2022-06-09 15:53 UTC
Other
Other
Swiss Army Knife Phishing
Group-IB identifies massive campaign capable of targeting clients of major Vietnamese banks
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 5,121 matching records.
AUTO-POLL // 2026-10-17 07:45 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P0 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 17
CLEAR
P0
COOL // 4 ARTICLES
FRI
Oct 16
RANSOMWARE
P8
COOL // 56 ARTICLES
THU
Oct 15
ACTIVE EXPLOITATION
P7
COOL // 87 ARTICLES
WED
Oct 14
RANSOMWARE
P8
COOL // 74 ARTICLES
TUE
Oct 13
ACTIVE EXPLOITATION
P7
COOL // 73 ARTICLES
MON
Oct 12
RANSOMWARE
P5
COOL // 42 ARTICLES
SUN
Oct 11
ACTIVE EXPLOITATION
P5
COOL // 6 ARTICLES
2022-06-07 00:00 UTC
Other
Other
GKE Authorized Networks bypass via Cloud Functions or Cloud Run
Executing Cloud Functions or Cloud Run in any project and in any organization allowed bypassing the GKE Authorized Networks (aka Kubernetes control plane firewalls) of a cluster in a different project or organization.
P0
2022-06-07 00:00 UTC
Security Journalism
Security Journalism
Recap: Navigating the NIST Cybersecurity Framework | Huntress
If you follow the NIST cybersecurity framework, you'll ensure that your money is spent on the right areas to build an effective defense strategy.
P0
2022-06-01 13:56 UTC
Other
Other
SideWinder.AntiBot.Script
APT SideWinder’s new tool that narrows their reach to Pakistan
P0
2022-05-31 00:00 UTC
Other
Other
MWAA logs leak tokens and hostnames
Two API calls used by Amazon Managed Workflows for Apache Airflow (MWAA) to convert AWS IAM credentials into tokens that can be used to login to Airflow (CreateCliToken and CreateWebLoginToken) were logging the tokens to Cloudtrail. The event included the hostname for the airflow server, so everything required to login to Airflow was in the event. However, the issue was largely mitigated by the fact that the tokens are only valid for 60 seconds and CloudTrail delivers logs on average about ever…
P0
2022-05-31 00:00 UTC
Security Journalism
Security Journalism
Out of Sight, Top of Mind | Huntress
It can be difficult to demonstrate the value of cybersecurity when your stack is doing its job. Here is how you can show the hidden value of cybersecurity.
P0
2022-05-30 00:00 UTC
Security Journalism
Security Journalism
Rapid Response: Microsoft Office RCE - “Follina” MSDT Attack | Huntress
A new attack vector enables hackers to more easily compromise users with malicious Microsoft Office documents.
P15
2022-05-24 00:00 UTC
Security Journalism
Security Journalism
The Mechanics of Defense Evasion | Huntress
Continuing our blog series on defense evasion, this blog dives into some practical, real-world examples of defense evasion in action.
P0
2022-05-17 00:00 UTC
Other
Other
ELB Cache mechanism HTTP header smuggling
While testing rate-limiter protection, The researcher noticed that when forcing HTTP/1 requests and injecting a space after `X-Forwarded-For` he was able to override this specific header, letting him impersonate any IP. Any internal header could have beem overridden, also the one that should not be exposed/forwarded by the client, such as `CloudFront-Viewer-Country-Region` or any other `CloudFront` enhanced header. This special security issue was affecting all AWS users with that a specific set…
P0
2022-05-17 00:00 UTC
Security Journalism
Security Journalism
How Huntress Protects SMBs | Huntress
Learn how The Huntress Managed Security Platform is built to equip SMBs with the ability to swiftly and accurately mitigate threats.
P0
2022-05-16 00:00 UTC
Security Journalism
Security Journalism
Huntress API Is Now in Public Beta!
Read about our latest addition, API, and how it enables MSPs and IT administrators to monitor, manage and maintain their cybersecurity stack how they want.
P0
2022-05-10 12:00 UTC
Government
Government
Organisational use of Enterprise Connected Devices
Assessing the cyber security threat to UK organisations using Enterprise Connected Devices.
P0
2022-05-10 12:00 UTC
Government
Government
ACD - The Fifth Year
Key findings from the 5th year of the Active Cyber Defence (ACD) programme.
