174 results for “Huntress”

Huntress describes two incidents where attackers enrolled victims in attacker-controlled MDM tenants (Hexnode and Rippling) and used them to push ScreenConnect as SYSTEM. One began with a fake DocuSign MSI that bundled Hexnode; the other with a fake Teams calendar link leading to Rippling enrollment. Removing ScreenConnect did not stop reinstalls. The post lists IOCs, a detection chain and mitigations.

huntress.comwriteupPublished and added 28 Oct 2026🛡️ Security

Huntress investigation of incidents in September and October 2025 where a compromised camera management application (CMS.exe) was the initial access vector. Attackers dropped rs.win32.exe, a reverse shell, and sideloaded modified zlib DLLs (IPHLPAPI.DLL, samcli.dll) via the legitimate Microsoft WpcMon.exe in AppData, with Run key persistence and beaconing to 144.172.116[.]37. Includes detection pivots and hardening advice.

huntress.comwriteupAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

Huntress analyzes Entra sign-in and audit logs from the ConnectWise Cloud Backup credential abuse of 15 October 2026 to judge whether a script, a person or an LLM agent drove it. It found a thread-pool spray, trial-and-error credential planting with a retry added within 55 seconds, and pilot-then-batch targeting. Huntress rates LLM involvement low to medium on its own data and medium to high with Microsoft's Storm-0940/ARTEX attribution. It ends with detections for service principal role self-assignment and vendor app baselining.

huntress.comwriteupPublished and added 26 Oct 2026🛡️ Security

Recap of a Huntress Tradecraft Tuesday session (October 2026) on phishing kits that target Microsoft 365 tokens, including EvilTokens (a device-code phishing campaign abusing Railway) and the Kali365 control panel. It explains device-code phishing, adversary-in-the-middle and token replay. It lists detections (unfamiliar cloud sign-ins, device-code auth, new devices) and response steps (revoke refresh tokens, remove rogue devices, block device-code flow).

huntress.comarticlePublished and added 22 Oct 2026🛡️ Security

Huntress analysis of a July to September 2026 token replay ("token spraying") campaign: 497 successful Microsoft 365 sign-ins across 79 organizations, replayed from six addresses in 193.26.115.0/24 (1337 Services GmbH). Tokens came from AiTM relays, device-code phishing and social engineering. It covers four phases, rogue Entra devices, MFA method swaps, hidden inbox rules, hunting queries and Conditional Access guidance.

huntress.comwriteupPublished and added 22 Oct 2026🛡️ Security

Huntress analysis of an Amazon-themed ClickFix campaign that used a Google sponsored result, a fake Amazon login on Google Sites and a fake CAPTCHA to make victims run the Windows finger utility. The .plan script drives IronPython, a Cyrillic-substituted Base64 Python loader, Doina, a Node.js stage, Lumma Stealer via sRDI, and a pirated NetSupport RMM. It lists C2 domains and gives detection tips (aclk/gclid markers, blocking the Run dialog).

huntress.comwriteupPublished and added 21 Oct 2026🛡️ Security

Huntress rapid-response post on php2shell, two leaked critical PHP core vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2 each) reported as remote code execution. The PHP team moved its security release to 21 October 2026, 14:00 UTC, after the leak. It lists hunting cues such as php-fpm, php-cgi or apache2 spawning shells, interpreters or download tools, plus inventory and patch steps. No root cause, affected versions, PoC or IOCs were public at writing.

huntress.comadvisoryPublished and added 21 Oct 2026🛡️ Security

CVE-2026-110936 is a DLL search-path flaw in Siemens Software Center (CVSS v4 8.4), fixed in version 4.0.9.8. Attackers paired a validly signed copy of the program (3.5.8.7) with their own DLLs for side-loading, delivered through the Romulus ClickFix platform. Siemens says its channels were not breached and advises behavior-based detection over file hashes. Huntress reported the flaw.

securityweek.comarticlePublished and added 19 Oct 2026🛡️ Security

ConnectWise suspended its Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management services in October 2026 after a compromised application credential was used to access customers' Microsoft 365 tenants. Huntress saw the Cloud Backup identity sign in to 162 tenants on 15 to 16 October and attacker IP 144.172.64[.]128 try nearly 1,000 Entra tenants, with over 300 successful sign-ins. In one tenant, the Cloud Management Teams app added itself to Global Administrator and added client secrets to other apps. No restoration timeline has been given.

securityweek.comarticlePublished and added 19 Oct 2026🛡️ Security

Huntress documents abuse of ConnectWise Cloud Backup (formerly SkyKick) vendor app credentials, used on October 15 from 144.172.64[.]128 to obtain Microsoft Graph tokens in at least 162 customer M365 tenants via client assertion. In one tenant, a ConnectWise Cloud Management Teams app self-assigned Global Administrator and added client secrets to an MSP management app and Huntress's own app, a persistence technique. The post lists application IDs, Entra sign-in and audit-log checks, user-agent indicators (kiota-dotnet vs Python-urllib/3.12, curl/7.88.1), and mitigation steps such as disabling (not deleting) the enterprise apps and reviewing added credentials.

huntress.comwriteupAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

Huntress post on where accounts remain exposed after a passkey rollout. It covers passkey-themed social engineering, the EvilTokens device-code phishing campaign (344 organizations in about 16 days), weak enrollment and recovery, SpecterOps research on Windows WebAuthn hooking on compromised endpoints, and the trade-offs between synced and device-bound passkeys. It closes with ITDR-style post-login monitoring, containment steps (revoke sessions, remove rogue authenticators, hunt inbox rules, OAuth grants, forwarding), and a five-question deployment checklist.

