Attackers compromised camera management software to deploy malware, establish persistence, and beacon to C2. Huntress breaks down the attack chain and IOCs.

How Huntress researchers reconstructed an Akira ransomware attack using Registry artifacts, Akira logs, and other post-compromise evidence.

Threat actors exploited Samsung MagicINFO to install AnyDesk, disable Defender, and compile a Monero miner directly on a victim endpoint. Learn the detection signals.

Huntress analysts reconstructed a three-week INC ransomware attack from endpoint data, uncovering a 17-day lull despite missing process telemetry.

Huntress has recently seen two incidents involving Settra, a ransomware variant that was first publicly reported in June 2026.

See how a threat actor used SQL injection and BadIIS to gain persistence, disable Windows Defender, and quietly install a cryptominer.

A recent investigation uncovered an Akira affiliate abusing a website owned by file-sharing app LimeWire for data exfiltration. Here's how the attack unfolded.

Two recent incidents involving The Gentlemen ransomware show the use of defense evasion tactics, including logs being cleared and attempts to add antivirus exclusions.

The ransomware name on the ransom note doesn't tell the full story. See how RaaS affiliates drive initial access, persistence, and exfiltration and what defenders should watch for.

A recent investigation into a NightSpire ransomware incident found significant variations in TTPs—including the use of "trucked-in" non-native tools like Chrome Remoting Desktop and MEGASync—which suggests affiliate involvement and demonstrates that IoCs aren't static, regardless of the group's RaaS status.

Threat actors got creative with data staging and exfiltration — and in doing so, left their entire infrastructure exposed. Here's what Huntress SOC analysts documented.

Huntress traced a full Iranian-linked APT intrusion from RDP initial access through DLL side-loading and C2 communications. This is the complete MuddyWater attack chain, step by step.

A business-critical construction accounting app quietly installed additional software alongside itself — and that software became an attack vector. Here's what the Huntress SOC team found.

The threat reports make every attacker sound like they're running a perfect playbook. The telemetry tells a different story: typos, failed attempts, and a lot of trial and error before anything works.

The threat actors from Part I weren't done. Part II tracks what happened after WSUS exploitation put a legitimate forensic tool in the wrong hands and how Huntress responded.