LATEST

Social Engineering in Action: How Fraudsters Exploit Trust with Fake Refund Schemes in the Middle East

Fraudsters have devised a sophisticated scheme targeting banking customers in the Middle East, impersonating government officials and using remote access software to steal credit card information and OTP codes. This scam specifically targets individuals who have lodged complaints online via a government portal, taking advantage of their trust and willingness to cooperate in hopes of refunds, leading to significant financial losses through fraudulent transactions.

Hijacking Azure Machine Learning Notebooks

Azure Machine Learning notebooks can be hijacked by attackers with Storage Account access to inject malicious code. A now-fixed vulnerability allowed Reader role escalation to code execution. The article details the attack methods, including modifying notebooks, obtaining managed identity tokens, and exfiltrating data. It also introduces a tool for dumping AML workspace credentials.

Cyber Predictions For 2025 (and Beyond): Group-IB’s Expert Take On What’s Coming

Don’t fall weak in the face of change and disruption. Review the upcoming cybersecurity changes and become equipped while there’s time!

Cleo Software Actively Being Exploited in the Wild | Huntress

Huntress identified an emerging threat involving Cleo’s LexiCom, VLTransfer, and Harmony software, known as CVE-2024-55956, commonly used to manage file transfers. Read more about this emerging threat on the Huntress Blog.

Exploring Package Tracking Smishing Scams | Huntress

Smishing (or SMS phishing) is far more frequent during the holidays. Learn to recognize the signs of a smish and how to avoid falling victim to one.

2024: Revisiting a Year in Threats | Huntress

Take a look back at some of the biggest threats we observed and analyzed in 2024.

AWS Neuron SDK Dependency Confusion Vulnerability Recurs

AWS Neuron SDK has reintroduced a dependency confusion vulnerability three times in four years. The issue stems from using the --extra-index-url parameter in pip install commands, which allows potential installation of malicious packages from PyPI instead of AWS's private repository. Despite previous reports, AWS has not fully addressed the problem, leaving new packages vulnerable to exploitation.

How Managed SIEM Helps Decode Compliance | Huntress

Understand how Managed SIEM supports your compliance journey worldwide.

NIST’s International Cybersecurity and Privacy Engagement Update – New Translations

As the year comes to a close, NIST continues to engage with our international partners to strengthen cybersecurity, including sharing over ten new international translations in over six languages as resources for our stakeholders around the world. These efforts were complemented by discussions on opportunities for future enhanced international collaboration and resource sharing. Here are some updates from the past few months: Our international engagement continues through our support to the Dep…

Analyzing Initial Access Across Today's Business Environment | Huntress

Learn more about the initial access techniques observed by the Huntress SOC and Tactical Response teams! Gain valuable insights to help you protect your environment.

Patch Me If You Can: The Truth About Smartphone Vulnerabilities

Discover how smartphone manufacturers conceal security flaws, the risks these vulnerabilities pose to users and businesses, and actionable steps to protect devices from data breaches, identity theft, and exploitative attacks.

When and Where SIEM Fits in Healthcare IT Settings | Huntress

Understanding SIEM’s benefits, limitations, and best applications in a strong healthcare security stack

Dirty DAG - Azure Apache Airflow Integration Vulnerabilities

Unit 42 researchers identified vulnerabilities in the Azure Data Factory's integration with Apache Airflow. These vulnerabilities include misconfigured Kubernetes Role-Based Access Control (RBAC), improper secret handling in Azure’s internal Geneva service, and weak authentication mechanisms. Exploiting these flaws, attackers could gain shadow admin control over Azure infrastructure by crafting malicious DAG files or compromising service principals, leading to unauthorized access, data exfiltra…

Does Santa Like NordVPN? | Huntress

Huntress Managed ITDR uncovers risks behind popular VPNs and proxies like NordVPN, Mullvad, and more—helping you steer clear of hackers this holiday season.

Bedrock API Logging Issue

Sysdig's Threat Research Team discovered an issue with Amazon Bedrock API logging in CloudTrail. Failed API calls were logged as successful without error codes, hindering detection efforts and potentially generating false positives. The issue affected Bedrock Runtime APIs, specifically InvokeModel and Converse. AWS resolved the problem.

