29 results for “Huntress SOC”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types29 Write-ups23 Articles6

“Huntress SOC”

huntress.comwriteup🛡️ Security

The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint

Huntress SOC analyzes an intrusion that began with exploitation of Samsung MagicINFO (CVE-2025-4632, after incomplete fix of CVE-2024-7399) via tomcat9.exe. The actor took three tries to install AnyDesk (certutil and PowerShell attempts were blocked by Defender), created an 'oldadministrator' account, disabled Defender, then ran Silent XMR Miner Builder, which compiled a Monero miner on the endpoint using csc.exe, cvtres.exe, donut, tcc and MinGW gcc. The miner ran masquerading as explorer.exe against C3Pool; the post gives command lines and detection ideas such as unusual compiler child processes from an unsigned parent and explorer.exe with mining arguments.

Samsung MagicINFOAnyDeskWindows Defender+3

CVE-2025-4632CVE-2024-7399SilentXMRMiner+10

Blue Team & Detection, Threat Intel· Published and added 24 Sep 2026

huntress.comwriteup🛡️ Security

Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware

Huntress SOC analysts Ryan Dowd and Jon Semon tore apart a live social-engineering campaign that began with a fake CoinDesk marketing exec DMing a researcher a Google Doc containing a container-bound Apps Script sidebar. The script ran client-side without OAuth consent, exfiltrated victim IP/geolocation/wallet presence via the Telegram API, then routed macOS users to a piped zsh/DMG AMOS stealer chain and Windows users through ClickOnce and PowerShell loaders using three stolen or fraudulent code-signing certificates (a Norwegian company, Discord, and Lenovo). The Windows chain culminated in NetSupport Manager RMM abuse, a Ledger wallet implant, and a self-generated rogue root certificate authority (spoofing Google Trust Services) installed via MsBuild.exe hollowing to silently intercept HTTPS traffic, which the authors flag as the artifact most likely to survive incident remediation short of full reimaging.

WindowsmacOSGoogle Workspace+3

AMOS stealerClickFixMacSync+6

Threat Intel, Malware & RE· Added 11 Sep 2026, published 15 Sep 2026

huntress.comarticle🛡️ Security

Best Practices for Good Endpoint Hardening | Huntress

A Huntress SOC-informed guide to endpoint hardening, explaining why checklist-only compliance approaches fail and detailing real intrusion paths observed in incidents: internet-exposed RDP brute-forced by scanners, RMM tool abuse delivered via phishing (277% spike in 2025), and ClickFix attacks that trick users into pasting malicious commands into the Windows Run prompt. It closes with a practical weekly checklist covering external exposure scanning, local admin rights reduction, Windows Defender tamper protection, and disabling SMBv1/legacy protocols.

RDPWindows DefenderSMBv1

ClickFix

Blue Team & Detection· Added 11 Sep 2026, published 10 Sep 2026

huntress.comwriteup🛡️ Security

Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence

Huntress SOC details two August incidents where phishing emails led victims through a fake CAPTCHA/Adobe PDF Reader lure into a browser-in-the-browser (BiTB) page spoofing get.adobe.com, tricking them into installing a ScreenConnect client disguised as an Adobe Reader update. The installer chained to a second rogue ScreenConnect client via curl/cmd.exe, both registered as Windows services for persistence, then executed defense-evasion binaries (HideCursor.exe, HideUL.exe) to hide cursor/screen activity before Huntress disrupted the intrusions. Full IOCs (domains, ScreenConnect client IDs/relays, file hashes/paths) are included for defenders.