huntress.comarticlePublished and added 14 Oct 2026🛡️ Security

Huntress analyzes an October incident where an admin searching Bing for a WatchGuard VPN download landed on watchguard-vpn[.]net, a lookalike site whose popup.js harvests Server/Login/Password, deliberately rejects the first submission to get a second set, and posts to watchguard-ssl[.]online. Unlike earlier iterations (Secplicity, Microsoft Storm-2561), the final payload is the genuine, validly signed WatchGuard installer from the official CDN, so no malware is present for endpoint tools to flag. Covers infrastructure timeline, thin VirusTotal detections, and defender guidance (MFA, monitoring VPN logins from hosting ASNs, blocking domains, publishing official download links).

huntress.comwriteupAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

Explains the "non-negotiable" requirements for a Conditional CMMC Level 2 (Self) status under 32 CFR 170.21. The minimum score is 88 of 110, every 3- and 5-point NIST SP 800-171 requirement must be implemented, plus a short list of 1-point ones. Those mandatory items add up to 64 points, which leaves 24 of the remaining 46 one-point requirements to choose. It also covers how this differs from legacy DFARS 252.204-7019/7020 self-assessments scored with the DoDAM (-203 to 110), and how the 180-day POA&M closeout window can silently expire a status in SPRS. The post ends with a Huntress product mapping.

huntress.comarticlePublished and added 12 Oct 2026🛡️ Security

Huntress reports in-the-wild exploitation of two unpatched AhsayCBS vulnerabilities (CVE-2026-105133 and CVE-2026-105134) affecting all versions up to and including the latest 10.3.4. Attackers chain an authentication bypass with OS command injection via the Replication Receiver API to gain unauthenticated RCE with System privileges, drop JSP webshells, deploy XMRig cryptominers disguised as Microsoft Edge, achieve persistence using a modified NSSM binary as a fake Microsoft Edge Update service, and load the vulnerable WinRing0x64.sys driver for kernel-level miner access (BYOVD). At least five organizations were targeted as of October 8; Huntress recommends restricting management-interface access until a patch is released.

securityweek.comarticlePublished and added 9 Oct 2026🛡️ Security

Huntress documents active exploitation of two AhsayCBS (Ahsay Cloud Backup Server) vulnerabilities being chained together: CVE-2026-105133, an authentication bypass in checkSysPwd, and CVE-2026-105134, an unauthenticated RCE in the Replication Receiver's UpdateReceivers.do endpoint that grants SYSTEM. Attackers use the chain to drop JSP webshells, then deploy a renamed XMRig cryptominer (masquerading as msedge.exe via a modified NSSM binary), a Task-Manager-aware anti-detection PowerShell script, and the vulnerable WinRing0x64.sys kernel driver for hardware-level miner access. Huntress provides IOCs, mitigation guidance (restrict management interface, re-image if compromised) and four Sigma rules targeting each stage of the intrusion chain.

huntress.comwriteupAdded 9 Oct 2026, published 8 Oct 2026🛡️ Security

Huntress details a phishing campaign that abuses legitimate Microsoft Power BI dashboards (app.powerbi.com) to host a fake "Download Reference" lure that bypasses mail filters trusting the Microsoft domain. Clicking the lure triggers browser/environment fingerprinting and Telegram-bot-based victim telemetry exfiltration via attacker domains (dailylifeproject.site, burnsworth.site, etc.), then silently downloads rogue ScreenConnect installers; a chained CMD/PowerShell script (SCAutoFix.ps1) deploys a second ScreenConnect instance, uninstalls the first for evasion, drops the defense-evasion tool HideUL_x64.exe, and sets a recurring scheduled task before Huntress's SOC intervened.

huntress.comwriteupPublished and added 7 Oct 2026🛡️ Security

Huntress researchers reconstruct an Akira ransomware attack timeline using forensic artifacts collected after the Huntress agent was installed post-compromise, including Windows Registry Shellbags, Event Logs, and Akira ransomware log files. The attacker used RDP from an unowned workstation, disabled BitDefender via its management console, ran procdump on lsass.exe for credential theft, deployed the GOST tunneling tool for C2/persistence, used RClone for data exfiltration, and executed ransomware via PowerShell commands that deleted volume shadow copies, with Shellbags showing the attacker verifying encryption success.

huntress.comwriteupPublished and added 6 Oct 2026🛡️ Security

Huntress explains why endpoint security typically misses ClickFix (no file artifact to scan) and how its Attack Disruption engine detects it instead: matching the obfuscated command-line shape gated on the parent process always being explorer.exe for Windows+R/Run-dialog execution. The post walks through a real incident where a user pasted a caret-obfuscated finger.exe download cradle disguised with Unicode padding to hide 'push enter' social engineering text, killed in under 1.25 seconds across four spawned processes, and describes a fix for variants that use 'start' to detach the payload process from its killed parent.

huntress.comwriteupPublished and added 5 Oct 2026🛡️ Security

An hour-by-hour ransomware incident response playbook written by UnderDefense CEO Nazar Tymoshyk and published on Huntress's blog, covering confirmation, containment, exfiltration detection, backup/recovery pitfalls, and root-cause investigation in the first 24 hours of an attack. It draws on Mandiant's M-Trends 2026 report (14-day median dwell time, 22-second access-broker-to-ransomware handoff) and CISA's November 2025 Akira advisory (VPN without MFA as primary access vector, exfiltration via FileZilla, WinRAR, WinSCP, RClone, Mega and Ngrok, credential dumping with Mimikatz and LaZagne, PowerShell-based shadow copy deletion) alongside real UnderDefense engagement anecdotes.

