Attackers are scanning for vulnerable Microsoft Exchange servers and abusing the latest line of Exchange vulnerabilities that were patched in early 2021.
A security researcher discovered that a secret FBI’s terrorist watchlist was accidentally exposed on the internet for three weeks between July 19 and August 9, 2021. The security researcher Bob...
Join us on a threat analysis journey as we discover a very shady Python—and a very friendly RAT.
How we make Tailored Threat Intelligence
Co-written by Catherine Huang, Ph.D. and Abhishek Karnik Artificial Intelligence (AI) continues to evolve and has made huge progress over the last decade. AI shapes our daily lives. Deep learning...
What can we learn from studying cybercriminals? Here’s a brief history of how hackers are evolving their tradecraft and attack tactics.
Siemens has released version V13.2.0.1 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read files in different file formats (CGM,...
Siemens has released a new version for Solid Edge that fixes three vulnerabilities - an XML external entity (XXE) injection, and two file parsing issues which could be triggered when the...
The Video Server application in SiNVR/SiVMS solutions contains five vulnerabilities involving information disclosure (CVE-2019-19291, CVE-2019-19299), path traversal (CVE-2019-19296,...
Written by: Lakshya Mathur Excel-based malware has been around for decades and has been in the limelight in recent years. During the second half of 2020, we saw... The post XLSM Malware with...
At Black Hat on Wednesday, Wiz researchers disclosed a vulnerability in DNS hosting services that affects millions of corporate endpoints.
AWC joins illicit carding business by offering 1 Mln compromised cards for free
Security researchers from the threat hunting and intelligence company Group-IB have revealed that in 2020, at least two espionage groups from China targeted the Russian Federal authorities....
Stephan Borosh // The year of 2021 has presented some interesting challenges to securing Windows and Active Directory environments with new flaws that Microsoft has been slow to address. In June,...
The story behind the BlackMatter ransomware strain
The key to success for Campo Loader, Hancitor, IcedID, and QBot
Learn about the costs of cybersecurity—and the risks of not having the right security stack—in this blog.
Last November, Wiz Research mapped all the services in AWS that allow access from other accounts to see if any of them might inadvertently expose customers and discovered 3 vulnerabilities in...
Wiz CTO Ami Luttwak discusses a new class of vulnerabilities discovered by Wiz Research, which exposed valuable dynamic DNS data from millions of endpoints worldwide.
Using the Windows Remote Procedure Call (RPC) interface is an interesting concept when conssidering the fact that it allows you to call functions, over the network in a remote process. I wanted to...
Chinese APTs attack Russia
Line, a popular Japanese messaging app with over 84 million monthly users, was breached resulting in the compromise of over 100 accounts belonging to Taiwanese political figures.
Line, a popular Japanese messaging app with over 84 million monthly users, was breached resulting in the compromise of over 100 accounts belonging to Taiwanese political figures.
Phew! This year’s hacker summer camp is packed with presentations from several hackers across the globe at Orange Cyberdefense. I can’t possibly go into all of the many details, but hope to give a...
Dive into Breached DB section
Co-written with Northwave’s Noël Keijzer. Executive Summary For a long time, ransomware gangs were mostly focused on Microsoft Windows operating... The post Babuk: Biting off More than they Could...
The Huntress team recaps what happened during the Kaseya VSA supply chain attack—and what we can learn from it.
We teamed up with our partners at Magna5 to talk about providing real-time prevention, detection and response.
Fraud-as-a-Service operation targeting Dutch residents
Guess has issued a breach notification to customers that were impacted by a ransomware attack that occurred in February.