2020-12-29 00:00 UTC
Security Journalism
Security Journalism
Redefining Beta | Huntress
At Huntress, beta means learning. Our goal is to accelerate and streamline security defense, which means releasing what we’re working on often.
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 5,283 matching records.
AUTO-POLL // 2026-10-21 12:35 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P7 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 21
RANSOMWARE
P7
COOL // 32 ARTICLES
TUE
Oct 20
RANSOMWARE
P2
COOL // 63 ARTICLES
MON
Oct 19
RANSOMWARE
P3
COOL // 51 ARTICLES
SUN
Oct 18
RANSOMWARE
P2
COOL // 8 ARTICLES
SAT
Oct 17
ACTIVE EXPLOITATION
P4
COOL // 12 ARTICLES
FRI
Oct 16
RANSOMWARE
P8
COOL // 56 ARTICLES
THU
Oct 15
ACTIVE EXPLOITATION
P7
COOL // 87 ARTICLES
2020-12-23 09:19 UTC
Other
Other
New attacks by UltraRank group
As part of UltraRank's new campaign, Group-IB Threat Intelligence team discovered 12 eCommerce websites infected with their JavaScript-sniffer.
P0
2020-12-22 00:00 UTC
Security Journalism
Security Journalism
Top Hacker Tradecraft That Caught Our Eye in 2020 | Huntress
We take a look back at some of the more interesting — and innovative — hacker tradecraft we saw over the course of 2020.
P0
2020-12-20 00:00 UTC
Other
Other
AWS SOC 2 type 2 failure (Fall 2020)
Information about this issue is under NDA, but AWS customers can read about it on pages 120-121 of the report, which is available for download through AWS Artifact. Note: This issue is outside the scope of this database's usual criteria for inclusion, but has been kept for historic reasons, as it was included in the original CSP Security Mistakes dataset.
P0
2020-12-17 00:00 UTC
Security Journalism
Security Journalism
Annual Security Awareness Training is a Waste of Time | Huntress
Annual security awareness training is a waste of time. We discuss why an ongoing security awareness program is required to protect against cyber threats.
P0
2020-12-14 00:00 UTC
Security Journalism
Security Journalism
Supply Chain Exploitation of SolarWinds Orion Software | Huntress
Huntress covers the breaking news about Solarwinds’ Orion platform being exploited as part of a coordinated attack to distribute malware.
P0
2020-12-07 09:23 UTC
Other
Other
The footprints of Raccoon
A story about operators of JS-sniffer FakeSecurity distributing Raccoon stealer
P0
2020-12-02 00:00 UTC
Security Journalism
Security Journalism
Rapid Response: TrickBoot | Huntress
TrickBot has unleashed yet another module in its growing arsenal specifically targeting firmware vulnerabilities, named TrickBoot.
P0
2020-11-27 00:00 UTC
Security Journalism
Security Journalism
I Have a Lot to be Thankful for in 2020
Huntress CEO Kyle Hanslovan has a lot to be thankful for in 2020 — and it starts with the MSP community.
P0
2020-11-24 00:00 UTC
Security Journalism
Security Journalism
Tried and True Hacker Technique: DOS Obfuscation | Huntress
In this blog, we dissect a sample of malware that makes clever use of batch scripting obfuscation—turns out it was a launcher for TrickBot!
P0
2020-11-22 00:00 UTC
Other
Other
GCP Default compute account is project Editor
When the compute API is enabled on a GCP Project, the default compute account is created. This account gets the primitive role Editor assigned by default, which allows for a wide variety of privilege excalation and resource abuse in the project. Especially, all new VMs created inherit this permissions by default. This issue is arguably a technical decision by GCP, but the documents advise customers to undo this.
P0
2020-11-22 00:00 UTC
Other
Other
IAM privilege escalation in multiple GCP services
Composer, Dataflow, Dataproc, Dataprep and Data Fusion all used the Compute Engine default service account by default and relied on product-level IAM permissions without requiring the iam.serviceAccount.actAs permission, meaning that users of these services could elevate their privileges. Following disclosure, GCP changed these services to require this permission.
P10
2020-11-20 13:34 UTC
Other
Other
P0
2020-11-18 00:00 UTC
Security Journalism
Security Journalism
Huntress Service: Partner Enablement | Huntress
Even the best cybersecurity tools won’t configure and sell themselves. That's why we're thrilled to introduce a new Huntress service: Partner Enablement!
P0
2020-11-12 00:00 UTC
Other
Other
SSRF in Google Cloud Monitoring
An SSRF bug in Google Cloud Monitoring's uptime check feature could have been used to leak the authentication token of the service account used for these checks. The issue was resolved but later bypassed by Omar Espino (@omespino), requiring another fix.
