Huntress is tracking a critical ransomware incident affecting MSPs and their customers, caused by a sophisticated Kaseya VSA supply chain attack.
Deep Dive into Prolific RaaS Affiliates' TTPs
Huntress is aware of PrintNightmare, a critical RCE and local privilege escalation vulnerability. This serious security flaw affects many Windows servers.
Under certain conditions, an attacker can flood DHCP packets to the victim VM, allowing it to impersonate the Metadata server, and grant themselves SSH access.
Providing cybersecurity services involves some risk and liability. Learn why managed detection and response could be the key to lowering your cyber risk.
Dive into a threat analysis with us as we dissect a PowerShell command with an environmentally keyed malware payload.
A privilege escalation vulnerability was discovered in Google's Dialogflow cloud platform. When downgrading a user's role from Developer to Reviewer, the permissions were not properly updated, allowing the user to retain Developer-level access. This issue persisted in the Google Cloud Console, where role changes resulted in additive permissions instead of replacements.
Today’s hackers know how to outsmart automation and evade detection. Learn how managed threat detection and response can help you fight back.
Our ThreatOps team details stumbling across Raccine, a ransomware remedy that works by hooking onto IFEO debuggers, for the first time.
Attribution secrets: Who is behind stealing credentials and bank card data by asking to install fake Flash Player, browser or font updates?
An adversary could gain access to IAM credentials in a victim's account, and make an API request to Elastic Beanstalk (even if they didn't have the proper IAM permissions). This request would be displayed in the management console in the Elastic Beanstalk section. Due to improper sanitization, an attacker could insert an XSS payload that would execute in a victim's browser.
In this testimonial, learn firsthand from one of our Security Awareness Consultants at Curricula about how a fake IRS phishing scam worked on one student.
Azure forces the install of an agent on Linux VMs, which contained a vulnerability that would grant root RCE if an attacker could send a web request to them. Initially, Microsoft did not update the agent automatically, and so customers had to patch manually, but a few days later they began patching some services remotely.
An in-depth look at the differences between AV, NGAV and EDR. We’ll explore the promises endpoint protection tools make vs. their ability to keep them.
SMBs need more advanced cybersecurity. Learn about the tools you need to help guide your clients toward better threat detection and response.
Explore the impact of ransomware on cybersecurity insurance. Learn how insurance providers are adapting and what organizations need to know to stay protected.
Join us for a threat hunting adventure as we analyze a suspicious run key that leads us to Cobalt Strike malware hidden across nearly 700 registry values.
President Biden signed a 34-page Executive Order aimed at strengthening the nation’s cybersecurity standards. Here are the top seven takeaways.
An analysis of the BlackCat ransomware affiliate program
As hackers get smarter, you must evolve your approach to threat detection and response. Learn how to protect your clients with threat intelligence tools.
The year four report covers 2020 and aims to highlight the achievements and efforts made by the Active Cyber Defence programme.
Group-IB specialists detected GrelosGTM group started to abuse Google Tag Manager legitimate functionality for their own purposes in infections of online shops.
We’ve been focused on expanding our platform and helping you better protect your customers. And we’re just getting started.
In this blog, we look at some malicious PowerShell code breadcrumbs that one hacker left behind to unravel how they maintained access during a cyberattack.
A vulnerability in AWS Cognito's password reset function allowed attackers to brute-force the six-digit reset code, potentially leading to account takeovers. Using concurrent HTTP requests, an attacker could make up to 1587 guesses instead of the documented limit of 20. The issue affected accounts without multi-factor authentication and was fixed by AWS on April 20, 2021.
Are you ready to scale your MSP or SMB? Level up your threat detection and response so you can focus on what's important: your business.
Back in action with JS sniffers redesigned to steal crypto
