UAT-6275 uses a WinRAR flaw to plant a shell in CIS government attacks
Cisco Talos traces four delivery routes across nine countries. Hunt Startup-folder changes and unexpected PowerShell, then update affected Windows archive tools.
Read article →endpoint
Endpoint security, malware, device controls, and host visibility.
Latest in endpoint
FBI Disrupts Laptop Farms Behind North Korean Remote Hires
CrowdStrike says fake employees used U.S. homes to run company laptops remotely. Inspect shipping changes, remote-access tools and hiring records together.
Read article →
Bank Intruder Targets Update Server After Third-Party Gateway Entry
At a European bank, compromised credentials opened a third-party gateway route; months of scanning and password guessing preceded a blocked attempt against WSUS.
Read article →
Volexity Volcano Recovers Browser Exploit Traces After Cleanup
A replayed Chrome-to-Windows intrusion left encoded script in free memory. Capture RAM early, then use host artifacts to guide wider collection.
Read article →
Attackers Briefly Hijacked AOMEI Updates to Plant Backdoors
UNC7017 changed two AOMEI configuration files for minutes at a time. Hunt updater-launched files and scheduled tasks even after the vendor restored its servers.
Read article →
Microsoft Patches Exploited Windows File Warning Bypass
The October updates address an exploited Windows Shell bypass and separate unauthenticated DHCP Server code execution. Check installed builds on endpoints and DHCP hosts.
Read article →
Microsoft Windows Shell flaw lands in CISA exploited catalog
CISA flags active exploitation of a Windows Shell security bypass. Compare affected desktop and server builds with Microsoft's CVE record and prioritize updates.
Read article →
Huntress kills a ClickFix Run chain before retrieved text executes
In a Windows ClickFix case, endpoint-side termination stopped repeated command pastes; check enforce mode and the process tree before treating an alert as a block.
Read article →
Akira Ransomware Leaves a File-Share Trail After Late EDR Deployment
Huntress reconstructed an Akira attack from Shellbags, ransomware logs and shadow-copy events after its endpoint agent arrived too late to record the launch.
Read article →
Microsoft Power BI phishing plants two rogue ScreenConnect clients
A Power BI report link sent targets to a fingerprinting page and a delayed installer. Hunt for both remote clients and the recurring repair task.
Read article →
Foxit PDF form flaws expose Reader users to code execution
Two crafted-PDF flaws affect Foxit Reader and Editor. Check both CVEs against installed platforms and releases, then verify Foxit updates on endpoints.
Read article →
Iranian Actors Trigger Malware When Visual Studio Opens a Coding Test
A fake Dubai Airports coding test ran from a Visual Studio project before compilation. Inspect the project target and developer-host staging path, then isolate matches.
Read article →
NeedyMantis Uses Sideloaded DLLs to Maintain Windows Access
Microsoft found a selective post-compromise implant paired with legitimate software and a same-name archive. Hunt the loader, archive and C2 together, then contain affected hosts.
Read article →Showing 1–13 of 77