huntress.comwriteupAdded 3 Oct 2026, published 2 Oct 2026🛡️ Security

Huntress commissioned a survey of 501 US knowledge workers (excluding security professionals) on AI usage, training, and policy at work. Key findings: 43% received no formal AI security training, only 26% have a written AI policy, and when asked if a company chatbot could plausibly be exploited via prompt injection, only 26% of workers recognized the risk (31% even among those with a written policy). It also surfaces behavioral risk data, like 25% of workers saying they'd copy a client contract into a personal AI account rather than check with IT first.

huntress.comarticleAdded 3 Oct 2026, published 2 Oct 2026🛡️ Security

Huntress's "Tragic Quadrant" ranks the cyber threats its SOC sees most often against small/mid-sized businesses by prevalence and blast-radius risk, drawing on 2026 telemetry from 5M+ endpoints and 15M identities. It highlights RMM abuse (45% of endpoint incidents in Q1 2026), mailbox-rule manipulation feeding BEC (24.6% of ITDR signals), AiTM session-token theft bypassing MFA (18.9% of identity threats), plus device code phishing (the EvilTokens PhaaS kit hit 344 orgs in 16 days using Railway-hosted infrastructure and spoofed Cisco/Trend Micro/Mimecast redirect links), ClickFix clipboard-paste infections leading to LummaC2 infostealer compromise, and emerging AI-platform abuse (the FakeAgent campaign hosted a malicious Claude Artifact on claude.ai to drop SectopRAT, hitting 29 organizations in two days).

huntress.comarticlePublished and added 1 Oct 2026🛡️ Security

Huntress breaks down how Microsoft Defender Antivirus (MDAV) path/extension exclusions can be abused to hide malicious binaries from scans, detailing the registry internals (HKLM...Windows Defender\Exclusions vs the GPO-driven Policies key) and the four ways to set them: PowerShell (Set/Add-MpPreference), the MSFT_MpPreference WMI class, GPO, and direct registry edits. It documents real-world abuse by GootKit (2019), WhisperGate (2022), and Muddled Libra (2024), plus an under-documented trick where setting HideExclusionsFromLocalAdmins blocks even SYSTEM from querying exclusions via PowerShell/WMI, and describes the registry-level telemetry and detections Huntress built to catch both behaviors.

huntress.comwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Huntress details a four-act intrusion against a shared parks-and-recreation management platform running on IIS, where an attacker first tried noisy unauthenticated exploits (IIS 8.3 tilde enumeration, WebDAV verb abuse, upload-handler bypasses) before simply registering a member account and uploading .aspx webshells via a member-file upload feature across three servers. The attacker enumerated hosts, extracted web.config/connection strings, hunted for cardholder data (Fortis/MXMerchant webhook logs, CVV/card-number strings), then escalated to timestomping, re-deploying known-filename webshells, and finally injecting an AI-generated PowerShell/JS dropper into a trojanized jQuery file to turn site visitors' browsers into WebRTC/WebSocket C2 clients (ririmochii/bubuneeko Cloudflare Workers infrastructure). Includes a zh-CN PowerShell user-agent string used for attribution and full command/IOC listings useful for detection engineering.

huntress.comwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Huntress researchers document a campaign where attackers built a malicious ChatGPT Custom GPT ("Plus 5.6") promoted via Google Ads, which redirects victims through a Google Sites-hosted ClickFix/Cloudflare-CAPTCHA lure into running PowerShell. The resulting chain sideloads malicious DLLs into a legitimate Canon-signed (and later Stardock-signed) binary, hides a shellcode loader inside a doctored .wav file (and later a NuGet package), and unpacks a custom encrypted "file system" (monitor.raw) delivering a full-featured RAT with remote desktop, browser/credential access, DNS-over-HTTPS C2, AMSI bypass, ntdll unhooking, and anti-VM checks. Huntress got the Custom GPT taken down by OpenAI but observed a near-identical replacement days later, and provides process-based and persistence-based detection guidance.

huntress.comwriteupAdded 29 Sep 2026, published 28 Sep 2026🛡️ Security

Huntress SOC analyzes an intrusion that began with exploitation of Samsung MagicINFO (CVE-2025-4632, after incomplete fix of CVE-2024-7399) via tomcat9.exe. The actor took three tries to install AnyDesk (certutil and PowerShell attempts were blocked by Defender), created an 'oldadministrator' account, disabled Defender, then ran Silent XMR Miner Builder, which compiled a Monero miner on the endpoint using csc.exe, cvtres.exe, donut, tcc and MinGW gcc. The miner ran masquerading as explorer.exe against C3Pool; the post gives command lines and detection ideas such as unusual compiler child processes from an unsigned parent and explorer.exe with mining arguments.

