LATEST

Managing Cybersecurity and Privacy Risks in the Age of Artificial Intelligence: Launching a New Program at NIST

The rapid proliferation of Artificial Intelligence (AI) promises significant value for industry, consumers, and broader society, but as with many technologies, new risks from these advancements in AI must be managed to realize it’s full potential. The NIST AI Risk Management Framework (AI RMF) was developed to manage the benefits and risks to individuals, organizations, and society associated with AI and covers a wide range of risk ranging from safety to lack of transparency and accountability.…

Making Sense of Alphabet Soup: 16 Security Terms and Acronyms You Should Know | Huntress

Read up on the key cybersecurity terms and acronyms every security professional should know and understand.

The State of the Dark Web | Huntress

Grab some popcorn and hold onto your seats: we’re headed back to the dark web.

Storm clouds on the horizon: Resurgence of TeamTNT?

Investigations into recent campaigns may suggest the reemergence of TeamTNT in 2023 to present day, since evaporating in 2022.

Cracks in the Foundation: FOUNDATION Accounting Intrusions | Huntress

Threat actors have been successful in gaining entry using accounting software commonly used by construction companies.

The Top 3 Cyber Challenges for Mid-Market Businesses | Huntress

Uncover top cyber challenges for mid-sized businesses in 2023; from lack of time and skills, human vulnerabilities, and budget constraints.

Concealed networks: Are dark web syndicates turning to social media for cybercrime?

Group-IB dark web investigations: To avoid prying eyes, find out how adversaries increasingly shift from the dark web to social media to execute attacks, leak credentials, share exploitable vulnerabilities, and more.

CloudImposer

Google Cloud Composer is a managed service for Apache Airflow. Tenable discovered that the Cloud Composer package was vulnerable to dependency confusion, which could have allowed attackers to inject malicious code when the package was compiled from source. This could have led to remote code execution on machines running Cloud Composer, which include various other GCP services as well as internal servers at Google. The dependency confusion stemmed from Google's risky recommendation in their docu…

Document AI data exfiltration

The Document AI service unintentionally allows users to read any Cloud Storage object in the same project, in a way that isn't properly documented. The Document AI service agent is auto-assigned with excessive permissions, allowing it to access all objects from Cloud Storage buckets in the same project. Malicious actors can exploit this to exfiltrate data from Cloud Storage by indirectly leveraging the service agent's permissions. This vulnerability is an instance of transitive access abuse, a …

Are Biometrics the Hero or Villain in Cybersecurity? | Huntress

Biometrics: the hero and villain of cybersecurity. Discover how this cutting-edge tech boosts security while posing serious risks. Is it a game-changer or a ticking time bomb? Let’s break it down.

Escalating from Reader to Contributor in Azure API Management

A vulnerability in Azure API Management allowed users with Reader access to escalate privileges to Contributor level by accessing admin user keys via the ARM API. This permitted full management capabilities through the Direct Management API, including reading secrets and modifying configurations.

Ajina attacks Central Asia: Story of an Uzbek Android Pandemic

Discovered by Group-IB in May 2024, the Ajina.Banker malware is a major cyber threat in the Central Asia region, disguising itself as legitimate apps to steal banking information and intercept 2FA messages.

Security Flaw in AWS Transit Gateway Peering Attachments

A security flaw in AWS Transit Gateway Peering attachments allowed unauthorized acceptance of peering requests between regions. The exploit bypassed the approval step, granting potential unauthorized access to networks. AWS patched the issue on August 7, 2024, after being notified on July 25, 2024.

MSPCFO: Identifying Operational Improvements from Huntress | Huntress

See the research that highlights how MSPs experience reduced time and effort spent on ticket management, cost savings, and boosted efficiency with Huntress.

