We're looking for a Principal Threat Intel Incident Commander here at @huntress.com ! Do you love to: 🔍 Conduct #DFIR analysis? 👀 Track threat actors? 🕸️ Work with others across different departments? ✍️ Write about your findings? 👩‍💼 Present your work? Apply!: job-boards.greenhouse.io/huntress/job...

just choked on my beverage

There's an open role for a Staff CTI Analyst on my team here @huntress.com 📢💫 ✨Do you love doing correlations between different incidents, sometimes digging into them, or doing malware analysis? ✨Do you like doing data analysis, and using this to make threat reports? 👇

We are excited to announce that we are hosting a second training course for #FTSCon week! Join @joegrand.bsky.social as he leads his popular 2-day Hardware Hacking Basics course on Oct. 21-22 in Arlington VA! Registration is now OPEN!

We are so excited to have @joegrand.bsky.social keynoting at #FTSCon 2025! Come join us on October 20th!

We are counting down to #FTSCon 2025! We have a slate of great speakers—you don't want to miss this event! 
If you haven't registered yet, register here: events.humanitix.com/from-the-sou.... Stay tuned for speaker spotlights!

#FTSCon Speaker Spotlight: Juan Andrés Guerrero-Saade is presenting “From Threat Hunting to Threat Gathering” in the HUNTER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

#FTSCon Speaker Spotlight: Toni de la Fuente is presenting “Open Cloud Security, lessons learned building Prowler” in the MAKER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

#FTSCon Speaker Spotlight: Wesley Shields (@wxs.bsky.social) is presenting “COLDRIVER: NOROBOT/YESROBOT/MAYBEROBOT” in the HUNTER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

#FTSCon Speaker Spotlight: Aleksandra Doniec (@hasherezade.bsky.social) is presenting “Uncovering Malware's Secrets with TinyTracer” in the MAKER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

#FTSCon Speaker Spotlight: Joseph Edwards (@eflags.bsky.social) is presenting “The Forensics of Zoom's Remote Control” in the HUNTER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

#FTSCon Speaker Spotlight: Andrew Case (@attrc.bsky.social) is presenting “Detection and Analysis of Memory-Only Linux Rootkits” in the MAKER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

Excited to speak at FTSCon next month!

#FTSCon Speaker Spotlight: Joe FitzPatrick (@securelyfitz.bsky.social) is presenting “Rethinking DMA Attacks with Erebus” in the MAKER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

#FTSCon Speaker Spotlight: Daniel Gordon (@validhorizon.bsky.social) is presenting “When the AppleJeus GitHub is Worth the Squeeze: Citrine Sleet Investigation” in the HUNTER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

#FTSCon Speaker Spotlight: Denis Bueno is presenting “CTADL: Customizable Static Taint Analysis” in the MAKER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

#FTSCon Speaker Spotlight: Michael Horka is presenting “Lilac Typhoon aboard the Indigo Train - The Current State of Chinese Obfuscation Networks” in the HUNTER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

An incredible firsthand glimpse into threat actor operations from Huntress:

CYBERWARCON is back. 🗓️ Wednesday, Nov 19, 2025 | Crystal City + virtual 🔗 cyberwarcon.com

Last chance to be a part of *THE* premier #InfoSec event in Northern Virginia, #BSidesNoVA! Submit a talk or workshop by 11:59PM ET tonight, August 15th. sessionize.com/bsidesnova-2...

We've seen quite a lot of intrusions involving SonicWall devices here at @huntress.com We decided to write a bit about what attacker tradecraft we've seen on the other end of these intrusions: 🔎 www.huntress.com/blog/exploit...

BSidesNYC thanks @gleeda.bsky.social and the rest of the 0x05 Technical CFP Committee, @cyb3rkitties.bsky.social, Cesar Vargas, Jase English, Jamie Williams, Jessica Hyde, @rmettig.com, and Stephanie Aceves for volunteering their time to review talks. Many thanks for curating our programming.

The BSidesNYC call for papers is still open. Submit your topic today! bsidesnyc.org

This is the first of a series of posts we're doing on some of the vulns found as part of the HackerOne work – we have lots more fun ones coming up about some great SSRF, SQLi, and RCE vulns it discovered, with very clever exploit techniques :)

excited bc today @huntress.com is releasing our analysis of a gnarly intrusion into a web3 company by the DPRK's BlueNoroff!! 🤠 we've observed 8 new pieces of macOS malware from implants to infostealers! and they're actually good (for once)! www.huntress.com/blog/inside-...