ScreenConnectWindowscurl+1

Browser-in-the-BrowserTrojan:Win32/Commando.A!mlHideCursor.exe+1

Threat Intel, Blue Team & Detection· Added 11 Sep 2026, published 9 Sep 2026

huntress.comarticle🛡️ Security

Boardroom Battles 2026: ASD’s Cyber Priorities & AI Risk

A Huntress blog post walks Australian boards through ASD's 2025-26 cyber security guidance and its companion frontier-AI cyber threat paper, citing the $12.5B FY23-24 espionage cost figure and the July 2026 Hugging Face autonomous-agent security incident (later linked by OpenAI to an internal cyber-capability evaluation) as evidence that AI is compressing attack timelines from days to hours. It illustrates ASD's "assume compromise" stance with real Huntress SOC cases — catching a VPN intrusion via correlated failed-login logs, and using ransom-note/file-extension artefacts plus sub-60-second mass host/account isolation to contain active ransomware — arguing AI should accelerate detection but remain human-supervised rather than replace analyst judgment.

HuntressHugging FaceOpenAI+2

Australian Signals Directorate (ASD)Australian Institute of Company DirectorsAthena

GRC, Blue Team & Detection, AI Security· Added 3 Sep 2026, published 30 Aug 2026

huntress.comwriteup🛡️ Security

The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms

Huntress SOC documents how threat actors abuse legitimate AI platform features — public Claude Artifacts, claude.ai/share conversation links, and shared ChatGPT/Grok conversations — as trusted hosting for malware lures. Case studies include the "FakeAgent" malvertising campaign (a fake Claude Desktop download Artifact leading to SectopRAT via downloading-api[.]it[.]com), a fake Apple Support guide hosted on claude.ai/share delivering the MacSync stealer via a ClickFix-style curl command, and SEO-poisoned ChatGPT/Grok shared conversations pushing AMOS stealer through fake "clear disk space" advice. It recommends restricting clipboard-driven script execution, application allow-listing, and rapid reporting to AI platform vendors.

ClaudeClaude DesktopChatGPT+3

FakeAgentSectopRATMacSync+4

Threat Intel, AI Security· Added 3 Sep 2026, published 27 Aug 2026

huntress.comwriteup🛡️ Security

MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

Huntress SOC analysts reverse-engineer MacSync, a macOS infostealer/RAT distributed via a sponsored Google Ads link to a fake "Apple Support"-branded claude.ai shared conversation that uses ClickFix to trick victims into pasting a curl/zsh loader into Terminal. The six-stage chain runs a polymorphic gzip/Base64 loader, an in-memory AppleScript stealer that harvests Chromium Safe Storage keys, keychain secrets, Telegram/SSH/cloud credentials, abuses TCC (Full Disk Access and Screen Recording) prompts, drops a Mach-O RAT with WebSocket/TLS C2 and an XOR-obfuscated fallback domain, and trojanizes 84 crypto wallet extensions/apps to phish seed phrases. The piece also compares it to prior AMOS Stealer and SectopRAT ClickFix campaigns and offers behavior-based detection guidance.

macOSAppleScriptzsh+3

MacSyncClickFixSectopRAT+2

Malware & RE, Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 17 Aug 2026

huntress.comwriteup🛡️ Security

Credential Stuffing Campaign Hits SonicWall | Huntress SOC Tracking

Huntress SOC tracked a credential stuffing campaign against SonicWall VPN/firewall logins starting July 25, 2026, originating from five DigitalOcean-hosted IPs. Over three days, 92 unique user accounts across 30 organizations were compromised through opportunistic, automated credential validation rather than targeted attacks, with no observed post-compromise activity. The post includes IoCs and mitigation guidance (WAN access restriction, credential resets, MFA enforcement) for defenders.

