2020-11-27 00:00 UTC
Security Journalism
Security Journalism
I Have a Lot to be Thankful for in 2020
Huntress CEO Kyle Hanslovan has a lot to be thankful for in 2020 — and it starts with the MSP community.
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 4,794 matching records.
AUTO-POLL // 2026-10-12 11:25 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P8 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 12
RANSOMWARE
P8
COOL // 9 ARTICLES
SUN
Oct 11
ACTIVE EXPLOITATION
P5
COOL // 6 ARTICLES
SAT
Oct 10
RANSOMWARE
P1
COOL // 11 ARTICLES
FRI
Oct 9
RANSOMWARE
P4
COOL // 67 ARTICLES
THU
Oct 8
RANSOMWARE
P3
COOL // 62 ARTICLES
WED
Oct 7
RANSOMWARE
P5
COOL // 86 ARTICLES
TUE
Oct 6
RANSOMWARE
P3
COOL // 61 ARTICLES
2020-11-24 00:00 UTC
Security Journalism
Security Journalism
Tried and True Hacker Technique: DOS Obfuscation | Huntress
In this blog, we dissect a sample of malware that makes clever use of batch scripting obfuscation—turns out it was a launcher for TrickBot!
P0
2020-11-22 00:00 UTC
Other
Other
GCP Default compute account is project Editor
When the compute API is enabled on a GCP Project, the default compute account is created. This account gets the primitive role Editor assigned by default, which allows for a wide variety of privilege excalation and resource abuse in the project. Especially, all new VMs created inherit this permissions by default. This issue is arguably a technical decision by GCP, but the documents advise customers to undo this.
P0
2020-11-22 00:00 UTC
Other
Other
IAM privilege escalation in multiple GCP services
Composer, Dataflow, Dataproc, Dataprep and Data Fusion all used the Compute Engine default service account by default and relied on product-level IAM permissions without requiring the iam.serviceAccount.actAs permission, meaning that users of these services could elevate their privileges. Following disclosure, GCP changed these services to require this permission.
P10
2020-11-20 13:34 UTC
Other
Other
P0
2020-11-18 00:00 UTC
Security Journalism
Security Journalism
Huntress Service: Partner Enablement | Huntress
Even the best cybersecurity tools won’t configure and sell themselves. That's why we're thrilled to introduce a new Huntress service: Partner Enablement!
P0
2020-11-12 00:00 UTC
Other
Other
SSRF in Google Cloud Monitoring
An SSRF bug in Google Cloud Monitoring's uptime check feature could have been used to leak the authentication token of the service account used for these checks. The issue was resolved but later bypassed by Omar Espino (@omespino), requiring another fix.
P0
2020-11-01 13:38 UTC
Other
Other
Big Game Hunting: Now in Russia
Top Russian companies and banks under attack from OldGremlin - a group controlling TinyCryptor ransomware
P15
2020-10-22 00:00 UTC
Security Journalism
Security Journalism
Cybersecurity Lessons We Learned from hack_it 2020 | Huntress
A recap of hack_it 2020, a virtual security training event packed with interactive exercises, malware research and analysis, and more.
P0
2020-10-19 00:00 UTC
Other
Other
Route table modification to imitate metadata service
An attacker with sufficient privileges in AWS to modify the route table and some other EC2 privileges, could pretend to be a metadata server and provide an attacker controlled bootup script to EC2s to move laterally.
P0
2020-10-17 00:00 UTC
Other
Other
AI Hub Jupyter Notebook instance CSRF
AI Hub Jupyter Notebook server lacked a check of the Origin header that led to a CSRF vulnerability. An attacker could have read sensitive data and execute arbitrary actions in customer environments.
P0
2020-10-17 00:00 UTC
Other
Other
Enumeration of Privileges Without Being Logged to CloudTrail
An attacker who gained access to IAM credentials could enumerate a subset of the privileges they had access to without logging to CloudTrail. This would allow them to perform the typically noisy permission enumeration process undetected.
P0
2020-10-15 00:00 UTC
Other
Other
Lack of internal change controls for IAM managed policies
AWS have released or changed managed IAM policies in unexpected and insecure ways. Examples include: CheesepuffsServiceRolePolicy, AWSServiceRoleForThorInternalDevPolicy, AWSCodeArtifactReadOnlyAccess.json, AmazonCirrusGammaRoleForInstaller. The worst being the ReadOnlyAccess policy having almost all privileges removed and unexpected ones added.
