2025-11-13 06:00 UTC
Security Journalism
Security Journalism
Threats Plague Educational Organizations
Threat actors are targeting the education sector with data breaches, phishing emails, ransomware hits, brute force RDP attacks, and more.
P15
LATEST
Aggregated cybersecurity reporting, advisories and research. 326 matching records.
AUTO-POLL // 2026-10-18 06:25 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
NO DATA
NO INTELLIGENCE AGGREGATED TODAY
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 18
NO DATA
--
NO INTEL
SAT
Oct 17
ACTIVE EXPLOITATION
P4
COOL // 12 ARTICLES
FRI
Oct 16
RANSOMWARE
P8
COOL // 56 ARTICLES
THU
Oct 15
ACTIVE EXPLOITATION
P7
COOL // 87 ARTICLES
WED
Oct 14
RANSOMWARE
P8
COOL // 74 ARTICLES
TUE
Oct 13
ACTIVE EXPLOITATION
P7
COOL // 73 ARTICLES
MON
Oct 12
RANSOMWARE
P5
COOL // 42 ARTICLES
2025-10-24 04:00 UTC
Security Journalism
Security Journalism
Exploitation of Windows Server Update Services Remote Code | Huntress
Huntress has observed threat actors exploiting a Microsoft Windows Server Update Services (WSUS) vulnerability (CVE-2025-59287).
P5
2025-10-07 05:00 UTC
Security Journalism
Security Journalism
Ditch Lame Cybersecurity Tips | Huntress
Tired of hearing the same old cybersecurity tips? Learn actionable, modern strategies to protect yourself and your organization from bad threat actors.
P0
2025-09-29 05:58 UTC
Other
Other
E-commerce Fraud-as-a-Service: How Scammers Exploit Brand Trust at Scale
In the rapidly evolving digital marketplace, e-commerce brands have become prime targets for cybercriminals. Beyond traditional data breaches, these brands now face sophisticated scams that exploit their reputation, deceive consumers, and erode trust. Drawing from investigations conducted by RedHunt Labs’ threat intelligence team, this blog delves into some of the most prevalent scams targeting e-commerce platforms and highlights how a Digital Risk Protection (DRP) solution can help fortify you…
P0
2025-09-25 14:00 UTC
Security Journalism
Security Journalism
A Vietnamese threat actor's shift from PXA Stealer to PureRAT
Trace a threat actor's journey from custom Python stealers to a sophisticated commodity RAT. Learn how their tactics evolved and why this shift to .NET matters.
P0
2025-08-29 05:00 UTC
Security Journalism
Security Journalism
From a Fake AnyDesk Installer to MetaStealer
Learn how a fake AnyDesk installer led to a unique MetaStealer attack, highlighting how threat actors evolve ClickFix techniques beyond the classic playbook to steal credentials and files.
P0
2025-08-27 05:00 UTC
Security Journalism
Security Journalism
Join Huntress' John Hammond & Dave Kleinatland on a | Huntress
Huntress researchers take a tour through the dark web, from innovative threat actor marketing techniques to cybercrime drama on BreachForums.
P0
2025-08-19 14:00 UTC
Security Journalism
Security Journalism
Exposing Data Exfiltration | Huntress
Threat actors often steal data during the course of their attacks. This is particularly true for ransomware threat actors, who do it before deploying file encryption in order to engage in “double extortion” activities. This activity can be difficult to detect, particularly if it’s not dissimilar to legitimate actions taken by system administrators.
P15
2025-08-14 05:00 UTC
Security Journalism
Security Journalism
Kawabunga, Dude, You’ve Been Ransomed!
Thanks in large part to our customer base, Huntress sees a great deal of interesting activity, particularly from threat actors (but also from admins). Part of that activity includes not just ransomware variants that Huntress hasn’t seen before, but also variants that may not have been documented via any public means. Further, when these incidents occur, Huntress very often gets a detailed look at the threat actor’s activity, including commands and their timing.
P15
2025-08-13 22:00 UTC
Security Journalism
Security Journalism
Active Exploitation of SonicWall VPNs
A likely zero-day vulnerability in SonicWall VPNs is being actively exploited to bypass MFA and deploy ransomware. Huntress advises disabling the VPN service immediately or severely restricting access via IP allow-listing. We're seeing threat actors pivot directly to domain controllers within hours of the initial breach.
P40
2025-07-31 04:00 UTC
Security Journalism
Security Journalism
The Commented Kill Chain: Why Old Ransomware Playbooks Never Die
When a clearly commented script revealed an attacker's tactics, Huntress prevented encryption. Read on to learn more about the evolution of recycled ransomware playbooks used by multiple threat actors.
P15
2025-07-25 07:51 UTC
Other
Other
Predictive AI: The “Quiet Catalyst” Behind The Future of Cybersecurity
Think threat actors are unpredictable? The rise of intelligence-driven defense and the push for incident predictions might just give us the edge to know their next moves…long before they make it.
P0
2025-07-17 05:00 UTC
Security Journalism
Security Journalism
Remote Monitoring and Management Tools | Huntress
When a threat actor exploited an MSP's RMM tool to target businesses, Huntress investigated and uncovered another eerily similar incident with key differences that reveal evolving tactics
P0
2025-06-13 16:03 UTC
Vendor Research
Vendor Research
Mitigating prompt injection attacks with a layered defense strategy
Posted by Adam Gavish, Google GenAI Security TeamWith the rapid adoption of generative AI, a new wave of threats is emerging across the industry with the aim of manipulating the AI systems themselves. One such emerging attack vector is indirect prompt injections. Unlike direct prompt injections, where an attacker directly inputs malicious commands into a prompt, indirect prompt injections involve hidden malicious instructions within external data sources. These may include emails, documents, or…
P0
2025-05-06 05:00 UTC
Security Journalism
Security Journalism
Do Tigers Really Change Their Stripes?
