🧰 Huntress agent

The items that name it 11

• Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack | Huntress
  writeup2026-10-06

  EDR agent deployed on the victim organization; generated the signal that revealed part of the attack activity

• Akira Hits Safe Mode: Ransomware Rebooting Around EDR
  writeup2026-08-12

  EDR agent that Huntress observed was taken offline by the Safe Mode reboot; deployed on only a fraction of machines in the affected environment.

• Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack
  writeup2026-06-16

  EDR/monitoring agent whose installation and coverage gaps are discussed as key to detecting/limiting the intrusion.

• Akira, LimeWire, and the Sour Taste of Data Exfiltration
  writeup2026-06-12

  EDR/security tooling used by Huntress SOC for detection; not installed on the newly-instantiated VM used by the threat actor

• The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress
  writeup2026-05-21

  Endpoint detection and response telemetry used by Huntress SOC to investigate incidents, deployed post-incident in both cases described

• Untangling a Linux Incident With an OpenAI Twist (Part 2)
  writeup2026-04-22

  Managed EDR agent installed mid-compromise that detected malicious activity, provided live telemetry, and was the primary tool enabling SOC investigation and remediation

• Uptick in Bomgar RMM Exploitation
  writeup2026-04-17

  Security monitoring agent that detected the activity described (added mid-compromise in one April 9 incident)

• Decoding NightSpire: Ransomware IOCs Aren't Set in Stone
  writeup2026-04-07

  Endpoint detection agent installed on customer endpoints; generated foothold/persistence and ransomware-launch signals that triggered the investigation

• How the Huntress SOC Stopped a VPN-Based Ransomware Attack
  writeup2026-03-13

  Security agent on endpoints; attacker attempted to kill it to sabotage defenses

• Data Exfiltration and Threat Actor Infrastructure Exposed
  writeup2026-03-12

  Endpoint detection agent; incomplete deployment across customer infrastructure limited visibility

• RMM Abuse: When IT Convenience Bites Back
  article2026-03-05

  Endpoint security/detection agent; targeted for disabling by attacker in described incident as defense evasion