LATEST

AI-Powered Celebrity Impersonation Scams: A Threat Intelligence Report by RedHunt Labs

Introduction A new wave of AI-powered investment scams is targeting Indian users on Facebook and Instagram, luring them with fake celebrity endorsements and deepfake interviews. Ads featuring figures like Nirmala Sitharaman, Sadhguru, and Neha Kakkar promote fraudulent schemes, directing users to counterfeit news websites mimicking The Times of India, IndiaTime, and NDTV. These sites claim celebrities have built fortunes using exclusive investment strategies, persuading victims to deposit ₹21,0…

Fraud-Proof Your Security: How BioConfirm Protects iGaming Platforms and Players

Enable real-time, token-based account security that stops withdrawal fraud before your brand, players, and their revenue are compromised.

Authenticate Users, Secure Transactions: How BioConfirm Secures High-Stakes Banking Operations

Introducing BioConfirm - Enable real-time, token-based user account security that stops withdrawal fraud before your brand, customers’ trust, and revenue are compromised.

Mitigating prompt injection attacks with a layered defense strategy

Posted by Adam Gavish, Google GenAI Security TeamWith the rapid adoption of generative AI, a new wave of threats is emerging across the industry with the aim of manipulating the AI systems themselves. One such emerging attack vector is indirect prompt injections. Unlike direct prompt injections, where an attacker directly inputs malicious commands into a prompt, indirect prompt injections involve hidden malicious instructions within external data sources. These may include emails, documents, or…

Do Tigers Really Change Their Stripes?

Across the larger cybersecurity community, an often-used adage is that “threat actors always change their tactics.” However, when we really start to look at and track incident data, we begin to see that while some changes may be necessitated based on infrastructures and other challenges the threat actor may encounter, there are times when tactics remain consistent across incidents. Recent investigations into exploitation activity for CVE-2025-31151 and CVE-2025-30406 show similar TTPs across di…

Fast, smart, and private: Group-IB introduces AI Assistant

Our new LLM-powered chatbot is designed for efficiency and security. Discover how Group-IB AI Assistant enhances threat intelligence workflows and provides security teams with instant insights — without compromising privacy.

RansomHub Never Sleeps Episode 1: The evolution of modern ransomware

Discover how ransomware has evolved into a sophisticated cyber threat, with groups like RansomHub leading the charge. Learn more about their adaptability, TTPs, and the rise of Ransomware-as-a-service in this first-of-three-part trilogy.

Beyond AI: Group-IB’s Local Expertise in Fraud Protection

Minimize false positives, proactively prevent threats, and gain customized fraud protection with Group-IB. Our AI-powered solutions are fine-tuned by local experts and real-time threat intelligence in key regions, ensuring optimal security performance and minimal disruption to your business.

Turning TTPs into CTF Challenges: Huntress CTF 2024 Retro | Huntress

Explore the highlights of Huntress Capture the Flag 2024, where teams cracked complex cyber challenges in a month-long journey of reverse engineering and malware analysis.

Boost your MSSP’s competitive edge: New strategies for leveraging Threat Intelligence

How to best empower your business clients’ cybersecurity with critical cyber threat intelligence

BlackCat Ransomware Affiliate TTPs | Huntress

This blog post provides a detailed look at the TTPs of a ransomware affiliate operator. In this case, the endpoint had been moved to another infrastructure (as illustrated by various command lines, and confirmed by the partner), so while Huntress SOC analysts reported the activity to the partner, no Huntress customer was impacted by the ransomware deployment.

Threat Intel Accelerates Detection and Response | Huntress

Evidence of a pre-existing exploit was rendered when the Huntress agent was added to an endpoint. Within minutes, and in part through the use of previously published threat intelligence, analysts were able to identify the issue and make recommendations to the customer to remediate the root cause.

Ace in the Hole: exposing GambleForce, an SQL injection gang

Analysis of TTPs tied to GambleForce, which carried out SQL injection attacks against companies in the APAC region

Curling for Data: A Dive into a Threat Actor's Malicious TTPs | Huntress

Huntress analysts recently observed a novel set of tactics, techniques, and procedures used by a threat actor for data collection and exfiltration.

Curse of the Krasue: New Linux Remote Access Trojan targets Thailand

This piece of malware has an insatiable appetite. Group-IB's Threat Intelligence unit offers their insights on the new RAT used in attacks against Thai companies.

Armés et dangereux : une soif d’argent inextinguible L’APT OPERA1ER en Afrique

En 2019, l'équipe Threat Intelligence de Group-IB a détecté une série d'attaques ciblant des organisations financières en Afrique.

We see you, Gozi

Hunting the latest TTPs used for delivering the Trojan

How MITRE ATT&CK® helps users of Threat Intelligence

Under the hood. Group-IB Threat Intelligence. Part 2

How we make Tailored Threat Intelligence

Under the hood. Group-IB Threat Intelligence. Part 1

Dive into Breached DB section

REvil Twins: Ransomware-as-a-Service program

Deep Dive into Prolific RaaS Affiliates' TTPs

What’s the Real Cost of Cybersecurity for Your SMB Clients? | Huntress

As hackers get smarter, you must evolve your approach to threat detection and response. Learn how to protect your clients with threat intelligence tools.

New attacks by UltraRank group

As part of UltraRank's new campaign, Group-IB Threat Intelligence team discovered 12 eCommerce websites infected with their JavaScript-sniffer.

The Locking Egregor

Analysis of TTPs employed by Egregor operators