2022-08-18 08:48 UTC
Other
Other
APT41 World Tour 2021 on a tight schedule
4 malicious campaigns, 13 confirmed victims, and a new wave of Cobalt Strike infections
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 4,617 matching records.
AUTO-POLL // 2026-10-07 17:30 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P6 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 7
RANSOMWARE
P6
COOL // 64 ARTICLES
TUE
Oct 6
RANSOMWARE
P3
COOL // 61 ARTICLES
MON
Oct 5
RANSOMWARE
P5
COOL // 48 ARTICLES
SUN
Oct 4
RANSOMWARE
P10
WARM // 11 ARTICLES
SAT
Oct 3
RANSOMWARE
P4
COOL // 14 ARTICLES
FRI
Oct 2
RANSOMWARE
P7
COOL // 46 ARTICLES
THU
Oct 1
RANSOMWARE
P8
COOL // 63 ARTICLES
2022-08-17 12:14 UTC
Other
Other
P0
2022-08-17 00:00 UTC
Other
Other
Remote Code Execution via GitHub Import
A critical vulnerability in GitLab's GitHub import feature allows remote code execution. The issue stems from improper handling of Sawyer::Resource objects, enabling injection of Redis commands. This can be escalated to execute arbitrary bash commands on the SaaS managed service as well as self-hosted GitLab servers, potentially leading to full system compromise.
P25
2022-08-16 00:00 UTC
Security Journalism
Security Journalism
Gifting User Passwords to Adversaries With NPPSPY | Huntress
We unravel an investigation that details one way threat actors are able to gather cleartext passwords via NPPSPY.
P0
2022-08-12 00:00 UTC
Other
Other
Actions Core Delimiter Injection Vulnerability
The @actions/core package had a delimiter injection vulnerability in the exportVariable function. Attackers could use a known delimiter to break out of a specific variable and assign values to other arbitrary variables. This may have allowed modification of path or environment variables without the intention of workflow or action authors.
P0
2022-08-11 15:39 UTC
Other
Other
Challenge accepted
Detecting MaliBot, a fresh Android banking trojan, with a Fraud Protection solution
P0
2022-08-11 00:00 UTC
Other
Other
Cloud SQL escape to host
In GCP's case, they introduced a modification to the Cloud SQL's PostgreSQL engine allowing the role assigned to the tenant (cloudsqlsuperuser) to arbitrarily change the ownership of a table to any user or role in the database. Thus, an attacker could (1) create a new table, (2) create an index function with a malicious payload, and (3) change the table owner to GCP’s superuser role (cloudsqladmin). Next, by initiating an ANALYZE command, the malicious function is executed with GCP’s superuser …
P10
2022-08-10 00:00 UTC
Other
Other
Google Cloud Shell command injection
A vulnerability was discovered in Cloud Shell that enabled command injection and remote shell access. By manipulating the "project" parameter, an attacker could have cause an unencoded Python script execution flaw. Exploiting this flaw, they could inject a command to display the contents of the "/etc/passwd" file, successfully execute arbitrary commands and obtain remote shell access. However, the impact of this is unclear, as an attacker would seemingly only be able to gain such a remote shell…
P0
2022-08-09 00:00 UTC
Security Journalism
Security Journalism
Don’t Get Schooled: How to Catch a Phish | Huntress
This blog explores phishing and smishing, diving into how to analyze text messages for their validity and legitimacy.
P0
2022-08-02 00:00 UTC
Security Journalism
Security Journalism
Huntress’ Commitment to the Cybersecurity Community | Huntress
We founded Huntress with a commitment to elevating the cybersecurity community as a guiding principle. Here are some of the ways we strive to make a difference.
P0
2022-07-29 08:54 UTC
Other
Other
Fake investment scams in Europe
How we almost got rich
P0
2022-07-28 00:00 UTC
Security Journalism
Security Journalism
Threat Advisory: Hackers Are Selling Access to MSPs | Huntress
We’re currently monitoring a situation that entails a hacker selling access to an MSP with access to 50+ customers, totaling 1,000+ servers.
P0
2022-07-26 00:00 UTC
Security Journalism
Security Journalism
Practical Tips for Conducting Digital Forensics Investigations | Huntress
A digital forensics investigation can be tedious. Fortunately, there are some efficient ways that you can still achieve success as an investigator.
P0
2022-07-25 11:38 UTC
Other
Other
Under the Hood. Group-IB Managed XDR
What Group-IB’s new all-in-one solution offers: cybersecurity management, network event analysis, and lightning-fast stops to attacks
P0
2022-07-21 00:00 UTC
Security Journalism
Security Journalism
Behind the Scenes: Crushing Cybercriminals with MAV | Huntress
This blog is a follow-up on our How to Crush Cybercriminals with Managed Antivirus webinar. We'll dive deeper through a threat analysis lens.
