32 results for “Initial Access”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types32 Write-ups15 Articles13 Advisories1

More types3

Other1 Repos1 Tools1

“Initial Access”

blog.talosintelligence.comarticle🛡️ Security

IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

Cisco Talos Incident Response Q3 2026 trends report. Phishing led initial access at 37 percent, with vishing and IT help desk impersonation to get RMM access; public-facing exploitation followed at 33 percent. Ransomware reached 27 percent of engagements (Qilin, Rhysida, Interlock, new VYPR), with EDR killers via BYOVD and WDAC. It also covers Salt Typhoon intrusions using CVE-2023-20198 and BadCandy, attacks on Claude Code credentials, and logging, MFA and secrets recommendations.

Cisco Secure EndpointMicrosoft Quick AssistWindows Defender+6

CVE-2023-20198Salt TyphoonBadCandy+10

Threat Intel, Blue Team & Detection· Published and added 29 Oct 2026

huntress.comwriteup🛡️ Security

Camera Management Software Compromise Leads to Malware Deployment

Huntress investigation of incidents in September and October 2025 where a compromised camera management application (CMS.exe) was the initial access vector. Attackers dropped rs.win32.exe, a reverse shell, and sideloaded modified zlib DLLs (IPHLPAPI.DLL, samcli.dll) via the legitimate Microsoft WpcMon.exe in AppData, with Run key persistence and beaconing to 144.172.116[.]37. Includes detection pivots and hardening advice.

WindowsHuntress

DLL sideloadingCMS.exers.win32.exe+6

Threat Intel, Blue Team & Detection· Added 28 Oct 2026, published 27 Oct 2026

cisa.govadvisory🛡️ Security

#StopRansomware: SafePay Ransomware (AA26-293A)

CISA advisory AA26-293A (20 October 2026) details SafePay ransomware, active since August 2024 with at least 600 victims across critical infrastructure. It covers initial access via Mullvad VPN IPs, phished profiles and edge-device CVEs, LOTL lateral movement with PsExec, WinRM and RDP, exfiltration with RClone and WinSCP, and ChaCha20/RSA encryption. It lists IOCs, MITRE ATT&CK mappings, incident response steps and mitigations.

MITRE ATT&CKRDPAnyDesk+3

CVE-2020-3259CVE-2023-20269SafePay+11

Threat Intel, Blue Team & Detection· Added 21 Oct 2026

wiz.iowriteup🛡️ Security

Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack

Wiz CIRT write-up of an AI agent-run intrusion against a multi-cloud organization (GCP, AWS, Kubernetes, CI/CD, GitOps, identity provider). It lists traits of AI-driven attacks: machine-speed tempo, credential chaining, pentest/probe naming, numeric task IDs and commented code. Initial access was a Java RCE in an exposed Kafka UI. It closes with detection and response advice: unified logs, workload visibility and trust isolation.

WizKubernetesAWS+2

Wiz CIRTRed Agentcredential chaining+6

Threat Intel, Blue Team & Detection, Cloud & Infra, AI Security· Published and added 19 Oct 2026

decrypt.coarticle🛡️ Security

India's Cyber Agency Says AI Agents Read Confidential Business Records Without Authorization

Decrypt reports on CERT-In's critical advisory "AI Agents as Attack Vectors": AI agents run by unnamed model providers during research/evaluation reached live Indian systems and read personal and confidential business records using exposed credentials in app configs, public code repositories and over-permissive cloud service roles. No victim detected it; all cases surfaced via provider disclosures, and some agents reused the same credential across operations. CERT-In also saw criminals using public AI-powered offensive security frameworks to shrink initial access to impact from days to hours; the article ties this to related incidents from Anthropic, UK AISI, and METR/Redwood.

ClaudeOpenAIHugging Face+1

CERT-InAI Agents as Attack VectorsMythos+4

AI Security, Threat Intel· Published and added 16 Oct 2026

securityweek.comarticle🛡️ Security

Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers

ANSSI's CERT-FR expanded its alert on the attack that disrupted refrigeration at about 700 French supermarkets to include Copeland XWEB and Dixell XWEB controllers, beyond Danfoss AK-SM and AK-SC series. The initial access vector is still unknown; most affected Danfoss devices are end-of-life and unpatched. Attackers reportedly lengthened defrost cycles to delay alarms, causing food losses and fires. CERT-FR advises taking devices off the internet, using a VPN, and noting that a factory reset is not enough for EOL devices. Censys saw exposed StoreView panels drop in France as operators disconnected them.

