2021-05-10 12:00 UTC
Government
Government
Active Cyber Defence (ACD) - the fourth year
The year four report covers 2020 and aims to highlight the achievements and efforts made by the Active Cyber Defence programme.
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 4,628 matching records.
AUTO-POLL // 2026-10-07 20:15 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P6 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 7
RANSOMWARE
P6
COOL // 75 ARTICLES
TUE
Oct 6
RANSOMWARE
P3
COOL // 61 ARTICLES
MON
Oct 5
RANSOMWARE
P5
COOL // 48 ARTICLES
SUN
Oct 4
RANSOMWARE
P10
WARM // 11 ARTICLES
SAT
Oct 3
RANSOMWARE
P4
COOL // 14 ARTICLES
FRI
Oct 2
RANSOMWARE
P7
COOL // 46 ARTICLES
THU
Oct 1
RANSOMWARE
P8
COOL // 63 ARTICLES
2021-05-07 08:17 UTC
Other
Other
P15
2021-05-06 08:21 UTC
Other
Other
GrelosGTM group abuses Google Tag Manager to attack e-commerce websites
Group-IB specialists detected GrelosGTM group started to abuse Google Tag Manager legitimate functionality for their own purposes in infections of online shops.
P0
2021-05-06 00:00 UTC
Security Journalism
Security Journalism
Huntress Series B: Our Next Chapter of Growth
We’ve been focused on expanding our platform and helping you better protect your customers. And we’re just getting started.
P0
2021-05-04 00:00 UTC
Security Journalism
Security Journalism
From PowerShell to Payload: An Analysis of Weaponized Malware | Huntress
In this blog, we look at some malicious PowerShell code breadcrumbs that one hacker left behind to unravel how they maintained access during a cyberattack.
P0
2021-04-30 00:00 UTC
Other
Other
Password Reset Code Brute-Force Vulnerability in AWS Cognito
A vulnerability in AWS Cognito's password reset function allowed attackers to brute-force the six-digit reset code, potentially leading to account takeovers. Using concurrent HTTP requests, an attacker could make up to 1587 guesses instead of the documented limit of 20. The issue affected accounts without multi-factor authentication and was fixed by AWS on April 20, 2021.
P0
2021-04-29 00:00 UTC
Security Journalism
Security Journalism
Scale Your Security Operations with Confidence | Huntress
Are you ready to scale your MSP or SMB? Level up your threat detection and response so you can focus on what's important: your business.
P0
2021-04-14 08:29 UTC
Other
Other
Lazarus BTC Changer
Back in action with JS sniffers redesigned to steal crypto
P0
2021-04-13 00:00 UTC
Security Journalism
Security Journalism
Emerging Cybersecurity Trends That May Impact Your SMB Clients | Huntress
Keep your MSP armed and ready for attacks, hacks and data breaches with the latest trends in cybersecurity.
P0
2021-04-12 08:30 UTC
Other
Other
Deep water: exploring phishing kits
Group-IB's Computer Emergency Response Team built a solid phishing kit database, which helps Group-IB fight phishing that targets specific brands.
P0
2021-04-08 08:42 UTC
Other
Other
When Karma Comes Back
The rise and fall of illicit cardshop breached twice in two years
P0
2021-04-06 00:00 UTC
Security Journalism
Security Journalism
What Is a Persistent Foothold? | Huntress
We hunt for persistent footholds, but what exactly does that mean? In this blog, we define what a foothold is and why it's a hacker favorite.
P0
2021-04-05 08:45 UTC
Other
Other
Kremlin RATs from Nigeria
The analysis of phishing campaigns carried out by a new threat actor
P0
2021-03-31 00:00 UTC
Security Journalism
Security Journalism
Top Takeaways from hack_it 2021 | Huntress
A recap of hack_it 2021, a virtual security training event packed with interactive exercises, malware analysis, hacking workshops and more.
P0
2021-03-23 00:00 UTC
Security Journalism
Security Journalism
How Hackers Exploit Windows Administrative Shares
Windows' administrative shares feature is often overlooked by users, but not by hackers. Learn how attackers abuse administrative shares to propagate.
