2024-01-24 12:00 UTC
Government
Government
The near-term impact of AI on the cyber threat
An NCSC assessment focusing on how AI will impact the efficacy of cyber operations and the implications for the cyber threat over the next two years.
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 4,585 matching records.
AUTO-POLL // 2026-10-07 13:25 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P4 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 7
RANSOMWARE
P4
COOL // 32 ARTICLES
TUE
Oct 6
RANSOMWARE
P3
COOL // 61 ARTICLES
MON
Oct 5
RANSOMWARE
P5
COOL // 48 ARTICLES
SUN
Oct 4
RANSOMWARE
P10
WARM // 11 ARTICLES
SAT
Oct 3
RANSOMWARE
P4
COOL // 14 ARTICLES
FRI
Oct 2
RANSOMWARE
P7
COOL // 46 ARTICLES
THU
Oct 1
RANSOMWARE
P8
COOL // 63 ARTICLES
2024-01-24 00:00 UTC
Other
Other
Google Cloud GKE Unsecure Sys:All Binding
The system:authenticated group in Kubernetes is a special group that includes all authenticated entities, including human users and service accounts. Anyone who successfully authenticates to the Kubernetes API server, regardless of the authentication method used, will be automatically included in this unique group. Thus, it will share the same roles and permissions of the group. This misunderstanding then creates a significant security loophole when administrators unknowingly bind this group wi…
P0
2024-01-18 00:00 UTC
Other
Other
Amazon Q for Business Data Exfiltration
An Indirect Prompt Injection attack can cause the LLM to return markdown tags. This allows an adversary who’s data makes it into the chat context (e.g via an uploaded file) to achieve data exfiltration of the victim’s data by rendering hyperlinks.
P0
2024-01-17 00:00 UTC
Security Journalism
Security Journalism
Ransomware Deployment Attempts Via TeamViewer | Huntress
Huntress analysts continue to observe access to endpoints via legacy TeamViewer installations, and/or compromised TeamViewer credentials.
P15
2024-01-16 07:58 UTC
Other
Other
Inferno Drainer: A Deep Dive into Crypto Wallet-Draining Malware
Inferno Drainer may have shut down in November 2023, but users of the devastating scam-as-a-service platform still pose a risk as they look for other avenues.
P0
2024-01-16 00:00 UTC
Security Journalism
Security Journalism
Full Transparency: Controlling Apple's TCC | Huntress
Dive into Apple's TCC framework, decoding its role in user privacy. Explore permissions, challenges, and the encryption safeguarding sensitive data.
P0
2024-01-12 00:00 UTC
Government
Government
[MàJ] Multiples Vulnérabilités dans GitLab (12 janvier 2024)
\[Mise à jour du 29 janvier 2024\] Le 25 janvier 2024, l'éditeur a publié un avis de sécurité concernant plusieurs vulnérabilités affectant GitLab CE et EE. La vulnérabilité CVE-2024-0402 est considérée critique avec un score CVSSv3 de 9,9. Elle permet à un attaquant authentifié d'écrire des...
P5
2024-01-12 00:00 UTC
Security Journalism
Security Journalism
Securing Healthcare: Handling Cyber Threats with Care | Huntress
What’s the key to navigating healthcare cybersecurity? This blog decodes today’s healthcare threat landscape and defensive strategies for patient well-being.
P0
2024-01-11 00:00 UTC
Government
Government
[MàJ] Multiples vulnérabilités dans Ivanti Connect Secure et Policy Secure Gateways (11 janvier 2024)
[Mise à jour du 4 mars 2024] Ivanti a publié le 29 février des recommandations de résolution pour les Ivanti Connect Secure ou Policy Secure en machine virtuelle [16]. [Mise à jour du 15 février 2024] l'éditeur a publié le 15 février des correctifs pour les versions suivantes, qui n'en...
P0
2024-01-04 00:00 UTC
Security Journalism
Security Journalism
Empowering the Hunt: All Your Security in One Place | Huntress
Huntress unveils a powerful new platform UI for 2024! From SOC insights to triage feeds, all your security insights are now in a unified interface in the Huntress platform.
P0
2024-01-02 00:00 UTC
Security Journalism
Security Journalism
Navigating Cybersecurity Challenges in Healthcare | Huntress
Discover essential strategies for healthcare cybersecurity in our latest blog. Learn how to navigate challenges, optimize resources, and safeguard patient data.
P0
2024-01-01 00:00 UTC
Other
Other
Microsoft Healthcare Chatbot Vulnerabilities
Multiple vulnerabilities in Microsoft's Azure Health Bot service were discovered, allowing access to sensitive infrastructure and confidential medical data. Issues included sandbox escapes, unrestricted code execution, access to authentication secrets, cross-tenant data exposure, and unauthorized deletion of resources. Microsoft quickly patched the vulnerabilities and restructured the service architecture for improved security.
P0
2023-12-29 07:59 UTC
Other
Other
Hunting Rituals #3: Threat hunting for scheduled tasks
Actionable guide to hunting for the scheduled tasks by using Group-IB MXDR
P0
2023-12-27 07:56 UTC
Other
Other
The future is now: Watch out for these 20 trends that will change the course of cybersecurity (Part 2)
Cybersecurity is changing, and changing fast. Learn how Group-IB can help you lead the change instead of being carried by it.
