All Posts

1 min Financial Services

The Japanese Financial Services Attack Landscape

We looked at the ways in which threat actors infiltrate Japanese companies (spoiler alert: it is often through foreign subsidiaries and affiliates) and some of the most pervasive threats those companies face such as ransomware and state-sponsored threat actors.

6 min Penetration Testing

PenTales: Old Vulnerabilities, New Tricks

At Rapid7 we love a good pentest story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully highlight some ways you can improve your own organization’s security. This engagement began like any other Internal Network Penetration test []. I follo

8 min Research

Old Blackmoon Trojan, NEW Monetization Approach

Rapid7 is tracking a new, more sophisticated and staged campaign using the Blackmoon trojan, which appears to have originated in November 2022.

2 min Emergent Threat Response

SonicWall Recommends Urgent Patching for GMS and Analytics CVEs

SonicWall published an urgent security advisory on July 12, 2023 warning customers of new vulnerabilities affecting their GMS and Analytics products.

12 min Vulnerability Management

Patch Tuesday - July 2023

Five zero-day vulns, including an Office maldoc attack with no patch yet and a SmartScreen bypass. Eight critical RCEs, and 130 total vulns. Busier than recent months.

7 min Vulnerability Disclosure

CVE-2023-29298: Adobe ColdFusion Access Control Bypass

Rapid7 discovered an access control bypass vulnerability affecting Adobe ColdFusion that allows an attacker to access the administration endpoints.

4 min Detection and Response

What’s New in Rapid7 Detection & Response: Q2 2023 in Review

Rapid7 is excited to share another quarter of new Detection & Response capabilities and improvements.

2 min Metasploit

Metasploit Weekly Wrap-Up

Apache RocketMQ We saw some great teamwork this week from jheysel-r7 [] and h00die [] to bring you an exploit module for CVE-2023-33246 []. In Apache RocketMQ version 5.1.0 and under, there is an access control issue which the module leverages to update the broker's configuration file without authentication. From here we can gain remote code execution as whichever user is ru

2 min Reports

The Japanese Automotive Industry Attack Landscape

We also took a look at some of the hardest hit industries and it should come as no surprise that some of the most commonly attacked companies are in industries where Japan currently excels on a global scale

3 min Penetration Testing

PenTales: “User enumeration is not a vulnerability” – I beg to differ

In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully highlight some ways you can improve your own organization’s security.

2 min SecOps

Showcasing SecOps Metrics That Matter

Our latest ebook, Presenting Upward: How to Showcase SecOps Metrics That Matter offers practical and actionable advice on how to present security metrics in a language execs understand.

3 min Partners

Alerting Rules!: InsightIDR Raises the Bar for Visibility and Coverage

Rapid7 user George Schneider of Listrak discusses why InsightIDR has become an essential resource for maintaining the company's security posture.

2 min Metasploit

Metasploit Weekly Wrap-Up

Nothing but .NET? Smashery continues to… smash it by updating our .NET assembly execution module. The original module allowed users to run a .NET exe as a thread within a process they created on a remote host. Smashery’s improvements let users run the executable within a thread of the process hosting Meterpreter and also changed the I/O for the executing thread to support pipes, allowing interaction with the spawned .NET thread, even when the other process has control over STDIN and STDOUT. The

4 min Vendor Consolidation

Four Signs You Need to Consolidate Your Tech Stack

Learn how consolidation can improve productivity, visibility, and reporting as well as bridge staff resourcing gaps.

4 min Vulnerability Management

What’s New in InsightVM and Nexpose: Q2 2023 in Review

In Q2, InsightVM and Nexpose got an improved UI for the Console, custom policy for Agent-Based assessment, a new dashboard card, and more.