Peeling Back the Layers of .NET Malware
Cyberattackers constantly develop creative ways to obfuscate their code to conceal the presence (and purpose) of their malware. In this blog, we dive into an…
Category: ThreatIntelligence-IncidentResponse
Abusing Ngrok: Hackers at the End of the Tunnel
Do you know that expression, “light at the end of the tunnel?” Usually, that has a positive connotation. After some hard work or persevering through…
How Hackers Exploit Windows Administrative Shares
The Huntress SOC team continues to see new Emotet, Trickbot, and Qakbot malware outbreaks within networks — regardless of antivirus, anti-spam, or firewall solutions. As a…
Top Takeaways from hack_it 2021
Just last week, we hosted our second hack_it training event to bring actionable security education to the infosec community. This two-day event (plus a Hacking…
What Is a Persistent Foothold?
Before Huntress, I always assumed that threat hunting was done like this: Gather as much visibility as you could afford Make sure it includes sophisticated…
Scale Your Security Operations with Confidence
If there’s one thing we know about hackers, it’s that they stay busy. In fact, hackers launch an attack every 39 seconds. That adds up…
From PowerShell to Payload: An Analysis of Weaponized Malware
Click, boom, and your network is compromised. All a hacker needs is one successful exploit and you could have a very bad day. Recently, we…
7 Takeaways from the Executive Order on Improving Cybersecurity
On May 12, 2021, President Biden signed an Executive Order (EO) to improve U.S. cybersecurity standards and further combat cyber threats against the nation. Though…
Cyber Security Insurance Perspective on Ransomware
It’s not the first time I’ve seen something like this happen, and it certainly won’t be the last. During my time as an auditor at…
Endpoint Protection: Promises vs. Reality
One of the major challenges in the cybersecurity industry is that vendors tend to overpromise and underdeliver. I see it time and time again. In…
How a College Student Lost $10,000 to “The IRS”
Back when I worked in the division of student affairs, I came across an unsettling report from our university’s police department. One of my students…
Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix
Acknowledgments:A special thank you to Tyler Bohlmann, Jon Semon, Lindsey O’Donnell-Welch, Aaron Deal, and Beth Robinson for their contributions and edits to this blog. And…