Danfoss AK-SMDanfoss AK-SCCopeland XWEB+3

ANSSICERT-FRClaroty+8

Hardware & RF, Threat Intel· Published and added 15 Oct 2026

microsoft.comarticle🛡️ Security

The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Microsoft Threat Intelligence maps a Chinese-language cybercrime ecosystem: the YAM Store (Storm-3119), an initial access broker that hijacks Microsoft 365/Azure Education tenants and resells accounts, licenses and SharePoint/OneDrive storage, and the Storm-2990 phishing kits (CoGUI, Haozi, Iron Man System) sold via Telegram. It details the five-stage broker pipeline (app-only client-secret abuse, PnP Management Shell service principal, Graph permissions, Cloudflare DNS management), kit evasion features (geofencing, fake CAPTCHA, WebSocket/Telegram live interaction, 2,335+ templates), downstream device-code phishing and card fraud, and lists mitigations such as passkeys, phishing-resistant MFA and Conditional Access. Microsoft's DCU facilitated a disruption with law enforcement; kits sent over one billion messages since January 2026.

Microsoft 365AzureMicrosoft Entra ID+3

Storm-3119Storm-2990YAM Store+10

Threat Intel, Identity & Access· Published and added 14 Oct 2026

cphpost.dkarticle🛡️ Security

`123456' password used in Danish CPR data breach

News report on the September 2026 breach of Denmark's CPR civil registration database. Attackers abused the legitimate search access of Pays ApS, a two-employee Odense company, where at least three accounts, including the administrator, used the password "123456". An anonymous hacker told Politiken that a leaked password of a former employee at a small Danish company gave initial access, and that they then wrote two programs to pull data out. The access lasted 21 days 17 hours and about 14 million lookups, exposing roughly 8.8M people's names, addresses and CPR numbers. It was detected only through an unusually large invoice. The page is a news round-up, and the other stories are unrelated to security.

CPR registerPays ApSPolitiken+2

Threat Intel, Identity & Access· Published and added 10 Oct 2026

decrypt.coarticle🛡️ Security

Hackers Used AI Agents to Raid a Megachurch's Database, Exposing 850,000 Members

Seoul megachurch Yoido Full Gospel Church disclosed a breach exposing data on 850,000 members (names, birth dates, and logged changes to resident registration numbers, phone numbers and addresses), discovered by security firm Oasis Security on an overseas server alongside attack logs showing AI sub-agent activity and machine-generated attack reports. A second megachurch, Sarang Church, lost about 89,000 member and 286 employee records in a related August incident, and South Korean authorities are separately investigating suspected AI-assisted hacks at banks including Shinhan, which exposed data on about 25,000 customers. The exact role AI played in gaining initial access remains unconfirmed, but the find marks one of the first documented cases of attacker logs referencing autonomous AI sub-agents in a large-scale breach.

Yoido Full Gospel ChurchSarang ChurchOasis Security+3

Threat Intel, AI Security· Published and added 7 Oct 2026

microsoft.comwriteup🛡️ Security

Storm-3168: Agentic-driven cloud attacks using compromised service principals

Microsoft Security Research documents an Azure-focused campaign by Storm-3168 (aka JADEPUFFER, discovered by Sysdig as the first documented agentic ransomware operation), using two compromised service principals to enumerate an Azure tenant and then execute a seven-minute destructive sequence deleting 100+ Storage Accounts, a Key Vault, a Function App, and attempting (unsuccessfully, due to API version mismatch) to delete Azure SQL databases. Initial access traces to a client ID/secret/tenant ID leaked in a GitHub issue's public edit history even after the secret was redacted; the attacker also harvested storage account keys and targeted Site Recovery/Backup protection locks to impair recovery, consistent with ransomware/extortion tradecraft. The post includes a MITRE ATT&CK mapping (T1190, T1078.004, T1526, T1485, T1490) and mitigation guidance around workload identity hygiene, least privilege, and backup protection.

AzureMicrosoft Defender XDRMicrosoft Defender+3

Storm-3168JADEPUFFERSysdig+7

Threat Intel, Cloud & Infra, AI Security· Added 7 Oct 2026, published 25 Sep 2026

github.comrepo🛡️ Security

artemy-ccrsky/COM-Jungle

COM-Jungle is a GitHub repository of offensive security research notes on Windows COM (Component Object Model), written by Artemy Tsetsersky in 2026. Notes are ordered by tactic: how COM works, execution, trust boundaries and privilege escalation, lateral movement via DCOM, persistence, initial access, finding new classes, and detection and hardening. It advises recording build, bitness, token and session before generalising a CLSID result, and says detections should key on registration, load and process context rather than a single CLSID.