P0
2022-07-20 00:00 UTC
Other
Other
S3 Replication only logs first destination bucket
If a malicious actor with prior access to an AWS environment has permission to modify the S3 Replication Service role access policy, they could abuse cross-account replication to exfiltrate stolen data to an external bucket under their control. Moreover, when configured to replicate to multiple buckets at once, and if logging is only scoped to specific buckets (as opposed to being set to log "all current and future buckets"), then the S3 Replication Service only logs a putObject event to CloudT…
P0
2022-07-19 00:00 UTC
Security Journalism
Security Journalism
Putting the Dee(Dee) in Defense: Huntress Acquires Curricula | Huntress
We're continuing to deliver on our promise to secure the 99% by acquiring Curricula: a story-based security awareness training platform.
P0
2022-07-16 00:00 UTC
Other
Other
Persistence Vulnerability in GCP Cloud Workstations
A critical security flaw in Google Cloud Platform's Cloud Workstations allows unauthorized access and privilege escalation. The vulnerability stems from persistent session management, enabling users to access and exploit credentials of higher-privileged users. This can lead to impersonation, creation of new service accounts with elevated permissions, and bypassing of access controls.
P10
2022-07-14 00:00 UTC
Other
Other
Dependency confusion in AWS CodeArtifact
AWS CodeArtifact was susceptible to dependency confusion / substitution (i.e, publication of a malicious package to a public repository with the same name as an organization’s internal package). AWS fixed this issue by adding package origin controls, allowing users to limit how versions of a given package can be added to a CodeArtifact repository.
P0
2022-07-12 00:00 UTC
Other
Other
Microsoft Azure Site Recovery DLL hijacking
The Microsoft Azure Site Recovery suite contained a DLL hijacking flaw that allowed for privilege escalation from any low privileged user to SYSTEM on hosts where this service was installed. Incorrect permissions on the cxprocessserver service's executable directory allowed new files to be created in it by any user. Since the service ran automatically and with SYSTEM privileges and attempted to load DLLs from the directory, this allowed for a DLL hijacking / planting attack.
P10
2022-07-12 00:00 UTC
Security Journalism
Security Journalism
Introducing the Huntress Neighborhood Watch Program | Huntress
Learn about Huntress’ Neighborhood Watch Program: a collection of programs and resources designed to help elevate the broader security community.
P0
2022-07-11 00:00 UTC
Other
Other
AWS IAM Authenticator for Kubernetes AccessKeyID Validation Bypass
Amazon Elastic Kubernetes Service (EKS) uses IAM to provide authentication to the cluster through the AWS IAM Authenticator for Kubernetes (aws-iam-authenticator). aws-iam-authenticator can be installed on any Kubernetes cluster, and it is installed by default in any EKS cluster both on AWS cloud and on-premises (Amazon EKS Anywhere). A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges. The bug …
P0
2022-07-05 00:00 UTC
Security Journalism
Security Journalism
Four Sneaky Attacker Evasion Techniques You Should Know About | Huntress
Learn about four of the most prominent attacker evasion techniques that hackers use—and how you can defend your environments against them.
P0
2022-06-30 09:23 UTC
Other
Other
Group-IB introduces the Unified Risk Platform
Group-IB’s platform allows organizations to overcome cyber risks
P0
2022-06-28 00:00 UTC
Other
Other
FabricScape (CVE-2022-30137) - Azure Service Fabric privilege escalation
A vulnerability in Service Fabric allows Linux containers to escalate their privileges in order to gain root privileges on the node, and then compromise all of the nodes in the cluster. An attacker would need to have read/write access to the cluster, and the vulnerability could be exploited on containers that are configured to have runtime access, but this is granted by default to every container. Though the bug exists in both the Windows and Linux versions, it is only exploitable on Linux.
P15
2022-06-28 00:00 UTC
Security Journalism
Security Journalism
Fighting Log4Shell with Huntress Managed EDR | Huntress
Read how our ThreatOps team used Huntress Managed EDR and Managed Antivirus to stop bad actors who were exploiting Log4Shell vulnerabilities.
P0
2022-06-24 15:42 UTC
Other
Other
P0
2022-06-22 00:00 UTC
Security Journalism
Security Journalism
Diversity in Security Awareness Training Content
Enhance your organization's security posture with our Diversity Security Awareness Training content. Explore engaging modules designed to foster inclusivity while equipping your team with essential skills to identify and mitigate security threats.
P0
2022-06-21 00:00 UTC
Security Journalism
Security Journalism
How to Crush Cybercriminals with Managed Antivirus | Huntress
Dive into the types of threats we’ve thwarted with Managed Antivirus and how IT teams are seeing more value from making the switch.
P0
2022-06-17 00:00 UTC
Security Journalism
Security Journalism
Scaling To Protect the 99% | Huntress
Learn about the latest platform changes and updates as Huntress continues to scale to protect the 99%.
P0