Today’s hackers know how to outsmart automation and evade detection. Learn how managed threat detection and response can help you fight back.
Our ThreatOps team details stumbling across Raccine, a ransomware remedy that works by hooking onto IFEO debuggers, for the first time.
Attribution secrets: Who is behind stealing credentials and bank card data by asking to install fake Flash Player, browser or font updates?
An adversary could gain access to IAM credentials in a victim's account, and make an API request to Elastic Beanstalk (even if they didn't have the proper IAM permissions). This request would be displayed in the management console in the Elastic Beanstalk section. Due to improper sanitization, an attacker could insert an XSS payload that would execute in a victim's browser.
In this testimonial, learn firsthand from one of our Security Awareness Consultants at Curricula about how a fake IRS phishing scam worked on one student.
Azure forces the install of an agent on Linux VMs, which contained a vulnerability that would grant root RCE if an attacker could send a web request to them. Initially, Microsoft did not update the agent automatically, and so customers had to patch manually, but a few days later they began patching some services remotely.
An in-depth look at the differences between AV, NGAV and EDR. We’ll explore the promises endpoint protection tools make vs. their ability to keep them.
SMBs need more advanced cybersecurity. Learn about the tools you need to help guide your clients toward better threat detection and response.
Explore the impact of ransomware on cybersecurity insurance. Learn how insurance providers are adapting and what organizations need to know to stay protected.
Join us for a threat hunting adventure as we analyze a suspicious run key that leads us to Cobalt Strike malware hidden across nearly 700 registry values.
President Biden signed a 34-page Executive Order aimed at strengthening the nation’s cybersecurity standards. Here are the top seven takeaways.
An analysis of the BlackCat ransomware affiliate program
As hackers get smarter, you must evolve your approach to threat detection and response. Learn how to protect your clients with threat intelligence tools.
The year four report covers 2020 and aims to highlight the achievements and efforts made by the Active Cyber Defence programme.
Group-IB specialists detected GrelosGTM group started to abuse Google Tag Manager legitimate functionality for their own purposes in infections of online shops.
We’ve been focused on expanding our platform and helping you better protect your customers. And we’re just getting started.
In this blog, we look at some malicious PowerShell code breadcrumbs that one hacker left behind to unravel how they maintained access during a cyberattack.
A vulnerability in AWS Cognito's password reset function allowed attackers to brute-force the six-digit reset code, potentially leading to account takeovers. Using concurrent HTTP requests, an attacker could make up to 1587 guesses instead of the documented limit of 20. The issue affected accounts without multi-factor authentication and was fixed by AWS on April 20, 2021.
Are you ready to scale your MSP or SMB? Level up your threat detection and response so you can focus on what's important: your business.
Back in action with JS sniffers redesigned to steal crypto
Keep your MSP armed and ready for attacks, hacks and data breaches with the latest trends in cybersecurity.
Group-IB's Computer Emergency Response Team built a solid phishing kit database, which helps Group-IB fight phishing that targets specific brands.
The rise and fall of illicit cardshop breached twice in two years
We hunt for persistent footholds, but what exactly does that mean? In this blog, we define what a foothold is and why it's a hacker favorite.
The analysis of phishing campaigns carried out by a new threat actor
A recap of hack_it 2021, a virtual security training event packed with interactive exercises, malware analysis, hacking workshops and more.
Windows' administrative shares feature is often overlooked by users, but not by hackers. Learn how attackers abuse administrative shares to propagate.
Let's hunt some bootkits
GCP provides an OS Login service for managing SSH access to compute instances using IAM roles. An attacker could abuse this feature via LXD, Docker (if available on the target system) and DHCP poisoning of the metadata server to escalate their privileges on a Google Compute Engine VM.
