LATEST

Meet the JS-Sniffers 2: G-Analytics Family

Group-IB discovered that the stolen payment cards data is sold through an underground store specially created for this purpose.

Meet the JS-Sniffers: ReactGet Family

ReactGet is one of the most interesting families of JS-sniffers, designed to steal banking cards data from online stores.

Gustuff: Weapon of Mass Infection

Android Trojan named «Gustuff» capable of targeting more than 100 global banking apps, a number of cryptocurrency and marketplace applications

Rapid Response: ASUS Live Update Attack (Operation ShadowHammer)

Periodically, a large scale cybersecurity issue requires “all hands on deck” from the Huntress Team (see WannaCry, Kaseya Cryptominer, GANDGRAB outbreak). The unfolding ASUS Live Update fiasco also happens to be one of those moments. We’ve created this blog is to provide simple answers to a complex supply chain attack affecting global IT Departments.

CVE-2017-18362: SQL Injection in ManagedITSync Integration | Huntress

A vulnerability was discovered and disclosed in late 2017 that affected the ConnectWise ManagedITSync integration, designed to sync data between the ConnectWise Manage PSA and the Kaseya VSA RMM.

The end of torrents era in Russia

Currently, a total of 80% of pirated films and almost 90% of TV series are being watched online

Impersonate GCP Organization Through the Organizations Update Method

A GCP Organizations name could be changed through the (deprecated) organizations.update method in the Resource Manager, even though the documentation said the "displayName" was read-only. With this, I could have my own organization and name it as another one and confuse users: - Rename an organization ".com" - Share it with "domain:.com" (Effectively sharing it with every Google user with a @.com account) - Profit from unsuspecting users creating resources in my organization, specially billing …

Azure Cloud Shell terminal escape

If attacker controlled data is viewed in Cloudshell it could have led to code execution. This exact same issue was later discovered in AWS as well.

Failing to Revive AUTOEXEC.BAT on Windows 7 & 10

Does AUTOEXEC.BAT still run on modern Windows? We test Windows 7/10, explore registry persistence, and revisit how attackers maintain access today.

Resource policy confused deputy issue with services

Resource policies lacked a way of restricting service access to only your own account, allowing an attacker to leverage a service to potentially access your resources. Originally discovered by Dan Peebles and presented at re:Invent in 2018, this issue did not gain enough attention to be fixed until Shir Tamari and Ami Luttwak from Wiz presented it at Black Hat 2021.

Distrusting Symantec Issued Certificates

Read more about security updates to the Huntress platform.

Silence: Moving into the Darkside

Group-IB has exposed the attacks committed by Silence cybercriminal group.

Attackers Abuse Trust with Indirection

Preventive security products like antivirus have made major strides in their ability to detect malicious behaviors as opposed to weak/static signatures. When implemented properly, these heuristics are capable of discovering even the most cleverly obfuscated routines. But don’t ring the victory bells yet. This cat-and-mouse game is just getting started…

Launching EC2s did not require specifying AMI owner

Attackers had put malicious AMIs in the marketplace to abuse the CLI''s way of selecting what AMI to use. Although the concept of planting malicious AMIs had existed for a while (ex. in the 2009 presentation "Clobbering the clouds" by Nicholas Arvanitis, Marco Slaviero, and Haroon Meer) it had not been used specifically to target this issue with the CLI.

Subdomain takeover via Azure Traffic Manager

Patrick Hudak demonstrated possible subdomain takeover using the Traffic Manager in Azure.

Ask Huntress: Fake .XPS Invoice Leading to Credential Phishing

Explore this phishing campaign used the age-old “Please remit payment” spiel to lure potential victims into opening the attached file.

Potentially Unwanted Programs: It's Not Always Malware | Huntress

Regardless of your daily duties, we’ve all encountered annoying ads, unwanted pop-ups, or generically named rogue applications. These nuisances, commonly called Potentially Unwanted Programs (PUP), are often unknowingly installed when downloading free software.

Cobalt Renaissance

New attacks and joint operations

AWS ElasticSearch Index Name Leakage

Even for the AWS-managed ElasticSearch clusters that had not been made public, their index names could be learned.

Deep Dive: Kaseya VSA Mining Payload

For many of us in the Managed Services Provider market, we were rocked with news of a vulnerability in Kaseya’s VSA product. The purpose of this blog is to shine technical light on what the Huntress ThreatOps team observed and analyzed thus far.

MoneyTaker: in pursuit of the invisible

Group-IB has uncovered a hacker group attacking banks in the USA and Russia

When Hackers are Quicker than Antiviruses: Cobalt Group Bypasses Antivirus Protection

Huntress Labs to Host Hands-On “Hacking Windows” Training | Huntress

IT Nation 2016 ended on a high note for Huntress Labs as we were named the “Best Newcomer” in the Partner Choice Awards. Now, as this year’s event quickly approaches, we are excited to continue our momentum.

Bypassable and overly-privileged IAM policies

AWS has previously provided managed policies or guidance in documentation for policies with mistakes that allow them to be bypassed. Additionally, some policies are over-privileged. Date of disclosure is for the first issue of this type, while references provide other examples by various individuals.

In a Queue for a Scam

How faudsters cash in on hype around new iPhones

NotPetya pulls BadRabbit out of the hat

Research revealed that the BadRabbit code was compiled from NotPetya sources.

BadRabbit: spread of new cryptolocker

There is a connection between BadRabbit and Not Petya

‘Black spot’ for pirates

Russia has developed a strong legal framework to combat online piracy. All that is needed is for it to be used effectively (especially for Forbes.ru)

AWS Java SDK XXE injection

The AWS Java SDK was vulnerable to XML external entity (XXE) injection related to XML parsers.

Abusing Trusted Applications with Nested Execution

Recently, my co-founders gave a talk at DerbyCon 7.0 on evading common persistence enumeration tools. Evasion using trusted applications has been a hot topic of discussion within the infosec community and is one of the techniques they covered in their presentation. However, very little discussion exists on why these matter or the steps researchers take to find “hosting” applications.