2020-05-29 13:54 UTC
Other
Other
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 4,633 matching records.
AUTO-POLL // 2026-10-07 21:55 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P5 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 7
RANSOMWARE
P5
COOL // 80 ARTICLES
TUE
Oct 6
RANSOMWARE
P3
COOL // 61 ARTICLES
MON
Oct 5
RANSOMWARE
P5
COOL // 48 ARTICLES
SUN
Oct 4
RANSOMWARE
P10
WARM // 11 ARTICLES
SAT
Oct 3
RANSOMWARE
P4
COOL // 14 ARTICLES
FRI
Oct 2
RANSOMWARE
P7
COOL // 46 ARTICLES
THU
Oct 1
RANSOMWARE
P8
COOL // 63 ARTICLES
2020-05-21 00:00 UTC
Other
Other
RCE in Google Cloud Deployment Manager
An RCE in Google Cloud Deployment Manager could have allowed an attacker to make requests to internal Google services, authenticated as a privileged service account.
P15
2020-05-14 14:09 UTC
Other
Other
ATT&CKing ProLock Ransomware
The success of enterprise ransomware attacks has motivated more and more threat actors to join the game.
P15
2020-05-04 12:00 UTC
Government
Government
High level privacy and security design for NHS COVID-19 contact tracing app
NCSC technical paper about the privacy and security design of the NHS contact tracing app developed to help slow the spread of coronavirus.
P0
2020-04-30 14:12 UTC
Other
Other
P0
2020-04-28 14:27 UTC
Other
Other
Reconstructing User Activity for Forensics with FeatureUsage
Useful feature that can help forensic analysts and incident responders to reconstruct user activities.
P0
2020-04-23 00:00 UTC
Other
Other
GuardDuty detection bypass via cloudtrail
GuardDuty detected CloudTrail being outright disabled, but did not detect if an attacker with the necessary permissions filtered out all events from CloudTrail via PutEventSelectors, resulting in defenders having no logs to review. AWS fixed this issue by adding a GuardDuty detection that triggers if PutEventSelectors is used to disable all event types.
P0
2020-03-11 00:00 UTC
Other
Other
GCP Cloudshell Cross-Site WebSocket Hijacking (CSWSH)
Google Cloudshell leveraged websockets without validating that the origin matched the current instance host. An attacker could therefore host a CSWSH attack on a Cloudshell instance they own, disabling authentication via access to the underlying VM. They could then start the OAuth process with a spoofed host header, using phishing to get the target Cloud Shell user into following a redirection link, completing the OAuth process and ending in successful CSWSH, which would allow the attacker to h…
P0
2020-03-08 00:00 UTC
Other
Other
Google wide domain check bypass
A vulnerability in Google's common JavaScript library allowed bypassing domain validation checks across multiple Google products. By using a backslash character in URLs, an attacker could make the regex parser and browser disagree on the authority (domain) portion of a URL, allowing injection of arbitrary domains that pass whitelisting checks.
P0
2020-02-20 09:13 UTC
Other
Other
Chromium-based Microsoft Edge from a Forensic Point of View
Explore the forensic perspective of the Microsoft Edge Chromium-based version and its features, such as msedge_proxy, edge cache location, and more.
P0
2020-02-04 00:00 UTC
Security Journalism
Security Journalism
How One Criminal Tried to Sell an MSP on the Dark Web | Huntress
In a rare encounter, we found ourselves directly interacting with a cybercriminal that took us down a dark web rabbit hole.
P0
2020-01-30 00:00 UTC
Other
Other
Azure App Service RCE
A Vulnerability in App Service could allow an unprivileged function run by the user to execute code in the context of NT AUTHORITY\system, thereby escaping the sandbox. This vulnerability allowed cross-account access when using the Free/Shared tier.
P15
2020-01-28 12:00 UTC
Government
Government
Summary of NCSC’s security analysis for the UK telecoms sector
A summary of the NCSC’s security analysis for the UK telecoms sector
P0
2020-01-24 16:00 UTC
Security Journalism
Security Journalism
Validating the SolarWinds N-central 'Dumpster Diver' Vuln | Huntress
Read more about Huntress validating the SolarWinds N-central “Dumpster Diver” Vulnerability.
