On 2022-07-18, an incident was reported, involving an unknown actor, gaining initial access via Cloud native misconfig, to achieve Supply chain attack, Denial of wallet.
Learn about Huntress’ Neighborhood Watch Program: a collection of programs and resources designed to help elevate the broader security community.
Several models of SINAMICS PERFECT HARMONY GH180 Drives are affected by a DHCP client vulnerability (CVE-2021-29998) in the integrated SCALANCE X206-1 device. The vulnerability could allow an...
Multiple vulnerabilities were found in SIMATIC WinCC that ultimately could allow local or remote attackers to escalate privileges and read, write or delete critical files. Siemens has released...
On 2022-07-11, a campaign was reported, involving Bondnet, gaining initial access via Password attack, targeting Microsoft SQL Server to achieve Resource hijacking.
On 2022-07-07, a campaign was reported, involving 8220 Gang, gaining initial access via 1-day vulnerability, to achieve Resource hijacking.
Firmware analysis is an essential part of security research and targeted search for vulnerabilities in IoT products. This article examines conventional methods of dynamic analysis and some less...
Learn about four of the most prominent attacker evasion techniques that hackers use—and how you can defend your environments against them.
Group-IB’s platform allows organizations to overcome cyber risks
Support for Alibaba Cloud follows just weeks after launch of Oracle Cloud Infrastructure (OCI) integration, providing organizations the broadest coverage of any cloud native application protection...
Read how our ThreatOps team used Huntress Managed EDR and Managed Antivirus to stop bad actors who were exploiting Log4Shell vulnerabilities.
A previously unknown Chinese-speaking threat actor attacking telecommunications, manufacturing, and transport organizations in several Asian countries. The group exploits MS Exchange vulnerability...
Hunting the latest TTPs used for delivering the Trojan
Enhance your organization's security posture with our Diversity Security Awareness Training content. Explore engaging modules designed to foster inclusivity while equipping your team with...
An LNK file is a Windows Shortcut that serves as a pointer to open a file, folder, or application. LNK files are based on the Shell Link binary file format, which holds information used to access...
On 2022-06-21, a campaign was reported, involving DarkRadiation operator, gaining initial access via Unknown, while using Database ransomware, Disk Wipe, Remotely execute commands or scripts on a...
Dive into the types of threats we’ve thwarted with Managed Antivirus and how IT teams are seeing more value from making the switch.
SIMATIC WinCC OA implements client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could...
OpenWRT, an open source firmware solution for home routers, was breached exposing the email addresses of many of its forum users.
OpenWRT, an open source firmware solution for home routers, was breached exposing the email addresses of many of its forum users.
Learn about the latest platform changes and updates as Huntress continues to scale to protect the 99%.
Nikita Rostovtsev on current cyber threats and his profession
Unsecured public-facing database allowed anyone to access ID selfies for months
Register for our 2022 Google Cloud Summit series, and be among the first to learn about new solutions across data, machine learning, collaboration, security, sustainability, and more. You’ll hear...
This blog dives into triangulation as a guiding concept during investigations and reporting.
Products that include the Siemens PROFINET-IO (PNIO) stack in versions prior V06.00 are potentially affected by a denial of service vulnerability when multiple legitimate diagnostic package...
SINEMA Remote Connect Server is affected by multiple vulnerabilities, including A cross-site scripting vulnerability in an error message pop up window (CVE-2022-29034) Several authentication...
Siemens has released updates for JT2Go, Solid Edge and Teamcenter Visualization to fix multiple file parsing vulnerabilities. If a user is tricked to open a malicious file (crafted as PDF, DXF or...
A vulnerability in Spring Framework was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2022-22965 and is...
The products listed below contain a vulnerability that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to...