SonicWall

Huntress

Threat Intel, Blue Team & Detection, Identity & Access· Added 3 Sep 2026, published 28 Jul 2026

huntress.comwriteup🛡️ Security

Threat Actors Achieve Persistence After SQL Injection

Huntress SOC analysis of a June incident where a threat actor exploited a SQL injection flaw in an IIS/MSSQL web application to gain access, then extensively modified the environment: enabling Terminal Services, creating a rogue admin account (adminweb2$), disabling Windows Defender, deploying BadIIS malicious IIS modules (HttpFastCgiModule.dll, HttpCgiModule.dll) for SEO fraud, installing the XMRig cryptominer with nssm.exe persistence and hidden/system file attributes, and dropping additional PowerShell/batch payloads (qdcjoke1.2.ps1, c_joke1.2.ps1) via base64-encoded PowerShell and Out-of-Band Application Security Testing (OAST) exfiltration channels (oastify.com).

Microsoft SQL ServerIISPowerShell+2

BadIISXMRignssm.exe+6

Threat Intel, Blue Team & Detection, AppSec· Added 3 Sep 2026, published 13 Jul 2026

huntress.comarticle🛡️ Security

LoTL Abuse: How to Spot It vs. Normal Admin Activity | Huntress

Huntress SOC breaks down how to differentiate legitimate admin use of native tools (PowerShell, WMI, RMM software) from living-off-the-land (LoTL) abuse by attackers, offering a four-point pressure test: who used the tool, where it ran, how it launched, and what followed. It includes real detection examples such as attackers using the legitimate RMM tool Action1 to deploy ScreenConnect for persistent access, a malicious process chain spawning from bomgar-scc.exe, and an LLM-generated script with code comments revealing Telegram-based exfiltration.

PowerShellWMIScreenConnect+2

bomgar-scc.exe

Blue Team & Detection, Threat Intel· Added 3 Sep 2026, published 8 Jul 2026

huntress.comarticle🛡️ Security

How the RaaS Business Model Actually Works

A Huntress blog post explaining how the Ransomware-as-a-Service (RaaS) model splits ransomware operations into specialized roles - operators who build and maintain malware/leak sites, affiliates who conduct intrusions, and initial access brokers who sell footholds - citing Huntress 2026 Cyber Threat Report data showing Akira, Medusa, Qilin, and Ransomhub accounted for over half of observed ransomware incidents. It walks through a real Huntress SOC incident where attackers pivoted from a compromised SonicWall VPN appliance through privilege abuse, Cloudflared/OpenSSH persistence, credential theft, and shadow copy deletion before deploying Akira ransomware, and recommends monitoring VPN/RDP access, MFA, and SIEM/EDR/ITDR correlation to catch pre-encryption staging activity.

SonicWallRDPVPN+3

AkiraQilinMedusa+2

Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 1 Jul 2026

huntress.comwriteup🛡️ Security

Defence Impairment Olympics

Huntress SOC incident writeup detailing a threat actor who exploited Adobe ColdFusion vulnerabilities (CVE-2023-26360, CVE-2023-29298, CVE-2023-29300) to drop a steganographic webshell hidden inside an image, then returned with a full defense-impairment batch script (i.bat) that disabled IIS logging, tampered with Windows Defender, killed/deleted security services (Sysmon, filebeat, SentinelOne, DrWeb, ImmunetProtect), used Image File Execution Options to freeze logging tools, deleted ModSecurity WAF module, enumerated FileZilla and multilingual local admin groups, weakened WDigest to force plaintext credentials in memory, dumped credentials via a Mimikatz kernel driver (mimidrv.sys), deleted CLSID/WScript registry keys, and cleared Windows event logs. The piece walks through each command block with attacker rationale and closes with concrete mitigation guidance for defenders.

Adobe ColdFusionIISWindows Defender+3

CVE-2023-26360CVE-2023-29298CVE-2023-29300+6

Blue Team & Detection, Threat Intel· Added 3 Sep 2026, published 29 Jun 2026

huntress.comwriteup🛡️ Security

The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed

Huntress SOC incident report on an internet-facing RD Gateway/RDWeb terminal server compromised via credential reuse with no MFA, where the actor staged Gammadyne Mailer (a legitimate commercial bulk-mail tool) to send 8.9 million Boots-impersonation phishing emails direct-to-MX from the victim's clean IP, evading AV entirely. The phishing kit itself was hosted on a compromised Bolivian government domain (ipelc.gob.bo) to inherit its trust and dodge reputation blocklists, and the writeup details the log-forensics (Windows Security log gaps, Terminal Services operational logs, Chainsaw parsing, WFP Event 5157) used to reconstruct the timeline and attribute a separate opportunistic brute-force bot.

