Response to Incidents

SlashAndGrab: The ConnectWise ScreenConnect Vulnerability Explained

SlashAndGrab: The ConnectWise ScreenConnect Vulnerability Explained

Think Your ScreenConnect Server Is Hacked? Here’s What To Look For.

SlashAndGrab: ScreenConnect Post-Exploitation in the Wild (CVE-2024-1709 & CVE-2024-1708)

A Catastrophe For Control: Understanding the ScreenConnect Authentication Bypass (CVE-2024-1709 & CVE-2024-1708)

Detection Guidance for ConnectWise CVE-2024-1709

Vulnerability Reproduced: Immediately Patch ScreenConnect 23.9.8

Rapid Response: TrickBoot

Critical Vulnerability: Exploitation of Apache ActiveMQ CVE-2023-46604

Threat Advisory: VMware Horizon Servers Actively Being Hit With Cobalt Strike

Rapid Response: Mass Exploitation of On-Prem Exchange Servers

Critical Vuln.: PrintNightmare Exposes Windows Servers to RCE

Threat Advisory: Hackers Are Exploiting CVE-2021-40444

Threat Advisory: Hackers Are Exploiting a Vulnerability in Popular Billing Software to Deploy Ransomware

Investigating Unauthorized Access: Huntress QA Environment Incident