logo

Huntress Blog

ID: e1b4d979-e6a5-5eef-9f0d-273f751e82e1

STIX ID: identity--e1b4d979-e6a5-5eef-9f0d-273f751e82e1

Feed Type: rss

Earliest post: 1970-01-01

Latest post: 2026-10-12

Threat research, incident response insights, and practical defensive guidance from the Huntress team — focused on real-world attacks, persistence mechanisms, and strategies to protect SMBs and enterprises.

01/01/2020
10/14/2026
Title Date Published ↓Threat ScoreAuthorVisible
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer2026-10-0875True
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs2026-10-0772True
2026-10-0672True
How Huntress Detects and Responds to a ClickFix Attack2026-10-0570True
The First 24 Hours: What Happens When Ransomware Lands2026-10-0275True
Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses2026-10-0175True
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix2026-09-2878True
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint2026-09-2470True
OAuth Token Theft Through Microsoft's Front Door | Huntress2026-09-2375True
Rogue RMM Abuse: How Attackers Exploit Remote Access Tools 2026-09-2375True
DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer2026-09-2278True
AI Attacks Move Faster. Huntress’ Agentic SOC Keeps Up2026-09-2260True
The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress2026-09-2178True
Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM2026-09-1775True
Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware2026-09-1580True
How Attackers Abuse VSS, and How Huntress Detects It2026-09-1470True
AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key2026-09-1090True
Grand Theft Auto VI hype leads to malware2026-09-0972True
AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance2026-09-0878True
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity2026-09-0380True
Inside Knight Office, a New M365 AiTM Phishing Kit2026-09-0275True
Hackers Frequently Target Healthcare and Finance Orgs2026-09-0150True
The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT2026-09-0178True
PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE2026-08-2885True
Boardroom Battles 2026: ASD’s Cyber Priorities & AI Risk 2026-08-2750True
Retail Cybersecurity in ANZ: Five Decisions That Keep Trading2026-08-2770True
The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms2026-08-2775True
Insights into Suspected DPRK Workers2026-08-2675True
What Good Identity Hardening Looks Like2026-08-2565True
RMM Abuse: How Attackers Exploit Remote Access Tools | Huntress 2026-08-2175True
Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware2026-08-1975True
MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer2026-08-1778True
10 Hacker Summer Camp Standouts at Black Hat and DEF CON2026-08-1450True
Education Under Attack: The Pattern Behind Recent University Breaches2026-08-1372True
Fake Refund Scam Hits Shopify Shop App Users2026-08-1350True
Akira Hits Safe Mode: Ransomware Rebooting Around EDR2026-08-1278True
Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest2026-08-1090True
From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS2026-08-0780True
Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam2026-08-0670True
Inside an Oracle Database SQL Injection Attack | Huntress 2026-08-0575True
Bank of America Phishing Email Delivers ScreenConnect Malware2026-08-0470True
Why App Control Fails Most Teams and How Managed ESPM Fixes It 2026-08-0370True
Critical N-able N-central Vulnerability and Active Exploitation2026-08-0390True
Device Code Phishing Keeps Evolving. Here’s What to Watch For2026-07-3170True
Reverse Engineering the Six Stages of MacSync Stealer and RAT 2026-07-2980True
Credential Stuffing Campaign Hits SonicWall | Huntress SOC Tracking2026-07-2865True
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT2026-07-2275True
How the LSHIY Password-Spraying Attack Abuses OAuth’s ROPC Grant2026-07-2270True
What Are Initial Access Brokers?2026-07-2165True
Every Ransomware Attack Has a Backstory2026-07-1575True

1–50 of 358