.
Do you have what it takes to hack_it? Read on for a sneak peek into our upcoming hack_it event and how it can help you better understand how hackers use their skills against you.
A vulnerability was discovered in the Anthos Identity Service (AIS) LDAP module of Anthos clusters on VMware versions 1.8 and 1.8.1 where a seed key used in generating keys is predictable. With this vulnerability, an authenticated user could add arbitrary claims and escalate privileges indefinitely.
Upon blocking a request, GCP Org policy constraints were logging the deny logs in Principal''s project and the blocking project. An attacker could use those logs to exfiltrate any data, by making request from a Principal they own from a defender project.
If a user with AWS WorkSpaces 3.0.10-3.1.8 installed visits a page in their web browser with attacker controlled content, the attacker can get zero click RCE under common circumstances.
Learn about the top four Common Vulnerabilities and Exposures (CVEs) attackers are exploiting—and how you can defend against them.
Scammers attack users in Middle Eastern countries
Convincing a victim to click a specially crafted link would allow the attacker to bypass the Identity-Aware Proxy (a core component of BeyondCorp).
Phishers take an approach to bypass security controls never seen in the country
In this blog, we debate which is the best approach for IT professionals to beat hackers: offensive cybersecurity or defensive cybersecurity.
Azure AD users could escalate their privileges using the Log Analytics Contributor role to reach the full Subscription Contributor role.
Allows an attacker with privileges in the account to share resources outside of the account even when an org policy restricts this, thus enabling them to backdoor their access.
Huntress is monitoring a new threat against Windows OS and Microsoft Office products (CVE-2021-40444). The MSHTML engine is vulnerable to arbitrary code execution.
In this blog, read along as we investigate a malicious foothold and decode the payload step by step.
Azure's Cosmos DB database service was vulnerable to remote account takeover. Any Azure user could gain full admin access to other customers' Cosmos DB instances without authorization. The vulnerability had a trivial exploit that doesn't require any previous access to the target environment.