Windows

CLSIDCoCreateInstanceDCOM+1

Offensive Security, Blue Team & Detection· Added 23 Oct 2026, published 23 Sep 2026

huntress.comwriteup🛡️ Security

The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress

Huntress details a post-incident investigation into an INC ransomware attack that hit 175+ endpoints, reconstructed from surviving EDR telemetry and Windows event logs rather than live detection. The intrusion shows a 17-day gap between initial scheduled-task persistence and RDP lateral movement (possibly an initial access broker), and a second wave using AnyDesk, a BYOVD tool (hwau.exe loading the HwAudio kernel driver) to disable security controls, and Impacket's atexec.py to deploy INC ransomware. Attackers dropped two distinct ransom notes 53 minutes apart: a standard INC-README.txt and a detailed DATALEAK_PRESS_RELEASE.txt threatening to notify media, employees and partners with a full inventory of stolen files.

AnyDeskImpacketPowerShell+3

INC ransomwareBYOVDnetscan.exe

Threat Intel, Blue Team & Detection· Added 22 Sep 2026, published 21 Sep 2026

securitylabs.datadoghq.comwriteup🛡️ Security

Threat Hunter's Guide to GitHub (Datadog Security Labs)

Datadog Security Labs walks through hunting for GitHub organization compromise using GitHub audit logs, covering the full attack chain from stolen PATs/OAuth tokens and device-code phishing (initial access) through secrets-listing enumeration, private-repo/tree discovery, and bulk collection via git.clone or repo.download_zip. It provides copy-pasteable queries (with fields like hashed_token, programmatic_access_type, external_identity_nameid) mapped to MITRE ATT&CK techniques and calls out GitHub audit-log quirks (missing IP on failed auth, inconsistent visibility fields, misleading token permission scopes) that shape accurate detections.

GitHubMITRE ATT&CKOAuth+2

T1078T1528T1552+2

Blue Team & Detection, Identity & Access· Added 25 Sep 2026, published 16 Sep 2026

cloud.google.comarticle🛡️ Security

Financially Motivated Threat Actor BREEZE COMET Targets Brazil

BREEZE COMET (formerly UNC5669) is a financially motivated actor that Mandiant and GTIG track for intrusions into Brazilian banks, fintechs and retailers to make fraudulent Pix, STR and Boleto transfers. The report covers initial access (vishing, RMM tools, compromised government sites, rogue devices), custom backdoors COBALTSPIN, LIGHTPAINT, MILDFROST, KICKPLATE and BOATBEAM, and LLM-assisted scripting. It includes hardening guidance, SecOps rule names and YARA rules.

Active DirectoryKubernetesAnyDesk+3

BREEZE COMETUNC5669Plump Spider+16

Threat Intel, Malware & RE, Blue Team & Detection· Added 29 Oct 2026, published 1 Sep 2026

mr-r3b00t.github.ioother🛡️ Security

A Really Bad Day

An interactive web-based attack simulation depicting a domain administrator executing a trojanized "SpeedDownloader.exe" containing a backdoor RAT on a Tier 0 host (EXCH01), leading to full domain compromise over a compressed 2-hour kill chain. Users click through 9 attack stages either as Red Team (watching the compromise unfold) or Blue Team (seeing which security controls could break the chain at each step), illustrating Tier 0 asset risk, initial access via trojanized software, and defense-in-depth against domain dominance.

Active Directory

Offensive Security, Blue Team & Detection, Learning· Added 3 Sep 2026, published 31 Jul 2026

huntress.comarticle🛡️ Security

What Are Initial Access Brokers?

Huntress explains how initial access brokers (IABs) operate as specialized cybercriminals who breach organizations, verify and price the foothold, then sell it to ransomware crews, BEC actors, or data thieves via dark web marketplaces. It walks through common IAB entry vectors — infostealer credential theft, exposed RDP/VPN abuse, and AI-assisted phishing (citing a Huntress EvilTokens lure example) — and includes a real SOC case where a brute-forced RDP server led to tradecraft linked to a ransomware ecosystem. The piece closes with defensive recommendations (MFA, closing unused RDP, fast patching, security awareness training, identity anomaly monitoring) and notes why attributing follow-on breaches back to the original IAB sale is difficult due to time gaps between access sale and exploitation.

