News · Huntress blog
-
Huntress blog
Camera Management Software Compromise Leads to Malware Deployment
Attackers compromised camera management software to deploy malware, establish persistence, and beacon to C2. Huntress breaks down the attack chain and IOCs.
-
Huntress blog
AI, Scripts, Operator: Inside the ConnectWise Attack
Microsoft says an AI agent drove the ConnectWise attack. Huntress telemetry is consistent with that: scripted tooling, steered by an operator.
-
Huntress blog
Meet the Huntress Neighborhood Watch Program
Learn more about how Huntress protects MSPs with our Neighborhood Watch Program. Test the agentic platform and 24/7 SOC in your environment before rolling out to clients.
-
Huntress blog
Unboxing Phishing Kits: Huntress Examines 3 Real Kits
Huntress examines 3 phishing kits that hand beginner attackers everything they need to steal tokens. See what the attacks look like from the inside.
-
Huntress blog
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.
-
Huntress blog
Attack Reduction in Huntress Managed ESPM: Disrupting ClickFix
ClickFix tricks users into pasting malicious commands into the Windows Run dialog. See how Attack Reduction in Huntress ESPM helps prevent that from happening.
-
Huntress blog
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
A Google search for Amazon business led to a ClickFix lure that dropped multiple malicious payloads onto the victim machine, including versions of Lumma Stealer and NetSupport Client RMM.
-
Huntress blog
Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.
CVE-2026-109618, CVE-2026-109619 -
Huntress blog
Identity Posture Assessment for Microsoft 365 | Managed ISPM
Build identity resilience with Identity Posture Assessment, an on-demand Microsoft 365 report that scores your identity defenses and shows how fast you can fix the gaps.
-
Huntress blog
Introducing ITDR Lookback: Find Out Who Was in Your Microsoft 365 Tenant Before You Were
Attackers may be in your tenant before you connect it. Huntress Managed ITDR Lookback reviews 180 days of Microsoft 365 logins & our SOC acts on active incidents.
-
Huntress blog
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
ConnectWise (SkyKick) vendor credentials are being abused to access Microsoft 365 tenants. Disable the apps now and check your logs here.
-
Huntress blog
Inside the Hunt: Sarah Reddish
Go inside the hunt with Sarah Reddish, a SOC analyst on Huntress’ global SOC working in Triage & Analysis. See how she makes a difference every day.
-
Huntress blog
Huntress + AlgaPSA Integration: Built in Days by Nine Minds
Nine Minds used the Huntress API and public docs to turn Huntress incident reports into AlgaPSA tickets in days. See how they did it and what you can build.
-
Huntress blog
What Does the Dark Web Look Like? Pulling Back the Curtain | Huntress
Learn what the dark web looks like with an exploration of the far reaches of the internet, how you can get there, and what you might find… from a safe distance.
-
Huntress blog
Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
Passkeys significantly improve authentication, but attackers still target enrollment, recovery, endpoints, and alternative flows. Discover how to secure the full account lifecycle with a comprehensive identity strategy.
-
Huntress blog
Texas HB 3834 Cybersecurity & AI Training Requirements
Texas HB 3834 and HB 3512 require annual cybersecurity and AI awareness training. Learn who’s in scope, what’s required, and how to comply fast.
-
Huntress blog
What Cybersecurity Leaders Must Prioritize in 2027
The threat landscape has shifted. Here's what cybersecurity leaders need to know about RMM abuse, AI-powered attacks, ransomware, and identity threats in 2026.
-
Huntress blog
Business Email Compromise (BEC) Attacks: How to Stop Them
Learn how business email compromise (BEC) attacks work, the warning signs to watch for, and how Huntress stops BEC with 24/7 identity threat detection.
-
Huntress blog
10 Endpoint Security Trends and Tips for 2027 | Huntress
Learn the latest endpoint security trends, from AI-powered defense to zero trust and human-led threat hunting that help under-resourced teams stop threats faster.
-
Huntress blog
7 Key Manufacturing Cybersecurity Trends for 2027 | Huntress
Explore the latest manufacturing cybersecurity trends, from ransomware to OT takeovers, and real-world risks to production. Learn how to secure your plant.
-
Huntress blog
13 Cybersecurity Frameworks for 2027 and How to Choose What's Best for You
Discover some of the most common cybersecurity frameworks by what they’re best for, plus tips for choosing the right one for your organization.
-
Huntress blog
Microsoft VSS: Still Essential, But Not the Whole Story
Microsoft VSS remains a cornerstone of Windows data protection, but its architectural limits matter. Learn when to rely on it and when to go beyond it.
-
Huntress blog
Fake WatchGuard VPN Site Steals Credentials
A fake WatchGuard VPN download site steals SSL VPN credentials, then serves the real signed client. Learn how it works and how to spot it.
-
Huntress blog
ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress
Doris searched for ChatGPT and ended up in a BEC scam. See how ClickFix, a stolen session cookie, and a hidden inbox rule chain into an OH $#!T moment.