P0
2023-12-27 00:00 UTC
Other
Other
Amazon Cognito Rate Limit Bypass Vulnerability
A rate limit bypass vulnerability was discovered in Amazon Cognito, allowing attackers to potentially brute-force login credentials, password reset PINs, and MFA codes by sending requests in parallel. The vulnerability affected the main login flow, password reset function, and MFA process, potentially exposing user accounts to unauthorized access.
P0
2023-12-27 00:00 UTC
Security Journalism
Security Journalism
Combating Emerging Microsoft 365 Tradecraft: Initial Access | Huntress
Threats evolve, and so does Huntress. Let’s talk about evolving our approach to hitting the hackers where it hurts on Microsoft 365.
P0
2023-12-23 00:00 UTC
Security Journalism
Security Journalism
Effortless Phishing Simulations Now Part of Huntress | Huntress
Read about our newest addition to Huntress Managed SAT, Managed Phishing, offering you expert-backed, hassle-free simulated phishing campaigns.
P0
2023-12-20 07:55 UTC
Other
Other
The future is now: Watch out for these 20 trends that will change the course of cybersecurity (Part 1)
Cybersecurity is changing, and changing fast. Learn how Group-IB can help you lead the change instead of being carried by it.
P0
2023-12-20 00:00 UTC
Other
Other
Azure Pipelines Agent poisoned pipeline execution
Azure Pipelines and GitHub Actions allow deployment of runners and agents using VM images sourced from a GitHub-managed repository (github.com/actions/runner-images). This repo was misconfigured to use self-hosted runners insecurely, in a way that could have allowed a malicious external contributor (i.e., anyone who had previously had at least one PR approved and merged in the repo) to poison the repository and achieve code execution on runners in the repo. This in turn could have theoretically…
P0
2023-12-20 00:00 UTC
Other
Other
Data Exfiltration Through CloudTrail
This scenario describes a potential data exfiltration technique using AWS CloudTrail. An attacker with access to CloudTrail logs could potentially extract sensitive information from logged events, including API calls and data modifications. This poses a risk to data confidentiality and could lead to unauthorized access to sensitive information.
P0
2023-12-20 00:00 UTC
Other
Other
Poisoning GitHub's Runner Images Supply Chain Attack
A critical vulnerability in GitHub's actions/runner-images repository allowed arbitrary code execution on self-hosted runners, potentially enabling modification of GitHub's runner base images. The flaw stemmed from misconfigured self-hosted runners on a public repository with default workflow approval settings. The researcher gained persistence, accessed secrets, and could have inserted malicious code into GitHub's runner images used by customers.
P10
2023-12-19 00:00 UTC
Other
Other
AWS IAM Identity Center Expiry
AWS IAM Identity Center exchanges third-party OIDC tokens for Identity Center-issued tokens. Identity Center relies on the jti claim in the third-party tokens to prevent replay attacks. Identity Center maintained a cache of previously-seen jti values for a fixed period (24 hours) and didn’t enforce that the third-party tokens had expiry claims. This meant that a token with a jti claim and without an exp claim could be replayed after >24 hours had passed.
P0
2023-12-15 07:56 UTC
Other
Other
You versus adversaries: How to become unbeatable in 20 cybersecurity moves (Part 2)
Cybersecurity essentials that ensure your business stays undisrupted in the upcoming year.
P0
2023-12-15 00:00 UTC
Other
Other
Google OAuth Vulnerability Allows Indefinite Access
A vulnerability in Google OAuth allows employees to retain indefinite access to applications like Slack and Zoom after being removed from their company's Google organization. The issue stems from the ability to create Google accounts using corporate email aliases, which can't be off-boarded by the organization. This bypasses typical account removal processes and poses a significant security risk.
P0
2023-12-14 06:02 UTC
Other
Other
Ace in the Hole: exposing GambleForce, an SQL injection gang
Analysis of TTPs tied to GambleForce, which carried out SQL injection attacks against companies in the APAC region
P0
2023-12-14 00:00 UTC
Security Journalism
Security Journalism
Curling for Data: A Dive into a Threat Actor's Malicious TTPs | Huntress
Huntress analysts recently observed a novel set of tactics, techniques, and procedures used by a threat actor for data collection and exfiltration.
P0
2023-12-13 00:00 UTC
Government
Government
Vulnérabilité dans Apache Struts 2 (13 décembre 2023)
Le 4 décembre 2023, Apache a publié un avis de sécurité concernant la vulnérabilité critique CVE-2023-50164 concernant le cadriciel Struts 2. Cette vulnérabilité permet à un attaquant non authentifié de téléverser une porte dérobée sur un serveur vulnérable, et ainsi exécuter du code arbitraire à...
P5
2023-12-12 00:00 UTC
Other
Other
Control plane bypass in Azure OpenAI
A way to manage Azure OpenAI deployments via the Data Plane was discovered, bypassing key security controls. This allows creation/modification/deletion of deployments without the usual protections of Resource Manager Locks, Azure Policy, and Entra ID authentication.
P0
2023-12-12 00:00 UTC
Security Journalism
Security Journalism
Orienting Intelligence Requirements to the Small Business Space
Discover how to streamline small business intelligence for practical decision-making, balance benefits, and explore cost-effective outsourcing solutions.
P0
2023-12-08 06:57 UTC
Other
Other
You versus adversaries: How to become unbeatable in 20 cybersecurity moves (Part 1)
Cybersecurity essentials that will ensure your business stays undisrupted in the upcoming year.
P0