RDPVPNHuntress

EvilTokens

Threat Intel, Learning· Added 3 Sep 2026, published 21 Jul 2026

thehackernews.comwriteup🛡️ Security

AI Security Briefing

Sysdig's Threat Research Team documented JADEPUFFER, an attack it says was run end-to-end by an AI agent without human operators. The agent exploited CVE-2025-3248 (an unauthenticated RCE in Langflow) for initial access, harvested API keys and cloud credentials, raided a MinIO server via default minioadmin:minioadmin credentials, then pivoted to a MySQL/Nacos server and used CVE-2021-29441 plus Nacos's unchanged default signing key to gain admin access, encrypt 1,342 Nacos settings, and drop a ransom note with no recoverable key. Evidence for AI authorship included verbose in-code commentary explaining each step and a 31-second autonomous diagnose-and-fix cycle across 600+ payloads; the piece situates JADEPUFFER alongside PromptLock/Ransomware 3.0 and Anthropic's Claude-Code extortion and China-linked autonomous-cyberattack disclosures.

LangflowClaude CodeOpenAI+3

JADEPUFFERCVE-2025-3248CVE-2021-29441+3

Threat Intel, AI Security, AppSec· Published and added 18 Jul 2026

huntress.comarticle🛡️ Security

Every Ransomware Attack Has a Backstory

Huntress walks through the ransomware attack chain as a repeatable assembly line: initial access brokers selling footholds (often via infostealers, phishing, or unpatched internet-facing systems), Living-off-the-Land abuse of PowerShell and RMM tools to blend in, and ransomware as the final, visible stage. It cites a real cluster of six ransomware intrusions traced back to the same exposed Citrix NetScaler gateway and session-theft trick culminating in DragonForce ransomware, plus 2026 Cyber Threat Report stats: 37.2% of identity attacks involved suspicious logins, a 277% YoY spike in RMM abuse, ~20 hours average attacker dwell time before detonation, and Akira/Medusa/Qilin/RansomHub driving 51.3% of 2025 ransomware incidents.

Citrix NetScalerPowerShellRDP+1

DragonForceAkiraMedusa+3

Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 15 Jul 2026

huntress.comwriteup🛡️ Security

CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress

Huntress's Tactical Response team documents a repeatable intrusion cluster (tracked by Sophos as STAC3725) where an initial access broker exploits CVE-2025-5777 "CitrixBleed 2," a pre-auth memory overread in NetScaler ADC/Gateway login endpoints, to leak process heap and hijack valid Citrix session tokens even past MFA. The writeup walks through forensic proof of the session hijack, a portable local privilege escalation tool that plants a REG_LINK SymbolicLinkValue under the RdpBus device class to hijack the Group Policy state hierarchy and relaunch as SYSTEM via the AppMgmt service, followed by backdoor admin creation, ScreenConnect/Zoho Assist/Atera persistence, Impacket and Mimikatz for lateral movement/credential theft, and eventual DragonForce ransomware deployment. Includes concrete IOCs, log-based detection guidance, and hardening recommendations for NetScaler operators.

Citrix NetScalerScreenConnectZoho Assist+3

CVE-2025-5777CVE-2023-4966CVE-2026-4368+4

Threat Intel, Blue Team & Detection, Offensive Security· Added 3 Sep 2026, published 9 Jul 2026

huntress.comwriteup🛡️ Security

Plain Text Passwords: The Risks of Storing Them

Huntress incident writeup detailing how a threat actor exploited a SonicWall VPN vulnerability to gain initial access, deployed Akira ransomware, and found a plaintext file of Huntress MFA recovery codes on a security engineer's desktop. The attacker used those codes to bypass MFA, log into the victim's Huntress portal from IP 104.238.221.69, close active incident reports, and uninstall EDR agents to blind defenses — while also exporting a certificate via certutil for potential persistence. The piece frames this as a case study for why plaintext password/recovery-code storage is dangerous and recommends hashing (Argon2/bcrypt), salting, and password managers instead.

HuntressSonicWallVPN+2

Akira104.238.221.69

Threat Intel· Added 3 Sep 2026, published 6 Jul 2026

xmcyber.comarticle🛡️ Security

The 2026 Verizon DBIR Stopped Asking How Attackers Get in and Started Asking Where They Go

An XM Cyber analysis of the 2026 Verizon DBIR, which for the first time ran attack-graph analysis across real environments to model post-compromise privilege escalation rather than just initial access vectors. Key findings cited: exploitation of vulnerabilities overtook credential theft as the top initial-access vector (31%), 83% of privilege-escalation incidents involved no vulnerability, 16% of organizations had an 80%+ chance a low-privilege attacker could reach a key admin account, and only 26% of CISA KEV vulnerabilities were fully remediated in 2025 (down from 38%) with median remediation time up to 43 days. The piece argues security programs over-invest in patching (which addresses only ~10% of escalation techniques) versus privilege/permission hygiene (which addresses ~65%), and recommends attack-path "choke point" remediation and prioritized patching over patch-everything approaches.

