LATEST

Introducing Group-IB Prevyn AI

How Group-IB is building a cognitive core that anticipates threats before they happen

Project Glasswing: what Mythos showed us

In recent weeks, we pointed Mythos and other security-focused LLMs at live code across critical parts of our infrastructure. We share what we observed, the models’ strengths and weaknesses, and what the work around them needs to look like before any of it can scale.

19 Cloud Security Challenges and How to Mitigate Risk | Huntress

Learn about some of the most common cloud security challenges facing modern businesses today, plus why it matters for you and your employees.

Welcome to BlackFile: Inside a Vishing Extortion Operation

Written by: Austin Larsen, Tyler McLellan, Genevieve Stark, Dan Ebreo Introduction Google Threat Intelligence Group (GTIG) has continued to track an expansive extortion campaign by UNC6671, a threat actor operating under the "BlackFile" brand, that targets organizations via sophisticated voice phishing (vishing) and single sign-on (SSO) compromise. By leveraging adversary-in-the-middle (AiTM) techniques to bypass traditional perimeter defenses and multi-factor authentication (MFA), UNC6671 gain…

What Is an Incident Response Retainer? (And Why Waiting Until a Breach Is Too Late)

An incident response retainer gives organizations immediate access to cybersecurity experts when a breach occurs, without losing critical time to legal, procurement, or onboarding delays. This article explains how IR retainers work, the different retainer models available, and why they can significantly reduce downtime, damage, and uncertainty during a cyber incident.

Digital Brand Protection in Cybersecurity: Why It Matters in 2026

Digital brand protection helps organizations detect and disrupt external threats, such as phishing sites, fake social profiles, counterfeit listings, and leaked credentials, before they become customer-facing fraud or reputational damage.

Why geopolitical turmoil is a gift for scammers, and how to stay safe

Conflict is a boon for opportunistic fraudsters. Look out for their ploys.

What Is Single Sign-On? The Practical Guide | Huntress

Learn what single sign-on (SSO) login is, how it’s used in role management and cybersecurity, and how to set it up at your organization.

[Màj] Vulnérabilité dans Microsoft Exchange Server (15 mai 2026)

[Mise à jour du 11 juin 2026] Le 9 juin 2026, Microsoft a publié des versions correctives. [Publication initiale] Le 14 mai 2026, Microsoft a publié un avis de sécurité concernant la vulnérabilité CVE-2026-42897 affectant Exchange Server. Elle permet à un attaquant non authentifié de provoquer...

Strong Stack. Strong Team. Real Security Resilience.

Learn how to build a resilient security stack and program that cuts alert noise, strengthens identity defense, and helps teams respond faster.

Cisco Catalyst SD-WAN Manager Vulnerabilities

Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow a remote attacker to gain access to sensitive information, elevate privileges, or gain unauthorized access to the application. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. Cisco strongly recommends that customers upgrade to…

Cisco Crosswork Network Controller and Cisco Network Services Orchestrator Advisory

Following the initial publication of the Security Advisory about a denial of service (DoS) condition in Cisco Crosswork Network Controller and Cisco Network Services Orchestrator (NSO), additional information has been made available to the Cisco Product Security Incident Response Team (PSIRT). Upon further analysis, the Cisco PSIRT has reclassified this issue as a customer-configurable, resource management issue rather than a security vulnerability. This advisory is available at the following l…

Panic at the Distro

Learn how critical Linux kernel flaws in CopyFail, Dirty Frag, and Fragnesia let unprivileged users escalate to root access. See what security teams can do to remediate.

FrostyNeighbor: Fresh mischief and digital shenanigans

ESET researchers uncovered new activities attributed to FrostyNeighbor, updating its compromise chain to support the group’s continual cyberespionage operations

CMMC Final Rule: A Guide for DoD Subcontractors

CMMC final rule requires DoD subs meet Level 2 by Nov 2026. Huntress Managed SIEM provides vendor docs and 24/7 monitoring for compliance.

How Huntress Managed ITDR's New Incident Report Timeline | Huntress

Learn how the Incident Report Timeline within Huntress Managed ITDR offers clear, chronological insights, enabling a decisive response to incidents.

The French 2-Step: Exposing a Multi-stage Scam Targeting the National Railway Company in France

This highly targeted scam scheme uses advanced phishing and social engineering cues, rely on brand recognition, event-based campaigns and emotional manipulation to defraud victims twice.

Security Alert: Microsoft Releases May 2026 Security Updates

What’s New in Android Security and Privacy in 2026

New Android security and privacy features

Android’s Agentic Future: Building Gemini Intelligence on a Foundation of Security & Privacy

Gemini Intelligence security and privacy principles

Huntress × Acrisure Cyber Insurance Program

The Huntress × Acrisure Cyber Insurance Program now simplifies cyber insurance. Get streamlined coverage and a $0 deductible on Tech E&O or Cyber policies when using Managed EDR and Managed ITDR.

How EvilTokens Turbocharges Old School Phishing with AI

Device code phishing doesn't need stolen passwords or malware—just a legitimate auth flow. Learn how EvilTokens weaponized AI to run this attack across 344 organizations.

Eyes wide open: How to mitigate the security and privacy risks of smart glasses

Smart glasses allow anyone to track and record the world around them. That could put your data and the privacy of those nearby at risk.

Influence Operations Bulletin Q1 2026

This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2026. It was last updated on March 31, 2026.JanuaryWe terminated 40 Yo…

Group-IB Digital Risk Protection Integrates with Google SecOps: Brand Threat Intelligence, Now In Your SOC

Threat Actors Weaponize Tiflux RMMs in Malspam Attacks

We dug into a recent malspam campaign that involved an installer for a commercially sold remote monitoring and management (RMM) tool called Tiflux.

Meet Andrea Colon, Restoring Peace of Mind in a Paranoid Digital World

An interview with Huntress Account Executive Andrea Colon about the emotional toll of a cyber breach on small businesses and the company's mission to restore peace of mind.

How Cloudflare responded to the “Copy Fail” Linux vulnerability

When a critical Linux kernel privilege escalation was publicly disclosed, Cloudflare's security and engineering teams detected, investigated, and mitigated the threat across our global fleet, confirming zero customer impact and no malicious exploitation.