LATEST

How to Eat an Entire Elephant

Scanning the Internet with BBOT

Fast, smart, and private: Group-IB introduces AI Assistant

Our new LLM-powered chatbot is designed for efficiency and security. Discover how Group-IB AI Assistant enhances threat intelligence workflows and provides security teams with instant insights — without compromising privacy.

Tales of Too Many RMMs

In a highly interconnected world, remote monitoring and management (RMM) tools are critical to reducing cost and increasing efficiencies. However, these tools pose challenges and even significant risk if not properly managed.

Typical Dark Web Fraud: Where Scammers Operate and What They Look Like

Why App Allowlisting & Zero Trust Alone Won't Save You | Huntress

App Allowlisting is a good preventative software tool, but it's not enough. Learn why a layered security approach with detection and response is crucial to protect against today's cyber threats.

Burning Data with Malicious Firewall Rules in Azure SQL

Varonis Threat Labs discovered a vulnerability in Azure SQL Server allowing privileged users to create malicious firewall rules that can delete Azure resources when triggered by admin actions. The exploit involves manipulating rule names via TSQL to inject destructive commands, potentially leading to large-scale data loss in affected Azure accounts.

CVE-2025-30406: Gladinet CentreStack & Triofox Exploited | Huntress

Huntress has observed in the wild exploitation against CVE-2025-30406, a weakness due to hardcoded cryptographic keys.

CISOs Top Order Of Business: Cyber Risk Reduction & Management

For modern CISOs, cyber risk management and reduction are nonstop challenges. But this blog offers exactly what you need to build a strategy that empowers you to manage and mitigate threats—cutting through the noise of an otherwise demanding role.

Activités de post-exploitation dans Fortinet FortiGate (11 avril 2025)

Fortinet a publié le 10 avril 2025 un billet de blogue [1] indiquant l'utilisation d'une technique de post-exploitation qui permet une atteinte à la confidentialité des données de l'ensemble du système des équipements Fortigate affectés. Cette technique repose sur l'utilisation d'un lien...

Ransomware Initial Access Brokers Exposed

Discover how a seemingly simple brute force attack led to the uncovering of a suspected ransomware-as-a-service operation. This ecosystem appears to be leveraged by initial access brokers, driving an illicit and complex network of cybercrime.

SMS Pumping: How Criminals Turn Your Messaging Service into Their Cash Machine

How EDR and ITDR Elevate Your Security

Threat actors are now exploiting both endpoints and identities in the latest cyberattacks. Learn about the rise of identity-based threats and why a combined EDR and ITDR approach is crucial for your cybersecurity.

Path Traversal in AWS SSM Agent Plugin ID Validation

A path traversal vulnerability in AWS SSM Agent's ValidatePluginId function allows attackers to create directories and execute scripts in unintended locations on the filesystem. This could lead to privilege escalation or other malicious activities, as files may be written to or executed from sensitive areas of the system with root privileges.

CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation

Huntress observed in-the-wild exploitation of CVE-2025-31161, an authentication bypass vulnerability in versions of CrushFTP and further post-exploitation leveraging MeshCentral and other malware.

Cyber Hygiene Threats: RDP, VPNs & Remote Tool Risks | Huntress

Poor credential hygiene and misconfigurations give hackers an easy way in. See real-world cyber hygiene failures, how attackers exploit them, and how Managed EDR stops them cold.

Fraud Underbelly: Australia’s Digital Boom—A Fraudster’s Goldmine?

Know exactly how cybercriminals are orchestrating attacks on Australia’s citizens and digital assets, and why are they a lucrative target?

[MàJ] Vulnérabilité dans les produits Ivanti (03 avril 2025)

**\[Mise à jour du 11 avril 2025\]** Le CERT-FR a connaissance d'une preuve de concept publique permettant de provoquer une exécution de code arbitraire à distance. **[Mise à jour du 04 avril 2025]** Le CERT-FR a connaissance d'une preuve de concept publique permettant de provoquer un arrêt du...

The beginning of the end: the story of Hunters International

Learn about technical details on the ransomware and Storage Software tool, how the criminals use the affiliate panel as well as information on the Hunters International ransomware group from its emergence to the end of the operation.

The Unwanted Guest

Threat actors are enabling the built-in Windows Guest account to maintain persistence. Learn how they gain access and how to detect this activity.

Scalable EDR Advanced Agent Analytics with ClickHouse

Learn how and why Huntress uses ClickHouse for scalable EDR agent analytics, ensuring availability and stability for millions of endpoints while maintaining cost efficiency.

ImageRunner: Privilege Escalation Vulnerability in GCP Cloud Run

An attacker with `run.services.update` and `iam.serviceAccounts.actAs` permissions but without explicit registry access could deploy new revisions of Cloud Run services that pulled private container images stored in the same GCP project. This was possible because Cloud Run uses a service agent with the necessary registry read permissions to retrieve these images, regardless of the caller’s access level. By updating a service revision and injecting malicious commands into the container's argumen…

Why cybersecurity matters for your business.

Doing nothing now can cost your business more than money. Learn why proactive cybersecurity steps keep your business resilient and save costs in the long term.

Securing Endpoints from Common Vulnerabilities

Learn how to lock down common endpoint vulnerabilities like weak passwords and unpatched software to secure your systems against threats like phishing and malware.

Navigating Cybercrime Currents in Latin America: Strengthening the Region’s Defenses

Stripping down barriers of distance, language, and the unknown, Group-IB’s mission to fight cybercrime brings us to our latest frontier –Latin America. Join us as we uncover the region’s deceptive criminals and tactics.

Unmasking the Classiscam in Central Asia

Scams like Classiscam automate fake websites to steal financial data, exploiting digitalization’s rise in developing countries, making fraud both effective and hard to detect. In this blog, we dissect the inner working of the scam and its prevalence in Central Asia.

CodeQLEAKED - CodeQL Supply Chain Attack via Exposed Secret

A publicly exposed GitHub token in CodeQL workflow artifacts could allow attackers to execute malicious code in repositories using CodeQL, potentially leading to source code exfiltration, secrets compromise, and supply chain attacks. The vulnerability stemmed from a debug artifact containing environment variables, which could be downloaded and exploited within a 1-2 second window.

Entra ID Bug Creates Immutable Users

A bug in Entra ID restricted management administrative units allowed creating immutable users that couldn't be modified or disabled, even by Global Administrators. This could enable an attacker to protect a compromised account from containment. The issue was caused by a timing vulnerability when removing users from restricted AUs and required specific steps to remediate affected accounts.

Hunting Rituals #5: Why hypothesis-based threat hunting is essential in cybersecurity

Discover how hypothesis-driven threat hunting uncovered stealthy malware. Learn why having a dedicated in-house team or leveraging expert threat hunting services is crucial for modern cybersecurity.

The Ultimate Validation: Making a Hacker’s “Do Not Engage” List

When Celestial Stealer runs in the wild, it looks for Huntress’ own Jai Minton as a potential threat, and this shuts down the infostealer operation if his name is detected.

AWS CDK CLI Issue with Custom Credential Plugins

AWS identified a security issue in the AWS CDK CLI versions 2.172.0-2.178.1 where temporary credentials from custom credential plugins could be printed to console output. This potentially exposes sensitive information to users with access to the console. The issue affects plugins that include an expiration property when returning temporary credentials.