LATEST

Do Tigers Really Change Their Stripes?

Across the larger cybersecurity community, an often-used adage is that “threat actors always change their tactics.” However, when we really start to look at and track incident data, we begin to see that while some changes may be necessitated based on infrastructures and other challenges the threat actor may encounter, there are times when tactics remain consistent across incidents. Recent investigations into exploitation activity for CVE-2025-31151 and CVE-2025-30406 show similar TTPs across di…

The Cybercriminal with Four Faces: Revealing Group-IB’s Investigation into ALTDOS, DESORDEN, GHOSTR and 0mid16B

Following the arrest of the cybercriminal behind the aliases ALTDOS, DESORDEN, GHOSTR, and 0mid16B, Group-IB provides a deep dive into his activities, uncovering striking similarities and unmasking the cybercriminal that breached more than 90 instances of data leaks worldwide over the span of four years in operation.

Rethinking investigation: Group-IB’s Graph takes a leap forward

Storm clouds on the horizon: Resurgence of TeamTNT?

Investigations into recent campaigns may suggest the reemergence of TeamTNT in 2023 to present day, since evaporating in 2022.

Concealed networks: Are dark web syndicates turning to social media for cybercrime?

Group-IB dark web investigations: To avoid prying eyes, find out how adversaries increasingly shift from the dark web to social media to execute attacks, leak credentials, share exploitable vulnerabilities, and more.

GCP HMAC Keys are not discoverable or revokable other than for self

GCP administrators face challenges in managing HMAC keys within their organizations, lacking visibility into which user accounts have generated these keys and whether they are actively being used to access storage objects. Additionally, there's a lack of functionality to revoke keys associated with other users, restricting their ability to enforce security policies effectively. Similarly, GCP incident response teams rely on Cloud Logging to monitor Cloud Storage object access, but they lack spe…

Active Remediation: Proactive Response with Huntress Managed EDR | Huntress

Learn how you can streamline incident response with Huntress Managed EDR's Active Remediation. Sleep soundly while we thwart threats on your behalf.

Healthcare Held Hostage: Fighting the Plague of Ransomware | Huntress

Ransomware is spreading like wildfire. Learn about its growing threat to healthcare, its impact on patient care, and how Huntress managed solutions can better protect your organization from cyberattacks.

Attacking MSSQL Servers, Pt. II | Huntress

The publication of the first blog post led a Huntress SOC analyst to identify and escalate a second, similar incident. A deeper investigation into the activity made it clear that the Huntress SOC had obviated several Trigona ransomware attacks, protecting customers from the impact of a ransomware infection.

Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware

Take a deep dive into the operations of one of the most active players in the Ransomware-as-a-Service market.

The untold story of incident response: Insider’s Gambit

Get a close look at details of the most notable cases faced by Group-IB’s Digital Forensics and Incident Response (DFIR) team

The untold story of incident response: A Christmas Miracle

Twas the night before Christmas, when out came the cry, a cyberattack is happening, so stop them, won’t you try?

Incident Response through an opportunity lens: In conversation with Dmitry Volkov (CEO, Group-IB)

Gather valuable insights on how incident response can be a make-or-break factor in securing your business.

Investigation into PostalFurious: a Chinese-speaking phishing gang targeting Singapore and Australia

How to investigate phishing campaigns

The Methods Behind a Huntress Managed Antivirus Investigation | Huntress

In this blog, we’ll go on a short journey of how we dissected a vague Managed Antivirus alert and offer some ideas and methods for security analysts.

Incident Response: A Choose Your Own Adventure Exercise

Incident response is a lot like a choose your own adventure exercise. We cover the ground rules and talk about some incidents we’ve helped partners with.

Deadbolt ransomware decryption: unlock your data

The Group-IB Incident Response Team investigated an incident related to a DeadBolt attack and analyzed a DeadBolt ransomware sample

Gifting User Passwords to Adversaries With NPPSPY | Huntress

We unravel an investigation that details one way threat actors are able to gather cleartext passwords via NPPSPY.

Practical Tips for Conducting Digital Forensics Investigations | Huntress

A digital forensics investigation can be tedious. Fortunately, there are some efficient ways that you can still achieve success as an investigator.

Triangulation | Huntress

This blog dives into triangulation as a guiding concept during investigations and reporting.

Investigating Unauthorized Access | Huntress

Learn about our investigation regarding unauthorized access to our QA and product testing environment.

Malware Under The Microscope: Manual Analysis

Learn manual malware analysis techniques used by threat researchers. Explore static & dynamic analysis, reverse engineering tools, and real-world investigation methods.

Digital forensics specialist’s bookshelf

Top 11 books on digital forensics, incident response, and malware analysis

Reconstructing User Activity for Forensics with FeatureUsage

Useful feature that can help forensic analysts and incident responders to reconstruct user activities.

Hunting for Attacker’s Tactics and Techniques With Prefetch Files

Windows Prefetch files were introduced in Windows XP and since that time have helped digital forensics analysts and incident responders find evidence of execution.

WhatsApp in Plain Sight: Where and How You Can Collect Forensic Artifacts

All about WhatsApp forensics and the wealth of data extracted from a device through forensic analysis.

Tools up: the best software and hardware tools for computer forensics

Igor Mikhailov gave his review of the best software and hardware solutions for computer forensics.

MSP Moment: Squashing an MSSQL Attack

When it comes to breaches, it’s hard to find a silver lining when the end result is customer down time, data theft, or damaged reputations. For Managed Service Providers with tens to hundreds (or even thousands) of clients, the stakes are even higher. In this MSP Moment, we’re highlighting how NTConnections, a Washington DC based MSP, responded to a database outage which quickly escalated into an incident response effort.