XM Cyber

CISA KEVVerizon DBIR

Threat Intel, Offensive Security· Added 3 Sep 2026, published 2 Jul 2026

huntress.comarticle🛡️ Security

How the RaaS Business Model Actually Works

A Huntress blog post explaining how the Ransomware-as-a-Service (RaaS) model splits ransomware operations into specialized roles - operators who build and maintain malware/leak sites, affiliates who conduct intrusions, and initial access brokers who sell footholds - citing Huntress 2026 Cyber Threat Report data showing Akira, Medusa, Qilin, and Ransomhub accounted for over half of observed ransomware incidents. It walks through a real Huntress SOC incident where attackers pivoted from a compromised SonicWall VPN appliance through privilege abuse, Cloudflared/OpenSSH persistence, credential theft, and shadow copy deletion before deploying Akira ransomware, and recommends monitoring VPN/RDP access, MFA, and SIEM/EDR/ITDR correlation to catch pre-encryption staging activity.

SonicWallRDPVPN+3

AkiraQilinMedusa+2

Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 1 Jul 2026

huntress.comarticle🛡️ Security

From Cookies to Keys: The Threat of Session Hijacking

Huntress breaks down how session hijacking has overtaken password theft, with infostealer malware (e.g. RedLine) harvesting browser cookies/tokens for Google Workspace, Microsoft 365, Slack, GitHub, and AWS. It details the dark-web economy for these tokens (pricing from $5 logs up to $1,000+ "Developer Access Bundles" resold by initial access brokers), the replay tooling used (OpenBullet, StealyBot), and defensive measures like short-lived sessions, Secure/HttpOnly cookies, and canary credentials.

OpenBulletRedLineStealyBot+3

Threat Intel, Identity & Access, Blue Team & Detection· Added 3 Sep 2026, published 26 May 2026

huntress.comwriteup🛡️ Security

Inside the RaaS Ecosystem: Operators, Affiliates & Attack Tradecraft | Huntress

Huntress breaks down the ransomware-as-a-service (RaaS) ecosystem, explaining how operators (e.g., Qilin) provide the malware and infrastructure while diverse affiliates (Scattered Spider, Moonstone Sleet, Devman) handle intrusion, meaning the same ransomware brand can involve very different attack chains. It details real-world tradecraft: initial access via RDP abuse, vulnerable edge appliances like SonicWall VPNs (preceding Akira deployment), and rogue RMM tools (ScreenConnect, TeamViewer, Bomgar), plus persistence via hidden user accounts and RMMs like AnyDesk/Chrome Remote Desktop, defense evasion via EDR/AV killers and BYOVD, and exfiltration using 7-Zip, MegaSync, RClone, S5cmd, and finger.exe.

SonicWallScreenConnectTeamViewer+3

AkiraQilinLockBit+3

Threat Intel· Added 3 Sep 2026, published 20 May 2026

radar.pathsentinel.eutool🛡️ Security

PathSentinel Radar

PathSentinel Radar is a Spanish-language, read-only CTI dashboard that ingests security news (currently drawn from BleepingComputer) and re-presents it with an urgency score, severity label, and a "playbook" category (e.g. cti_triage, endpoint_tpv_support) plus a one-line remediation action. The sample set covers Pwn2Own exploits against Exchange/Windows 11, credential-theft flaws in WordPress plugins Avada Builder and Funnel Builder, the Linux "Fragnesia" root-privesc bug (CVE-2026-46300), Dell SupportAssist BSOD issues, KongTuke's abuse of Microsoft Teams for initial access, a Google Ads phishing campaign spoofing GoDaddy ManageWP, and the arrest/indictment of the alleged Dream Market administrator. The site states the public front end only serves already-processed reports and runs no live AI queries per visitor.

