Discover the alarming prevalence of exposed passwords on endpoints and how to safeguard your credentials. Learn from Huntress' findings and insights.
Get a close look at details of the most notable cases faced by Group-IB’s Digital Forensics and Incident Response (DFIR) team
\[Mise à jour du 22 novembre 2023\] L'éditeur a publié un document \[3\] le 20 novembre 2023 listant les différents journaux à analyser ainsi que les éléments à rechercher pour identifier une activité pouvant être liée à une compromission. Par ailleurs, la CISA a publié un avis de sécurité le 21...
In Azure AI Playground, a Prompt Injection attack could cause an LLM to return markdown tags. This would have allowed an adversary whose data makes it into the chat context (e.g., via an uploaded file) to achieve exfiltration of the victim’s data by rendering hyperlinks. However, the severity of this issue is low, as there were no integrations that could pull remote content. This means Indirect Prompt Injection was not possible, and it would require the victim to copy the malicious prompt from …
In Vertex AI Studio, a Prompt Injection attack could cause the LLM to return markdown tags. This could have allowed an adversary whose data makes it into the chat context (e.g., via an uploaded file) to achieve exfiltration of the victim’s data by rendering hyperlinks. However, the severity of this issue is low, as there were no integrations that could pull remote content. This means Indirect Prompt Injection was not possible, and it would require the victim to copy the malicious prompt from el…
Explore the art of phishing, learn how to spot common phishing scams and red flags, and understand the importance of security awareness training.
Hacktivists take center stage with DDoS, defacement attacks – summary of Week 1 and 2 of the conflict.
Twas the night before Christmas, when out came the cry, a cyberattack is happening, so stop them, won’t you try?
Read up on how and why Huntress built its Managed ITDR (formerly MDR for Microsoft 365) solution to help combat the growing threat of business email compromise (BEC).
Is it worth ditching your legacy antivirus solution? This blog takes a hard look at what matters most in AV and endpoint protection tools.
In the spirit of Cybersecurity Awareness Month, use these cybersecurity tips to take your security hygiene and cyber knowledge up a notch.
AWS identified an issue in the Amazon WorkSpaces Windows client which resulted in unintentionally logging connection debugging information to a user's local system. This data could include usernames or passwords if they contain specific characters: \ (backslash) or " (double quotes). If an attacker gained access to an Amazon WorkSpaces user's machine, they could then compromise such credentials from the log.
Delve into the tactics of the GoldDigger Trojan and discover ways to safeguard your customers
We can use automation, detection and response, and open-source software to solve common SOC challenges. Read about simple approaches for SOC automation.
In this blog, our Mac expert answers the existential question: As a Mac user, do you need to use an antivirus (AV) to protect your Mac?
Le 27 septembre 2023, Zero Day Initiative (ZDI) a publié six avis de sécurité \[1\] concernant des vulnérabilités de type zéro-jour affectant les versions antérieures à 4.96.1 ou 4.97 de l'agent de transfert de courriels (*Mail Transfer Agent* ou *MTA*) Exim. Le 1er octobre 2023, l'éditeur a...
Huntress is actively investigating numerous vulnerabilities affecting the WS_FTP Server Ad Hoc Transfer Module observed in the wild.
Huntress is tracking a new critical vulnerability seen in the wild that affects anything using the libwebp WebP image library. Here’s what we know so far.
Can AI ever fully replace humans in cybersecurity? We argue that human-powered security is the key to staying one step ahead of today’s threats.
No sleep until the Cybercrime Fighters Club is done with finding the answer as to who is behind this new ransomware-as-a-service affiliate.
The following is an analysis by the Huntress team of several recent intrusions connected to the Netscaler exploitation.
Group-IB analysts discovered and analyzed a cryptojacking campaign on a popular educational resource using Group-IB Managed XDR.
Read about Huntress' newest feature, Incident Notification, which allows us to instantly alert partners to critical incidents via SMS text or phone call.
Dive into the fundamentals of reverse engineering malware and understanding how malicious software works.
Actionable guide to hunting for the Windows Services abuse by using Group-IB MXDR.
Read expert tips about how MSPs in Australia and New Zealand can elevate their cybersecurity offerings and have better sales conversations with customers.
Researchers at Omegapoint identified two issues in AWS API Gateway authorizers: 1) A header rewrite feature could be abused to bypass authorization by overwriting headers after the authorizer lambda processed them. 2) Caching of authorization policies could be exploited to reuse cached policies with modified identification sources, bypassing the authorizer.
Customers can configure Chronicle to ingest data from customer-owned Cloud Storage buckets using an ingestion feed. Chronicle previously used a shared service account for all customers for granting permission to the bucket. Therefore, one customer's Chronicle instance could be configured to ingest data from another customer's Cloud Storage bucket. However, this required knowledge of the bucket URI.
Gather valuable insights on how incident response can be a make-or-break factor in securing your business.
Dive into the recent Las Vegas casino cyberattacks linked to Scattered Spider, and learn how organizations can defend against such identify-based attacks.