RDPIISWindows+3

ipelc.gob.boBootsdracii.mmp+2

Threat Intel, Blue Team & Detection, Identity & Access· Added 3 Sep 2026, published 15 Jun 2026

huntress.comwriteup🛡️ Security

Akira, LimeWire, and the Sour Taste of Data Exfiltration

Huntress SOC details an Akira ransomware incident where a threat actor accessed a hypervisor, spun up a new VM (bypassing EDR since it lacked the Huntress agent), disabled Microsoft Defender, and deployed a renamed akira.exe encryptor. Notably, the actor exfiltrated staged WinRAR archives via Easyupload.io, a file-upload service run by the rebranded former peer-to-peer client LimeWire, alongside earlier use of WinSCP for exfiltration.

Akira ransomwareWinRARWinSCP+2

HuntressLimeWireEasyupload.io+4

Threat Intel, Blue Team & Detection, Malware & RE· Added 3 Sep 2026, published 12 Jun 2026

huntress.comwriteup🛡️ Security

Inside Kali365, a Device Code Phishing Ecosystem | Huntress

Huntress SOC investigation into Kali365 (also seen as Octopi365/Freedom365), an AI-enabled Phishing-as-a-Service kit that abuses the Microsoft device-code authentication flow to steal M365 tokens and maintain persistent mailbox access even after password resets. The writeup dissects three panel editions (base AiTM/device-code capture, a post-compromise BEC/fraud module using Claude for drafting wire-transfer scam replies, and a self-service reseller tier with crypto billing via OxaPay), and reverse-engineers the companion Electron desktop apps OctoLink Live and OctoLink Sender, which exchange stolen refresh tokens for real ESTSAUTH session cookies to drive undetected Graph mail-sending and admin-portal access — tactics overlapping with Microsoft's Storm-2372 reporting. Includes IoCs and a KQL hunting rule for detecting device-code abuse.

Microsoft 365OAuthCloudflare Workers+3

Kali365Octopi365Freedom365+5

Threat Intel, Identity & Access, Blue Team & Detection· Added 3 Sep 2026, published 11 Jun 2026

huntress.comwriteup🛡️ Security

Inside .NET Loader Analysis: From Malspam to In-Memory Loader

Huntress SOC dissects a multi-stage infection chain that begins with a malspam HTML attachment routed through a legitimate Google DoubleClick tracking link to evade reputation filters, before landing on a self-personalizing phishing kit and dropping a ZIP with a heavily obfuscated JScript loader. The chain cascades through PowerShell droppers into a .NET stager that performs extensive anti-analysis/anti-sandbox checks, disables Windows Defender, patches AMSI (via NtManageHotPatch on Windows 11 24H2) and ETW at the native API level, and uses RunPE process hollowing into InstallUtil.exe or MSBuild.exe to run a final loader that communicates over AES/RSA-encrypted, protobuf-serialized TCP C2 with certificate pinning. The writeup includes GPU-fingerprinting behavior, persistence via registry Run keys and randomized scheduled tasks, and concrete detection/hardening recommendations.

.NETPowerShellWindows Defender+2

InstallUtil.exeMSBuild.exeNtManageHotPatch

Malware & RE, Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 3 Jun 2026

huntress.comwriteup🛡️ Security

The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress

Huntress SOC details two Gentlemen ransomware incidents showing Windows Event Log clearing, PowerShell-based Defender tampering, and Scheduled Task persistence via a fake svchost32.exe creating a SOCKS proxy C2 connection. Ties findings to a leaked internal RaaS database revealing CVE-2024-55591 exploitation and infrastructure links to Qilin and Lazarus Group.