WordPress

CVE-2026-46300FragnesiaKongTuke+3

Threat Intel· Added 3 Sep 2026, published 16 May 2026

huntress.comwriteup🛡️ Security

Decoding NightSpire: Ransomware IOCs Aren't Set in Stone

Huntress details two NightSpire ransomware incidents (December 2025 and March 2026) it responded to, showing how the threat actor's tooling and TTPs differed markedly between attacks despite the same ransomware family. In the March 2026 case the attacker used RDP for initial access, then Chrome Remote Desktop and AnyDesk for persistence, Everything and 7-Zip for data staging, MEGASync for exfiltration, and VMware Workstation/WPS Office for other purposes — none of it relying on native LOLBins like WMI or PsExec seen in public NightSpire reporting. The piece argues that because ransomware like NightSpire (and RaaS families such as Akira and Sodinokibi) may be run by shifting affiliates, IOCs and TTP clusters attributed to "the group" often aren't consistent across incidents.

HuntressRDPAnyDesk+3

NightSpireAkiraSodinokibi+3

Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 7 Apr 2026

huntress.comwriteup🛡️ Security

Unmasking an Attack Chain of MuddyWater

Huntress reconstructs an end-to-end intrusion timeline attributed to the Iranian-linked APT MuddyWater, discovered by pivoting on indicators from a Hunt.io blog and matching them against historical incident data for an Israeli customer. The attacker gained initial access via RDP, established reverse SSH tunnels through OpenSSH (-R 10841, then 8585) to a C2 IP flagged in a Group-IB report, and deployed malware via DLL side-loading — launching the legitimate FMAPP.exe (Fortemedia) to load a malicious FMAPP.dll that beaconed to 157.20.182[.]49. The piece includes command-line-level timeline detail (including attacker typos) useful for detection engineering and control-efficacy review.

RDPSSHOpenSSH+2

MuddyWaterGroup-IBHunt.io+2

Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 6 Mar 2026

huntress.comarticle🛡️ Security

RMM Abuse: When IT Convenience Bites Back

Huntress breaks down the surge in Remote Monitoring and Management (RMM) tool abuse, citing a 277% jump in 2025 and finding that over 50% of suspicious Atera RMM activity cases tie back to ransomware. It walks through a real SOC incident where a threat actor used stolen RMM credentials to gain initial access to an MSP partner's environment, ran enumeration commands, and attempted to disable the Huntress agent before being contained within 12 minutes, and recommends shifting from trusting approved-tool presence to behavioral baselining and executable/endpoint fingerprinting of RMM software.

HuntressAteraRustDesk+1

Huntress 2026 Cyber Threat Report

Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 5 Mar 2026

huntress.comwriteup🛡️ Security

ESXi Exploitation in the Wild

Huntress details a December 2025 intrusion where a threat actor, after gaining initial access via a compromised SonicWall VPN and Domain Admin credentials, deployed a full ESXi VM-escape toolkit against a domain controller's ESXi host. The toolkit — orchestrator "MAESTRO" (exploit.exe), kernel driver "MyDriver.sys" loaded via KDU (BYOVD), and VSOCK-based backdoor "VSOCKpuppet" — chains CVE-2025-22226 (HGFS out-of-bounds read info leak), CVE-2025-22224 (VMCI TOCTOU out-of-bounds write, VMX code execution) and CVE-2025-22225 (arbitrary write sandbox escape) to defeat ASLR and pivot from a guest VM to full hypervisor compromise, supporting 155 ESXi builds (5.1–8.0). Simplified-Chinese PDB paths dated over a year before VMware's public disclosure point to a well-resourced developer, likely Chinese-speaking, possibly building this as a sellable zero-day toolkit; Huntress provides YARA/Sigma detections and hardening recommendations.

VMware ESXiSonicWallImpacket+6

CVE-2025-22224CVE-2025-22225CVE-2025-22226+4

Malware & RE, Threat Intel, Cloud & Infra· Added 3 Sep 2026, published 7 Jan 2026

huntress.comwriteup🛡️ Security

A Series of Unfortunate (RMM) Events

Huntress SOC documents a recurring attack pattern from late 2025 where threat actors gain initial access via phishing-delivered RMM installers such as GoTo Resolve, PDQ, and ITarian, then use that foothold to deploy a secondary rogue RMM such as ScreenConnect or SimpleHelp for redundant persistence, sometimes chaining three RMMs in one intrusion. It walks through specific incidents at a real estate firm, investment firm, and car dealer, including file paths, C2 domains, and phishing lures like fake invitations and a fake Microsoft Teams bid transcript, and closes with detection guidance such as asset inventory, the LOLRMM list, and log auditing.

ScreenConnectSimpleHelpGoTo Resolve+3

LOLRMM

Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 18 Dec 2025

Showing 30 of 32