P0
2020-01-23 00:00 UTC
Other
Other
AWS uploaded sensitive data to public GitHub bucket
An AWS employee pushed sensitive data to a public github bucket, including customer information and credentials. Note: This issue is outside the scope of this database's usual criteria for inclusion, but has been kept for historic reasons, as it was included in the original CSP Security Mistakes dataset.
P0
2020-01-22 00:00 UTC
Security Journalism
Security Journalism
Validating the Bishop Fox Findings in ConnectWise Control | Huntress
The Huntress team validates eight vulnerabilities found in ConnectWise Control that ranged from low to high severity.
P0
2020-01-17 14:32 UTC
Other
Other
Hunting for Nextcloud Cloud Storage Forensic Artifacts on Endpoints
Forensic artifacts, which can be found during forensic examination of a Windows endpoint.
P0
2020-01-12 00:00 UTC
Other
Other
GCP Speech to Text Information Disclosure
GCP's Speech-to-Text "operations/list" and "operations/get" APIs would return data that did not belong to the caller when no parameters were provided. It is unclear whether this was cross-customer data disclosure, or potentially test or internal data.
P0
2019-12-20 14:35 UTC
Other
Other
A Shortcut to Compromise: Cobalt Gang phishing campaign
Cobalt Gang is alive and well, and continued to attack financial institutions around the globe in 2019.
P0
2019-12-19 00:00 UTC
Other
Other
GCP Stackdriver Debugger SSRF
An SSRF bug in GCP's Stackdriver Debugger feature's code import could have been used to leak the authentication token of the user to an attacker-controlled server. Exploitation would require that the user had previously configured a specific code hosting service (such as GitHub), and could be tricked into clicking a malicious link.
P0
2019-12-16 00:00 UTC
Other
Other
GCP Cloudshell Vulnerabilities
Wouter ter Maat discovered 9 vulnerabilities in GCP Cloudshell that could allow an attacker to access resources in another customer's environment.
P0
2019-12-15 00:00 UTC
Other
Other
GCP Cloudshell XSS and CSRF bugs
GCP Cloudshell has been affected by various XSS and CSRF vulnerabilities stemming from different root causes related to authentication handling, markdown editing, file uploading and more. Explotiation of these vulnerabilities normally requires user interaction through social engineering (convincing a potential victim to click a malicious link).
P0
2019-12-11 14:37 UTC
Other
Other
Hunting for Attacker’s Tactics and Techniques With Prefetch Files
Windows Prefetch files were introduced in Windows XP and since that time have helped digital forensics analysts and incident responders find evidence of execution.
P0
2019-11-29 00:00 UTC
Other
Other
Google Cloud Platform VRP Prize Writeup
A vulnerability was discovered in Google Cloud Platform's AI Hub service, allowing unrestricted file uploads. This could potentially lead to bypassing Same-Origin Policy by uploading SWF files, enabling CSRF attacks across browsers, and exploiting CVE-2014-8453 on IE with Adobe Reader installed. The issue resulted in a $1337 bounty reward.
P5
2019-11-18 14:41 UTC
Other
Other
Group-IB unveils its Graph
The story about Group-IB searching for graph analysis solution and creating its own unique instrument
P0
2019-11-15 00:00 UTC
Security Journalism
Security Journalism
Assisted Remediation in Action | Huntress
Learn how Huntress helped an MSP partner contain and remediate an Emotet/TrickBot infection with Assisted Remediation.
P0
2019-11-08 14:52 UTC
Other
Other
Massive malicious campaign by FakeSecurity JS-sniffer
Group-IB specialists detected a new JS-sniffer family called FakeSecurity.
P0
2019-11-07 12:14 UTC
Other
Other
WhatsApp in Plain Sight: Where and How You Can Collect Forensic Artifacts
All about WhatsApp forensics and the wealth of data extracted from a device through forensic analysis.
P0
2019-11-05 14:43 UTC
Other
Other
RDoS attacks by fake Fancy Bear hit banks in multiple locations
Group-IB experts have detected a massive email campaign spreading similar ransom demands sent to banks and financial organizations across the word.
P0
2019-10-04 13:23 UTC
Other
Other
P0