HuntressPowerShellWindows Defender+3

CVE-2024-55591The GentlemenQilin+5

Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 21 May 2026

huntress.comarticle🛡️ Security

Exposed RDP: The Misconfiguration Attackers Keep Exploiting

Huntress SOC writeup detailing three real incidents stemming from exposed RDP: a healthcare org's internet-facing RDP port (3389) hit by opportunistic scanning, an RDWeb portal re-exploited by the same attacker a day after eviction using a custom cross-platform reverse tunnel and credential harvester, and a SonicWall VPN compromise where the attacker used cheap bulletproof hosting (Hostinger, Freakhosting) then manually re-enabled RDP via registry edits and netsh firewall rules before running Advanced IP Scanner for lateral movement. The piece argues these are not zero-days but recurring misconfigurations, and recommends firewalling RDP, closing/rotating exposed entry points quickly, and feeding VPN/firewall logs into SIEM alongside EDR for visibility.

RDPEDRSIEM+3

RDWebAdvanced IP ScannerHostinger+1

Blue Team & Detection, Offensive Security· Added 3 Sep 2026, published 19 May 2026

huntress.comwriteup🛡️ Security

Threat Actor Defense Evasion: How Attackers Disable AV & EDR

Huntress SOC breaks down how attackers disable AV/EDR: blocking agent communications via malicious/hidden Windows Firewall rules (WFP), abusing Add/Remove or CLI to uninstall EDR agents, abusing Defender AV exclusions, and Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel access and kill protected security processes. Includes real intrusion examples — a February 2026 SonicWall VPN-credential intrusion using a revoked-but-still-trusted 2006 EnCase forensic driver (exploiting a legacy Windows Driver Signature Enforcement exception) to kill 59 named security processes every second, and a March 2026 malvertising campaign (Google Ads for W-2/W-9 forms) that dropped a rogue ScreenConnect instance and used a vulnerable signed Huawei audio driver to terminate EDR/AV processes.

Windows DefenderWindows FirewallEDR

EDRSandBlastEDRSilencerMITRE ATT&CK T1562+7

Blue Team & Detection, Threat Intel, Malware & RE· Added 3 Sep 2026, published 18 May 2026

huntress.comwriteup🛡️ Security

Untangling a Linux Incident With an OpenAI Twist (Part 2)

Part two of a Huntress SOC case study untangling a Linux host compromised by three simultaneous actors: a legacy cryptominer, a multi-revenue botnet (XMR mining, EarnFM bandwidth-selling, Repocket residential proxy) with eight persistence mechanisms, and a credential-harvesting cluster that exfiltrated SSH keys, cloud credentials, and .env secrets via wget POST, while the legitimate developer used OpenAI's Codex agent to partially and ineffectively triage the same box. The SOC documents Codex's wins and misses (no root visibility, missed cron.d/UDEV persistence, race conditions with reinfecting attackers) and traces an April reinfection to unpatched CVE-2025-55182 (React2Shell) in the developer's Next.js/React app, underscoring that AI-assisted remediation without live EDR telemetry and root-cause patching leaves footholds open.

OpenAI CodexHuntressLinux+3

CVE-2025-55182XMRigEarnFM+1

Blue Team & Detection, Threat Intel, AI Security· Added 3 Sep 2026, published 22 Apr 2026

huntress.comwriteup🛡️ Security

Uptick in Bomgar RMM Exploitation

Huntress SOC documents an ongoing wave of exploitation of CVE-2026-1731, an unauthenticated RCE in Bomgar (rebranded BeyondTrust Remote Support/Privileged Remote Access), first disclosed in February 2026 and patched in versions 25.3.2/25.1. Attackers are using compromised outdated Bomgar instances — including at an MSP and a dental software vendor — to add rogue domain admin accounts, deploy LockBit ransomware (likely via a leaked LockBit 3.0 builder), drop the BYOVD EDR-killer PoisonKiller, and pivot to additional RMM tools like AnyDesk, Atera, ScreenConnect, and a renamed SimpleHelp for persistence across downstream customer environments.

