LATEST

Webworm: New burrowing techniques

ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal

Volume Obfuscation Game: The Lead Data Brokers Out To Waste Your Time

An increasing number of data brokers active in Chinese-speaking dark web forums and Telegram channels are advertising large volumes of purportedly stolen data from organizations worldwide. But are they credible?

Continued Evolution of Persistence Mechanism Against Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense

On April 23, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an update to V1: Emergency Directive (ED) 25-03: Identify and Mitigate Potential Compromise of Cisco Devices related to Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) products. According to the update, the ArcaneDoor threat actor has developed a previously unknown persistence mechanism that is preserved across upgrading to the fixed releases that wer…

Is Fraud Distorting Your iGaming Growth Numbers?

A candid conversation on fraud disguised as iGaming growth with Sarah Psaila, Head of Gaming at Group-IB.

The quest for greater tech independence

A complete decoupling from US technology is neither realistic nor necessary, but the changing environment does require nations and companies to reassess their relationships and dependencies

Exposed RDP: The Misconfiguration Attackers Keep Exploiting

Exposed RDP is still one of the most reliable ways attackers get in and most teams don't know it's open. See real cases where it was caught before it became a catastrophe.

Threat Actor Defense Evasion: How Attackers Disable AV & EDR

Threat actors are actively targeting your security tools. Learn how threat actors disable antivirus and EDR through vulnerable drivers, tampering attacks, and malicious firewall rules, and how Huntress detects.

Introducing Group-IB Prevyn AI

How Group-IB is building a cognitive core that anticipates threats before they happen

Project Glasswing: what Mythos showed us

In recent weeks, we pointed Mythos and other security-focused LLMs at live code across critical parts of our infrastructure. We share what we observed, the models’ strengths and weaknesses, and what the work around them needs to look like before any of it can scale.

19 Cloud Security Challenges and How to Mitigate Risk | Huntress

Learn about some of the most common cloud security challenges facing modern businesses today, plus why it matters for you and your employees.

Welcome to BlackFile: Inside a Vishing Extortion Operation

Written by: Austin Larsen, Tyler McLellan, Genevieve Stark, Dan Ebreo Introduction Google Threat Intelligence Group (GTIG) has continued to track an expansive extortion campaign by UNC6671, a threat actor operating under the "BlackFile" brand, that targets organizations via sophisticated voice phishing (vishing) and single sign-on (SSO) compromise. By leveraging adversary-in-the-middle (AiTM) techniques to bypass traditional perimeter defenses and multi-factor authentication (MFA), UNC6671 gain…

What Is an Incident Response Retainer? (And Why Waiting Until a Breach Is Too Late)

An incident response retainer gives organizations immediate access to cybersecurity experts when a breach occurs, without losing critical time to legal, procurement, or onboarding delays. This article explains how IR retainers work, the different retainer models available, and why they can significantly reduce downtime, damage, and uncertainty during a cyber incident.

Digital Brand Protection in Cybersecurity: Why It Matters in 2026

Digital brand protection helps organizations detect and disrupt external threats, such as phishing sites, fake social profiles, counterfeit listings, and leaked credentials, before they become customer-facing fraud or reputational damage.

Why geopolitical turmoil is a gift for scammers, and how to stay safe

Conflict is a boon for opportunistic fraudsters. Look out for their ploys.

What Is Single Sign-On? The Practical Guide | Huntress

Learn what single sign-on (SSO) login is, how it’s used in role management and cybersecurity, and how to set it up at your organization.

[Màj] Vulnérabilité dans Microsoft Exchange Server (15 mai 2026)

[Mise à jour du 11 juin 2026] Le 9 juin 2026, Microsoft a publié des versions correctives. [Publication initiale] Le 14 mai 2026, Microsoft a publié un avis de sécurité concernant la vulnérabilité CVE-2026-42897 affectant Exchange Server. Elle permet à un attaquant non authentifié de provoquer...

Strong Stack. Strong Team. Real Security Resilience.

Learn how to build a resilient security stack and program that cuts alert noise, strengthens identity defense, and helps teams respond faster.

Cisco Catalyst SD-WAN Manager Vulnerabilities

Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow a remote attacker to gain access to sensitive information, elevate privileges, or gain unauthorized access to the application. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. Cisco strongly recommends that customers upgrade to…

Cisco Crosswork Network Controller and Cisco Network Services Orchestrator Advisory

Following the initial publication of the Security Advisory about a denial of service (DoS) condition in Cisco Crosswork Network Controller and Cisco Network Services Orchestrator (NSO), additional information has been made available to the Cisco Product Security Incident Response Team (PSIRT). Upon further analysis, the Cisco PSIRT has reclassified this issue as a customer-configurable, resource management issue rather than a security vulnerability. This advisory is available at the following l…

Panic at the Distro

Learn how critical Linux kernel flaws in CopyFail, Dirty Frag, and Fragnesia let unprivileged users escalate to root access. See what security teams can do to remediate.

FrostyNeighbor: Fresh mischief and digital shenanigans

ESET researchers uncovered new activities attributed to FrostyNeighbor, updating its compromise chain to support the group’s continual cyberespionage operations

CMMC Final Rule: A Guide for DoD Subcontractors

CMMC final rule requires DoD subs meet Level 2 by Nov 2026. Huntress Managed SIEM provides vendor docs and 24/7 monitoring for compliance.

How Huntress Managed ITDR's New Incident Report Timeline | Huntress

Learn how the Incident Report Timeline within Huntress Managed ITDR offers clear, chronological insights, enabling a decisive response to incidents.

The French 2-Step: Exposing a Multi-stage Scam Targeting the National Railway Company in France

This highly targeted scam scheme uses advanced phishing and social engineering cues, rely on brand recognition, event-based campaigns and emotional manipulation to defraud victims twice.

Security Alert: Microsoft Releases May 2026 Security Updates

What’s New in Android Security and Privacy in 2026

New Android security and privacy features

Android’s Agentic Future: Building Gemini Intelligence on a Foundation of Security & Privacy

Gemini Intelligence security and privacy principles

Huntress × Acrisure Cyber Insurance Program

The Huntress × Acrisure Cyber Insurance Program now simplifies cyber insurance. Get streamlined coverage and a $0 deductible on Tech E&O or Cyber policies when using Managed EDR and Managed ITDR.

How EvilTokens Turbocharges Old School Phishing with AI

Device code phishing doesn't need stolen passwords or malware—just a legitimate auth flow. Learn how EvilTokens weaponized AI to run this attack across 344 organizations.