A vulnerability was discovered in the Anthos Identity Service (AIS) LDAP module of Anthos clusters on VMware versions 1.8 and 1.8.1 where a seed key used in generating keys is predictable. With this vulnerability, an authenticated user could add arbitrary claims and escalate privileges indefinitely.
Upon blocking a request, GCP Org policy constraints were logging the deny logs in Principal''s project and the blocking project. An attacker could use those logs to exfiltrate any data, by making request from a Principal they own from a defender project.
If a user with AWS WorkSpaces 3.0.10-3.1.8 installed visits a page in their web browser with attacker controlled content, the attacker can get zero click RCE under common circumstances.
Learn about the top four Common Vulnerabilities and Exposures (CVEs) attackers are exploiting—and how you can defend against them.
Scammers attack users in Middle Eastern countries
Convincing a victim to click a specially crafted link would allow the attacker to bypass the Identity-Aware Proxy (a core component of BeyondCorp).
Phishers take an approach to bypass security controls never seen in the country
In this blog, we debate which is the best approach for IT professionals to beat hackers: offensive cybersecurity or defensive cybersecurity.
Azure AD users could escalate their privileges using the Log Analytics Contributor role to reach the full Subscription Contributor role.
Allows an attacker with privileges in the account to share resources outside of the account even when an org policy restricts this, thus enabling them to backdoor their access.
Huntress is monitoring a new threat against Windows OS and Microsoft Office products (CVE-2021-40444). The MSHTML engine is vulnerable to arbitrary code execution.
In this blog, read along as we investigate a malicious foothold and decode the payload step by step.
Azure's Cosmos DB database service was vulnerable to remote account takeover. Any Azure user could gain full admin access to other customers' Cosmos DB instances without authorization. The vulnerability had a trivial exploit that doesn't require any previous access to the target environment.
We clarify the differences between the ProxyShell (August 2021) and the ProxyLogon (March 2021) exploits impacting Microsoft Exchange on-premises servers.
Dive into a cyber threat analysis that details a sneaky enabler of a targeted cyberattack: persistence.
Attackers are scanning for vulnerable Microsoft Exchange servers and abusing the latest line of Exchange vulnerabilities that were patched in early 2021.
Join us on a threat analysis journey as we discover a very shady Python—and a very friendly RAT.
How we make Tailored Threat Intelligence
What can we learn from studying cybercriminals? Here’s a brief history of how hackers are evolving their tradecraft and attack tactics.
AWC joins illicit carding business by offering 1 Mln compromised cards for free
The key to success for Campo Loader, Hancitor, IcedID, and QBot
Lightsail object storage allows the creation of access keys which were logged to CloudTrail (both access key and secret key)
Learn about the costs of cybersecurity—and the risks of not having the right security stack—in this blog.
Dive into Breached DB section
The Huntress team recaps what happened during the Kaseya VSA supply chain attack—and what we can learn from it.
We teamed up with our partners at Magna5 to talk about providing real-time prevention, detection and response.
