Blog Post
Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing
Threat actors used a convincing Microsoft Teams meeting-booking lure to conceal device code phishing and trick victims into authorizing attacker access.
Blog Posts By This Author
All Categories
- Read more about Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing
- Read more about SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of EndpointsBlog Post
SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints
Attackers are using cloud-hosted ScreenConnect panels to install rogue clients on hundreds of managed endpoints.
- Read more about N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit ChainsBlog Post
N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit Chains
UPDATE: N-able took N-central offline after 33 critical flaws were disclosed, including chains enabling remote code execution and privilege escalation.
- Read more about Who Watches the Watchers?Blog Post
Who Watches the Watchers?
Attackers compromised camera management software to deploy malware, establish persistence, and beacon to C2. Huntress breaks down the attack chain and IOCs.
- Read more about Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed ClientBlog Post
Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client
A fake WatchGuard VPN download site steals SSL VPN credentials, then serves the real signed client. Learn how it works and how to spot it.
- Read more about Up a Creek Without a Command Line: Mapping an Akira Ransomware AttackBlog Post
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
How Huntress researchers reconstructed an Akira ransomware attack using Registry artifacts, Akira logs, and other post-compromise evidence.
