Threat Research

Threat Research is where the Huntress SOC shows its work. We cover real intrusion investigations, malware and ransomware analysis, threat actor profiles, and the tradecraft attackers lean on: persistence, defense evasion, and living-off-the-land techniques. Whether it broke this week or has been around for years, this is where you see how attacks unfold and how we stop them.


Beyond the clipboard: The evolving tradecraft of ClickFix

ClickFix techniques are evolving. Huntress breaks down four attack chains: lateral movement, hidden PNG payloads, Node.js RATs and cache seeing.

Ryan IsenhowerDani LopezAustin WorlineBen NahorneySusannah Matt

Ryan Isenhower, Dani Lopez, Austin Worline, Ben Nahorney, Susannah Matt

Nov 10, 2026

The Latest Threat Research Blog Posts

Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant
Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant
Nov 9, 2026
Managed for Malice: How Attackers Turn MDM into Remote Access
Managed for Malice: How Attackers Turn MDM into Remote Access
Oct 28, 2026
AI, Scripts, Operator - Inside the ConnectWise Attack
AI, Scripts, Operator - Inside the ConnectWise Attack
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
Oct 16, 2026
Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client
Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Oct 7, 2026
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers