Attack Behaviors | Huntress

This report reviews Huntress observations of recurring ‘threat clusters’ in early 2024 where attackers exploited CVE-2023-48788 (and other vectors) to compromise endpoints, deploy RMM tools (ScreenConnect, SimpleHelp), and exfiltrate data (including via finger.exe); it emphasizes habit-driven TTPs—password reuse, repeated endpoint names, and consistent command sequences—as high-fidelity indicators defenders can track to detect and disrupt campaigns earlier.