Vulnérabilité dans SonicWall (10 septembre 2024)

Le 22 août 2024, Sonicwall a publié un correctif concernant la vulnérabilité critique CVE-2024-40766 affectant les pare-feux Sonicwall génération 5, 6 et 7. Cette vulnérabilité, de type contrôle d'accès défaillant, permet à un attaquant de provoquer un déni de service à distance, une atteinte à...

Will Patients’ Data Ever Be Safe if We Let GPTs Into Healthcare? | Huntress

Are GPTs safe for healthcare? Discover expert opinions on AI’s role in enhancing patient care while ensuring data integrity with Huntress.

You’re the “Why” Behind the Huntress Hub | Huntress

Huntress Hub is here. It’s your all-in-one portal for resources, training, and marketing tools to empower your cybersecurity journey. Simplify workflows, boost productivity, and grow your business with ease.

The Duality of the Pluggable Authentication Module (PAM)

Chaos to Clarity: How Our Community Helped Transform SIEM | Huntress

Our community’s support drove the development of Huntress Managed SIEM, a groundbreaking solution that simplifies management, cuts through noise, and ensures consistent pricing.

Learning, Sharing, and Exploring with NIST’s New Human-Centered Cybersecurity Community of Interest

Human-centered cybersecurity (also known as ‘usable security’) involves the social, organizational, and technological influences on people’s understanding of and interactions with cybersecurity. By taking a human-centered cybersecurity (HCC) approach, we can both improve people's cybersecurity experiences and achieve better cybersecurity outcomes, which is so important in today’s digitally interconnected world. At NIST, we understand the value of making connections, listening, and interactivity…

APT Lazarus: Eager Crypto Beavers, Video calls and Games

Explore the growing threats posed by the Lazarus Group's financially-driven campaign against developers. We will examine their recent Python scripts, including the CivetQ and BeaverTail malware variants, along with their updated versions in Windows and Python releases. Additionally, we will analyze their tactics, techniques, and indicators of compromise.

Phishing in the Fast Lane | Huntress

Join Huntress team members as they walk through some of the most malicious phishing techniques, presented from the attacker's perspective.

RansomHub ransomware-as-a-service

Learn why RansomHub's new affiliate program and its advanced ransomware tactics—recruiting former Scattered Spider members, exploiting unprotected RDP services, and exfiltrating large data volumes—are critical for staying ahead of modern cyber threats.

APT Targeting Vietnamese Human Rights Defenders | Huntress

Huntress identified an intrusion against a non-profit supporting Vietnamese human rights that’s likely spanned years. Jump in as we provide a thorough analysis of this malicious threat actor.

Hiding in plain sight: Techniques and defenses against `/proc` filesystem manipulation in Linux

Group-IB explores methods of process visibility evasion through /proc filesystem manipulation in Linux, along with effective defenses to counteract these tactics.

Which States Are Most at Risk for Government Cyberattacks? | Huntress

Cyberattacks on U.S. government and critical infrastructure surged in 2023, with over 420 million global attacks. Learn which states are most affected and discover how Huntress can help protect your organization

Remote Work Security | Huntress

Join Imani on her adventures as she learns how to remain secure in remote work environments with our latest Huntress SAT episode!

Protecting Against Session Hijacking & Credential Theft | Huntress

Discover how our new Unwanted Access capability strengthens your defenses against session hijacking and credential theft. Dive in and learn how to minimize risks and protect your business-critical assets from evolving cyber threats.

Implementation Challenges in Privacy-Preserving Federated Learning

In this post, we talk with Dr. Xiaowei Huang and Dr. Yi Dong (University of Liverpool), Dr. Mat Weldon ( United Kingdom (UK) Office of National Statistics (ONS)), and Dr. Michael Fenton (Trūata) who were winners in the UK-US Privacy-Enhancing Technologies ( PETs) Prize Challenges. We discuss implementation challenges of privacy-preserving federated learning (PPFL) - specifically, the areas of threat modeling and real world deployments. Threat Modeling In research on privacy-preserving federated…

Copilot Studio information disclosure via SSRF