The AppFlow WooCommerce connector allowed specification of a full URL. The connector included details of response content when the URL offered an unexpected response. This means you could make arbitrary GET requests to any URL from the WooCommerce connector, and view the response content. The response in the error was truncated to 500 characters.
A vulnerability in Google Bard allowed for prompt injection and data exfiltration through its Extensions feature. By injecting malicious instructions into shared Google Docs, an attacker could force Bard to render images with exfiltrated chat history data in the URL. The exploit bypassed Content Security Policy using Google Apps Script.
Amazon Managed Workflows for Apache Airflow (MWAA) and the Task instance details page in the Google Composer UI were not patched against CVE-2023-29247 (Stored XSS). This meant that post-authentication, a threat actor could have exploited this to store their JavaScript payload in the victim's managed Apache Airflow instance and run JavaScript on behalf of the victim (who could be an admin or another user with higher permissions than the threat actor, thereby leading to privilege escalation). Wi…
CVE-2023-46604 is a critical remote code execution vulnerability in Apache ActiveMQ. Patch now to avoid any potential adversary exploitation.
This blog post is a retrospective on the Huntress team's month-long Capture the Flag (CTF) event, highlighting diverse challenges and hacker camaraderie.
Discover the alarming prevalence of exposed passwords on endpoints and how to safeguard your credentials. Learn from Huntress' findings and insights.
Get a close look at details of the most notable cases faced by Group-IB’s Digital Forensics and Incident Response (DFIR) team
\[Mise à jour du 22 novembre 2023\] L'éditeur a publié un document \[3\] le 20 novembre 2023 listant les différents journaux à analyser ainsi que les éléments à rechercher pour identifier une activité pouvant être liée à une compromission. Par ailleurs, la CISA a publié un avis de sécurité le 21...
In Azure AI Playground, a Prompt Injection attack could cause an LLM to return markdown tags. This would have allowed an adversary whose data makes it into the chat context (e.g., via an uploaded file) to achieve exfiltration of the victim’s data by rendering hyperlinks. However, the severity of this issue is low, as there were no integrations that could pull remote content. This means Indirect Prompt Injection was not possible, and it would require the victim to copy the malicious prompt from …
In Vertex AI Studio, a Prompt Injection attack could cause the LLM to return markdown tags. This could have allowed an adversary whose data makes it into the chat context (e.g., via an uploaded file) to achieve exfiltration of the victim’s data by rendering hyperlinks. However, the severity of this issue is low, as there were no integrations that could pull remote content. This means Indirect Prompt Injection was not possible, and it would require the victim to copy the malicious prompt from el…
Explore the art of phishing, learn how to spot common phishing scams and red flags, and understand the importance of security awareness training.
Hacktivists take center stage with DDoS, defacement attacks – summary of Week 1 and 2 of the conflict.
Twas the night before Christmas, when out came the cry, a cyberattack is happening, so stop them, won’t you try?
Read up on how and why Huntress built its Managed ITDR (formerly MDR for Microsoft 365) solution to help combat the growing threat of business email compromise (BEC).
Is it worth ditching your legacy antivirus solution? This blog takes a hard look at what matters most in AV and endpoint protection tools.
In the spirit of Cybersecurity Awareness Month, use these cybersecurity tips to take your security hygiene and cyber knowledge up a notch.
AWS identified an issue in the Amazon WorkSpaces Windows client which resulted in unintentionally logging connection debugging information to a user's local system. This data could include usernames or passwords if they contain specific characters: \ (backslash) or " (double quotes). If an attacker gained access to an Amazon WorkSpaces user's machine, they could then compromise such credentials from the log.
Delve into the tactics of the GoldDigger Trojan and discover ways to safeguard your customers
We can use automation, detection and response, and open-source software to solve common SOC challenges. Read about simple approaches for SOC automation.
In this blog, our Mac expert answers the existential question: As a Mac user, do you need to use an antivirus (AV) to protect your Mac?
Le 27 septembre 2023, Zero Day Initiative (ZDI) a publié six avis de sécurité \[1\] concernant des vulnérabilités de type zéro-jour affectant les versions antérieures à 4.96.1 ou 4.97 de l'agent de transfert de courriels (*Mail Transfer Agent* ou *MTA*) Exim. Le 1er octobre 2023, l'éditeur a...
Huntress is actively investigating numerous vulnerabilities affecting the WS_FTP Server Ad Hoc Transfer Module observed in the wild.
Huntress is tracking a new critical vulnerability seen in the wild that affects anything using the libwebp WebP image library. Here’s what we know so far.
Can AI ever fully replace humans in cybersecurity? We argue that human-powered security is the key to staying one step ahead of today’s threats.
No sleep until the Cybercrime Fighters Club is done with finding the answer as to who is behind this new ransomware-as-a-service affiliate.
The following is an analysis by the Huntress team of several recent intrusions connected to the Netscaler exploitation.
Group-IB analysts discovered and analyzed a cryptojacking campaign on a popular educational resource using Group-IB Managed XDR.
Read about Huntress' newest feature, Incident Notification, which allows us to instantly alert partners to critical incidents via SMS text or phone call.
Dive into the fundamentals of reverse engineering malware and understanding how malicious software works.
Actionable guide to hunting for the Windows Services abuse by using Group-IB MXDR.