-
Huntress blog
CMMC Level 2 Non-Negotiable Requirements Explained | Huntress
Learn the CMMC Level 2 requirements you can’t skip, the new 88-point minimum score, and how the 180 day POA&M clock affects contract eligibility.
-
Huntress blog
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
Threat actors are exploiting AhsayCBS flaws, including CVE-2026-105133 and CVE-2026-105134, to deploy webshells and XMRig cryptominers. Update to 10.3.4 and restrict access now.
CVE-2026-105133, CVE-2026-105134 -
Huntress blog
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
A recent phishing campaign abused Microsoft Power BI links to deliver multiple rogue ScreenConnect clients.
-
Huntress blog
SMB1001: How Huntress Maps to Each Tier
SMB1001 gives small businesses a cybersecurity standard with a finish line. See how its five tiers work and where Huntress maps to each control.
-
Huntress blog
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
How Huntress researchers reconstructed an Akira ransomware attack using Registry artifacts, Akira logs, and other post-compromise evidence.
-
Huntress blog
How Huntress Detects and Responds to a ClickFix Attack
ClickFix attacks leave no file to scan or block, which is why most endpoint tools miss it. See how Huntress Attack Disruption kills the chain in under a second.
-
Huntress blog
The First 24 Hours: What Happens When Ransomware Lands
Nazar Tymoshyk from UnderDefense shares his thoughts on what ransomware attacks look like during the all-important opening hours.
-
Huntress blog
Companies Push AI Use But Skip Training and Official Policy
New data shows that many workers have employer-sponsored AI accounts and are encouraged to use them, yet 43% haven't been trained in AI.
-
Huntress blog
New Huntress View for Security Incident Investigations
See how the Huntress SOC runs security incident investigations from first signal to final resolution, including the ones closed as benign.
-
Huntress blog
Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
The Huntress Tragic Quadrant ranks the cyber threats hitting businesses most, from RMM abuse to AiTM, ClickFix, using real SOC data.
-
Huntress blog
Defender Exclusion Abuse: How Attackers Hide Malware from MDAV
See how attackers like GootKit and WhisperGate abuse Windows Defender exclusions to hide malware from AV scans — and how Huntress detects it.
-
Huntress blog
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
Huntress SOC found a threat actor exploiting a file upload flaw in recreation management to breach 3 municipal servers and steal payment data.
-
Huntress blog
Meet Athena: Huntress' Agentic SOC Analyst
Learn how Huntress' Athena brings agentic AI to the SOC, investigating signals end-to-end while human analysts own the final call.
-
Huntress blog
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
Huntress researchers reveal how attackers are exploiting ChatGPT Custom GPTs to spread ClickFix lures and DLL-sideloaded malware. See the full breakdown.
-
Huntress blog
Privilege Hygiene: Least Privilege Best Practices Guide
Learn what good privilege hygiene looks like, from local admin sprawl to accidental access, plus least privilege best practices you can start today.
-
Huntress blog
Culture at Speed: Protecting What Makes Huntress Work
As Huntress scales past 800 teammates, Chief People Officer Kristin Dean reflects on protecting culture and not just letting it happen.
-
Huntress blog
Managed or Modified: Choose How Huntress Hardens Microsoft 365
Managed ISPM now offers two deployment modes. Choose fully automated hardening or full control over which Microsoft 365 controls roll out, and when. See how it works.
-
Huntress blog
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
Threat actors exploited Samsung MagicINFO to install AnyDesk, disable Defender, and compile a Monero miner directly on a victim endpoint. Learn the detection signals.
-
Huntress blog
OAuth Token Theft Through Microsoft's Front Door
A sideloaded package turns a Microsoft-signed binary into an OAuth token theft tool. No phishing domain, no spoofed UI, no browser. Here's how to detect it.
-
Huntress blog
Rogue RMM Abuse: How Attackers Exploit Remote Access Tools
The Huntress SOC uncovered phishing attacks that trick employees into installing rogue RMM tools like ScreenConnect for persistent access. Learn how to spot it.
-
Huntress blog
DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer
DarkMe, an APT-linked VB6 RAT known for using zero day exploits, turned up in two Huntress incidents stripped down to a plain .pif infostealer malware.
-
Huntress blog
Fighting AI Slop in Production Codebases: How Huntress Improved Fable 5.1’s API Recall
Three changes to the Huntress coding harnesses doubled Claude Fable 5.1’s API recall evaluation accuracy rate.
-
Huntress blog
AI Attacks Move Faster. Huntress’ Agentic SOC Keeps Up
AI hasn't changed attacker tradecraft, just the speed. See how Huntress built Athena, an agentic SOC partner, to help analysts keep pace.
-
Huntress blog
The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
Huntress analysts reconstructed a three-week INC ransomware attack from endpoint data, uncovering a 17-day lull despite missing process telemetry.
-
Huntress blog
Operational Resilience: Turning Your IR Plan Into a Resilient Team
An incident response plan only works if it’s tested. Learn the 5 pillars of operational resilience and how to turn your plan into muscle memory before an attack hits.
-
Huntress blog
Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
Huntress has recently seen two incidents involving Settra, a ransomware variant that was first publicly reported in June 2026.
