2022-10-19 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
In September 22', SOCRadar discovered an insecure public Azure blob storage owned by Microsoft (olyympusv2.blob.core.windows[.]net). This blob storage was used for storing emails and other documents from interactions with their customers (such as contracts and purchase orders). In total, the blob storage contained 2.4TB of data with information concerning thousands of Microsoft customers across dozens of countries, dated between 2017 and August 22'. Following disclosure, Microsoft reconfigured …
P0
2022-10-18 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
We’ve got a problem in cybersecurity that needs to be addressed—and it has to do with accessibility to women.
P0
2022-10-17 14:19 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
With well-set digital marketing campaigns and professional call-centres
P0
2022-10-11 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Service Fabric Explorer (SFX) is a tool for inspecting and managing Azure Service Fabric clusters. An attacker with existing access to a "Deployer" type user with CreateComposeDeployment permissions in a given cluster could create a malicious application with a specially-crafted name. This would lead to client-side template injection (CSTI) and storing a malicious XSS payload in a dashboard shared between users of the same cluster. If a victim user with administrative permissions logged into th…
P0
2022-10-11 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Azure Arc allows customers to connect on-premises Kubernetes clusters to Azure. This is facilitated by middleware (the Azure Arc-enabled Kubernetes agent) which includes a "cluster connect" feature in the form of a reverse proxy. A vulnerability in this feature could allow an unauthenticated user to elevate their privileges and potentially gain remote administrative control over any Azure Arc-enabled cluster, as long as they know its randomly generated external DNS endpoint. Azure Stack Edge de…
P10
2022-10-04 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Our workshop dedicated to hacker tradecraft is back November 14-16. Mark your calendars, sign up today and don't forget your hacker hat!
P0
2022-09-29 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
The Huntress team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers, piggybacking on ProxyShell and ProxyLogon.
P25
2022-09-28 14:13 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
How Group-IB Attack Surface Management ensures full mastery of your external attack surface
P0
2022-09-27 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Bug bounty programs are everywhere for enterprise organizations. But where does that leave the 99%—those under-resourced small to mid-sized businesses?
P0
2022-09-20 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Any unattached storage volume, or attached storage volumes allowing multi-attachment, could have been read from or written to as long as an attacker knew their Oracle Cloud Identifier (OCID), allowing sensitive data to be exfiltrated or even more impactful attacks to be initiated via executable file manipulation in the target tenant's environment.
P0
2022-09-20 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
An issue in Azure Cloud Shell could have allowed an attacker to take over an Azure App Service domain and leverage it to inject and execute commands in other tenants' terminals if they navigated to the domain while logged into their account. Using this method, an attacker could query the Azure IMDS on other tenants' behalf and thereby obtain their access tokens.
P0
2022-09-20 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Protecting your servers just isn’t enough to keep bad actors out. Protecting the workstation is often an overlooked but critical step to security.
P0
2022-09-13 12:11 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Hackers use the browser-in-the-browser technique to steal Steam accounts
P0
2022-09-13 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Read about our journey to unravel a PowerShell reverse shell—and how our Managed EDR feature tipped us off that something wasn’t right.
P0
2022-09-01 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Azure Synapse Analytics is an analytics service for processing data using various runtimes, among them Apache Spark. Synapse provided users the capability to mount Azure File Shares to their Apache Spark Pools via a script called filesharemount.sh that would execute with elevated privileges. This script would mount the File Share to the /synfs directory. There was a race condition in the script where, if successfully exploited, a user could execute the chown command to change the ownership of a…
P0
2022-08-30 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Discover how Process Insights brings new managed EDR functionality to The Huntress Managed Security Platform to help you detect cyberattacks as they happen.
P0
2022-08-25 09:02 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Over 130 organizations have been compromised in a sophisticated attack using simple phishing kits
P0
2022-08-23 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
Learn how Progressive Computing fought through a mass-scale attack and came out on the other side scarred, but wiser and stronger.
P0
2022-08-19 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
Amazon SNS' signature validation in the official SDK relied on a weak regex for default AWS certificate locations, that would incorrectly match an S3 bucket named `sns`. This bucket happened to be publicly readable and writeable, allowing an attacker to forge messages to any user of the official SDK SNS validator.
P0
2022-08-18 08:48 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
4 malicious campaigns, 13 confirmed victims, and a new wave of Cobalt Strike infections
P0
2022-08-17 12:14 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Links between ATMZOW JS-sniffer and Hancitor
P0
2022-08-17 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
A critical vulnerability in GitLab's GitHub import feature allows remote code execution. The issue stems from improper handling of Sawyer::Resource objects, enabling injection of Redis commands. This can be escalated to execute arbitrary bash commands on the SaaS managed service as well as self-hosted GitLab servers, potentially leading to full system compromise.
P25
2022-08-16 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
We unravel an investigation that details one way threat actors are able to gather cleartext passwords via NPPSPY.
P0
2022-08-12 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
The @actions/core package had a delimiter injection vulnerability in the exportVariable function. Attackers could use a known delimiter to break out of a specific variable and assign values to other arbitrary variables. This may have allowed modification of path or environment variables without the intention of workflow or action authors.
P0
2022-08-11 15:39 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
Detecting MaliBot, a fresh Android banking trojan, with a Fraud Protection solution
P0
2022-08-11 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
In GCP's case, they introduced a modification to the Cloud SQL's PostgreSQL engine allowing the role assigned to the tenant (cloudsqlsuperuser) to arbitrarily change the ownership of a table to any user or role in the database. Thus, an attacker could (1) create a new table, (2) create an index function with a malicious payload, and (3) change the table owner to GCP’s superuser role (cloudsqladmin). Next, by initiating an ANALYZE command, the malicious function is executed with GCP’s superuser …
P10
2022-08-10 00:00 UTC
Other
Cloud Vuln DB · indexed 2026-09-07 17:30 UTC
A vulnerability was discovered in Cloud Shell that enabled command injection and remote shell access. By manipulating the "project" parameter, an attacker could have cause an unencoded Python script execution flaw. Exploiting this flaw, they could inject a command to display the contents of the "/etc/passwd" file, successfully execute arbitrary commands and obtain remote shell access. However, the impact of this is unclear, as an attacker would seemingly only be able to gain such a remote shell…
P0
2022-08-09 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
This blog explores phishing and smishing, diving into how to analyze text messages for their validity and legitimacy.
P0
2022-08-02 00:00 UTC
Security Journalism
Huntress · indexed 2026-09-07 17:30 UTC
We founded Huntress with a commitment to elevating the cybersecurity community as a guiding principle. Here are some of the ways we strive to make a difference.
P0
2022-07-29 08:54 UTC
Other
Group-IB · indexed 2026-09-07 17:30 UTC
How we almost got rich
P0
