blue squares forming the abstract shape of an arrow set against a white background

On 2024-02-14, a research was reported, involving , gaining initial access via Cloud native misconfig, while using Cloud key compromise, targeting Azure Storage to achieve Resp. disclosure.

On 2024-02-14, a research was reported, involving , gaining initial access via Software misconfig, targeting Ansible, NGINX to achieve Resp. disclosure.

Through its managed security services offerings, Volexity routinely identifies spear-phishing campaigns targeting its customers. One persistent threat actor, whose campaigns Volexity frequently...

Water Hydra group (AKA DarkCasino), whose activity was first detected in 2021, is known for their cyberattacks targeting the financial industry globally, including banks, cryptocurrency platforms,...

On 2024-02-13, an incident was reported, involving an unknown actor, gaining initial access via 1-day vulnerability, targeting Confluence Server to achieve Data exfiltration.

On 2024-02-13, a research was reported, involving , gaining initial access via Software misconfig, while using Cloud key compromise, to achieve Resp. disclosure.

Fortinet offers guidance to detect and mitigate CVE-2024-21762 and CVE-2024-23113, critical RCE vulnerabilities in FortiOS and FortiProxy, including guidance that organizations should patch urgently.

We explore how advancements in EKS Access Entries and Pod Identity have opened new attack vectors and offer examples of how adversaries could exploit them.

On 2024-02-09, a research was reported, involving , gaining initial access via Software misconfig, targeting MongoDB to achieve Resp. disclosure.

On 2024-02-09, a research was reported, involving , gaining initial access via Software misconfig, targeting Salesforce to achieve Resp. disclosure.

UPDATE: Following our initial release, we have been contacted by our fellow researchers at Jamf who were able to identify three more samples that act like first-stage payloads. They are...

UPDATE: Following our initial release, we have been contacted by our fellow researchers at Jamf who were able to identify three more samples that act like first-stage payloads. They are...

Get a detailed analysis of the entire attack chain of Microsoft's breach by Midnight Blizzard (APT29), as well as detection and mitigation recommendations.

Chapter III. Exploring and comparing prominent Russian language cybercriminal forums. Welcome to the third part of this series of OSINT...

Authored by Dexter Shin MoqHao is a well-known Android malware family associated with the Roaming Mantis threat actor group first... The post MoqHao evolution: New variants start automatically...

On 2024-02-08, an incident was reported, involving an unknown actor, gaining initial access via Unknown, to achieve Data exfiltration.

On 2024-02-08, an incident was reported, involving an unknown actor, gaining initial access via End-user compromise, to achieve Data exfiltration.

On 2024-02-08, a campaign was reported, involving an unknown actor, gaining initial access via 1-day vulnerability, while using Vulnerability exploitation, targeting Confluence Server to achieve...

The explosive growth of Generative AI has sparked many questions and considerations not just within tech circles, but in mainstream... The post Generative AI: Cross the Stream Where it is...

Secure Microsoft Azure AI Services, including Azure OpenAI, with Wiz AI-SPM providing full visibility into AI pipelines and risks on the Wiz Security Graph

What UN Regulations 155 and 156 require from vehicle manufacturers in reality, and how to ensure compliance with requirements and prepare for certification if necessary

Hypervisor-Protected Code Integrity (HVCI) is a method of preventing compromise of various kernel parts even when an attacker has compromised part of the kernel itself. While creating a Windbg...

The Cosmos SDK is a blockchain development framework written in Golang. The security of this system is crucial. So, they have fuzzing integrated into the framework, which the author is going to...

Aptos Roll is a secure instant randomness API. This is done with a bunch of pretty crazy cryptography schemes. Unlike Chainlink VRF, this is on-chain, which makes it faster and cheaper to use....

The Wiz research team unpacks the security implications of the new EKS access and identity management features and recommends best practices when using them.

Detect and mitigate CVE-2023-46805, CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893, critical vulnerabilities in Ivanti VPN products. Organizations should patch urgently, and government agencies...

Sometimes you need to get in the way of a hardware device and its controller, and see what it has to say for itself. If you are lucky, the two parts are communicating using a serial port, and then...

a blue square that reads "Threat Analysis Group"

On 2024-02-06, an incident was reported, involving an unknown actor, gaining initial access via End-user compromise, while using Azure Batch abuse, targeting Azure Batch to achieve Resource...