Huntress, Friday, November 6th, 2026
Brute Force Sentry for Managed SIEM
Huntress Managed SIEM's Brute Force Sentry flags brute force runs that end in successful logins on RDP, RD Gateway, RDWeb and SSH.
more →
Back Issues/Search Home → Archive → RSS → Subscribe → Services → Vendors → Blog → Popular →
All sections ›
Archive
Huntress — Archive
52 articles · page 1 of 2
Huntress, Thursday, November 5th, 2026
Adversary Infrastructure New Huntress ITDR Feature
Huntress Managed ITDR's Adversary Infrastructure blocks attacker infrastructure at Microsoft 365 sign-in across all opted-in tenants.
more → Huntress, Thursday, November 5th, 2026
Defense Drill Interventions
Huntress Defense Drill Interventions pair Managed EDR detections with just-in-time training when users fall for ClickFix attacks.
more → Huntress, Tuesday, November 3rd, 2026
Huntress + Hudu Integration: Security Context in Your IT Docs
Hudu has built a beta integration that brings Huntress organizations, agents, memberships and identities into its IT documentation platform.
more → Huntress, Monday, November 2nd, 2026
Threat Hunting: What It Is, How It Works, & Why It Matters
Huntress explains what cyber threat hunting is, how hypothesis-driven hunts work and how hunting relates to threat intelligence and detection.
more → Huntress, Thursday, October 29th, 2026
Reports of SIEM's Death Have Been Greatly Exaggerated
Huntress argues SIEM is not dead but the ingest-based pricing model is, and discusses AI and smarter logging strategy.
more →
Huntress, Wednesday, October 28th, 2026
Managed for Malice: How Attackers Turn MDM into Remote Access
Huntress reports attackers abusing legitimate MDM platforms such as Hexnode and Rippling to deploy rogue RMM tools and keep remote access.
more → Huntress, Tuesday, October 27th, 2026
Camera Management Software Compromise Leads to Malware Deployment
Huntress reports attackers compromising camera management software for initial access, then sideloading malicious DLLs to deploy malware.
more → Huntress, Monday, October 26th, 2026
AI, Scripts, Operator: Inside the ConnectWise Attack
Huntress analyzes the ConnectWise Cloud Backup credential abuse, finding signs consistent with an AI agent using scripted tooling.
more → Huntress, Thursday, October 22nd, 2026
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress tracked an M365 token replay campaign that hit 79 organizations with nearly 500 successful sign-ins.
more →
Huntress, Wednesday, October 21st, 2026
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
Huntress details an Amazon-themed ClickFix campaign using the finger utility to deliver Lumma Stealer and NetSupport.
more → Huntress, Wednesday, October 14th, 2026
Passkeys Raise the Bar. Here's Where Attackers Can Still Get In.
Huntress explains how attackers still target enrollment, recovery, endpoints and social engineering despite passkeys.
more →
Security Boulevard, Tuesday, October 13th, 2026
Huntress Tragic Quadrant Rates 'Pucker Factor,' Reveals RMM as Biggest Risk
Huntress maps attack tactics by prevalence and business impact, finding RMM tool abuse in 45% of endpoint incidents.
more →
Huntress, Monday, October 12th, 2026
CMMC Level 2 Non-Negotiable Requirements Explained
Huntress explains which NIST 800-171 controls are non-negotiable under CMMC Level 2 self-assessments for defense contractors.
more → Huntress, Wednesday, October 7th, 2026
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Huntress details a phishing campaign that uses legitimate Microsoft Power BI links to deliver rogue ScreenConnect RMM clients.
more →
Huntress, Tuesday, October 6th, 2026
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Huntress reconstructs an Akira ransomware attack from registry data and Akira logs after its agent was installed post-compromise.
more → Huntress, Monday, October 5th, 2026
How Huntress Detects and Responds to a ClickFix Attack
Huntress explains why ClickFix fake-CAPTCHA attacks evade artifact-based endpoint tools and how it detects and responds to them.
more → Huntress, Friday, October 2nd, 2026
The First 24 Hours: What Actually Happens When Ransomware Lands
Huntress walks through the first day of a ransomware incident hour by hour, from discovery to recovery decisions.
more →
Huntress, Friday, October 2nd, 2026
Companies Push AI Use, But Many Skip Training (43%) and Official Policies (26%)
A Huntress survey finds 43% of knowledge workers got no AI training and 74% could not spot a prompt injection risk.
more → Huntress, Thursday, October 1st, 2026
The Huntress Tragic Quadrant: Beat the Hype on Cyber Tactics Wrecking Businesses
Huntress ranks attacker tactics by prevalence and proximity to business disruption, topped by RMM abuse, BEC and AiTM takeover.
more → Huntress, Monday, September 28th, 2026
What Good Privilege Hygiene Looks Like
Huntress outlines least-privilege practices to curb local admin sprawl, sticky admin sessions and accidental SaaS admins.
more → Huntress, Monday, September 28th, 2026
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
Huntress found attackers using ChatGPT Custom GPTs to impersonate products and push a ClickFix lure that installs a RAT.
more → Huntress, Thursday, September 24th, 2026
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
Huntress found an attacker compiling a cryptominer on a compromised endpoint after exploiting a Samsung MagicINFO flaw and disabling Defender.
more →
Huntress, Thursday, September 24th, 2026
Managed or Modified: Choose How Huntress Hardens Microsoft 365
Huntress says most Microsoft 365 tenants are missing over half of recommended identity controls, and offers automated or customizable hardening.
