huntress.comwriteupHow the Huntress SOC Stopped a VPN-Based Ransomware Attack
Huntress SOC incident writeup describing how attackers breached a small US construction manufacturer via a VPN lacking two-factor authentication, then used RDP for reconnaissance, dumped credentials after lateral movement, and attempted to disable Microsoft Defender and the Huntress EDR agent. The SOC's triage, support, and tactical response teams detected the activity via Managed EDR, isolated the network, reviewed VPN logs, and remediated by disabling compromised accounts and enabling 2FA before ransomware deployment occurred.
TL;DR Huntress SOC detected and stopped a ransomware attack that began with an MFA-less VPN compromise, RDP recon, and credential dumping before attackers could deploy ransomware.
Technologies named here
Techniques named here
- VPN compromise
- RDP-based reconnaissance
- Credential theft / lateral movement
- Disabling security tools
- Network isolation
Related in Blue Team & Detection
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup