On 2023-08-15, an incident was reported, involving an unknown actor, gaining initial access via 0-day vulnerability, while using SSM orchestration abuse, Cron persistence, IMDS abuse, targeting...
On 2023-08-15, an incident was reported, involving an unknown actor, gaining initial access via ,. The following tools were observed: linPEAS.
On 2023-08-15, a campaign was reported, involving 0ktapus, gaining initial access via Unknown, while using Azure Run Commands abuse, with unknown impact.
Uncover the disruptive nature of Gigabud malware and take proactive measures to mitigate the associated risks
The Huntress team investigated a ransomware attack of a new INC Ransom threat actor group. Here is the activity we observed.
Patterson Cake // When it comes to M365 audit and investigation, the “Unified Audit Log” (UAL) is your friend. It can be surly, obstinate, and wholly inadequate, but your friend […] The post...
In this part we present information on the four types of implants and two tools used during the last (third) stage of the attacks discovered.
On 2023-08-10, a campaign was reported, involving an unknown actor, gaining initial access via 1-day vulnerability, targeting SugarCRM. The following tools were observed: Pacu, ScoutSuite.
We’ve entered the era of identity security. Are you ready? Explore how to counter evolving threats and protect identities with confidence.
Researchers also disclosed a separate bug called "Inception" for newer AMD CPUs.
Discover how Huntress caught an attempted business email compromise (BEC) scam that would have cost the company more than $100,000 had it gone undetected.
Wiz is the #1 cloud security company on the list and one of the biggest movers from last year, alongside OpenAI. What an honor!
Discover how today's businesses can conquer security challenges, strengthen defenses and evolve their security beyond traditional antivirus measures.
Mitigating factors include typing style, multi-case passwords, uncommon laptops.
COVID's impact still resonates. Remote work, AI, and a turbulent economy have made the future unpredictable, including the future of cloud security. But we still have best practices for you! Let's...
Shining a Light on the Hidden Tactics and Techniques Employed by DarkGate
Welcome to the world of hacktivism, where technology and activism collide. Verifying and researching hacktivist claims can be a challenging and time-consuming endeavour. The sheer volume of claims...
Huntress is tracking a new PaperCut vulnerability, CVE-2023-39143, which allows full remote code execution on unpatched servers.
Authored by SangRyol Ryu, McAfee Threat Researcher We live in a world where advertisements are everywhere, and it’s no surprise... The post Invisible Adware: Unveiling Ad Fraud Targeting Android...
Fighting cybercrime is more effective when we work together. Find out more about how you can work with Group-IB to document emerging threats.
Analysis of a highly active hacktivist group with global reach
The wealth of data available on the internet and the infinite potential that it has to offer requires much diligence and technique to unlock. This is where ‘Web Crawling’ and ‘Web Scraping’ come...
Dive into how Huntress caught a threat actor adding several legitimate email apps to maintain persistent access to a compromised Microsoft 365 environment.
Authored by: Lakshya Mathur and Yashvi Shah As the Back-to-School season approaches, scammers are taking advantage of the opportunity to... The post The Season of Back to School Scams appeared...
Wiz protects AI infrastructure against cloud attacks, allowing data scientists and engineers to focus on deploying more AI applications.
In the early hours of 3 July, 2023, Israel launched a major military operation in the Jenin refugee camp, reportedly one of the largest conducted in the West Bank since 2002. Multiple videos...
Discover the key phases of the threat hunting process and how threat hunters structure their hunts to proactively seek out threats.
LeetSwap is a decentralized token exchange. It's a fork of Solidly. In Solidity, private and internal functions are started with an _ (underscore) by convention. In practice, the visibility is the...
Curve Finance is a central protocol within the DeFi ecosystem. The protocol was written in the Vyper language because of its gas efficiency. Most people assumed that the exploits were due to a...
In the world of security, the dominant approach to branding is often based on fear and intimidation. But at Wiz, we're taking a different approach. We believe in the power of optimism and...