Resource policies lacked a way of restricting service access to only your own account, allowing an attacker to leverage a service to potentially access your resources. Originally discovered by Dan Peebles and presented at re:Invent in 2018, this issue did not gain enough attention to be fixed until Shir Tamari and Ami Luttwak from Wiz presented it at Black Hat 2021.
Read more about security updates to the Huntress platform.
Group-IB has exposed the attacks committed by Silence cybercriminal group.
Preventive security products like antivirus have made major strides in their ability to detect malicious behaviors as opposed to weak/static signatures. When implemented properly, these heuristics are capable of discovering even the most cleverly obfuscated routines. But don’t ring the victory bells yet. This cat-and-mouse game is just getting started…
Attackers had put malicious AMIs in the marketplace to abuse the CLI''s way of selecting what AMI to use. Although the concept of planting malicious AMIs had existed for a while (ex. in the 2009 presentation "Clobbering the clouds" by Nicholas Arvanitis, Marco Slaviero, and Haroon Meer) it had not been used specifically to target this issue with the CLI.
Patrick Hudak demonstrated possible subdomain takeover using the Traffic Manager in Azure.
Explore this phishing campaign used the age-old “Please remit payment” spiel to lure potential victims into opening the attached file.
Regardless of your daily duties, we’ve all encountered annoying ads, unwanted pop-ups, or generically named rogue applications. These nuisances, commonly called Potentially Unwanted Programs (PUP), are often unknowingly installed when downloading free software.
New attacks and joint operations
Even for the AWS-managed ElasticSearch clusters that had not been made public, their index names could be learned.
For many of us in the Managed Services Provider market, we were rocked with news of a vulnerability in Kaseya’s VSA product. The purpose of this blog is to shine technical light on what the Huntress ThreatOps team observed and analyzed thus far.
Group-IB has uncovered a hacker group attacking banks in the USA and Russia
IT Nation 2016 ended on a high note for Huntress Labs as we were named the “Best Newcomer” in the Partner Choice Awards. Now, as this year’s event quickly approaches, we are excited to continue our momentum.
AWS has previously provided managed policies or guidance in documentation for policies with mistakes that allow them to be bypassed. Additionally, some policies are over-privileged. Date of disclosure is for the first issue of this type, while references provide other examples by various individuals.
Research revealed that the BadRabbit code was compiled from NotPetya sources.
There is a connection between BadRabbit and Not Petya
Russia has developed a strong legal framework to combat online piracy. All that is needed is for it to be used effectively (especially for Forbes.ru)
The AWS Java SDK was vulnerable to XML external entity (XXE) injection related to XML parsers.
Recently, my co-founders gave a talk at DerbyCon 7.0 on evading common persistence enumeration tools. Evasion using trusted applications has been a hot topic of discussion within the infosec community and is one of the techniques they covered in their presentation. However, very little discussion exists on why these matter or the steps researchers take to find “hosting” applications.
Top global airline companies have been compromised by fraudsters for the second time during the last six months.
Over the past month, the Emotet family of malware has re-emerged as a formidable piece of crimeware, thanks to its new self-propagation techniques (undoubtedly inspired by the success of WannaCry and Petya).
How Cobalt hackers bypass your defenses
On the price of hacker attacks and the toxic cyber environment
The man who "saved the world" from the WannaCry outbreak has been arrested on suspicion of being the author of Kronos banking Trojan
Group-IB reveals the identity of alleged members of the Islamic hacker group United Islamic Cyber Force
Russia as a testing ground
Dive deep into Redosdru malware analysis, unpacking encrypted DLLs, keylogging behavior, and how Huntress defenders detect and respond.
During the previous MSP Moment, we walked our readers through an incident where our partner, NTConnections, used Huntress to discover a previously undetected breach. In this Deep Drive, we’ll examine the tradecraft used by the attackers to gain access through the database, kill/disable antivirus, download malicious files, and establish a persistent foothold within the network.