huntress.comwriteupPublished and added 24 Sep 2026🛡️ Security

Huntress researcher Andrew Schwartz demonstrates a novel OAuth token-theft technique: a sideloaded AppX package registered via Add-AppxPackage -Register (requiring only Developer Mode, no admin beyond that toggle) can set ContentUriRules WindowsRuntimeAccess="all" so attacker-controlled JavaScript rendered inside the Microsoft-signed WWAHost.exe process gets full WinRT access, including the legacy WebAuthenticationBroker OAuth API. Using Microsoft Office's own client ID and the oob redirect URI, the attacker triggers a genuine login.microsoftonline.com/MFA dialog with no browser chrome, captures the auth code, and exchanges it for an access token plus a long-lived refresh token carrying the full Office delegated Graph scope set (mail, files, Teams, directory, AuditLog.Create) — validated end-to-end against a live Entra ID tenant with MFA and default Conditional Access. The post frames it as a class of vulnerable signed AppX host binaries sharing the same WinRT activation layer, and provides a Sigma rule keyed on the MSAppHost/3.0 EdgeHTML user agent reaching non-Microsoft destinations, plus Sysmon/Event ID and GPO-based mitigations (restricting Developer Mode, Conditional Access, shorter refresh-token lifetimes, CAE).

huntress.comwriteupPublished and added 23 Sep 2026🛡️ Security

Huntress details a 2026 DarkMe RAT campaign that ditches the zero-days (CVE-2023-38831, CVE-2024-21412) previously used by the Water Hydra/EvilNum-linked group in favor of a plain phishing email delivering a disguised .pif file. The writeup reverse-engineers the full chain — msiexec pulling a wrapped MSI, a WSF stager, three obfuscated VB6 loader DLLs (Coconout.dll, Use.dll, Finalized.dll), a novel 329-app "inverted sandbox" gate, process hollowing into a signed clspack.exe, and Locked:// protocol-handler persistence — and corrects prior public reporting by showing the payload's "single-byte XOR" is actually a broken RC4 implementation. It closes with fresh C2 infrastructure (thatawful[.]boutique, port 7712), OSINT on delivery domains (including a related ClickFix/Efimer campaign), and concrete Sigma-style hunting rules and remediation steps.

huntress.comwriteupAdded 23 Sep 2026, published 22 Sep 2026🛡️ Security

Huntress ran a controlled eval (forked from Rails core team's rails/lemans harness) measuring whether Claude Fable 5.1 in Claude Code chooses built-in Rails APIs over hand-rolled equivalents, starting from a 48% baseline. They tested three interventions—a four-line CLAUDE.md rule, a Rails-gem lookup tool, and a Claude Code Stop-hook reviewer that has a second model critique the diff—and combined they reached 100% (28/28) API recall across seven eval tasks, with statistical significance via McNemar's test. The piece includes concrete prompts, the CLAUDE.md rule text, and the reviewer hook prompt, making it directly reusable for other coding-agent harnesses.

huntress.comwriteupAdded 23 Sep 2026, published 22 Sep 2026🧠 AI

Huntress details a post-incident investigation into an INC ransomware attack that hit 175+ endpoints, reconstructed from surviving EDR telemetry and Windows event logs rather than live detection. The intrusion shows a 17-day gap between initial scheduled-task persistence and RDP lateral movement (possibly an initial access broker), and a second wave using AnyDesk, a BYOVD tool (hwau.exe loading the HwAudio kernel driver) to disable security controls, and Impacket's atexec.py to deploy INC ransomware. Attackers dropped two distinct ransom notes 53 minutes apart: a standard INC-README.txt and a detailed DATALEAK_PRESS_RELEASE.txt threatening to notify media, employees and partners with a full inventory of stolen files.

huntress.comwriteupAdded 22 Sep 2026, published 21 Sep 2026🛡️ Security

Huntress analysts detail two Settra ransomware incidents (July and September) observed in customer environments, documenting the threat actor's use of the MeshAgent RMM for persistence, BYOVD via the gdrv.sys driver, and anti-forensic techniques including Windows Event Log clearing, reagentc /disable, diskpart-based recovery partition removal, and cipher.exe free-space wiping. The post includes specific IOCs — C2 IPs 45.13.122[.]7 and 193.5.65[.]114, the recurring workstation name WIN-LIVFRVQFMKO, and the RESTORE_FILES.txt ransom note — supplementing prior public reporting from MoxFive and SOCRadar on this newer ransomware variant first seen in June.

huntress.comwriteupAdded 22 Sep 2026, published 17 Sep 2026🛡️ Security

Huntress SOC analysts Ryan Dowd and Jon Semon tore apart a live social-engineering campaign that began with a fake CoinDesk marketing exec DMing a researcher a Google Doc containing a container-bound Apps Script sidebar. The script ran client-side without OAuth consent, exfiltrated victim IP/geolocation/wallet presence via the Telegram API, then routed macOS users to a piped zsh/DMG AMOS stealer chain and Windows users through ClickOnce and PowerShell loaders using three stolen or fraudulent code-signing certificates (a Norwegian company, Discord, and Lenovo). The Windows chain culminated in NetSupport Manager RMM abuse, a Ledger wallet implant, and a self-generated rogue root certificate authority (spoofing Google Trust Services) installed via MsBuild.exe hollowing to silently intercept HTTPS traffic, which the authors flag as the artifact most likely to survive incident remediation short of full reimaging.

huntress.comwriteupAdded 11 Sep 2026, published 15 Sep 2026🛡️ Security

A Huntress blog post breaking down how attackers abuse Windows Volume Shadow Copy Service (VSS) beyond the well-known "delete shadow copies before ransomware detonation" pattern — including creating shadow copies to quietly extract NTDS.dit for credential access, and manipulating shadow copy size/configuration. It details why single VSS events (creation/deletion) are noisy, useless alerts on their own, and describes how Huntress correlates VSSAdmin activity with lateral movement, credential-harvesting commands, and process lineage over a time window, illustrated with a real incident involving PsExec, vssadmin create shadow against a domain controller, a blocked cleanup attempt, and follow-on DNS enumeration.

