LATEST

Learning, Sharing, and Exploring with NIST’s New Human-Centered Cybersecurity Community of Interest

Human-centered cybersecurity (also known as ‘usable security’) involves the social, organizational, and technological influences on people’s understanding of and interactions with cybersecurity. By taking a human-centered cybersecurity (HCC) approach, we can both improve people's cybersecurity experiences and achieve better cybersecurity outcomes, which is so important in today’s digitally interconnected world. At NIST, we understand the value of making connections, listening, and interactivity…

APT Lazarus: Eager Crypto Beavers, Video calls and Games

Explore the growing threats posed by the Lazarus Group's financially-driven campaign against developers. We will examine their recent Python scripts, including the CivetQ and BeaverTail malware variants, along with their updated versions in Windows and Python releases. Additionally, we will analyze their tactics, techniques, and indicators of compromise.

Phishing in the Fast Lane | Huntress

Join Huntress team members as they walk through some of the most malicious phishing techniques, presented from the attacker's perspective.

RansomHub ransomware-as-a-service

Learn why RansomHub's new affiliate program and its advanced ransomware tactics—recruiting former Scattered Spider members, exploiting unprotected RDP services, and exfiltrating large data volumes—are critical for staying ahead of modern cyber threats.

APT Targeting Vietnamese Human Rights Defenders | Huntress

Huntress identified an intrusion against a non-profit supporting Vietnamese human rights that’s likely spanned years. Jump in as we provide a thorough analysis of this malicious threat actor.

Hiding in plain sight: Techniques and defenses against `/proc` filesystem manipulation in Linux

Group-IB explores methods of process visibility evasion through /proc filesystem manipulation in Linux, along with effective defenses to counteract these tactics.

Which States Are Most at Risk for Government Cyberattacks? | Huntress

Cyberattacks on U.S. government and critical infrastructure surged in 2023, with over 420 million global attacks. Learn which states are most affected and discover how Huntress can help protect your organization

Remote Work Security | Huntress

Join Imani on her adventures as she learns how to remain secure in remote work environments with our latest Huntress SAT episode!

Protecting Against Session Hijacking & Credential Theft | Huntress

Discover how our new Unwanted Access capability strengthens your defenses against session hijacking and credential theft. Dive in and learn how to minimize risks and protect your business-critical assets from evolving cyber threats.

Implementation Challenges in Privacy-Preserving Federated Learning

In this post, we talk with Dr. Xiaowei Huang and Dr. Yi Dong (University of Liverpool), Dr. Mat Weldon ( United Kingdom (UK) Office of National Statistics (ONS)), and Dr. Michael Fenton (Trūata) who were winners in the UK-US Privacy-Enhancing Technologies ( PETs) Prize Challenges. We discuss implementation challenges of privacy-preserving federated learning (PPFL) - specifically, the areas of threat modeling and real world deployments. Threat Modeling In research on privacy-preserving federated…

Copilot Studio information disclosure via SSRF

WireServing Up Credentials in Azure Kubernetes Services

A vulnerability in Azure Kubernetes Services allowed attackers to escalate privileges and access cluster credentials. Affected clusters used Azure CNI for network configuration and Azure for network policy. Attackers could exploit this issue to steal data and cause financial and reputational damage. The vulnerability has been fixed by Microsoft after disclosure by Mandiant.

AWS Direct Connect route injection issue

A BGP-based feature of the AWS Direct Connect service allowed a third party to inject an incorrect route for an external IP, effectively hijacking AWS-sourced traffic. This resulted in connectivity issues between AWS EC2 instances and external systems. The issue was caused by a typo in a Direct Connect customer's configuration, which advertised an incorrect prefix to AWS.

