LATEST

Rethinking investigation: Group-IB’s Graph takes a leap forward

Know Thy Enemy: A Novel November Case | Huntress

In this blog, Huntress SOC investigators unravel the lateral movement and persistence of an interesting threat actor and their novel infrastructure

Kicking-Off with a December 4th Workshop, NIST is Revisiting and Revising Foundational Cybersecurity Activities for IoT Device Manufacturers, NIST IR 8259!

In May 2020, NIST published Foundational Cybersecurity Activities for IoT Device Manufacturers (NIST IR 8259), which describes recommended cybersecurity activities that manufacturers should consider performing before their IoT devices are sold to customers. These foundational cybersecurity activities can help manufacturers lessen the cybersecurity-related efforts needed by customers, which in turn can reduce the prevalence and severity of IoT device compromises and the attacks performed using c…

Tracing the Path of VietCredCare and DuckTail: Vietnamese dark market of infostealers’ data

Following the arrest in May 2024 of more than 20 individuals behind Facebook infostealers campaigns in Vietnam, we have compared the tactics of operators behind VietCredCare and DuckTail stealers. These 2 malware families have been active before the arrest in Vietnam and are believed to be controlled by Vietnamese threat actors. Based on the research, we decided that the groups operate in a different way and the arrest probably affected the VietCredCare operators.

Make Your Microsoft Security Tools Come to Life With Huntress | Huntress

Huntress joins the Microsoft Intelligent Security Association to enhance Microsoft tools for SMBs, delivering stronger defenses against today’s most advanced cyber threats.

Silencing the EDR Silencers | Huntress

Discover how adversaries are using tools like EDRSilencer to tamper with EDR communications and learn how you can fight back.

Unlocking Cybersecurity Talent: The Power of Apprenticeships

Cybersecurity is a fast-growing field, with a constant need for skilled professionals. But unlike other professions — like medicine or aviation — there’s no clear-cut pathway to qualifying for cybersecurity positions. For employers and job seekers alike, this can make the journey to building a team (or entering a successful cybersecurity career) feel uncertain. Enter the registered apprenticeship program — a proven method for developing skilled talent in cybersecurity that benefits both the emp…

To MFA or Not To MFA | Huntress

MFA could be the thing that stops your payroll money from disappearing in a wire transaction. So why do we treat it as an optional inconvenience?

Strengthening AML Defenses: Detect Money Mules During Their ‘Warm-Up’ Phase

Know the need to catch mules early in their operations to protect you from severe risks, including large-scale money laundering, compliance breaches, and business and customer disruptions.

[MàJ] Multiples vulnérabilités sur l'interface d'administration des équipements Palo Alto Networks (15 novembre 2024)

Le 8 novembre 2024, Palo Alto Networks a publié un avis de sécurité relatif à une vulnérabilité critique dans certains pare-feux Palo Alto Networks. Elle permet à un attaquant non authentifié d'exécuter du code arbitraire à distance sur l'interface d'administration des équipements. L'éditeur...

Digital Identities: Getting to Know the Verifiable Digital Credential Ecosystem

If you are interested in the world of digital identities, you have probably heard some of the buzzwords that have been floating around for a few years now… “verifiable credential,” “digital wallet,” “mobile driver’s license” or “mDL.” These terms, among others, all reference a growing ecosystem around what we are calling “verifiable digital credentials.” But what exactly is a verifiable digital credential? Take any physical credential you use in everyday life – your driver’s license, your medic…

Stealthy Attributes of Lazarus APT Group: Evading Detection with Extended Attributes

WTF is ITDR? | Huntress

ITDR is the latest must-know acronym. But what is it? And why does it matter? Let Huntress break down the essentials of identity threat detection and response, and learn why it’s critical for your defenses.

A Parent's Guide to Securing Children's Tech Gifts | Huntress

Safeguard holiday tech gifts for kids this season—secure their devices, protect privacy, and build lifelong safety habits. Feat. resources from our exclusive Fireside Chat.

ModeLeak: LLM Model Exfiltration Vulnerability in Vertex AI

A vulnerability in GCP's Vertex AI service allows privilege escalation and unauthorized access to sensitive LLM models. Attackers can exfiltrate these models by exploiting misconfigurations in access controls and service bindings. By exploiting custom job permissions, researchers were able to escalate their privileges and gain unauthorized access to all data services in the project. In addition, deploying a poisoned model in Vertex AI led to the exfiltration of all other fine-tuned models, posi…

Turning TTPs into CTF Challenges: Huntress CTF 2024 Retro | Huntress

Explore the highlights of Huntress Capture the Flag 2024, where teams cracked complex cyber challenges in a month-long journey of reverse engineering and malware analysis.

