Fake tech support scams used to end with a gift card. Now they end with a modified Havoc C2 framework in your environment, using indirect syscalls to dodge your EDR.

Gladinet CentreStack is being actively exploited, with the cl0p ransomware group now reportedly targeting internet-facing servers. Huntress has been tracking this from the start and has the latest updates.

A local file inclusion flaw in Gladinet CentreStack and Triofox was actively exploited before a patch existed. Huntress documented the vulnerability, the exploitation activity, and what to do now.