Deciphering the Brain Cipher Ransomware

Deep dive into Brain Cipher ransomware group's activities and techniques, and how they are seemingly linked to other ransomware groups such as EstateRansomware and SenSayQ

Azue Health privilege escalation via SSRF

BBOT 2.0 - Release Announcement

The recursive internet scanner gets an upgrade

Multiples vulnérabilités dans Roundcube (09 août 2024)

Le 4 août 2024, Roundcube a publié des correctifs concernant les vulnérabilités critiques CVE-2024-42008 et CVE-2024-42009 affectant son serveur de courriel. Ces vulnérabilités permettent des injections de code indirectes à distance (XSS) qui peuvent, par exemple, conduire à la récupération du...

Under Siege: The threat of compromised Mobile Device Management credentials and its implications for organizational security

The leakage of credentials for Mobile Device Management (MDM) services could pose significant risks to organizations and their data security.

Bucket Monopoly Attack on AWS Services

Researchers discovered critical vulnerabilities in 6 AWS services that could allow attackers to breach accounts through malicious S3 buckets. By claiming predictable bucket names, attackers could inject code, steal data, or gain admin access. AWS has since fixed the issues, but the attack vector may still apply to other services and open source projects.

Privilege Elevation Vulnerability in Entra ID

Semperis researchers discovered vulnerabilities in Microsoft applications that allowed privilege elevation in Entra ID beyond expected authorization controls. The most severe finding enabled adding users to privileged roles, including Global Administrator, without proper permissions. The issues affected Device Registration Service, Viva Engage, and Microsoft Rights Management Service. Microsoft has since resolved the vulnerabilities.

Don't Get Security from Your RMM Provider: Know the Risks | Huntress

Here’s why purchasing your cybersecurity products and services through your RMM provider isn’t always the best value. Learn how to avoid common pitfalls and choose more effective EDR and MDR solutions.

SlashAndGrab ConnectWise ScreenConnect Vulnerability

Huntress gives you a non-technical breakdown of the SlashAndGab ConnectWise ScreenConnect Vulnerability; dig into the insights on how we discovered it and supported the community along the way.

NIS 2 compliance for EU businesses: Meet cybersecurity requirements before the deadline (October 17)

With NIS 2 non-compliance proving detrimental — resulting in millions in fines, business activity suspension, and more, become compliant while there’s still time!

Huntress CVE Numbering Authority (CNA): Common Vulnerabilities and Exposures Explained

What is a CVE Numbering Authority (CNA)? Learn how CNAs assign CVE IDs, why they matter for vulnerability management, and how Huntress became one.

Beware CraxsRAT: Android Remote Access malware strikes in Malaysia

CraxsRAT is a notorious Android malware family known for its Remote Administration Tools (RAT), which include remote device control and advanced spyware functions like keylogging, gesture manipulation, and recording of cameras, screens, and calls.

Huntress Recognized with 44 New G2 Leader Badges for Summer 2024 | Huntress

Huntress Managed EDR was featured in 50 unique G2 reports, earning over 44 Leader badges. Learn why we’re retaining our #1 rank for the 9th quarter in a row.

GXC Team Unmasked: The cybercriminal group targeting Spanish bank users with AI-powered phishing tools and Android malware

Specializing in AI-powered phishing-as-a-service and Android malware capable of intercepting OTP codes, the GXC Team targets Spanish bank users and 30 institutions worldwide

GCP Cloud Functions Privilege Escalation Vulnerability

A privilege escalation vulnerability dubbed "ConfusedFunction" was discovered in Google Cloud Platform's Cloud Functions service. It allows attackers to escalate privileges from Cloud Function permissions to the default Cloud Build service account during function deployment. The vulnerability affects both first and second-generation Cloud Functions.

When Trust Becomes a Trap: Foiling a Medical Software Hack | Huntress

Hackers cloned a legitimate medical image viewer site to distribute malware, but thanks to Huntress, the threat was detected in time. Dive into the incident and see how we uncovered the deception and averted disaster.

Qilin Revisited: Diving into the techniques and procedures of the recent Qilin Ransomware Attacks

Discover the insidious tactics of the Qilin ransomware group, notorious for their $50 million attack on the healthcare sector, impacting key NHS hospitals.