Sketchy Cheat Sheet

Multiple vulnerabilities were discovered in Google's Cloud Architecture Diagramming Tool, including XSS, unauthorized access to user data, and misconfigured storage buckets. The issues allowed accessing sensitive customer information and potentially executing arbitrary code. Google ultimately decommissioned the service due to the severity of the flaws.

Issue with data.all Framework Multiple CVEs

Multiple security vulnerabilities were identified in data.all, an open source development framework for building data marketplaces on AWS. The issues affect versions 1.0.0 through 2.6.0 and include problems with authentication token invalidation, unauthorized operations on DataSets and Environments, incorrect object-level authorizations, potential access to sensitive data via logs, and unauthorized mutating update operations on notification records.

Run from Chase Cyber Threats

Waiting for risks to be presented to you rather than actively hunting them down? After reading this, you might consider a shift in approach to improve detection and proactively counter sophisticated attacks.

Lead the Pack with SAT Leaderboards | Huntress

Leaderboards and Manager Notifications are the new way to motivate learners and track progress in Huntress Managed SAT.

HISAA: Raised Cybersecurity Standards for Healthcare | Huntress

Discover how the Health Infrastructure Security and Accountability Act aims to enforce stricter cybersecurity standards across the healthcare sector.

The Evolution of the Huntress Neighborhood Watch Program | Huntress

Explore how the Huntress Neighborhood Watch Program has grown and how it empowers MSPs with Managed ITDR, Managed EDR, and more.

Confused Deputy Vulnerability in Amazon DataZone

A vulnerability in Amazon DataZone allowed potential attackers to assume roles in AWS accounts by exploiting a confused deputy problem. This could have granted unauthorized access to sensitive data managed by DataZone or other AWS services accessible by the IAM role trusting DataZone. The issue has been resolved, with no customers reportedly impacted.

Repo swatting attack deletes/blocks GitHub and GitLab accounts

A technique called "repo swatting" allows attackers to delete GitHub and block GitLab accounts by exploiting file upload features and abuse reporting mechanisms. Attackers upload malicious files to a target's repository, then report the account for hosting malicious content, potentially resulting in account deletion. The vulnerability was partially mitigated by October 2024 via changes in upload URL paths and requirement for each uploader to be authenticated (in GitHub).

Cybersecurity Awareness Month is Ending, but Holiday Threats Are Just Getting Started | Huntress

Learn why cybersecurity awareness should last all year round, and discover pro tips to keep you and your org secure, especially as we enter into the threat-filled holiday season.

Delivery Deception: Escalating cybercriminal tactics in the Balkan region

Explore our latest findings on the surge of cyberattacks in the Balkan region, focusing on threats to financial institutions and critical infrastructure. Discover how phishing scams impersonating postal services are targeting citizens in Croatia, Romania, Serbia, and Slovenia, and learn about the implications for public safety and security. Stay informed and protected against the rising tide of cybercrime.

Group-IB Fraud Protection: Know your real users, catch the fraudsters

Stop fraud, RATs, and malware with Group-IB's Fraud Protection AI. Our advanced behavioral analysis uses AI to detect and prevent threats in real-time, safeguarding your business and users.

Staff Stories Spotlight Series: Cybersecurity Awareness Month 2024

This blog is part of a larger NIST series during the month of October for Cybersecurity Awareness Month , called 'Staff Stories Spotlight.' Throughout the month of October this year, Q&A style blogs will be published featuring some of our unique staff members who have interesting backgrounds, stories to tell, and projects in the world of cybersecurity. This year’s Cybersecurity Awareness Month theme is ‘Secure our World.’ How does this theme resonate with you, as someone working in cybersecurit…

Global iGaming? Tailor Your Security with Group-IB Fraud Protection

With Group-IB Fraud Protection, you can navigate the complexities of global iGaming regulations and risk. Tailor security measures for each market, optimize costs, and maximize growth. Learn how our advanced fraud detection and prevention tools can protect your players and profits.

AWS CDK Bucket Squatting Risk

The AWS Cloud Development Kit (CDK) is a way of deploying infrastructure-as-code. The vulnerability involves AWS CDK’s use of a predictable S3 bucket name format (cdk-{Qualifier}-assets-{Account-ID}-{Region}), where the default “random” qualifier (hnb659fds) is common and easily guessed. If an AWS customer deletes this bucket and reuses CDK, an attacker who claims the bucket can inject malicious CloudFormation templates, potentially gaining admin access. Attackers supposedly only need the AWS a…