@volexity.com #threatintel: Multiple Russian threat actors are using Signal, WhatsApp & a compromised Ukrainian gov email address to impersonate EU officials. These phishing attacks abuse 1st-party Microsoft Entra apps + OAuth to compromise targets. www.volexity.com/blog/2025/04...

#dfir

Congratulations to all of the Volatility contributors - this was no small feat! We are proud to be a sustaining sponsor of this important open-source project that remains the world’s most widely used memory forensics platform. #dfir

We are excited to announce FTSCon 2025 on October 20, 2025, in Arlington VA! Registration is now OPEN + we have a Call for Speakers. Following FTSCon will be a 4-day Malware & Memory Forensics Training course with Volatility 3. See the full details here: volatilityfoundation.org/announcing-f...

It’s raining, and feeding time, so what do we do? Sheep and goat dance set!!! 💣💥 turn up the volume! 🔊🔊

Lots of new stickers! thegarbagefile.etsy.com

We have reached out to Samsung. There is active exploitation in the wild. Be sure to look for new files created in the server directory of your MagicInfo install, and child processes spawning from the Apache Tomcat process.

The version offered on their website via the download button is currently not even the latest, so even if it was patched (it isn't, the vulnerable class has not changed at all) anyone downloading the software is getting an outdated version! No updates here: security.samsungtv.com/securityUpda...

I've confirmed Samsung's MagicINFO 21.1050 is VULNERABLE to the publicly reported POC in the blog below. ssd-disclosure.com/ssd-advisory... The media is reporting this as CVE-2024-7399, but if it is then the patch is incomplete. There is currently NO PATCH AVAILABLE!

Today’s mood m.youtube.com/watch?v=bWur...

Huntress continues to observe in-the-wild exploitation of CVE-2025-30406, a critical vulnerability in Gladinet CentreStack and Triofox

Some good takeaways from @huntress.com’s recent Tradecraft Tuesday ft. Patrick Wardle: -The impact of Apple bringing TCC events to Endpoint Security -#Mac malware persistence techniques vs BTM -Security alert inundation for #macOS users Catch up here⤵️ www.huntress.com/blog/say-hel...

Exposed RDP can lead to anything—even attempted ransomware attacks. Here’s what went down at this manufacturing business👇

CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild! We've got some post exploitation and detection opportunities for you: #DFIR #threatintel #CTI www.huntress.com/blog/cve-202...

Huntress has observed in-the-wild exploitation of CVE-2025-30406, a critical vulnerability in the Gladinet CentreStack enterprise file-sharing platform.

When you've replied to a tweet from S1 a couple months ago asking for an updated url for a panel Chris Krebs was on, and wake up to a hate bot storm demanding his head. oh what a time to be alive 🫠

CVE-2025-2825 or CVE-2025-31161: A vulnerability by any other name is still a threat 😇: We've updated the blog to reflect some new attacker tradecraft observed yesterday cc @huntress.com @re.wtf @johnhammond.bsky.social #DFIR #vuln #CVE www.huntress.com/blog/crushft...

✅Are you well versed in Linux? ✅Do you understand Linux internals and eBPF? ✅ Do you like building out POCs? ✅Do you understand cyber threats and forensic artifacts? 💥Become a Principal Linux Researcher at @huntress.com Apply here: 👉 job-boards.greenhouse.io/huntress/job...

🤣🤣🤣🤣

They like it!

MUSK: A sophisticated cyberattack from Ukraine took out Twitter's servers REALITY: Twitter's servers were not secured properly and were publicly visible Great explainer here from @lhn.bsky.social www.wired.com/story/x-ddos...

👏👏👏👏

Everybody's already mad at me today, so I will just say, as a farmer, whoever this lady is -- she's right. The price of cheap eggs is paid for in abusive labor practices, abuse to animals, and abuse to the planet. I know I've said this before. People weren't as mad at me then. Lol

@volexity.com Volcano Server & Volcano One v25.02.21 adds 300 new YARA rules; consistent Bash/ZSH history & sessions from Linux/macOS memory and files; and parses Linux systemd journals, macOS unified logs, and Windows USNs (search + timeline for all). [1/2] #dfir #memoryforensics #memoryanalysis