Palo Alto Networks recently completed the acquisition of IBM's QRadar Software as a Service (SaaS) assets. IBM continue to sale QRadar on-premises.

Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.

Advisory for CVE-2021-41765, a critical SQL injection vulnerability leading to remote code execution, by the Horizon3.ai red team.

TheLastVvV.com has realised a new security note Apache HTTP Server 2.4.50 Remote Code Execution

MSRPC to ATT&CK is a one-stop shop for learning more about how adversaries abuse Remote Procedure Calls and what you can do to detect it.

How this Shellbot malware works, dig into malware analysis, and how to detect it with Falco and Sysdig Secure.

Explore SecureAuth's resources to learn more about better workforce and customer identity and access management.

To protect our users, TAG routinely hunts for 0-day vulnerabilities exploited in-the-wild. In late August 2021, TAG discovered watering hole attacks targeting visitors t…

In this blog, we’ll explore a new way to exploit reentrancy that can be used to evade the behavioral analysis of EDR and legacy antivirus products.

Mimikatz provides the opportunity to leverage kernel mode functions through the included driver, Mimidrv. Mimidrv is a signed Windows…

The discovery and analysis of a new threat: Krane malware – a cryptominer botnet that has the ability to spread laterally.

Authors: Antonio de la Piedra (Kudelski Security Research Team) and Marloes Venema (Radboud University Nijmegen) This week at Black Hat Europe 2021 we have presented our work on attacking attribute…

This article describes two authenticated remote code execution vulnerabilities that we found during a time-bounded security assessment of Grandstream’s HT801 Analog Telephone Adapter. Both vulnerabilities are exploitable via the limited configuration shell…

RedSense Cyber Threat Intelligence provides products and services to many of the world’s most sophisticated corporate threat intelligence departments and security organizations. As companies rethink their intelligence frameworks for greater efficacy and cost…

a sophisticated watering hole campaign drops a new macOS implant!

Using shell preview handlers for privileged persistence

Execute ELF files without dropping them on disk. Contribute to nnsee/fileless-elf-exec development by creating an account on GitHub.

In the second of a four-part series on the NOBELIUM nation-state attack, we share the behind-the-scenes details of the detection and investigation into the threat.