P0
2020-11-01 13:38 UTC
Other
Other
Big Game Hunting: Now in Russia
Top Russian companies and banks under attack from OldGremlin - a group controlling TinyCryptor ransomware
P15
2020-10-22 00:00 UTC
Security Journalism
Security Journalism
Cybersecurity Lessons We Learned from hack_it 2020 | Huntress
A recap of hack_it 2020, a virtual security training event packed with interactive exercises, malware research and analysis, and more.
P0
2020-10-19 00:00 UTC
Other
Other
Route table modification to imitate metadata service
An attacker with sufficient privileges in AWS to modify the route table and some other EC2 privileges, could pretend to be a metadata server and provide an attacker controlled bootup script to EC2s to move laterally.
P0
2020-10-17 00:00 UTC
Other
Other
AI Hub Jupyter Notebook instance CSRF
AI Hub Jupyter Notebook server lacked a check of the Origin header that led to a CSRF vulnerability. An attacker could have read sensitive data and execute arbitrary actions in customer environments.
P0
2020-10-17 00:00 UTC
Other
Other
Enumeration of Privileges Without Being Logged to CloudTrail
An attacker who gained access to IAM credentials could enumerate a subset of the privileges they had access to without logging to CloudTrail. This would allow them to perform the typically noisy permission enumeration process undetected.
P0
2020-10-15 00:00 UTC
Other
Other
Lack of internal change controls for IAM managed policies
AWS have released or changed managed IAM policies in unexpected and insecure ways. Examples include: CheesepuffsServiceRolePolicy, AWSServiceRoleForThorInternalDevPolicy, AWSCodeArtifactReadOnlyAccess.json, AmazonCirrusGammaRoleForInstaller. The worst being the ReadOnlyAccess policy having almost all privileges removed and unexpected ones added.
P0
2020-10-10 13:41 UTC
Other
Other
Group-IB Fraud Protection (ex. Fraud Hunting Platform)
Keeping user digital identity safe
P0
2020-10-06 00:00 UTC
Other
Other
Multiple issues in AWS IAM Authenticator for Kubernetes
Amazon Elastic Kubernetes Service (EKS) uses IAM to provide authentication to the cluster through the AWS IAM Authenticator for Kubernetes (aws-iam-authenticator). Multiple issues were identified in the authenticator that could have allowed exploitation, namely (1) a lax regular expression used to verify presigned URLs; (2) HTTP client redirect follow (due to using Golang HTTP client in its default configuration); (3) use of the Golang URL.Query function (which silently drops parameters that Go…
P0
2020-10-01 00:00 UTC
Other
Other
Google Cloud Shell XSS to RCE Vulnerability
A vulnerability in Google Cloud Shell allowed escalation from XSS to full instance takeover as root. The attack exploited an XSS in the markdown preview functionality to read sensitive files, obtain the instance's private key and hostname, and gain SSH access as root. The issue affected the Eclipse Theia-based editor used in Cloud Shell.
P15
2020-09-28 00:00 UTC
Other
Other
Encryption SDK vulnerabilities
AWS KMS and all versions of AWS Encryption SDKs prior to version 2.0.0 were susceptible to information leakage (an attacker could create ciphertexts that would leak the user’s AWS account ID, encryption context, user agent, and IP address upon decryption), ciphertext forgery (an attacker could create ciphertexts that were accepted by other users) and lack of robustness (an attacker could create ciphertexts that decrypt to different plaintexts for different users).
P0
2020-09-28 00:00 UTC
Other
Other
S3 bucket tagging not restricted
Lack of the privilege s3:PutBucketTagging did not restrict the ability to tag S3 buckets.
P0
2020-09-25 00:00 UTC
Other
Other
CloudFormer review
An audit of an AWS open-source project identified a great deal of issues, and as a result AWS made the decision to take it down.
P0
2020-09-22 00:00 UTC
Other
Other
CloudFormation resource provider credentials leak
CloudFormation allows the use of Lambda-backed resource providers, wherein Lambda can be used to write custom provisioning logic to be executed during CloudFormation stack operations. The aforementioned Lambda functions were executed in an AWS-managed account (thus effectively allowing arbitrary code execution in that account), and were passed a set of credentials ("platformCredentials") for a role in this account that had several EventBridge permissions. These were sufficient for an attacker t…
P0
2020-09-17 00:00 UTC
Security Journalism
Security Journalism
Phishing, Office 365 and the Commercialization of Cybercrime | Huntress
Hackers getting better at their tradecraft and their skills are becoming more and more accessible to other bad actors via the Dark Web.
P0
2020-09-15 00:00 UTC
Other
Other
Timing attack with Lambda and CloudWatch Synthetics
The immutability of Lambda versions could be violated via a timing attack against CloudWatch Synthetics canaries.
P0