2023-04-04 00:00 UTC
Security Journalism
Security Journalism
Huntress Heads Into Q2 Serving More SMBs and 2 Million Endpoints | Huntress
We're so excited to say we're now securing more than two million endpoints!
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 5,259 matching records.
AUTO-POLL // 2026-10-21 06:30 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P2 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 21
BREACH
P2
COOL // 8 ARTICLES
TUE
Oct 20
RANSOMWARE
P2
COOL // 63 ARTICLES
MON
Oct 19
RANSOMWARE
P3
COOL // 51 ARTICLES
SUN
Oct 18
RANSOMWARE
P2
COOL // 8 ARTICLES
SAT
Oct 17
ACTIVE EXPLOITATION
P4
COOL // 12 ARTICLES
FRI
Oct 16
RANSOMWARE
P8
COOL // 56 ARTICLES
THU
Oct 15
ACTIVE EXPLOITATION
P7
COOL // 87 ARTICLES
2023-04-03 00:00 UTC
Other
Other
App Runner cross-tenant observability config info leak
The API action ListObservabilityConfigurationsForAccount did not properly validate the "AccountId" parameter that was passed to it. As a result, any account ID could be provided and the API would return the information for that account. This would leak minor information about the observability configuration for App Runner in the account.
P0
2023-04-03 00:00 UTC
Other
Other
App Runner cross-tenant VPC connectors info leak
The API action ListVpcConnectorsForAccount did not properly validate the "AccountId" parameter that was passed to it. As a result, any account ID could be provided and the API would return the information for that account. This would leak minor information about the VPC configuration for App Runner in the account including the subnet ID, security group ID, and the VPC Connector ARN.
P0
2023-03-31 10:59 UTC
Other
Other
36gate: supply chain attack
What is known about the 3CX supply chain incident and how to defend against it?
P0
2023-03-31 00:00 UTC
Security Journalism
Security Journalism
Contextualizing Events & Enabling Defense: What 3CX Means | Huntress
In this blog, we contextualize the events and talk about enabling defense from the 3CX compromise.
P0
2023-03-30 00:00 UTC
Other
Other
Azure on-premises data gateway cross-tenant access
Azure on-premises data gateway allows data transfer between an on-prem customer network and several Azure cloud services, and also enables a connected agent installed locally in an on-prem network to perform certain actions remotely. NetSPI discovered a deserialization issue in Microsoft Power Platform connectors that lead to RCE on several Azure backend servers that processed call backs from on-premises data gateways, effectively allowing unauthorized cross-tenant access.
P15
2023-03-30 00:00 UTC
Other
Other
RCE vulnerability in Azure Pipelines
Legit Security found an RCE vulnerability in Azure Pipelines that could have allowed an attacker to gain complete control of variables and tasks by exploiting logging commands. This would have enabled them to execute malicious code in a context of a pipeline workflow, which would have granted them access to sensitive secrets such as cloud deployment keys, move laterally in the organization, and potentially initiate supply chain attacks. To exploit this vulnerability, an attacker would have need…
P15
2023-03-30 00:00 UTC
Security Journalism
Security Journalism
3CX VoIP Software Compromise & Supply Chain Threats | Huntress
The 3CX VoIP Desktop Application has been compromised to deliver malware via legitimate 3CX updates. Huntress has been investigating this incident and working to validate and assess the current supply chain threat to the security community.
P0
2023-03-28 00:00 UTC
Security Journalism
Security Journalism
Mid-Sized Businesses vs. The Threat Landscape in 2023 | Huntress
A survey of mid-sized businesses revealed common cybersecurity vulnerabilities. Learn what they are and how to improve your security posture in 2023.
P0
2023-03-23 00:00 UTC
Other
Other
Azure Function Apps privilege escalation
Undocumented APIs used by the Azure Function Apps Portal could have allowed an attacker with existing access to a Reader role on a Function App to escalate their privileges and gain write permissions through arbitrary file reads on Function App containers. For Windows containers, this would only grant an attacker the ability to extract ASP.NET encryption keys (the impact of which remains unclear), but for Linux containers it would have allowed an attacker to read environmental variables contain…
P25
2023-03-21 04:13 UTC
Other
Other
Venomous vacancies: Job seekers across MEA hit by sting in scammers’ tail
Group-IB uncovers more than 2,400 scam job pages in ongoing campaign targeting users in Egypt, KSA, Algeria, and 10 other MEA countries.
P0
2023-03-21 00:00 UTC
Security Journalism
Security Journalism
macOS (Not)ifications | Huntress
In this blog, we dive into macOS notifications—and the intentional design behind them.
P0
2023-03-20 00:00 UTC
Other
Other
Partial CloudTrail logging in AWS Control Tower
AWS Control Tower was not properly logging to CloudTrail when API calls failed due to a lack of permissions. This could have helped an adversary with existing access to a victim AWS environment avoid detection while enumerating privileges, since any unsuccessful API calls would not generate "access denied" log entries.
P0
2023-03-19 00:00 UTC
Other
Other
CloudTrail bypass for AWS Service Catalog
Due to an exposed development endpoint, it was possible to bypass CloudTrail logging for both read and write API actions for the Service Catalog service. This could have enabled adversaries to alter Service Catalog resources undetected after gaining a foothold in a victim AWS environment.
