2024-04-03 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
GitLab addressed a critical vulnerability, CVE-2023-7028, affecting managed SaaS gitlab.com instance as well as self-hosted versions 16.1 to 16.7.1. The flaw could allow account takeovers via unverified email password resets. Third party could intercept the password reset request, add their own email to the request and forward it. GitLab would then send the reset link to the added 3rd-party email. This is in effect an account takeover with only precondition of knowing victim email associated wi…
P15
2024-04-01 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Threat actors have been using malicious versions of Advanced IP Scanner to compromise their targets via malvertising campaigns. Let’s analyze one.
P0
2024-03-29 07:58 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Actionable insights on hunting for Windows Management Instrumentation (WMI) execution abuse
P0
2024-03-28 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Huntress continues to see MSSQL server systems being attacked, and in recent incidents have seen overlap with previous incidents, not only in the use of LOLBins, but also in IP addresses used by the threat actor.
P0
2024-03-27 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
A flaw in AWS Bedrock's foundation model access control allowed unauthorized subscriptions to certain models, bypassing IAM policies using the aws-marketplace:ProductId condition key. This could lead to compliance issues and financial risks. AWS has since fixed the issue and notified affected customers.
P0
2024-03-26 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Depending on which EDR solution you choose, capabilities and outcomes can differ greatly. Huntress looks at what differentiates Huntress Managed EDR from competitors, reviewing key features and benefits.
P0
2024-03-24 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
TrustOnCloud identified a flaw in how AWS Bedrock enforces IAM access controls using the aws-marketplace:ProductId condition key, which is meant to restrict subscriptions to specific foundation models. Their testing revealed that some Bedrock models, including those from Cohere and Stability AI, were not consistently blocked or allowed as intended by IAM policies, posing potential compliance and cost risks. AWS acknowledged and fixed the issue, notifying affected customers and updating testing …
P0
2024-03-21 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
A flaw in Amazon Managed Workflows for Apache Airflow (MWAA) could have allowed potential session hijacking and remote code execution. The issue stemmed from a combination of session fixation in the MWAA web management panel and an AWS domain configuration error leading to a cross-site scripting (XSS) attack. Attackers exploiting this could manipulate victims' configurations, trigger workflows, and potentially move laterally to other services within the cloud environment. The exploit of this bu…
P15
2024-03-21 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Many security awareness training solutions aren’t easy to manage, and worse, they affect knowledge retention. Let’s review the common SAT features that diminish your ability to improve your security posture.
P0
2024-03-20 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Huntress recently detected interesting activity on an endpoint; a threat actor was attempting to establish a foothold on an endpoint by using commands issued via MSSQL to upload a reverse shell accessible from the web server. All attempts were obviated by MAV and process detections, but boy-howdy, did they try!
P0
2024-03-15 08:04 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Pegasus infects mobile devices through zero-click exploits and silently harvests messages, calls, location, and microphone access. Learn how the spyware operates and the steps security teams can take to detect it on iOS and Android.
P0
2024-03-13 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
“Double extortion” attacks, often perpetrated by ransomware threat actors, include data exfiltration prior to file encryption. Huntress analysts have observed various means of data exfiltration, but recently observed the use of a legitimate backup application seen by others to be associated with a Noberus/ALPHV ransomware affiliate.
P15
2024-03-11 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
The primary goal of Apple's Transparency, Consent, and Control (TCC) is to empower users with transparency regarding how their data is accessed and used by applications. In this Part 2, dig even deeper into the mechanism that runs TCC and what's happening in the background.
P0
2024-03-07 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Tenable Research discovered a privilege escalation flaw that allows a user to escalate privileges to that of the root user within the context of a Spark VM. This escalation was achieved because of a permissions issue with scripts utilized by the intelligent caching service (AKA "Vegas") present in the environment.