BomgarAnyDeskScreenConnect+3

CVE-2026-1731LockBitLockBit 3.0+3

Threat Intel· Added 3 Sep 2026, published 17 Apr 2026

huntress.comwriteup🛡️ Security

Untangling a Linux Incident With an OpenAI Twist

Huntress SOC analysts detail a Linux incident where a user, unaware their endpoint was compromised by a Monero cryptominer (mining to 62.60.246.210:443 via a binary masquerading as systemd-logind) and multiple threat actors, used OpenAI's Codex coding agent to troubleshoot loud fans and perform ad-hoc security audits. Codex's generated one-liners (curl, redirected output, chained pipes) closely resembled attacker living-off-the-land tradecraft, triggering EDR detections and forcing analysts to sift Codex session/chat logs to distinguish legitimate remediation from actual malicious activity by at least two threat actors performing cryptomining and credential theft. Part one of a two-part series on how AI-agent usage on a compromised host complicates SOC triage.

HuntressOpenAI CodexCodex+4

Huntress Managed EDR

Blue Team & Detection, AI Security, Threat Intel· Added 3 Sep 2026, published 17 Apr 2026

huntress.comarticle🛡️ Security

Attackers Love Your VPN To-Do List

Huntress SOC writeup on VPN compromise as the dominant initial-access vector, citing that ~70% of intrusions their SOC catches begin with attacker authentication through VPN. It walks through real incidents: a compromised FortiGate VPN leading to deployment of publicly available GitHub tools BlueHammer, RedSun, and UnDefend (attributed to threat actor Nightmare-Eclipse); a VPN-originated Play ransomware attempt stopped by EDR; missing VPN logs hampering investigation; and a SonicWall SSLVPN credential compromise that led to BYOVD-based defense evasion due to missing MFA and account segmentation. It closes with a prioritized remediation checklist (enforce MFA, audit privileged accounts, disable legacy accounts, centralize logging).

VPNFortiGateSonicWall+3

Nightmare-EclipseBlueHammerRedSun+3

Threat Intel, Blue Team & Detection, Identity & Access· Added 3 Sep 2026, published 17 Apr 2026

huntress.comwriteup🛡️ Security

How the Huntress SOC Stopped a VPN-Based Ransomware Attack

Huntress SOC incident writeup describing how attackers breached a small US construction manufacturer via a VPN lacking two-factor authentication, then used RDP for reconnaissance, dumped credentials after lateral movement, and attempted to disable Microsoft Defender and the Huntress EDR agent. The SOC's triage, support, and tactical response teams detected the activity via Managed EDR, isolated the network, reviewed VPN logs, and remediated by disabling compromised accounts and enabling 2FA before ransomware deployment occurred.

VPNRDPMicrosoft Defender+2

Blue Team & Detection, Identity & Access· Added 3 Sep 2026, published 13 Mar 2026

huntress.comwriteup🛡️ Security

Data Exfiltration and Threat Actor Infrastructure Exposed

Huntress SOC details two related incidents where threat actors used PsExec for privilege escalation, a scheduled task ("Recovery Diagnostics") to run base64-encoded PowerShell that configured a renamed copy of restic (winupdate.exe) pointed at a Wasabi S3 bucket, then disabled/removed VIPRE Business Agent and Windows Defender before deploying INC ransomware. A second, near-identical prior incident on 9 February reused the same AWS access keys and used HRSword to disable Acronis security tooling, and the same TTPs were independently documented by the Cyber Centaurs team on 22 January 2026. The post highlights detection gaps (incomplete agent deployment, no SIEM) and notes RestartManager API telemetry (also seen with Akira) as a ransomware-encryption indicator.