P0
2023-03-17 14:22 UTC
Other
Other
Bleak outlook: Mitigating CVE-2023-23397
Microsoft Outlook Elevation of Privilege Vulnerability
P5
2023-03-17 00:00 UTC
Security Journalism
Security Journalism
Everything We Know About CVE-2023-23397 | Huntress
Huntress is tracking CVE-2023-23397, a 0-day that impacts Microsoft Outlook and requires no user interaction to expose user credential hashes.
P30
2023-03-16 00:00 UTC
Security Journalism
Security Journalism
Addressing Initial Access | Huntress
Series of blog posts that share the breadth and depth of Huntress’ experience to assist others in reducing their attack surface, and inhibiting or even obviating cyber attacks.
P0
2023-03-14 00:00 UTC
Other
Other
Super FabriXss
Azure Service Fabric Explorer (SFX) was affected by an XSS vulnerability that could have allowed a malicious script to be reflected off a web application. After a potential victim clicked on a crafted malicious URL, the attacker could remotely toggle the ‘Cluster’ Event Type setting under the Events tab. This could lead to unauthenticated remote code execution on a container hosted on a Service Fabric node.
P15
2023-03-13 00:00 UTC
Security Journalism
Security Journalism
Veeam Backup & Replication CVE-2023-27532 Response | Huntress
We cover CVE-2023-27532, a vulnerability in the Veeam Backup & Replication component that allowed an unauthenticated user to retrieve host credentials.
P5
2023-03-08 00:00 UTC
Other
Other
Imposter commits vulnerability in GitHub Actions
A vulnerability in GitHub Actions allows bypassing workflow settings using commits from forked repositories (rather than commits of the main action repo). This "imposter commits" issue can potentially introduce untrusted code into CI/CD pipelines, posing a risk to the security of the software supply chain. The vulnerability stems from GitHub's handling of forked repositories and how commits are shared between forks and parent repositories. A partial solution to this was GitHub prohibiting parti…
P0
2023-03-07 00:00 UTC
Security Journalism
Security Journalism
How To Get Buy-In for an EDR Purchase
EDR is a baseline for security controls these days. Learn which questions to ask and answers to give when seeking buy-in to add or replace an EDR in your security stack.
P0
2023-03-06 00:00 UTC
Other
Other
Unauthorized access to Codespace secrets in GitHub
A vulnerability in GitHub's Repository Security Advisory feature allowed unauthorized users to access plaintext Codespace secrets of any organization, including GitHub itself. The issue stemmed from the new beta feature that allows external users to report vulnerabilities to public repositories, inadvertently granting access to sensitive organization-level secrets.
P0
2023-02-25 00:00 UTC
Other
Other
AWS CodeBuild Token Leakage
An attacker with elevated permissions in CodeBuild could leak the configured credentials for Github/Bitbucket. This was possible by configuring the http_proxy and https_proxy variables, which would allow you to capture the credentials via MITM.
P0
2023-02-25 00:00 UTC
Other
Other
Overprivileged CodeBuild default ECR IAM policy
For AWS CodeBuild, when using a custom container image stored in ECR and the project service role for the credentials to pull the image, the default IAM policy attached to the role to allow pulling the container was over-privileged and allowed the CodeBuild container to overwrite its own build image. An attacker with the ability to read the container credentials from the meta-data service or run commands within the container could thereby overwrite the container to gain persistence within the C…
P0
2023-02-23 00:00 UTC
Security Journalism
Security Journalism
What Endpoint Detection and Response (EDR) Looks Like | Huntress
We’re going to try to cut through the noise and shed some light on EDR to understand the variance, capability, and efficacy of EDR solutions in the market.
P0
2023-02-21 00:00 UTC
Security Journalism
Security Journalism
Built-in macOS Security Tools | Huntress
We discuss some of our favorite and most interesting built-in macOS security tools.
P0
2023-02-20 09:52 UTC
Other
Other
Bad Behaviour: How to detect banking trojans
Mobile banking users are being manipulated by attackers to authorize fraudulent transactions. Learn what financial service providers can do to render these organized crimes powerless.
P0
2023-02-17 07:57 UTC
Other
Other
Package deal: Malware bundles causing disruption and damage across EMEA
What happens when you combine ransomware with information stealers, remote access Trojans, and other malware in one easy-to-download package?
P15
2023-02-15 00:00 UTC
Other
Other
Azure AD B2C cryptographic flaw allowing account compromise
Azure Active Directory B2C service (AD B2C) mistakenly implemented RSA key authentication using the public part of the key pair instead of the private one. This cryptographic flaw could have allowed an unauthenticated attacker to craft an OAuth refresh token for any AD B2C user account if they knew their public key. Moreover, every AD B2C user's public key was recoverable through an unrelated vulnerability (though asymmetric cryptography should not rely on public key secrecy regardless). An att…
P0
2023-02-14 00:00 UTC
Other
Other
AWS EC2 Autoscaling Privilege Escalation Vulnerability
A privilege escalation vulnerability in Amazon EC2 Autoscaling was identified. The CreateLaunchConfiguration action lacked PassRole validation, allowing users to launch EC2 instances with unauthorized roles. AWS fixed the issue for both CreateLaunchConfiguration and CreateAutoScalingGroup actions, implementing proper PassRole validation when using the instance-id option.
P10