P0
2021-03-17 08:49 UTC
Other
Other
Masters of disguise
Let's hunt some bootkits
P0
2021-03-17 00:00 UTC
Other
Other
Privilege escalation in GCP OS Login
GCP provides an OS Login service for managing SSH access to compute instances using IAM roles. An attacker could abuse this feature via LXD, Docker (if available on the target system) and DHCP poisoning of the metadata server to escalate their privileges on a Google Compute Engine VM.
P10
2021-03-16 00:00 UTC
Security Journalism
Security Journalism
Abusing Ngrok: Hackers at the End of the Tunnel | Huntress
At the end of this tunnel, we find some shady hackers using ngrok to gain remote control access to victim networks.
P0
2021-03-15 08:52 UTC
Other
Other
JavaScript sniffers’ new tricks
Analysis of the E1RB JS sniffer family
P0
2021-03-10 00:00 UTC
Other
Other
AWS CloudShell terminal escape
If attacker controlled data is viewed in Cloudshell it could have led to code execution. This exact same issue existed in Azure previously.
P0
2021-03-09 00:00 UTC
Other
Other
Azure Linux VM extension credential leak
A vulnerability in the Azure Linux VM extension mechanism allowed an unprivileged user to leak any Azure VM extension’s private data. An attacker could have abused this to gain credentials for the VM itself as well as credentials for extensions associated with the VM. Paired with the design of the VMAccess extension (an official Azure extension for managing VM credentials), this could have been used to achieve privilege escalation, as an unprivileged attacker would have been able to elevate the…
P10
2021-03-09 00:00 UTC
Security Journalism
Security Journalism
Peeling Back the Layers of .NET Malware
Hackers always try to cover up their tracks. In this blog, we step through layers of obfuscation to uncover the real intent of a .NET malware sample.
P0
2021-03-03 00:00 UTC
Security Journalism
Security Journalism
Rapid Response: Mass Exploitation of On-Prem Exchange Servers | Huntress
On-prem Microsoft Exchange Server vulnerabilities are being actively exploited in the wild. Read our blog for Huntress' most up-to-date research and IOCs.
P45
2021-03-02 00:00 UTC
Security Journalism
Security Journalism
What Is Human-Powered Threat Hunting? | Huntress
In this blog, we define what threat hunting is, the differences between human analysis and automation, plus an example of human-powered threat hunting.
P0
2021-03-01 09:02 UTC
Other
Other
Inside Classiscam
A deep dive into Classiscam: automated scam as a service designed to steal money and payment data
P0
2021-02-23 00:00 UTC
Security Journalism
Security Journalism
Zero-Day Vulnerabilities in Platforms Could Leave MSPs Exposed | Huntress
We unveil zero-day vulnerabilities we discovered in virtual event platforms used in MSP/Fortune 500 communities, plus some insight on supply chain attacks.
P25
2021-02-19 12:00 UTC
Government
Government
Active Cyber Defence (ACD) - The Third Year
The year three report covers 2019 and aims to highlight the achievements and efforts made by the Active Cyber Defence programme.
P0
2021-02-16 00:00 UTC
Security Journalism
Security Journalism
Cybersecurity Education Is the Key to Outsmarting Hackers | Huntress
In cybersecurity, education and training are the key to winning. Read our blog to learn how you can grow your skills through continuous security education.
P0
2021-02-15 00:00 UTC
Other
Other
Azure Cloud Shell and Container Instances breakout
An attacker could gain root privileges on their Azure Cloud Shell container, escape from the container, and then gain root privileges on the underlying node, the root cause being an insecure kubelet port (10250), among other cluster misconfigurations. Once they could access the node filesystem, an attacker could extract kubelet API credentials which allowed listing all pods and nodes in the cluster, including those belonging to other tenants. Moreover, an attacker could bypass RBAC policies in …
P0
2021-02-09 00:00 UTC
Security Journalism
Security Journalism
Malware Deep Dive: Examining A PowerShell Payload | Huntress
To avoid detection, hackers often turn a system’s own tools against itself. Here, we examine a malicious payload that was executed using PowerShell.
P0