P0
2022-05-10 00:00 UTC
Security Journalism
Security Journalism
Evicting the Adversary | Huntress
This blog shows how to catch an adversary moving from machine to machine, how to terminate this movement and how to evict the adversary from your network.
P0
2022-05-09 00:00 UTC
Other
Other
Synlapse
Azure Synapse Analytics and Azure Data Factory were vulnerable to cross-tenant access and code execution. This was made possible via a combination of (1) a shell injection RCE vulnerability in the integration runtime, (2) credentials for multiple customers stored on a shared host and (3) an insecure management server API.
P15
2022-05-05 00:00 UTC
Security Journalism
Security Journalism
One Year Later | Huntress
We recap some of the lessons we have learned over the past year thanks to the Colonial Pipeline attack.
P0
2022-05-04 12:00 UTC
Government
Government
Threat report on application stores
This report outlines the risks associated with the use of official and third party app stores.
P0
2022-05-03 00:00 UTC
Security Journalism
Security Journalism
What Is Defense Evasion? | Huntress
An introduction to defense evasion as an attack tactic. Read on to explore what defense evasion is and why it’s important to understand how it’s used.
P0
2022-05-01 00:00 UTC
Other
Other
AWS package backfill attack
Two malicious versions were created of packages previously used by AWS. The packages were officially authored and maintained by AWS before they were removed by their legitimate author, and once the packages were removed, their names became available and the two packages were then populated with malicious code. If AWS-deployed software had any dependencies on these packages, this would have led to a dependency confusion attack.
P0
2022-04-28 00:00 UTC
Other
Other
ExtraReplica
A chain of critical vulnerabilities was discovered in Azure Database for PostgreSQL Flexible Server, allowing unauthorized read access to other customers’ PostgreSQL databases, thus bypassing tenant isolation. If exploited, a malicious actor could have replicated and gained read access to Azure PostgreSQL Flexible Server customer databases.
P0
2022-04-26 00:00 UTC
Security Journalism
Security Journalism
Bring Your Own Command & Control (BYOC2)
Sometimes hackers can be overly confident in their malware. Take a journey with us through a malware sample that contains no obfuscation whatsoever.
P0
2022-04-25 12:00 UTC
Government
Government
Malware analysis report on SparrowDoor malware
A technical analysis of a new variant of the SparrowDoor malware.
P0
2022-04-20 00:00 UTC
Other
Other
AWS SSM agent local privilege escalation
The Amazon SSM Agent (used for managing EC2 instances via Amazon Systems Manager) created a world-writable sudoers file, which would have allowed local attackers to inject Sudo rules and escalate privileges to root. This could occur in certain situations involving a race condition.
P10
2022-04-19 00:00 UTC
Other
Other
Log4Shell Hot Patch Vulnerable to Container Escape and Privilege Escalation
AWS's hotpatches for Log4shell worked as intended but introduced new container escape vulnerabilities.
P10
2022-04-14 11:36 UTC
Other
Other
Old Gremlins, new methods
Russian-speaking ransomware gang OldGremlin resumes attacks in Russia
P15
2022-04-14 00:00 UTC
Security Journalism
Security Journalism
Breaking Down the NIST Cybersecurity Framework
A comprehensive guide to the NIST cybersecurity framework, its five main functions and how you can use the NIST framework to improve your cybersecurity posture.
P0
2022-04-12 00:00 UTC
Other
Other
Privilege Escalation to SYSTEM in AWS VPN Client
The AWS VPN Client application is affected by an arbitrary file write as SYSTEM, which can lead to privilege escalation and an information disclosure vulnerability that allows the user's Net-NTLMv2 hash to be leaked via a UNC path in a VPN configuration file.
P10
2022-04-12 00:00 UTC
Security Journalism
Security Journalism
How Huntress Can Complement—Not Complicate—Your Security Stack | Huntress
Learn why Huntress is built to complement—not complicate—our partners’ daily operations and deliver on our mission to secure the 99%.
P0
2022-04-11 00:00 UTC
Other
Other
AWS RDS local file read
A vulnerability was discovered in the Aurora PostgreSQL log_fdw extension for Amazon Relational Database Service (RDS), allowing an attacker to read files on the EC2 host and obtain credentials for an internal AWS service.
P0
2022-04-08 15:57 UTC
Other
Other
Scammers make off with $1.6 million in crypto
Fake giveaways hit bitcoiners again. Now on YouTube
P0