Hardening the Hypervisor: Practical Defenses Against Ransomware Targeting ESXi
Hypervisors are the backbone of modern virtualized environments, but when compromised, they can become a force multiplier for attackers. A single breach at this layer…
Category: ThreatIntelligence-IncidentResponse
Announcing the Latest Report on Huntress Managed SAT: Key Findings and Insights
Security awareness training (SAT) is supposed to make companies safer, but too often, it feels like just another box to check. While every SAT vendor…
Active Exploitation of Gladinet CentreStack/Triofox Insecure Cryptography Vulnerability
Acknowledgments: Special thanks to John Hammond for his contributions to this investigation and write-up. Update #2: 12/18/25 @ 6pm ET We’ve seen reports from other…
Proactive Threat Hunting with Elastic Security — Elastic Security Labs
When a new threat actor technique emerges — whether from a research blog, an intelligence feed, or breaking news — every threat hunter instinctively shifts…
How Elastic Infosec Optimizes Defend for Cost and Performance — Elastic Security Labs
In the world of Security Operations Centers (SOCs), data is valuable, but excessive data can be problematic. Collecting every single event from every endpoint is…
Accelerate Attack Surface Discovery with new AI-Powered Connectors
Discovery: The foundation of exposure management To understand your attack surface, and all related exposures, Rapid7’s Command Platform provides Attack Surface Management, (included in Surface…
How Workflows and Agent Builder Close the Loop — Elastic Security Labs
SOC leaders face a daily battle against basic math that doesn’t add up. Data volumes are growing exponentially, attack surfaces are expanding globally, yet your…
Securing Your Business: The Vital Role of Cyber Insurance
Let’s talk about Shelby. Shelby runs a successful online artisanal soap store, priding herself on quality and attention to detail. So when an email lands…
Rising Supply Chain Attacks on Cybersecurity Ecosystems
Cybersecurity has always relied on trust. Every software update, hardware purchase, and cloud integration depends on the implicit belief that vendors will protect their customers.…
Automate your Detection Rule Migration — Elastic Security Labs
Migrating to a new SIEM is often viewed as a daunting task. The sheer volume of legacy detection rules, dashboards, and custom configurations can keep…
Automating GOAD and Live Malware Labs — Elastic Security Labs
Introduction: The Need for a Scalable, Automated Simulation Range In modern security operations, detection engineering is no longer a “set it and forget it” discipline.…
Destructive Malware Targeting Poland’s Energy Sector — Elastic Security Labs
Summary On December 29, 2025, a coordinated campaign of destructive cyberattacks targeted Poland’s energy infrastructure, affecting over 30 renewable energy facilities and a major combined…