Across the larger cybersecurity community, an often-used adage is that “threat actors always change their tactics.” However, when we really start to look at and track incident data, we begin to see that while some changes may be necessitated based on infrastructures and other challenges the threat actor may encounter, there are times when tactics remain consistent across incidents. Recent investigations into exploitation activity for CVE-2025-31151 and CVE-2025-30406 show similar TTPs across di…
P5
2025-04-23 07:05 UTC
Other
Other
Toll of Deception: Where Evasion Drives Phishing Forward
Discover the latest phishing campaign targeting a major toll road service provider, where cybercriminals use sophisticated evasion techniques to bypass security detections. This in-depth blog reveals how threat actors exploit legitimate platforms and deploy cloaking methods to disguise malicious links, allowing them to evade detection by security solutions. Discover how these sophisticated tactics create highly convincing phishing pages designed to steal victims’ card information, and how to sa…
P0
2025-04-22 05:00 UTC
Security Journalism
Security Journalism
Say Hello to Mac Malware
In this month’s Tradecraft Tuesday, we talked about how threat actors are finetuning their macOS malware in order to maintain persistent access and avoid detection by Apple’s security features.
P0
2025-04-09 05:00 UTC
Security Journalism
Security Journalism
How EDR and ITDR Elevate Your Security
Threat actors are now exploiting both endpoints and identities in the latest cyberattacks. Learn about the rise of identity-based threats and why a combined EDR and ITDR approach is crucial for your cybersecurity.
P0
2025-04-02 05:00 UTC
Security Journalism
Security Journalism
The Unwanted Guest
Threat actors are enabling the built-in Windows Guest account to maintain persistence. Learn how they gain access and how to detect this activity.
P0
2025-01-09 22:12 UTC
Security Journalism
Security Journalism
LOLBins: What are they & How to Detect Them
Learn what LOLBins are, threats malicious threat actors can pose, how to detect those threats, and how to prevent them.
P0
2024-11-25 00:00 UTC
Security Journalism
Security Journalism
Know Thy Enemy: A Novel November Case | Huntress
In this blog, Huntress SOC investigators unravel the lateral movement and persistence of an interesting threat actor and their novel infrastructure
P0
2024-11-21 09:33 UTC
Other
Other
Tracing the Path of VietCredCare and DuckTail: Vietnamese dark market of infostealers’ data
Following the arrest in May 2024 of more than 20 individuals behind Facebook infostealers campaigns in Vietnam, we have compared the tactics of operators behind VietCredCare and DuckTail stealers. These 2 malware families have been active before the arrest in Vietnam and are believed to be controlled by Vietnamese threat actors. Based on the research, we decided that the groups operate in a different way and the arrest probably affected the VietCredCare operators.
P0
2024-10-17 00:00 UTC
Security Journalism
Security Journalism
Detecting Malicious Use of LOLBins, Pt. II | Huntress
Rhetoric within the cybersecurity community has leaned heavily towards threat actor use of LOLBins as a means of “hiding amongst the noise” of normal, administrative and operational activity. However, as Huntress SOC analysts can attest, this is often far from the case.
P0
2024-10-03 00:00 UTC
Security Journalism
Security Journalism
Password Spraying Tools: How Attackers Spray M365
Join Huntress Threat Hunters as they unpack the password-spraying techniques of threat actors, exposing how they target everything from small businesses to giants like Microsoft.
P0
2024-09-20 00:00 UTC
Security Journalism
Security Journalism
Akira Ransomware Indicators | Huntress
Tracking various indicators associated with different attacks, Huntress analysts have been able to identify specific indicators (threat actor workstation names, passwords associated with new user account creation or current account modification, CloudFlare tunnel tokens) that are associated with Akira ransomware infections. By detecting these indicators much earlier in the attack chain, organizations can inhibit or even obviate file encryption malware deployment.
P15
2024-09-17 00:00 UTC
Security Journalism
Security Journalism
Cracks in the Foundation: FOUNDATION Accounting Intrusions | Huntress
Threat actors have been successful in gaining entry using accounting software commonly used by construction companies.
P0
2024-08-28 00:00 UTC
Security Journalism
Security Journalism
APT Targeting Vietnamese Human Rights Defenders | Huntress
Huntress identified an intrusion against a non-profit supporting Vietnamese human rights that’s likely spanned years. Jump in as we provide a thorough analysis of this malicious threat actor.
P0
2024-07-25 05:58 UTC
Other
Other
GXC Team Unmasked: The cybercriminal group targeting Spanish bank users with AI-powered phishing tools and Android malware
Specializing in AI-powered phishing-as-a-service and Android malware capable of intercepting OTP codes, the GXC Team targets Spanish bank users and 30 institutions worldwide
P0
2024-06-21 05:25 UTC
Other
Other
Boolka Unveiled: From web attacks to modular malware
Uncovering the operations of threat actor Boolka, driven by the creation of malicious scripts, malware trojans, sophisticated malware delivery platforms, and more.
P0
2024-05-30 00:00 UTC
Security Journalism
Security Journalism
Attack Behaviors | Huntress
In the cybersecurity community, we may hear analysts say, “Oh, threat actors change their tactics…”, and at times, they may include the word “always” as part of that statement. However, the question at hand is, “Does the data really show that to be the case?” What are we truly seeing in real-world incidents?
P0