more → Huntress, Wednesday, September 23rd, 2026
Rogue RMM Abuse: How Attackers Exploit Remote Access Tools
Huntress warns attackers use phishing lures to install rogue remote monitoring and management tools, often stacking multiple RMMs for backup access.
more → Huntress, Wednesday, September 23rd, 2026
OAuth Token Theft Through Microsoft's Front Door
Huntress details an attack that sideloads a Microsoft-signed AppX package to capture OAuth tokens from a legitimate Microsoft sign-in page.
more → Huntress, Tuesday, September 22nd, 2026
Fighting AI Slop in Production Codebases: How Huntress Improved Fable 5.1's API Recall
Huntress raised Claude Fable 5.1's API-recall accuracy from about 48% to 100% on its evals using three small changes to its coding agent harness.
more → Huntress, Tuesday, September 22nd, 2026
AI Attacks Move Faster. Huntress' Agentic SOC Keeps Up
Huntress' Athena AI orchestrator matched or beat human analysts on identity-threat investigations in a monthlong test, alongside human SOC staff.
more → Huntress, Monday, September 21st, 2026
The Tale of Two INC Ransom Notes: A Ransomware Timeline
Huntress reconstructed an INC ransomware attack timeline, including BYOVD driver abuse to disable defenses, despite limited initial telemetry.
more → Huntress, Tuesday, September 15th, 2026
Operational Resilience: IT Security Risks with Reduced Staffing
Huntress examines how thinner IT and security staffing erodes operational resilience and what teams can do to compensate.
more →
Huntress, Monday, September 14th, 2026
How Attackers Abuse VSS, and How Huntress Detects It
Huntress explains adversary abuse of Windows Volume Shadow Copy Service for credential theft and ransomware prep, plus detection logic.
more → Huntress, Thursday, September 10th, 2026
The 20 Most Common Passwords Hackers Target in 2026
This year's most common passwords, why they fall instantly, and what actually improves credential strength.
more →
Huntress, Thursday, September 10th, 2026
Best Practices for Good Endpoint Hardening
What endpoint hardening covers and which measures actually reduce attack surface and close intrusion paths.
more → Huntress, Thursday, September 10th, 2026
Credential Theft: How Attackers Steal & Use Stolen Credentials
A primer on credential theft techniques and the identity-focused defenses that actually interrupt them.
more → Huntress, Thursday, September 10th, 2026
AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key
Exporting the Server Licensor Certificate private key enables offline decryption of protected documents.
more → Huntress, Wednesday, September 9th, 2026
Grand Theft Auto VI Hype Leads to Malware
Fake leaked GTA VI downloads spread through SEO poisoning carry RATs, infostealers and ransomware.
more → Huntress, Wednesday, September 9th, 2026
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
Browser-in-the-browser phishing led to rogue ScreenConnect persistence in incidents Huntress analysts unpicked.
more → Huntress, Wednesday, September 9th, 2026
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Rogue ScreenConnect clients repeatedly spawn Windows Script Host to run VBScript files across unrelated environments.
more → Huntress, Tuesday, September 8th, 2026
AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance
Mapping the AD RMS trust model and showing how an attacker discovers and fingerprints a deployment.
more → Huntress, Monday, September 7th, 2026
AI SIEM Search
Plain-English querying of SIEM data, removing the query language barrier during investigations.
more → Huntress, Sunday, September 6th, 2026
Critical N-able N-central Vulnerability and Active Exploitation
A critical N-central flaw gives unauthenticated attackers console-level privileges on the RMM platform.
more → Huntress, Monday, August 31st, 2026
Huntress API Update: New Endpoints, Webhooks, and Automation
The Huntress API has grown from six read-only endpoints into a full integration platform with webhooks and MCP support.
more →
Huntress, Friday, August 28th, 2026
PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE
Huntress reproduced a pre-authentication RCE chain in PaperCut NG/MF now under active exploitation, with patching guidance.
more →
Huntress, Friday, August 28th, 2026
A Beginner's Guide to Phishing Simulation Training for Employees
Huntress covers the essentials of running phishing simulation training for employees.
more → Huntress, Friday, August 28th, 2026
Teach Yourself to Phish
Huntress explains the strategy behind phishing simulations and how they build organizational resilience.
more → Huntress, Friday, August 28th, 2026
Next-Gen Phishing Tactics Users Aren't Ready For
Huntress covers ClickFix, browser-in-the-browser and OAuth consent phishing, tactics standard awareness training misses.
more → Huntress, Thursday, August 27th, 2026
The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms
Huntress examines how attackers abuse trusted AI platforms such as Claude, ChatGPT, Grok and Gemini to deliver malware and steal data.
more → Huntress, Thursday, August 27th, 2026
Retail Cybersecurity in ANZ: Five Decisions That Keep Trading
Huntress sets out five security decisions for Australian and New Zealand retailers focused on maintaining trading continuity.
more → Huntress, Thursday, August 27th, 2026
New Huntress Managed ITDR Dashboard: Faster Identity Investigations
Huntress redesigns its Managed ITDR dashboard with Rapid Identity Triage, Failed Login Characterization and Quick SIEM search.
more → Huntress, Wednesday, August 26th, 2026
Insights into Suspected DPRK Workers
Huntress analyzes DPRK remote IT worker incidents in partner environments and lists red flags for detection.
more →