2022-11-03 13:30 UTC
Other
Other
Armés et dangereux : une soif d’argent inextinguible L’APT OPERA1ER en Afrique
En 2019, l'équipe Threat Intelligence de Group-IB a détecté une série d'attaques ciblant des organisations financières en Afrique.
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 4,617 matching records.
AUTO-POLL // 2026-10-07 17:00 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P6 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 7
RANSOMWARE
P6
COOL // 64 ARTICLES
TUE
Oct 6
RANSOMWARE
P3
COOL // 61 ARTICLES
MON
Oct 5
RANSOMWARE
P5
COOL // 48 ARTICLES
SUN
Oct 4
RANSOMWARE
P10
WARM // 11 ARTICLES
SAT
Oct 3
RANSOMWARE
P4
COOL // 14 ARTICLES
FRI
Oct 2
RANSOMWARE
P7
COOL // 46 ARTICLES
THU
Oct 1
RANSOMWARE
P8
COOL // 63 ARTICLES
2022-11-03 11:26 UTC
Other
Other
Financially motivated, dangerously activated: OPERA1ER APT in Africa
The French-speaking gang managed to carry out over 30 successful attacks on banks, financial services and telecommunications companies, mainly located in Africa.
P0
2022-11-01 00:00 UTC
Other
Other
CosMiss
Cosmos DB notebooks lacked an authentication check, meaning that if an attacker somehow had prior knowledge of a notebook’s temporary ‘forwardingId’ (a 128bit cryptographically random GUID assigned to a short-lived workspace that expires after an hour), they could gain full permissions on the notebook, including read and write access and the ability to modify the file system of the container running the notebook. These permissions would suffice for an attacker to obtain remote code execution (R…
P15
2022-11-01 00:00 UTC
Security Journalism
Security Journalism
macOS Support Is Here! | Huntress
We're excited to announce the general availability of the Huntress macOS agent! And don't worry – Persistent Footholds are just the beginning.
P0
2022-10-31 00:00 UTC
Security Journalism
Security Journalism
ConnectWise/R1Soft RCE & Supply Chain Risks | Huntress
Huntress has validated an initial report for an authentication bypass and sensitive file leak present in the Java framework “ZK”, used within the ConnectWise R1Soft software Server Backup Manager SE.
P25
2022-10-27 00:00 UTC
Security Journalism
Security Journalism
Huntress Myths and Misconceptions | Huntress
We’ve been seeing some misinformation being spread around with regards to the Huntress technology stack/capabilities we possess today. We’re here to provide clarity.
P0
2022-10-25 00:00 UTC
Other
Other
Azure CLI code injection vulnerability
Azure CLI contained a code injection vulnerability that could be exploited in a scenario where the host runs a command where parameter values have been provided by an external untrusted source - these could be specially crafted in such a way as to exploit the vulnerability, leading to remote code execution on the host. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the `&` or `|…
P15
2022-10-25 00:00 UTC
Security Journalism
Security Journalism
Cybersecurity Basics: A Chat With Syncro | Huntress
Read our webinar recap to learn what Henry Washburn of Huntress and Ian Alexander of Syncro outlined to help MSPs protect SMBs from cybersecurity threats.
P0
2022-10-24 07:31 UTC
Other
Other
Treasure trove. Alive and well point-of-sale malware
Analysis of months-long MajikPOS and Treasure Hunter campaign that infected dozens of terminals
P0
2022-10-24 00:00 UTC
Other
Other
Docker Command Escaping in GitHub Actions Runner
A vulnerability in the GitHub Actions Runner allowed untrusted inputs in environment variables to escape and modify docker command invocations. This affected jobs using container actions, job containers, or service containers. The issue has been patched in multiple versions of the runner.
P0
2022-10-19 11:52 UTC
Other
Other
Deadbolt ransomware decryption: unlock your data
The Group-IB Incident Response Team investigated an incident related to a DeadBolt attack and analyzed a DeadBolt ransomware sample
P15
2022-10-19 00:00 UTC
Other
Other
BlueBleed
In September 22', SOCRadar discovered an insecure public Azure blob storage owned by Microsoft (olyympusv2.blob.core.windows[.]net). This blob storage was used for storing emails and other documents from interactions with their customers (such as contracts and purchase orders). In total, the blob storage contained 2.4TB of data with information concerning thousands of Microsoft customers across dozens of countries, dated between 2017 and August 22'. Following disclosure, Microsoft reconfigured …
P0
2022-10-18 00:00 UTC
Security Journalism
Security Journalism
Making Cybersecurity Accessible for Women | Huntress
We’ve got a problem in cybersecurity that needs to be addressed—and it has to do with accessibility to women.
