Response to Incidents

Exploitation of Windows Server Update Services Remote Code Execution Vulnerability (CVE-2025-59287)

Active Exploitation of Gladinet CentreStack and Triofox Local File Inclusion Flaw (CVE-2025-11371)

Huntress Threat Advisory: Active Exploitation of SonicWall VPNs

Rapid Response: Samsung MagicINFO 9 Server Flaw

CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild

CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation

SlashAndGrab: The ConnectWise ScreenConnect Vulnerability Explained

Oh No Cleo! Malichus Implant Malware Analysis

Threat Advisory: Oh No Cleo! Cleo Software Actively Being Exploited in the Wild

Cracks in the Foundation: Intrusions of FOUNDATION Accounting Software

SlashAndGrab: The ConnectWise ScreenConnect Vulnerability Explained

SlashAndGrab: ScreenConnect Post-Exploitation in the Wild (CVE-2024-1709 & CVE-2024-1708)

Think Your ScreenConnect Server Is Hacked? Here’s What To Look For.

A Catastrophe For Control: Understanding the ScreenConnect Authentication Bypass (CVE-2024-1709 & CVE-2024-1708)

Detection Guidance for ConnectWise CVE-2024-1709