GCP provides an OS Login service for managing SSH access to compute instances using IAM roles. An attacker could abuse this feature via LXD, Docker (if available on the target system) and DHCP poisoning of the metadata server to escalate their privileges on a Google Compute Engine VM.
At the end of this tunnel, we find some shady hackers using ngrok to gain remote control access to victim networks.
Analysis of the E1RB JS sniffer family
If attacker controlled data is viewed in Cloudshell it could have led to code execution. This exact same issue existed in Azure previously.
A vulnerability in the Azure Linux VM extension mechanism allowed an unprivileged user to leak any Azure VM extension’s private data. An attacker could have abused this to gain credentials for the VM itself as well as credentials for extensions associated with the VM. Paired with the design of the VMAccess extension (an official Azure extension for managing VM credentials), this could have been used to achieve privilege escalation, as an unprivileged attacker would have been able to elevate the…
Hackers always try to cover up their tracks. In this blog, we step through layers of obfuscation to uncover the real intent of a .NET malware sample.
On-prem Microsoft Exchange Server vulnerabilities are being actively exploited in the wild. Read our blog for Huntress' most up-to-date research and IOCs.
In this blog, we define what threat hunting is, the differences between human analysis and automation, plus an example of human-powered threat hunting.
A deep dive into Classiscam: automated scam as a service designed to steal money and payment data
We unveil zero-day vulnerabilities we discovered in virtual event platforms used in MSP/Fortune 500 communities, plus some insight on supply chain attacks.
The year three report covers 2019 and aims to highlight the achievements and efforts made by the Active Cyber Defence programme.
In cybersecurity, education and training are the key to winning. Read our blog to learn how you can grow your skills through continuous security education.
An attacker could gain root privileges on their Azure Cloud Shell container, escape from the container, and then gain root privileges on the underlying node, the root cause being an insecure kubelet port (10250), among other cluster misconfigurations. Once they could access the node filesystem, an attacker could extract kubelet API credentials which allowed listing all pods and nodes in the cluster, including those belonging to other tenants. Moreover, an attacker could bypass RBAC policies in …
To avoid detection, hackers often turn a system’s own tools against itself. Here, we examine a malicious payload that was executed using PowerShell.
Forensic examination of incidents involving source code leaks
Read about Huntress’ Managed Antivirus service and how it enables MSPs and IT admins to strengthen endpoint protection and rebalance their cyber stack.
Technical report on best practice use of this fundamental data routing protocol.
Microsoft Defender Antivirus is among one of the leading antivirus contenders. Here’s why it’s worth taking another look at Defender AV.
Learn manual malware analysis techniques used by threat researchers. Explore static & dynamic analysis, reverse engineering tools, and real-world investigation methods.
A bug in the GKE gVisor sandbox's network policy implementation allowed access to the Google Compute Engine metadata API.
At Huntress, beta means learning. Our goal is to accelerate and streamline security defense, which means releasing what we’re working on often.
As part of UltraRank's new campaign, Group-IB Threat Intelligence team discovered 12 eCommerce websites infected with their JavaScript-sniffer.
We take a look back at some of the more interesting — and innovative — hacker tradecraft we saw over the course of 2020.
Information about this issue is under NDA, but AWS customers can read about it on pages 120-121 of the report, which is available for download through AWS Artifact. Note: This issue is outside the scope of this database's usual criteria for inclusion, but has been kept for historic reasons, as it was included in the original CSP Security Mistakes dataset.
Annual security awareness training is a waste of time. We discuss why an ongoing security awareness program is required to protect against cyber threats.
Huntress covers the breaking news about Solarwinds’ Orion platform being exploited as part of a coordinated attack to distribute malware.
A story about operators of JS-sniffer FakeSecurity distributing Raccoon stealer
TrickBot has unleashed yet another module in its growing arsenal specifically targeting firmware vulnerabilities, named TrickBoot.
Huntress CEO Kyle Hanslovan has a lot to be thankful for in 2020 — and it starts with the MSP community.
In this blog, we dissect a sample of malware that makes clever use of batch scripting obfuscation—turns out it was a launcher for TrickBot!