P0
2022-10-17 14:19 UTC
Other
Other
Scam is rising
With well-set digital marketing campaigns and professional call-centres
P0
2022-10-11 00:00 UTC
Other
Other
FabriXss
Service Fabric Explorer (SFX) is a tool for inspecting and managing Azure Service Fabric clusters. An attacker with existing access to a "Deployer" type user with CreateComposeDeployment permissions in a given cluster could create a malicious application with a specially-crafted name. This would lead to client-side template injection (CSTI) and storing a malicious XSS payload in a dashboard shared between users of the same cluster. If a victim user with administrative permissions logged into th…
P0
2022-10-11 00:00 UTC
Other
Other
Azure Arc-enabled Kubernetes privilege escalation
Azure Arc allows customers to connect on-premises Kubernetes clusters to Azure. This is facilitated by middleware (the Azure Arc-enabled Kubernetes agent) which includes a "cluster connect" feature in the form of a reverse proxy. A vulnerability in this feature could allow an unauthenticated user to elevate their privileges and potentially gain remote administrative control over any Azure Arc-enabled cluster, as long as they know its randomly generated external DNS endpoint. Azure Stack Edge de…
P10
2022-10-04 00:00 UTC
Security Journalism
Security Journalism
A Sneak Peek at hack_it 2022 | Huntress
Our workshop dedicated to hacker tradecraft is back November 14-16. Mark your calendars, sign up today and don't forget your hacker hat!
P0
2022-09-29 00:00 UTC
Security Journalism
Security Journalism
New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress
The Huntress team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers, piggybacking on ProxyShell and ProxyLogon.
P25
2022-09-28 14:13 UTC
Other
Other
Take control of your shadow IT
How Group-IB Attack Surface Management ensures full mastery of your external attack surface
P0
2022-09-27 00:00 UTC
Security Journalism
Security Journalism
Bug Bounties for the 99%
Bug bounty programs are everywhere for enterprise organizations. But where does that leave the 99%—those under-resourced small to mid-sized businesses?
P0
2022-09-20 00:00 UTC
Other
Other
AttachMe
Any unattached storage volume, or attached storage volumes allowing multi-attachment, could have been read from or written to as long as an attacker knew their Oracle Cloud Identifier (OCID), allowing sensitive data to be exfiltrated or even more impactful attacks to be initiated via executable file manipulation in the target tenant's environment.
P0
2022-09-20 00:00 UTC
Other
Other
Azure Cloud Shell access token theft
An issue in Azure Cloud Shell could have allowed an attacker to take over an Azure App Service domain and leverage it to inject and execute commands in other tenants' terminals if they navigated to the domain while logged into their account. Using this method, an attacker could query the Azure IMDS on other tenants' behalf and thereby obtain their access tokens.
P0
2022-09-20 00:00 UTC
Security Journalism
Security Journalism
Back to Basics: Protecting Your Endpoints With Managed EDR and ITDR
Protecting your servers just isn’t enough to keep bad actors out. Protecting the workstation is often an overlooked but critical step to security.
P0
2022-09-13 12:11 UTC
Other
Other
Letting off steam
Hackers use the browser-in-the-browser technique to steal Steam accounts
P0
2022-09-13 00:00 UTC
Security Journalism
Security Journalism
Unraveling a Reverse Shell with Managed EDR | Huntress
Read about our journey to unravel a PowerShell reverse shell—and how our Managed EDR feature tipped us off that something wasn’t right.
P0
2022-09-01 00:00 UTC
Other
Other
Synapse Spark LPE
Azure Synapse Analytics is an analytics service for processing data using various runtimes, among them Apache Spark. Synapse provided users the capability to mount Azure File Shares to their Apache Spark Pools via a script called filesharemount.sh that would execute with elevated privileges. This script would mount the File Share to the /synfs directory. There was a race condition in the script where, if successfully exploited, a user could execute the chown command to change the ownership of a…
P0
2022-08-30 00:00 UTC
Security Journalism
Security Journalism
Evolving Endpoint Protection and the Next Iteration of Huntress
Discover how Process Insights brings new managed EDR functionality to The Huntress Managed Security Platform to help you detect cyberattacks as they happen.
P0
2022-08-25 09:02 UTC
Other
Other
Roasting 0ktapus: The phishing campaign going after Okta identity credentials
Over 130 organizations have been compromised in a sophisticated attack using simple phishing kits
P0
2022-08-23 00:00 UTC
Security Journalism
Security Journalism
How Progressive Computing Combated a Large-Scale Cyberattack | Huntress
Learn how Progressive Computing fought through a mass-scale attack and came out on the other side scarred, but wiser and stronger.
P0
2022-08-19 00:00 UTC
Other
Other
SNS SigningCertUrl improper validation
Amazon SNS' signature validation in the official SDK relied on a weak regex for default AWS certificate locations, that would incorrectly match an S3 bucket named `sns`. This bucket happened to be publicly readable and writeable, allowing an attacker to forge messages to any user of the official SDK SNS validator.
P0