huntress.comarticleAdded 22 Sep 2026, published 15 Sep 2026🛡️ Security

A DFIR field notes post describing how an analyst pivoted from a Microsoft Defender "Behavior:Win32/RegDump.SA" alert (flagged on svchost.exe running as SYSTEM) to identify Impacket's secretsdump.py activity. MFT analysis revealed a leftover temp file (ASOWCIKI.tmp) matching Impacket's RemoteOperations naming pattern (8 random ASCII chars + .tmp) for a partially-saved SAM registry hive, and the post explains why svchost.exe appears in telemetry due to the Remote Registry service being abused over MS-RRP/winreg via SMB. It also cross-references a similar Huntress case (April 2026) that additionally observed SCM Event ID 7040 (Remote Registry service enabled) as a corroborating artifact.

dfir.chwriteupAdded 13 Sep 2026, published 11 Sep 2026🛡️ Security

A Huntress SOC-informed guide to endpoint hardening, explaining why checklist-only compliance approaches fail and detailing real intrusion paths observed in incidents: internet-exposed RDP brute-forced by scanners, RMM tool abuse delivered via phishing (277% spike in 2025), and ClickFix attacks that trick users into pasting malicious commands into the Windows Run prompt. It closes with a practical weekly checklist covering external exposure scanning, local admin rights reduction, Windows Defender tamper protection, and disabling SMBv1/legacy protocols.

huntress.comarticleAdded 11 Sep 2026, published 10 Sep 2026🛡️ Security

Part 2 of a Huntress series on AD RMS shows how any Service Group member can export the deployment's root SLC private key via the admin SOAP surface's Trusted Publishing Domain (TPD) operation, then use it to offline-decrypt any document the cluster has ever protected — no server contact required. The author goes further, forging XrML Rights Account Certificates signed with the stolen SLC key to trick a live AD RMS server into issuing genuine use licenses for arbitrary/impersonated identities (a "hybrid" of a Golden Ticket and Silver Ticket), and releases the SharpRMS tool that implements extraction, decryption, and RAC forgery. Because the SLC key has a 255-year certificate and no rotation mechanism, the compromise is permanent for all previously protected content, unlike KRBTGT which can be reset to invalidate forged Kerberos tickets.

huntress.comwriteupAdded 11 Sep 2026, published 10 Sep 2026🛡️ Security

Huntress analyzed a fake GTA6 game ISO (some padded to 100GB+ with junk data) distributed via SEO poisoning, gaming forums, and torrents ahead of the game's real release. The ISO's "installer" drops a Russian-language crack-themed installer that stages multiple NJRAT copies, a DCRAT implant, the Mercurial Grabber infostealer (exfiltrating browser/Discord/Roblox/Minecraft data via Discord webhooks), Chaos ransomware repurposed as a destructive wiper (with a fake "license not found" error to mask the compromise), and an unexplained Yandex Browser install. The writeup includes IOCs (C2 IPs, ngrok tunnel, hosts-file modifications, malicious Discord webhook URL) and notes current Windows Defender detects the components.

huntress.comwriteupAdded 11 Sep 2026, published 9 Sep 2026🛡️ Security

Huntress SOC details two August incidents where phishing emails led victims through a fake CAPTCHA/Adobe PDF Reader lure into a browser-in-the-browser (BiTB) page spoofing get.adobe.com, tricking them into installing a ScreenConnect client disguised as an Adobe Reader update. The installer chained to a second rogue ScreenConnect client via curl/cmd.exe, both registered as Windows services for persistence, then executed defense-evasion binaries (HideCursor.exe, HideUL.exe) to hide cursor/screen activity before Huntress disrupted the intrusions. Full IOCs (domains, ScreenConnect client IDs/relays, file hashes/paths) are included for defenders.

huntress.comwriteupAdded 11 Sep 2026, published 9 Sep 2026🛡️ Security

Part 1 of a Huntress research series on Active Directory Rights Management Services (AD RMS), explaining its PKI-based trust model (Server Licensor Certificate signing content keys), why it's still deployed despite Microsoft's deprecation push toward Azure Information Protection, and how to fingerprint and enumerate a cluster from an unprivileged domain account. It introduces SharpRMS, a custom C# tool that speaks the AD RMS SOAP protocol to enumerate clusters and rights-policy templates, and shows how local AD RMS Service Group membership (not Domain Admin) gates the administrative surface where the SLC private key can eventually be reached — setting up Part 2's key extraction and offline decryption.

huntress.comarticlePublished and added 8 Sep 2026🛡️ Security

Huntress details a campaign in which social-engineering (tech-support scams, Quick Assist, malicious downloads) leads to rogue ScreenConnect installs that deploy a four-stage VBScript loader (1.vbs–4.vbs). The loader profiles the host (checking for EDR products, existing ScreenConnect, RAM size), fetches an AES-encrypted payload via a Dropbox-hosted map file, and drops one of three packages: a user-level backdoor, a persistence/privesc kit, or a tunneling+cryptomining bundle (wstunnel/XMRig plus the vulnerable WinRing0 driver for BYOVD). A backdoored ScreenConnect client then re-pushes the VBScript chain to every newly connected Host session via ScreenConnect's file-transfer API, giving the campaign worm-like self-propagation — which ConnectWise later confirmed stems from CVE-2026-84869, a 9.9 CVSS flaw in unauthorized file-transfer execution, patched in ScreenConnect 26.6.5.

