🧰 Huntress SOC

The items that name it 11

• Fake WatchGuard VPN Site Steals Credentials
  writeup2026-10-13It is written here as Huntress SOC (analyzed the incident and provided remediation steps).

  analyzed the incident and provided remediation steps

• Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
  article2026-10-01It is written here as Huntress SOC (Security Operations Center).

  Investigates real-world incidents across partner and customer environments to inform the Tragic Quadrant rankings

• Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
  writeup2026-09-09

  Detected malicious activity, investigated the two incidents, and shut down the threats

• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
  writeup2026-09-03

  Detected and shut down the rogue ScreenConnect/VBScript attack chains across multiple customer environments; authored the investigation and writeup.

• Boardroom Battles 2026: ASD’s Cyber Priorities & AI Risk
  article2026-08-30

  24/7 human-supervised security operations center performing detection, investigation and containment (e.g. host/mass isolation) for customer environments

• The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms
  writeup2026-08-27

  Security Operations Center that detected and investigated the campaigns described

• MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer
  writeup2026-08-17

  Security Operations Center that analyzed the MacSync campaign and pulled a malware sample directly from attacker servers.

• Threat Actors Achieve Persistence After SQL Injection
  writeup2026-07-13

  Detected and reported the malicious MSSQL activity and investigated the incident.

• Inside .NET Loader Analysis: From Malspam to In-Memory Loader
  writeup2026-06-03

  Security operations center that responded to and investigated the .NET loader infection

• How EvilTokens Turbocharges Old School Phishing with AI
  article2026-05-11It is written here as Huntress SOC (Security Operations Center).

  Detected the EvilTokens campaign pattern across thousands of organizations and pushed a conditional access policy across more than 60,000 tenants to block Railway's infrastructure outright.

• Tradecraft Tuesday Recap | Huntress
  article2025-12-23

  Huntress security operations center reportedly seeing real ClickFix victims at scale