P0
2020-10-10 13:41 UTC
Other
Other
Group-IB Fraud Protection (ex. Fraud Hunting Platform)
Keeping user digital identity safe
P0
2020-10-06 00:00 UTC
Other
Other
Multiple issues in AWS IAM Authenticator for Kubernetes
Amazon Elastic Kubernetes Service (EKS) uses IAM to provide authentication to the cluster through the AWS IAM Authenticator for Kubernetes (aws-iam-authenticator). Multiple issues were identified in the authenticator that could have allowed exploitation, namely (1) a lax regular expression used to verify presigned URLs; (2) HTTP client redirect follow (due to using Golang HTTP client in its default configuration); (3) use of the Golang URL.Query function (which silently drops parameters that Go…
P0
2020-10-01 00:00 UTC
Other
Other
Google Cloud Shell XSS to RCE Vulnerability
A vulnerability in Google Cloud Shell allowed escalation from XSS to full instance takeover as root. The attack exploited an XSS in the markdown preview functionality to read sensitive files, obtain the instance's private key and hostname, and gain SSH access as root. The issue affected the Eclipse Theia-based editor used in Cloud Shell.
P15
2020-09-28 00:00 UTC
Other
Other
Encryption SDK vulnerabilities
AWS KMS and all versions of AWS Encryption SDKs prior to version 2.0.0 were susceptible to information leakage (an attacker could create ciphertexts that would leak the user’s AWS account ID, encryption context, user agent, and IP address upon decryption), ciphertext forgery (an attacker could create ciphertexts that were accepted by other users) and lack of robustness (an attacker could create ciphertexts that decrypt to different plaintexts for different users).
P0
2020-09-28 00:00 UTC
Other
Other
S3 bucket tagging not restricted
Lack of the privilege s3:PutBucketTagging did not restrict the ability to tag S3 buckets.
P0
2020-09-25 00:00 UTC
Other
Other
CloudFormer review
An audit of an AWS open-source project identified a great deal of issues, and as a result AWS made the decision to take it down.
P0
2020-09-22 00:00 UTC
Other
Other
CloudFormation resource provider credentials leak
CloudFormation allows the use of Lambda-backed resource providers, wherein Lambda can be used to write custom provisioning logic to be executed during CloudFormation stack operations. The aforementioned Lambda functions were executed in an AWS-managed account (thus effectively allowing arbitrary code execution in that account), and were passed a set of credentials ("platformCredentials") for a role in this account that had several EventBridge permissions. These were sufficient for an attacker t…
P0
2020-09-17 00:00 UTC
Security Journalism
Security Journalism
Phishing, Office 365 and the Commercialization of Cybercrime | Huntress
Hackers getting better at their tradecraft and their skills are becoming more and more accessible to other bad actors via the Dark Web.
P0
2020-09-15 00:00 UTC
Other
Other
Timing attack with Lambda and CloudWatch Synthetics
The immutability of Lambda versions could be violated via a timing attack against CloudWatch Synthetics canaries.
P0
2020-09-10 13:46 UTC
Other
Other
Lock Like a Pro
Dive in Recent ProLock's Big Game Hunting
P0
2020-09-01 00:00 UTC
Other
Other
CloudFormation denial of service (in a single account)
An attacker with the ability to create CloudFormation stacks could cause a denial-of-service on some CloudFormation actions within a single AWS account.
P0
2020-08-26 00:00 UTC
Other
Other
GCP service accounts and projects information leak
It was possible to list IAM service accounts of any GCP project, given only its ID, by forging a pageToken for the projects.serviceAccounts.list method of the IAM API. Due to the design of certain services in GCP, this issue could lead to exposure of sensitive information related to a project, and could be further used to enumerate unsecured resources in the platform, such as App Engine apps, Container Registry repositories, etc.
P0
2020-08-20 00:00 UTC
Security Journalism
Security Journalism
Hiding in Plain Sight: Part 2
As a follow-up to our previous post, we recently uncovered a really peculiar piece of malware that works through a lot of different layers of abstraction.
P0
2020-08-18 00:00 UTC
Other
Other
Dropping a Shell in Google Cloud SQL
Researchers discovered vulnerabilities in Google Cloud SQL that allowed gaining unauthorized shell access to MySQL instances. By chaining SQL injection, parameter injection in mysqldump, and network spoofing, they were able to escape a Docker container and gain full access to the host VM running Cloud SQL.
P0
2020-08-18 00:00 UTC
Other
Other
Google Cloud Shell Bugs Expose User Credentials
Three vulnerabilities in Google Cloud Shell were discovered, allowing attackers to execute arbitrary code and potentially steal user credentials. The bugs affected Ruby gemspec parsing, TypeScript plugin loading, and Go binary path manipulation in Cloud Run. These issues arose from mismatches between Cloud Shell's threat model and the assumptions of its underlying open-source components.
P0
2020-08-10 00:00 UTC
Other
Other
S3 Crypto SDK vulnerabilities
No summary available
P0
2020-07-28 12:00 UTC
Government
Government
Decrypting diversity: Diversity and inclusion in cyber security report 2020
Joint report between the NCSC and KPMG UK is the first in a series to benchmark and track levels of diversity and inclusion in the cyber security industry.
P0