huntress.comwriteupAdded 8 Sep 2026, published 3 Sep 2026🛡️ Security

Huntress blog post clarifying that DoD's July 13 "strategic pause" only suspended CMMC Phase 2 third-party certification requirements (for solicitations after Nov 2026), while Phase 1 self-assessments, SPRS scoring, and DFARS 252.204-7012's 72-hour CUI incident reporting remain fully in force and now face closer DIBCAC/DOJ False Claims Act scrutiny. It also flags the FAR Council's June 23 proposed CUI rule (part of the Revolutionary FAR Overhaul), which would extend 72-hour breach reporting and a NIST 800-171 Rev 3 baseline to all FAR-based federal contractors, not just the defense industrial base, creating a temporary split between CMMC's Rev 2 and the FAR's Rev 3. It closes with a breakdown of 32 CFR 170.21's strict POA&M limits (no POA&M at Level 1, minimum 88/110 score and only 1-point requirements eligible at Level 2) and practical questions MSPs should ask clients about federal contract exposure.

huntress.comarticleAdded 8 Sep 2026, published 2 Sep 2026🛡️ Security

Huntress researchers uncovered the operator console for "Knight Office," a Flask-based adversary-in-the-middle (AiTM) phishing kit used to steal Microsoft 365 session tokens via a DocuSign-themed, self-spoofed lure that routes victims through Monday.com redirects and a compromised Joomla site to a fake Microsoft device-code authentication page. After capturing tokens, the attacker registered a rogue device in Microsoft Entra ID and bound a Windows Hello for Business key credential to the compromised account to maintain persistent, MFA-bypassing access even after token revocation. The writeup details IOCs (IPs, .vu domains, User-Agent strings), links the campaign to hundreds of reported phishing emails since April, and gives defenders concrete hunting/response steps around callback-proxy sign-ins and newly registered WHfB credentials.

huntress.comwriteupAdded 8 Sep 2026, published 2 Sep 2026🛡️ Security

Huntress dissects a trojanized Exodus crypto wallet installer (v24.33.4, unsigned MSI built with WiX) that installs a genuine wallet but patches Electron's show()/focus()/center() methods so no window ever appears, then loads a modular RAT via a hand-written reflective PE loader implemented in JavaScript using the Node.js koffi FFI library. The RAT (VNC, SOCKS proxy, browser-credential stealer, recon module) beacons over WebSockets and uses Azure Table Storage as a dead-drop C2 channel to blend into legitimate cloud traffic, while delivery abuses double-extension .pdf.js phishing, ZIP-staged JS files, and an unused search-ms/WebDAV technique; the writeup also covers multi-layer string-array/arithmetic deobfuscation and includes full IOCs and mitigation guidance.

huntress.comwriteupAdded 3 Sep 2026, published 1 Sep 2026🛡️ Security

Huntress details a phishing campaign that tricks victims into installing a legitimately signed Faronics Deploy agent disguised as Adobe/Zoom documents, enrolling endpoints into an attacker-controlled deployment console. The threat actors then abuse Faronics' remote script execution to pull PowerShell payloads (via curl, mshta, msiexec) from GitHub-hosted staging and install ScreenConnect for persistent remote access. The post identifies key forensic artifacts (C:\ProgramData\Faronics\Logs\ScriptRunner.log and the deployment's unique "ck" identifier) that defenders can use to trace attacker infrastructure and cluster malicious enrollments, and notes Faronics' response to disrupt abuse after Huntress's disclosure.

huntress.comwriteupAdded 5 Sep 2026, published 31 Aug 2026🛡️ Security

A Huntress blog post walks Australian boards through ASD's 2025-26 cyber security guidance and its companion frontier-AI cyber threat paper, citing the $12.5B FY23-24 espionage cost figure and the July 2026 Hugging Face autonomous-agent security incident (later linked by OpenAI to an internal cyber-capability evaluation) as evidence that AI is compressing attack timelines from days to hours. It illustrates ASD's "assume compromise" stance with real Huntress SOC cases — catching a VPN intrusion via correlated failed-login logs, and using ransom-note/file-extension artefacts plus sub-60-second mass host/account isolation to contain active ransomware — arguing AI should accelerate detection but remain human-supervised rather than replace analyst judgment.

huntress.comarticleAdded 3 Sep 2026, published 30 Aug 2026🛡️ Security

Huntress security team shares their internal strategy for running monthly phishing simulations, including how they rotate lures (payment offers, spoofed conferencing tools), track click rates and report-before-click as success metrics, and use repeat-clicker data to target individualized training. Includes real click-rate trends from their own employees across January-February campaigns showing how difficulty escalation and exposure therapy reduce susceptibility over time.

huntress.comwriteupAdded 3 Sep 2026, published 28 Aug 2026🛡️ Security

Huntress details five modern phishing techniques that bypass traditional "check the URL" training and MFA: ClickFix (fake CAPTCHA tricking users into running Win+R/paste commands to execute malware), Browser-in-the-Browser (fake HTML popup windows mimicking OAuth login prompts with forged address bars/padlocks), ConsentFix (dragging an identity icon to leak an OAuth authorization code that attackers trade for Microsoft Entra ID access/refresh tokens), device code phishing (abusing the legitimate microsoft.com/devicelogin flow to authorize an attacker's device via a code, seen weaponized in PhaaS kits like EvilTokens), and fake video-conference (Teams/Zoom/Google Meet) waiting-room overlays that push a malicious "driver update" install. Each section explains why the technique defeats standard security-awareness training and how Huntress's simulated phishing scenarios replicate it.