P10
2024-03-07 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Impossible Travel is one of the earliest indicators of user compromise, and it works against any user-centric event that can be tied back to a location. Huntress goes in-depth on this problem, explaining how it works, revealing challenges surrounding it, and offering real-world examples occurring within Microsoft 365.
P0
2024-03-05 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Huntress has launched Huntress Security Awareness Training (SAT), a new and improved SAT solution tailored to the needs of underserved and resource-strapped organizations. It features memorable, story-driven episodes, making it easier for users to retain knowledge. And since it’s fully managed by Huntress, admins will enjoy it too. Most importantly, Huntress SAT was developed with one overall goal—elevate the security of your small- and medium-sized business (SMB).
P0
2024-03-04 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Over the past year, the Huntress team has posted a number of blog posts related to remote monitoring and management (RMM) tools being installed or abused by threat actors.
P0
2024-03-01 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
In an era where cyber threats like SocGholish are becoming increasingly sophisticated, understanding and combating these attacks is crucial for digital safety. This post delves into leveraging Huntress for effectively handling SocGholish threats, outlining a step-by-step approach for IT professionals.
P0
2024-02-29 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
The publication of the first blog post led a Huntress SOC analyst to identify and escalate a second, similar incident. A deeper investigation into the activity made it clear that the Huntress SOC had obviated several Trigona ransomware attacks, protecting customers from the impact of a ransomware infection.
P15
2024-02-28 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
This blog post provides a detailed look at the TTPs of a ransomware affiliate operator. In this case, the endpoint had been moved to another infrastructure (as illustrated by various command lines, and confirmed by the partner), so while Huntress SOC analysts reported the activity to the partner, no Huntress customer was impacted by the ransomware deployment.
P15
2024-02-23 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Adversaries have been VERY busy in the wake of the ScreenConnect vulnerabilities (CVE-2024-1709 & CVE-2024-1708). Here’s all the post-exploitation details, tradecraft, and tactics we’ve observed so far!
P5
2024-02-23 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Huntress Guide: Review this guide on how to tell which ScreenConnect Server autoruns are found on your endpoint so you can quickly find and remove them.
P0
2024-02-21 07:58 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Group-IB discovers new information stealer targeting Vietnam with rare functionality to filter out Facebook accounts with advertising credits
P0
2024-02-21 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
This blog discusses the Huntress Team's analysis efforts of the two vulnerabilities and software weaknesses in ConnectWise ScreenConnect (CVE-2024-1708 and CVE-2024-1709) and the technical details behind this attack.
P5
2024-02-20 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Stay secure with Huntress! Learn about critical vulnerabilities tied to ConnectWise, including CWE-288 authentication bypass. Patch now to version 23.9.8 for protection.
P15
2024-02-19 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Huntress has validated the vulnerabilities referred to in the latest February 19 ConnectWise ScreenConnect advisory. For on-premise users, it is our strongest recommendation to patch and update to ScreenConnect version 23.9.8 immediately.
P0
2024-02-16 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Endpoint detection and response (EDR) is an essential endpoint security solution, but without the right time, resources, and knowledge to remediate threats, your EDR can quickly become a nuisance.
P0
2024-02-15 08:02 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Group-IB uncovers the first iOS Trojan harvesting facial recognition data used for unauthorized access to bank accounts. The GoldDigger family grows
P0
2024-02-15 00:00 UTC
Government
CERT-FR Alerts · indexed 2026-09-07 17:35 UTC
\[Mise à jour du 15 mars 2024\] Ajout de précision concernant les défi-réponses NTLM \[Mise à jour du 22 février 2024\] Ajout de recommandations et de précisions sur le fonctionnement de la vulnérabilité. La vulnérabilité CVE-2024-21413 permet à un attaquant de contourner les mesures de sécurité...
P5
2024-02-15 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Healthcare organizations are facing cyber threats at an alarming rate, and as the U.S. Department of Health and Human Services (HHS) introduces new measures for cybersecurity, it’s also time for small- and mid-sized organizations to be proactive in their defense.
P0
