25 matches found
threat-intel
threat-intel 이 저장소에는 Huntress 블로그 게시물 및 기타 미디어에서 논의된 IOC와 시그니처를 포함한 보충 항목이 포함되어 있습니다. 구성 이 저장소는 연도별로 구성되어 있으며, 해당 폴더 안에는 해당 콘텐츠가 지원하는 미디어의 월과 제목으로 명명된 하위 폴더가 있습니다. 예를 들면 다음과 같습니다: root@kitploit: 2022 └── 2022-12 └── 28-TITLE └── detections └── sigma └── tools └── misc 이러한 보충 파일의 정확성이나 그 밖의 다른 측면에...
Sigma
Sigma Rules Huntress Labs에서 개발한 Sigma 규칙 모음 트위터: https://twitter.com/embeeresearch https://twitter.com/HuntressLabs 라이선스 이 규칙들은 적절한 크레딧작성자/소유자 등이 유지되는 한, 본질적으로 제한 없이 자유롭게 사용할 수 있습니다. Detection Rule License DRL 1.1 이에 따라 본 규칙 세트 및 관련 문서 파일이하 "규칙"의 사본을 취득하는 모든 사람에게, 다음 조건에 따라 규칙을 제한 없이 다룰 수 있는 권한이...
log4shell_scanner
log4shellscanner 빠르고 간단한 스캐너로, 일반적인 포트를 스캔하여 Log4Shell CVE-2021-44228 취약점을 탐색합니다. 이 도구는 wget, curl, nmap 및 Log4Shell Huntress LDAP 엔드포인트를 사용합니다: https://log4shell.huntress.com/ 인터넷에 접속할 수 없는 사설 서브넷을 스캔해야 한다면, 다음 소스 코드를 사용하여 자체 HTTP 및 LDAP 서버를 구축할 수 있습니다:...
Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data
Salesforce has revealed that it disabled the Klue Battlecards app integration within its platform in response to a security incident impacting the competitive intelligence company on June 11, 2026. To that end, organizations will be unable to connect to Salesforce via the app until further notice...
MAESTRO Toolkit Exploiting VMware VM Escape Vulnerabilities
Cybersecurity researchers from Huntress detail a major VM Escape attack where hackers took over host servers. Using a secret toolkit called MAESTRO, the attackers stayed hidden for over a year. Read the exclusive details on how this breach was stopped and how to protect your network...
Gladinet's Triofox and CentreStack Under Active Exploitation via Critical RCE Vulnerability
A recently disclosed security flaw in Gladinet CentreStack also impacts its Triofox remote access and collaboration solution, according to Huntress, with seven different organizations compromised to date. Tracked as CVE-2025-30406 CVSS score: 9.0, the vulnerability refers to the use of a hard-cod...
CVE-2025-30406
creationtimestamp| type| source ---|---|--- 2025-04-03 19:35:34+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10326 2025-04-03 21:06:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llwsmf36672w 2025-04-03 23:36:28+00:00| seen| https://t.me/cvedetector/22026 2025-04-04...
Cleo File Transfer Vulnerability Under Exploitation – Patch Pending, Mitigation Urged
Users of Cleo-managed file transfer software are being urged to ensure that their instances are not exposed to the internet following reports of mass exploitation of a vulnerability affecting fully patched systems. Cybersecurity company Huntress said it discovered evidence of threat actors...
Webinar: Learn How Storytelling Can Make Cybersecurity Training Fun and Effective
Let's face it—traditional security training can feel as thrilling as reading the fine print on a software update. It's routine, predictable, and, let's be honest, often forgotten the moment it's over. Now, imagine cybersecurity training that's as unforgettable as your favorite show. Remember how...
Hackers Exploit Default Credentials in FOUNDATION Software to Breach Construction Firms
Threat actors have been observed targeting the construction sector by infiltrating the FOUNDATION Accounting Software, according to new findings from Huntress. "Attackers have been observed brute-forcing the software at scale, and gaining access simply by using the product's default credentials,"...
Exploit for Missing Authentication for Critical Function in Veeam Veeam_Backup_\&_Replication
It is an exploit module/toolkit targeting a web application. The...
New Critical MOVEit Transfer SQL Injection Vulnerabilities Discovered - Patch Now!
Progress Software, the company behind the MOVEit Transfer application, has released patches to address brand new SQL injection vulnerabilities affecting the file transfer solution that could enable the theft of sensitive information. "Multiple SQL injection vulnerabilities have been identified in...
New Critical MOVEit Transfer SQL Injection Vulnerabilities Discovered - Patch Now!
Progress Software, the company behind the MOVEit Transfer application, has released patches to address brand new SQL injection vulnerabilities affecting the file transfer solution that could enable the theft of sensitive information. "Multiple SQL injection vulnerabilities have been identified in...
Clop Ransomware Gang Likely Aware of MOVEit Transfer Vulnerability Since 2021
The U.S. Cybersecurity and Infrastructure Security Agency CISA and Federal Bureau of Investigation FBI have published a joint advisory regarding the active exploitation of a recently disclosed critical flaw in Progress Software's MOVEit Transfer application to drop ransomware. "The Cl0p Ransomwar...
Exploit for Missing Authentication for Critical Function in Veeam Veeam_Backup_\&_Replication
PoC exploit for CVE-2023-27532, a vulnerability in Veeam Backup...
CVE-2023-27532
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts. Recent assessments: sfewer-r7 at March 14, 2023 2:49pm UTC reported: On March 7, 2023, Veeam...
CISA Issues Warning on Active Exploitation of ZK Java Web Framework Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a high-severity flaw affecting the ZK Framework to its Known Exploited Vulnerabilities KEV catalog based on evidence of active exploitation. Tracked as CVE-2022-36537 CVSS score: 7.5, the issue impacts ZK Framework versions...
threat-intel
threat-intel This repository contains supplemental items inclu...
Critical RCE Vulnerability Reported in ConnectWise Server Backup Solution
IT service management software platform ConnectWise has released Software patches for a critical security vulnerability in Recover and R1Soft Server Backup Manager SBM. The issue, characterized as a "neutralization of Special Elements in Output Used by a Downstream Component," could be abused to...