Nezha is a post-exploitation tool appearing in China-nexus intrusions, and it wasn't built for cybercrime. After Huntress published the research, someone from Mainland China reached out with context.

Huntress analysts found a ransomware variant no one had documented before. Obscura hit multiple hosts across a network before anyone had a name for it. Here's the full breakdown.

Learn how a fake AnyDesk installer led to a unique MetaStealer attack, highlighting how threat actors evolve ClickFix techniques beyond the classic playbook to steal credentials and files.

A partner reported a potentially malicious Zoom extension. What Huntress found was a full DPRK BlueNoroff intrusion targeting a Web3 company that was weeks in the making and deeply sophisticated.

RedCurl is an APT known for cyberespionage that goes undetected for months. In late 2024, Huntress uncovered RedCurl activity across multiple Canadian organizations. Read about the full investigation.

SocGholish's newest campaign started July 4, 2024, and ended in something unexpected: BOINC volunteer computing software being silently installed. Huntress tracks the infection chain from fake update to payload.

BlackBerry said the new LightSpy upload was an iOS implant. Huntress researchers disagreed — what they found was an unreported macOS variant. Here's the full analysis of what it actually does.