PowerShellWindowsWindows Defender+3

INC ransomwareAkiraHRSword+2

Blue Team & Detection, Threat Intel· Added 3 Sep 2026, published 12 Mar 2026

huntress.comwriteup🛡️ Security

How Hacked Construction Apps Are Bringing Down Jobsite Security

Huntress SOC details active in-the-wild exploitation of CVE-2025-51683, a blind SQL injection vulnerability in Mjobtime construction labor-tracking software (v15.7.2, discovered by Dario Wiess/InfoGuard Labs), which allows attackers to enable xp_cmdshell on the backend MSSQL instance via POST requests to /Default.aspx/update_profile_Server. Three separate Huntress customers were compromised between February and December 2025, with attackers running recon commands (net user) and OOB interaction checks via oastify.com before detection; no patch is currently available from the vendor. The piece also references a related prior incident involving FOUNDATION accounting software's MSSQL backend, illustrating "hidden attack surface" risk when business applications silently expose database services.

IISMicrosoft SQL Server

CVE-2025-51683Dario WiessInfoGuard Labs+4

AppSec, Threat Intel· Added 3 Sep 2026, published 21 Jan 2026

huntress.comwriteup🛡️ Security

Rogue RMMs: Common Social Engineering Tactics We Saw in 2025

Huntress SOC details a year-long pattern of threat actors social-engineering employees into installing rogue ScreenConnect instances via lures disguised as Social Security statements, event invitations, and overdue invoices. The post shares specific malicious executable names, top C2 domains (lory473[.]top, subjent25.zapto[.]org, sans[.]infosedi[.]de, and others), a notable SHA256 hash, and a walkthrough of an incident where a Google Docs "invitation" page delivered a ScreenConnect installer. ScreenConnect accounts for 74.5% of abused RMMs Huntress observed, with recommendations to audit/monitor RMM usage and review execution logs.

ScreenConnectHuntressTeamViewer+2

lory473[.]topsans[.]infosedi[.]desubjent25.zapto[.]org+5

Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 31 Dec 2025

huntress.comwriteup🛡️ Security

A Series of Unfortunate (RMM) Events

Huntress SOC documents a recurring attack pattern from late 2025 where threat actors gain initial access via phishing-delivered RMM installers such as GoTo Resolve, PDQ, and ITarian, then use that foothold to deploy a secondary rogue RMM such as ScreenConnect or SimpleHelp for redundant persistence, sometimes chaining three RMMs in one intrusion. It walks through specific incidents at a real estate firm, investment firm, and car dealer, including file paths, C2 domains, and phishing lures like fake invitations and a fake Microsoft Teams bid transcript, and closes with detection guidance such as asset inventory, the LOLRMM list, and log auditing.

ScreenConnectSimpleHelpGoTo Resolve+3

LOLRMM

Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 18 Dec 2025

huntress.comwriteup🛡️ Security

Velociraptor Misuse, Pt. II: The Eye of the Storm

Huntress SOC details three incidents (Sept–Nov 2025) where attackers abused the legitimate DFIR tool Velociraptor for C2 after gaining initial access via the ToolShell SharePoint exploit chain (CVE-2025-49706/CVE-2025-49704, CVE-2025-53770/CVE-2025-53771). Attackers installed Velociraptor as a persistent SYSTEM service, then pivoted to Cloudflare tunnels and VS Code (code.exe) remote tunnels for resilient C2, with one incident tied to Warlock ransomware and the financially motivated cluster Storm-2603. The piece includes shared IOCs across incidents (same Workers.dev download domain, Cloudflare tunnel token), attacker command mistakes, and a SecurityCheck.exe malware sample flagged by VirusTotal.

VelociraptorCloudflareVS Code+9

CVE-2025-49706CVE-2025-49704CVE-2025-53770+5

Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 3 Dec 2025