Hackers cloned a legitimate medical image viewer site to distribute malware, but thanks to Huntress, the threat was detected in time. Dive into the incident and see how we uncovered the deception and averted disaster.
Discover the insidious tactics of the Qilin ransomware group, notorious for their $50 million attack on the healthcare sector, impacting key NHS hospitals.
Huntress has observed new behaviors in conjunction with the malware SocGholish. Read on to understand the implications of this threat and how you can better protect yourself.
Evasion Techniques and Detection Strategies for Memory-Resident Malware
Learn why the FBI recently warned dental practices of potential cyberattacks and discover how Huntress Security Awareness Training can help prevent them.
The AWS Client VPN service was found to be affected by two vulnerabilities which could potentially allow malicious actors with access to a user’s device to execute arbitrary commands with elevated privileges, including escalating to root access. Both vulnerabilities stem from buffer overflow issues, a common programming error that can be exploited to overwrite memory and gain unauthorized control over a system. The impact of these vulnerabilities is severe, as successful exploitation could lead…
This post is part of a series on privacy-preserving federated learning. The series is a collaboration between NIST and the UK government’s Responsible Technology Adoption Unit (RTA), previously known as the Centre for Data Ethics and Innovation. Learn more and read all the posts published to date at NIST’s Privacy Engineering Collaboration Space or RTA’s blog . The last two posts in our series covered techniques for input privacy in privacy-preserving federated learning in the context of horizo…
The digital space is riddled with risks to your brand. Ensure it stays defended with Group-IB Digital Risk Protection’s automated violation detection and takedown.
Microsoft Defender for Cloud at one point provided customers with a flawed configuration template through their public GitHub repository. This template creates resources in the customer's AWS account so that Microsoft Defender for Cloud can scan it. In the rare cases in which this template was deployed, under certain, limited circumstances, Defender for Cloud's security findings for these AWS accounts could be disclosed to unauthorized third parties.
Delaying security updates and neglecting regular reviews created vulnerabilities that were exploited by attackers, resulting in severe ransomware consequences.
Secure endpoints are critical to your cyber defenses. Here’s a list of endpoint security tips every IT and security professional should know.
Where adversaries do not hesitate to initiate blended attacks combining multiple tactics, why are security teams still operating in silos?
Learn about the current state of cyber threats to critical infrastructure and find out how state and local governments can protect against devastating breaches.
All about Eldorado Ransomware and how its affiliates make their own samples for distribution.
Cybercriminals are now blending into legitimate systems. Huntress’ 2024 Cyber Threat Report reveals the latest unsettling trends and tactics we observed, including the misuse of remote monitoring tools and cloud storage services.
How to best empower your business clients’ cybersecurity with critical cyber threat intelligence
Le 1 juillet 2024, OpenSSH a publié un avis de sécurité concernant la vulnérabilité critique CVE-2024-6387. Cette vulnérabilité permet à un attaquant non authentifié d'exécuter du code arbitraire à distance avec les privilèges *root*. L'éditeur précise que les versions 8.5p1 à 9.7p1 sont...
The scam schemes enabled by Craxs Rat malware provide complete remote control of the victims’ devices. Defend yourself from being next.
Healthcare must protect sensitive data from accidental equipment loss, data theft, and insider attacks. Learn practical steps and solutions to enhance your security and maintain patient trust.
Huntress Chief People Officer Todd Riesterer discusses how we curate a culture of BElonging, built on pillars of humaneness, equity, and diversity.
Learn about Huntress' latest feature, Auto-Remediations for Low-severity Incidents, which can help save time by instantly remediating low-severity threats.
Here’s why bundling cybersecurity products and services like Kaseya K365 aren’t always the best value for your organization. Learn how to avoid common pitfalls and choose more effective EDR and MDR solutions.
Uncovering the operations of threat actor Boolka, driven by the creation of malicious scripts, malware trojans, sophisticated malware delivery platforms, and more.
Huntress CEO Kyle Hanslovan highlights the cybersecurity leader's Series D funding and how this investment will benefit partners moving forward.
Certain API endpoints on ml.azure.com and ai.azure.com used for adding/viewing data connections could be leveraged for server side request forgeries (SSRF). While they do have protections to restrict making requests to internal hosts, it was possible to circumvent those protections using a 301 or 302 redirect response which points to a sensitive host.
Cloud Audit Logs do not capture actions mediated through the cloud console private API service (cloudconsole-pa). Consequently, there is no logging of HMAC key creation or deletion linked to user accounts. This absence of logs hampers defenders' ability to alert or monitor the creation of HMAC keys for user accounts, posing a persistence risk, or their deletion, presenting a denial of service risk.
GCP administrators face challenges in managing HMAC keys within their organizations, lacking visibility into which user accounts have generated these keys and whether they are actively being used to access storage objects. Additionally, there's a lack of functionality to revoke keys associated with other users, restricting their ability to enforce security policies effectively. Similarly, GCP incident response teams rely on Cloud Logging to monitor Cloud Storage object access, but they lack spe…
GitHub Copilot Chat VS Code Extension was vulnerable to data exfiltration via prompt injection when analyzing untrusted source code. The vulnerability allowed attackers to access previous conversation turns and append information from the chat history to an image URL, which was then automatically retrieved by Copilot, sending the data to the attacker.
Let Huntress debunk the biggest Mac security myths. macOS is now a popular target for hackers, so learn the truth about its vulnerabilities and discover practical steps to enhance protection against cyber threats.
The last few months have brought even more opportunities for NIST to engage with our international partners to enhance cybersecurity. Here are some updates on our recent international engagement: Conversations have continued with our partners throughout the world on the recent release of the Cybersecurity Framework Version 2.0 . NIST international engagement continues through our support to the Department of State and the International Trade Administration (ITA) during numerous international di…