huntress.comarticleAdded 3 Sep 2026, published 28 Aug 2026🛡️ Security

Huntress details active exploitation of an authorization-bypass flaw in PaperCut NG/MF (CVE-2026-81578) chained with an unsafe dynamic class-loading vulnerability in the database connection utilities (CVE-2026-82078) to achieve unauthenticated remote code execution in the PaperCut Application Server. The writeup covers Huntress's own observed intrusions (base64-encoded recon commands, dropped Java .class payloads decompiled with Fernflower, log-wiping behavior, and an Apache Derby pwn database indicator), a reproduced PoC achieving SYSTEM-level code execution via pc-app.exe, and detailed patching, evidence-preservation, and hunting guidance across PaperCut's staged emergency patches.

huntress.comadvisoryAdded 3 Sep 2026, published 28 Aug 2026🛡️ Security

Huntress SOC documents how threat actors abuse legitimate AI platform features — public Claude Artifacts, claude.ai/share conversation links, and shared ChatGPT/Grok conversations — as trusted hosting for malware lures. Case studies include the "FakeAgent" malvertising campaign (a fake Claude Desktop download Artifact leading to SectopRAT via downloading-api[.]it[.]com), a fake Apple Support guide hosted on claude.ai/share delivering the MacSync stealer via a ClickFix-style curl command, and SEO-poisoned ChatGPT/Grok shared conversations pushing AMOS stealer through fake "clear disk space" advice. It recommends restricting clipboard-driven script execution, application allow-listing, and rapid reporting to AI platform vendors.

huntress.comwriteupAdded 3 Sep 2026, published 27 Aug 2026🛡️ Security

Huntress details investigations into five suspected DPRK (FAMOUS CHOLLIMA) remote workers who infiltrated partner organizations in IT, sales/marketing, and healthcare roles in 2026. The writeup covers detection methodology using Microsoft 365 Unified Audit Logs, Huntress ITDR, and analysis of infrastructure (Astrill VPN, IPRoyal Proxy, WorkTitans B.V. bulletproof hosting), plus forensic evidence of fraudulent identity documents (fake Chinese passports/ID cards with matching forged details) used during onboarding.

huntress.comwriteupAdded 3 Sep 2026, published 26 Aug 2026🛡️ Security

Huntress blog post arguing that MFA is only a starting point for identity security, walking through how credential/session theft (e.g. via ClickFix fake-CAPTCHA lures that trick users into pasting commands into the Windows Run dialog) bypasses single-sign-on defenses. It includes a real-world case study of a small real estate firm where a CEO's MFA exception led to a business email compromise and fraudulent wire transfers, followed by a practical identity-hardening checklist covering conditional access by geography/device, closing MFA exceptions, monitoring for configuration drift, and reducing stale privileged accounts.

huntress.comarticleAdded 3 Sep 2026, published 25 Aug 2026🛡️ Security

Huntress researchers describe how attackers increasingly abuse legitimate RMM tools like ScreenConnect and AnyDesk instead of custom malware, citing a 277% year-over-year rise in RMM abuse and its presence in nearly 40% of investigated incidents. The piece walks through a real case where a ScreenConnect lure sat dormant for five months before the attacker logged in to hijack a browser session and send spam, and describes how Huntress/AnyDesk staff used RMM access defensively to disrupt an India-based scam call center and a pig-butchering compound. It closes by pitching Huntress's RMM Guard, an app-control feature that inventories and blocks unauthorized RMM installs.

huntress.comarticleAdded 3 Sep 2026, published 21 Aug 2026🛡️ Security

Huntress researchers document a phishing campaign targeting Black Hat/DEF CON attendees via X DMs impersonating a CoinDesk exec, luring victims into opening a weaponized Google Doc with a custom Google Apps Script sidebar that runs a fake "decryption" flow before delivering ClickFix-style commands or a manual "update" that drops malware. On macOS this delivers AMOS infostealer plus a LaunchDaemon-based polling backdoor with SOCKS5 proxy capability; a follow-up fake DocSend/Dropbox installer delivers a ClickOnce/NSIS loader chain on Windows that installs NetSupport RAT, a process-hollowed rogue Certificate Authority that MITMs VirusTotal traffic, and an incomplete Ledger wallet-targeting implant. The piece includes deep technical detail on the loader's C2 protocol, stolen/fraudulent code-signing certificates, and infrastructure patterns (multi-branded loader domains), plus mitigation guidance and a link to published IOCs.

huntress.comwriteupAdded 3 Sep 2026, published 19 Aug 2026🛡️ Security

A Huntress detection engineer describes using an LLM to analyze a Microsoft 365 account-takeover case: the model flagged an app identifier as malicious, but it turned out to be the legitimate Outlook desktop client (present in 17%+ of customer orgs) — a scoping error caused by comparing against the wrong denominator. Rescoping the same query correctly surfaced the actual malicious tooling (an identifier seen in only three orgs, rewriting inbox rules), which shipped as a live detection rule with true positives and no false positives so far. The piece generalizes this into a framework for delegating detection-engineering work to AI: only hand over tasks you can cheaply and reliably verify, and invest in building fast, repeatable checks (coverage checks, alert-volume checks, known-good/known-bad tests) rather than trusting raw LLM output.