Trust Hijacked: The Subtle Art of Phishing Through Familiar Facades

Explore the advanced tactics employed in recent email phishing campaigns targeting employees from over 30 companies across 12 industries and 15 jurisdictions. This blog unveils sophisticated techniques used to outsmart Secure Email Gateways (SEGs) and exploit trusted platforms, creating highly convincing schemes to deceive victims and steal their credentials.

Code Execution in Azure API Management Developer Portal

A vulnerability in Azure API Management Developer Portal allows arbitrary code execution and secret exfiltration. The issue stems from a workflow that loads untrusted data from opened issues, potentially allowing attackers to inject malicious commands. This could lead to code execution in the runner, granting access to sensitive tokens and permissions.

Cleo Malichus Malware Analysis CVE-2024-55956| Huntress

Team Huntress has analyzed Cleo's software vulnerability CVE-2024-55956. Take a look at the technical breakdown of a new family of malware we’ve named Malichus.

2024 Wrapped: Huntress Managed SAT Edition | Huntress

With 2024 ending, let’s look back at everything new from Huntress Managed SAT this past year.

Data Pipeline Challenges of Privacy-Preserving Federated Learning

This post is part of a series on privacy-preserving federated learning. The series is a collaboration between NIST and the UK government’s Responsible Technology Adoption Unit (RTA), previously known as the Centre for Data Ethics and Innovation. Learn more and read all the posts published to date at NIST’s Privacy Engineering Collaboration Space or RTA’s blog . Introduction In this post, we talk with Dr. Xiaowei Huang and Dr. Yi Dong (University of Liverpool) and Sikha Pentyala (University of W…

Managed SIEM and the Art of Perfecting Cyber Defense | Huntress

How Huntress Managed SIEM turns signal recognition into defensive mastery.

Deepfake Fraud: How AI is Deceiving Biometric Security in Financial Institutions

Group-IB’s Fraud Protection team examines how fraudsters use deepfake technology to bypass biometric security in financial institutions, including facial recognition and liveness detection. This blog highlights the use of emulators, app cloning, and virtual cameras to exploit vulnerabilities, and highlights the financial and societal impacts of deepfake fraud.

Huntress Managed Security Awareness Training: Relevance | Huntress

In this new blog series, we’ll explore the managed episodes from Huntress Managed SAT, dive into the topics, and gain insight into why these episodes are relevant right now.

Shady Bets: How to Protect Yourself from Gambling Fraud Online

Scammers are using fake betting game advertisements on social media to target users, with over 500 deceptive advertisements and 1,377 malicious websites identified by Group-IB CERT. These scams promise quick money but are designed to steal personal data and funds, and this blog aims to educate users on how to recognize and protect themselves from such threats.

Rethinking investigation: Group-IB’s Graph takes a leap forward

Know Thy Enemy: A Novel November Case | Huntress

In this blog, Huntress SOC investigators unravel the lateral movement and persistence of an interesting threat actor and their novel infrastructure

Kicking-Off with a December 4th Workshop, NIST is Revisiting and Revising Foundational Cybersecurity Activities for IoT Device Manufacturers, NIST IR 8259!

In May 2020, NIST published Foundational Cybersecurity Activities for IoT Device Manufacturers (NIST IR 8259), which describes recommended cybersecurity activities that manufacturers should consider performing before their IoT devices are sold to customers. These foundational cybersecurity activities can help manufacturers lessen the cybersecurity-related efforts needed by customers, which in turn can reduce the prevalence and severity of IoT device compromises and the attacks performed using c…

Tracing the Path of VietCredCare and DuckTail: Vietnamese dark market of infostealers’ data

Following the arrest in May 2024 of more than 20 individuals behind Facebook infostealers campaigns in Vietnam, we have compared the tactics of operators behind VietCredCare and DuckTail stealers. These 2 malware families have been active before the arrest in Vietnam and are believed to be controlled by Vietnamese threat actors. Based on the research, we decided that the groups operate in a different way and the arrest probably affected the VietCredCare operators.

Make Your Microsoft Security Tools Come to Life With Huntress | Huntress

Huntress joins the Microsoft Intelligent Security Association to enhance Microsoft tools for SMBs, delivering stronger defenses against today’s most advanced cyber threats.

Silencing the EDR Silencers | Huntress

Discover how adversaries are using tools like EDRSilencer to tamper with EDR communications and learn how you can fight back.