2021-03-16 00:00 UTC
Security Journalism
Security Journalism
Abusing Ngrok: Hackers at the End of the Tunnel | Huntress
At the end of this tunnel, we find some shady hackers using ngrok to gain remote control access to victim networks.
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 4,791 matching records.
AUTO-POLL // 2026-10-12 10:35 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P9 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 12
ACTIVE EXPLOITATION
P9
COOL // 6 ARTICLES
SUN
Oct 11
ACTIVE EXPLOITATION
P5
COOL // 6 ARTICLES
SAT
Oct 10
RANSOMWARE
P1
COOL // 11 ARTICLES
FRI
Oct 9
RANSOMWARE
P4
COOL // 67 ARTICLES
THU
Oct 8
RANSOMWARE
P3
COOL // 62 ARTICLES
WED
Oct 7
RANSOMWARE
P5
COOL // 86 ARTICLES
TUE
Oct 6
RANSOMWARE
P3
COOL // 61 ARTICLES
2021-03-15 08:52 UTC
Other
Other
JavaScript sniffers’ new tricks
Analysis of the E1RB JS sniffer family
P0
2021-03-10 00:00 UTC
Other
Other
AWS CloudShell terminal escape
If attacker controlled data is viewed in Cloudshell it could have led to code execution. This exact same issue existed in Azure previously.
P0
2021-03-09 00:00 UTC
Other
Other
Azure Linux VM extension credential leak
A vulnerability in the Azure Linux VM extension mechanism allowed an unprivileged user to leak any Azure VM extension’s private data. An attacker could have abused this to gain credentials for the VM itself as well as credentials for extensions associated with the VM. Paired with the design of the VMAccess extension (an official Azure extension for managing VM credentials), this could have been used to achieve privilege escalation, as an unprivileged attacker would have been able to elevate the…
P10
2021-03-09 00:00 UTC
Security Journalism
Security Journalism
Peeling Back the Layers of .NET Malware
Hackers always try to cover up their tracks. In this blog, we step through layers of obfuscation to uncover the real intent of a .NET malware sample.
P0
2021-03-03 00:00 UTC
Security Journalism
Security Journalism
Rapid Response: Mass Exploitation of On-Prem Exchange Servers | Huntress
On-prem Microsoft Exchange Server vulnerabilities are being actively exploited in the wild. Read our blog for Huntress' most up-to-date research and IOCs.
P45
2021-03-02 00:00 UTC
Security Journalism
Security Journalism
What Is Human-Powered Threat Hunting? | Huntress
In this blog, we define what threat hunting is, the differences between human analysis and automation, plus an example of human-powered threat hunting.
P0
2021-03-01 09:02 UTC
Other
Other
Inside Classiscam
A deep dive into Classiscam: automated scam as a service designed to steal money and payment data
P0
2021-02-23 00:00 UTC
Security Journalism
Security Journalism
Zero-Day Vulnerabilities in Platforms Could Leave MSPs Exposed | Huntress
We unveil zero-day vulnerabilities we discovered in virtual event platforms used in MSP/Fortune 500 communities, plus some insight on supply chain attacks.
P25
2021-02-19 12:00 UTC
Government
Government
Active Cyber Defence (ACD) - The Third Year
The year three report covers 2019 and aims to highlight the achievements and efforts made by the Active Cyber Defence programme.
P0
2021-02-16 00:00 UTC
Security Journalism
Security Journalism
Cybersecurity Education Is the Key to Outsmarting Hackers | Huntress
In cybersecurity, education and training are the key to winning. Read our blog to learn how you can grow your skills through continuous security education.
P0
2021-02-15 00:00 UTC
Other
Other
Azure Cloud Shell and Container Instances breakout
An attacker could gain root privileges on their Azure Cloud Shell container, escape from the container, and then gain root privileges on the underlying node, the root cause being an insecure kubelet port (10250), among other cluster misconfigurations. Once they could access the node filesystem, an attacker could extract kubelet API credentials which allowed listing all pods and nodes in the cluster, including those belonging to other tenants. Moreover, an attacker could bypass RBAC policies in …
P0
2021-02-09 00:00 UTC
Security Journalism
Security Journalism
Malware Deep Dive: Examining A PowerShell Payload | Huntress
To avoid detection, hackers often turn a system’s own tools against itself. Here, we examine a malicious payload that was executed using PowerShell.
