News for hackers. Stuff that matters.

A comment on How An Attacker's Blunder Gave Us a Rare Look Inside Their Day-to-Day Operations. Parent comment

Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by viccis on Tuesday September 09, 2025 @01:20PM (#45185202)
They mention in the write up that they correlated certain indicators with what they had seen in other attacks to be reasonably sure they knew this was an active attacker.

The problem to me is that this is the kind of thing you'd expect to see being done by a state intelligence organization with explicitly defined authorities to carry out surveillance of foreign attackers codified in law somewhere. For a private company to carry out a massive surveillance campaign against a target based on their own determination of the target's identity and to then publish all of that is much more legally questionable to me. It's already often ethically and legally murky enough when the state does it; for a private company to do it seems like they're operating well beyond their legal authority. I'd imagine (or hope I guess) that they have a lawyer who they consulted before this campaign as well as before this publication.

Either way, not a great advertisement for your EDR service to show everyone that you're shoulder surfing your customers' employees and potentially posting all that to the internet if you decide they're doing something wrong.

[ Parent | on HN ]
Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by fckgw on Tuesday September 09, 2025 @01:27PM (#45185325)
> The standout red flag was that the unique machine name used by the individual was the same as one that we had tracked in several incidents prior to them installing the agent.

The machine was already known to the company as belonging to a threat actor from previous activity

[ Parent | on HN ]
Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by bornfreddy on Tuesday September 09, 2025 @03:41PM (#45187645)
That's not very convincing. They still abused trust placed in them - by an active attacker, granted, but still... This seems like a legally risky move and it doesn't inspire trust in Huntress.
[ Parent | on HN ]
Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by fckgw on Tuesday September 09, 2025 @04:36PM (#45188579)
Who's trust? Their job is to hunt down and research threat actors. The information gained from this is used to better protect their enterprise customers.

This gains more trust with their customers and breaking trust with ... threat actors?

[ Parent | on HN ]
Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by viccis on Tuesday September 09, 2025 @04:52PM (#45188879)
>Who's trust? Their job is to hunt down and research threat actors

No, their job is to provide EDR protection for their customers.

[ Parent | on HN ]
Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by cybergreg on Tuesday September 09, 2025 @07:55PM (#45191211)
Threat intelligence is a thing.in fact there’s entire companies that sell just that. In fact, there’s entire government organizations that do just that.
[ Parent | on HN ]
Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by viccis on Wednesday September 10, 2025 @01:13PM (#45200764)
Sure but that's not what their customer was engaging with them to do. It's not ethical to sell "EDR" services and then use that access to spy on your customers for intelligence purposes.
[ Parent | on HN ]
Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by viccis on Tuesday September 09, 2025 @03:43PM (#45187680)
That is what I said, yes.
[ Parent | on HN ]
Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by glitchc on Wednesday September 10, 2025 @12:53PM (#45200484)
Yes, but only according to the company's own logs, which were not externally validated. To rephrase, the company thinks this was an active attacker based on logs its own tool generates. It does not discount the possibility that the tool generated erroneous logs or identified the wrong machine(s).
[ Parent | on HN ]