Explore the recent disclosures concerning Volt Typhoon, a threat actor engaged in the widespread exploitation of external-facing services and network appliances.
Threat actors in possession of IAM active credentials that had the power to update S3 bucket policies could have bypassed GuardDuty’s S3 detections and silently updated permissions for S3 resources, resulting in a bucket configuration that allowed anonymous data access. This gap in GuardDuty’s alert coverage occurred only when S3’s Block Public Access was not enabled on the account or the bucket, and when KMS-based server-side bucket encryption was not in use. In order to trigger on opening pub…
Google users can find and install third-party OAuth applications from Google Marketplace that are integrated with Google Workspace. Each OAuth application client in Google is associated with a GCP project. A bug in the way a GCP project enters a "pending deletion" state when deleted, could have allowed threat actors to make a malicious application invisible and unremovable from the user's account. If an attacker had managed to install an application in an account (e.g., through a phishing attac…
We unravel an investigation that details one way threat actors are able to gather cleartext passwords via NPPSPY.
Huntress discovered threat actors abusing a blind SQL injection vulnerability in BillQuick Web Suite. Follow our analysis and latest findings in this blog.
The analysis of phishing campaigns carried out by a new threat actor
The success of enterprise ransomware attacks has motivated more and more threat actors to join the game.
How the hacker group MuddyWater attacked a Turkish manufacturer of military electronics
Group-IB has exposed the attacks committed by Silence cybercriminal group.
Group-IB has uncovered a hacker group attacking banks in the USA and Russia
Group-IB reveals the identity of alleged members of the Islamic hacker group United Islamic Cyber Force
