Incident Education: Sales Ammo for the IT Arsenal
The Incident Backstory A recently unsealed US indictment detailed how the GozNym cybercrime group was behind $100 million in damages. The hackers specifically infected victims’…
Category: ThreatIntelligence-IncidentResponse
Keeping up with BlueKeep | Huntress
What is BlueKeep? During Windows’ May 2019 patch cycle, Microsoft released a patch for a remote code execution bug in their Remote Desktop Services software.…
Huntress Development Notes: Updating the Updater
If you’ve ever taken a look inside the Huntress Agent directory you may have noticed the file wyUpdate.exe . This executable is wyUpdate, the third party update utility…
How threat hunting evolves at scale
At Red Canary, our deep focus on mechanized detection engineering has always been complemented by an underlying need to understand emerging threats, patterns, and vulnerabilities…
Deceptive Installers: How Fake Apps Target macOS
If you’ve ever downloaded a “free” version of software that traditionally has a price tag, I’m looking at you, my LimeWire power-users of the 2000s.…
How Federal Agencies Can Activate a Risk Operations Center (ROC) to Meet CISA BOD 26-04
Executive Summary Recognizing the ability of Frontier AI models to discover and exploit vulnerabilities at unprecedented speed and scale, CISA’s Binding Operational Directive (BOD) 26-04…
Turning Millions of Risks Into One Actionable List
Every security leader walks into Monday morning with the same question. The findings are there. The dashboards are running. But out of the thousands of…
Assisted Remediation in Action | Huntress
This week we had the opportunity to help an MSP partner contain and remediate an Emotet/TrickBot infection that impacted a client with 50+ computers and…
Microsoft and Adobe Patch Tuesday, June 2026 Security Update Review
Every Patch Tuesday presents a race between defenders applying fixes and attackers seeking opportunities. Microsoft’s June 2026 release is no exception, delivering security updates for vulnerabilities…
Validating the Bishop Fox Findings in ConnectWise Control
In computer security, responsible disclosure is a vulnerability disclosure model in which an issue is publicly disclosed only after a period of time that allows…
Validating the SolarWinds N-central ‘Dumpster Diver’ Vuln
Additionally, there was a screenshot highlighting how a hacker might find these vulnerable servers online using Shodan. For those not familiar with the Shodan service,…
How One Criminal Tried to Sell an MSP on the Dark Web
In a rare encounter, we found ourselves directly interacting with a cybercriminal that took us down a dark web rabbit hole. But before we dive…