5 Modern Threats You Need to Watch

What to watch for (detection signals the summary omits)

The Huntress post's value beyond the existing summary is its concrete per-scenario detection guidance and a few operational metrics. The three attack patterns themselves are already summarized; what follows is what an engineer would actually alert on.

Identity-led ransomware. The disqualifying signal isn't the login — it's the sequence after it:

• Admin or service accounts suddenly hopping between machines when that isn't normal for them, especially if followed by registry changes.
• Remote-access or IT-management software appearing on machines your team never installed it on.

The ~20-hour gap between initial login and encryption is framed explicitly as the response window — the period where the chain is still breakable before it converges on encryption.

Mailbox-only BEC.

• New inbox rules that quietly move or hide mail, particularly anything touching invoices or payments (the "Conversation History" redirect is the example).
• Logins to sensitive accounts — finance, executives, shared mailboxes — from unusual devices or locations.

Two figures the summary doesn't carry: mailbox-rule tricks make up close to a fifth of the identity-related incidents in Huntress telemetry, and the case cited was contained ~25 minutes from detection once the account was flagged. That contrast — 25 minutes vs. 20 hours — is the argument for prioritizing identity telemetry over endpoint alerts here.

Weaponized IT tooling (Qilin case). The RMM/remote-access tool was installed under a name almost identical to a legitimate, commonly used tool — near-identical naming is the specific blend-in tactic, so name-similarity (not just presence of unknown software) is the thing to check. It was then used to pull in credential/browser-password stealers.

Two patterns the page names but does not detail

The post advertises five threats; the fetched text only fully develops three. The remaining two are named but not explained (the fetch cuts off mid-scenario 3):

• Employees tricked into copying and pasting an attacker's command themselves (the "paste this to fix your browser" / ClickFix-style social-engineering pattern).
• A flood of low-signal login alerts that only reveal an attack when correlated together.

If either of these is your concern, the summary and this document won't help — the actionable detail isn't in the retrieved text.

Caveat

This is a vendor blog with no CVEs, versions, or reproducible commands; the "what to watch for" items are behavioral heuristics, not queries. The Qilin case is explicitly a single-endpoint, post-infection reconstruction ("a pinhole of visibility"), so its tradecraft description is inferred from limited scope.