P0
2021-01-26 09:13 UTC
Other
Other
The source of everything
Forensic examination of incidents involving source code leaks
P0
2021-01-26 00:00 UTC
Security Journalism
Security Journalism
Huntress Service: Managed Antivirus | Huntress
Read about Huntress’ Managed Antivirus service and how it enables MSPs and IT admins to strengthen endpoint protection and rebalance their cyber stack.
P0
2021-01-20 12:00 UTC
Government
Government
Technical report: Responsible use of the Border Gateway Protocol (BGP) for ISP interworking
Technical report on best practice use of this fundamental data routing protocol.
P0
2021-01-19 00:00 UTC
Security Journalism
Security Journalism
Why Microsoft Defender Antivirus Is Worth Another Look | Huntress
Microsoft Defender Antivirus is among one of the leading antivirus contenders. Here’s why it’s worth taking another look at Defender AV.
P0
2021-01-12 00:00 UTC
Security Journalism
Security Journalism
Malware Under The Microscope: Manual Analysis
Learn manual malware analysis techniques used by threat researchers. Explore static & dynamic analysis, reverse engineering tools, and real-world investigation methods.
P0
2020-12-30 00:00 UTC
Other
Other
GKE gVisor sandbox escape
A bug in the GKE gVisor sandbox's network policy implementation allowed access to the Google Compute Engine metadata API.
P0
2020-12-29 00:00 UTC
Security Journalism
Security Journalism
Redefining Beta | Huntress
At Huntress, beta means learning. Our goal is to accelerate and streamline security defense, which means releasing what we’re working on often.
P0
2020-12-23 09:19 UTC
Other
Other
New attacks by UltraRank group
As part of UltraRank's new campaign, Group-IB Threat Intelligence team discovered 12 eCommerce websites infected with their JavaScript-sniffer.
P0
2020-12-22 00:00 UTC
Security Journalism
Security Journalism
Top Hacker Tradecraft That Caught Our Eye in 2020 | Huntress
We take a look back at some of the more interesting — and innovative — hacker tradecraft we saw over the course of 2020.
P0
2020-12-20 00:00 UTC
Other
Other
AWS SOC 2 type 2 failure (Fall 2020)
Information about this issue is under NDA, but AWS customers can read about it on pages 120-121 of the report, which is available for download through AWS Artifact. Note: This issue is outside the scope of this database's usual criteria for inclusion, but has been kept for historic reasons, as it was included in the original CSP Security Mistakes dataset.
P0
2020-12-17 00:00 UTC
Security Journalism
Security Journalism
Annual Security Awareness Training is a Waste of Time | Huntress
Annual security awareness training is a waste of time. We discuss why an ongoing security awareness program is required to protect against cyber threats.
P0
2020-12-14 00:00 UTC
Security Journalism
Security Journalism
Supply Chain Exploitation of SolarWinds Orion Software | Huntress
Huntress covers the breaking news about Solarwinds’ Orion platform being exploited as part of a coordinated attack to distribute malware.
P0
2020-12-07 09:23 UTC
Other
Other
The footprints of Raccoon
A story about operators of JS-sniffer FakeSecurity distributing Raccoon stealer
P0
2020-12-02 00:00 UTC
Security Journalism
Security Journalism
Rapid Response: TrickBoot | Huntress
TrickBot has unleashed yet another module in its growing arsenal specifically targeting firmware vulnerabilities, named TrickBoot.
P0
2020-11-27 00:00 UTC
Security Journalism
Security Journalism
I Have a Lot to be Thankful for in 2020
Huntress CEO Kyle Hanslovan has a lot to be thankful for in 2020 — and it starts with the MSP community.
P0
2020-11-24 00:00 UTC
Security Journalism
Security Journalism
Tried and True Hacker Technique: DOS Obfuscation | Huntress
In this blog, we dissect a sample of malware that makes clever use of batch scripting obfuscation—turns out it was a launcher for TrickBot!
P0
2020-11-22 00:00 UTC
Other
Other
GCP Default compute account is project Editor
When the compute API is enabled on a GCP Project, the default compute account is created. This account gets the primitive role Editor assigned by default, which allows for a wide variety of privilege excalation and resource abuse in the project. Especially, all new VMs created inherit this permissions by default. This issue is arguably a technical decision by GCP, but the documents advise customers to undo this.
P0