huntress.comarticleAdded 3 Sep 2026, published 19 Aug 2026🛡️ Security

Huntress SOC analysts reverse-engineer MacSync, a macOS infostealer/RAT distributed via a sponsored Google Ads link to a fake "Apple Support"-branded claude.ai shared conversation that uses ClickFix to trick victims into pasting a curl/zsh loader into Terminal. The six-stage chain runs a polymorphic gzip/Base64 loader, an in-memory AppleScript stealer that harvests Chromium Safe Storage keys, keychain secrets, Telegram/SSH/cloud credentials, abuses TCC (Full Disk Access and Screen Recording) prompts, drops a Mach-O RAT with WebSocket/TLS C2 and an XOR-obfuscated fallback domain, and trojanizes 84 crypto wallet extensions/apps to phish seed phrases. The piece also compares it to prior AMOS Stealer and SectopRAT ClickFix campaigns and offers behavior-based detection guidance.

huntress.comwriteupAdded 3 Sep 2026, published 17 Aug 2026🛡️ Security

Huntress breaks down a recurring pattern across 2026 university breaches: Newcastle University's admissions-system misconfiguration exposed ~440,000 contacts, University of Western Australia left Callista student-system credentials exposed online, Avans University had a Power BI misconfiguration leak data for nearly a year, and ShinyHunters breached Instructure's Canvas (defacing login portals during finals week) before exploiting an unpatched RCE flaw in Oracle PeopleSoft across 300+ instances at 100+ organizations. The piece argues higher ed's decentralized IT ownership across departments produces recurring hygiene gaps (misconfigurations, exposed credentials) rather than sophisticated attacks, and that identity/access visibility across distributed environments is the real fix.

huntress.comarticleAdded 3 Sep 2026, published 13 Aug 2026🛡️ Security

Huntress documents a fake refund scam in which attackers create or compromise Shopify seller accounts, set up fake orders targeting victims by phone/email, and trigger legitimate Shop app push notifications and "out for delivery" status updates containing phony invoices and support phone numbers. Victims who call are directed into classic refund scams involving remote access tools (ScreenConnect, AnyDesk), fake bank transaction edits, and gift-card cash-out, a technique the authors frame as a variant of Living off Trusted Sites (LoTS) since the lure is delivered through Shopify's own trusted infrastructure rather than a spoofed domain, drawing a parallel to a similar PayPal invoice abuse campaign.

huntress.comwriteupAdded 3 Sep 2026, published 13 Aug 2026🛡️ Security

Huntress details an Akira ransomware intrusion from August 2026 that followed the group's usual SonicWall SSL VPN → domain controller → AD enumeration → WinRAR/s5cmd exfiltration → detonation playbook, but with a new twist: the affiliate ran msconfig.exe to force a reboot into Safe Mode with Networking (MITRE T1688), which killed the Huntress agent and Windows Defender real-time protection while preserving network access, after pre-registering an AnyDesk service to survive the minimal Safe Mode driver set. The blog notes Safe Mode's constrained virtual memory appears to have caused akira.exe to crash with out-of-memory errors, accidentally sabotaging the attacker's own encryption run, and closes with detection guidance for boot-configuration changes, Safe Mode Kernel-Boot/Kernel-General event IDs, and Safe Boot registry tampering.

huntress.comwriteupAdded 3 Sep 2026, published 12 Aug 2026🛡️ Security

Huntress interview/recap covering the 2021 HAFNIUM (Silk Typhoon) mass exploitation of on-prem Microsoft Exchange servers that led to 88,000+ web shell backdoors, how Huntress and CrowdStrike tracked victims via cloned adversary infrastructure, and the FBI's unprecedented Rule 41 warrant used to remotely remove web shells at scale. It also details the July 2025 arrest of Xu Zewei, and 2026 FBI Operation Riptide takedowns of the Outsider phishing-as-a-service platform, NetNut residential proxy network, and MediaLand bulletproof hosting provider.

huntress.comarticleAdded 3 Sep 2026, published 10 Aug 2026🛡️ Security

Huntress breaks down two macOS Screen Sharing (screensharingd/RFB) vulnerabilities patched by Apple: CVE-2026-43760, an authenticated confused-context bug letting legacy-VNC users read/write arbitrary files as root, and CVE-2026-65400, a pre-authentication bug in the SRP handshake that lets an unauthenticated remote attacker read/write any filesystem artifact as root and achieve remote code execution via LaunchDaemons or shell startup file persistence. The post details the SSFileCopySender/SSFileCopyReceiver helper processes, their kTCCServiceSystemPolicyAllFiles entitlement, TCC/SIP interactions, exposure via hosted bare-metal Mac providers, and how to detect exploitation using Apple's Endpoint Security framework (ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH, authentication_type, UID/GID anomalies).

huntress.comwriteupAdded 3 Sep 2026, published 7 Aug 2026🛡️ Security

Huntress details a macOS incident where a victim ran a ClickFix fake-CAPTCHA Terminal command that chained a Bash profiler/loader into a Go-based Mach-O stealer. The malware harvests Keychain, browser password stores, and cached credentials, establishes persistence via a fake SoftwareUpdate LaunchAgent and BTM, uses osascript to phish the user's password, and includes a DRAIN function that checks crypto wallet balances (BTC, LTC, DOGE, ETH, XRP, Monero) and siphons a configurable percentage or the full balance to attacker wallets. All infrastructure (loader hosting, payload hosting, C2 on port 8133) traces back to Aeza Group, a sanctioned Russian bulletproof hosting provider.

huntress.comwriteupAdded 3 Sep 2026, published 6 Aug 2026🛡️ Security