Sign Up for Huntress Updates
Get insider access to Huntress tradecraft, killer events, and more.
All Huntress Blog Posts
All Huntress Blog Posts
All things cybersecurity engaging and accessible - so you can stay ahead of hackers and boost your cybersecurity savviness.
Insights into Suspected DPRK Workers: Red Flags to Look Out For
Insights into Suspected DPRK Workers: Red Flags to Look Out For
Huntress analyzed several incidents involving DPRK remote workers (Famous Chollima) in partner environments. Learn key indicators to detect and prevent North Korean threats.
August 26, 2026
“Malware, from the Outside!”: How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information Stealers
“Malware, from the Outside!”: How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information Stealers
Fake OpenClaw installers sat quietly on GitHub for over a week, loading GhostSocks and information stealers onto every system that downloaded them. Here's what Huntress found.
March 4, 2026
DE&TH to Vulnerabilities: Huntress Catches SmarterMail Account Takeover Leading to RCE
DE&TH to Vulnerabilities: Huntress Catches SmarterMail Account Takeover Leading to RCE
Huntress caught active in-the-wild exploitation of a SmarterMail vulnerability that turns an account takeover into remote code execution. If you're running SmarterMail before Build 9511, update now.
January 22, 2026
The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors
The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors
Nezha is a post-exploitation tool appearing in China-nexus intrusions, and it wasn't built for cybercrime. After Huntress published the research, someone from Mainland China reached out with context.
October 15, 2025
Rapid Response: Samsung MagicINFO 9 Server Flaw
Rapid Response: Samsung MagicINFO 9 Server Flaw
Reports said the latest Samsung MagicINFO 9 Server version patched CVE-2024-7399. Huntress independently verified it didn't. Here's the rapid response details.
May 7, 2025
Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders
Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders
Even non-profits and human rights organizations have adversaries. Huntress investigated an APT campaign targeting Vietnamese human rights defenders. Learn more about the tradecraft and the full attribution.
August 28, 2024
MSSQL to ScreenConnect
MSSQL to ScreenConnect
Malicious activity on MSSQL servers is still a persistent problem. We discuss a recent case where attackers pivoted from a Fortinet EMS MSSQL installation to ScreenConnect, and what Huntress found.
March 28, 2024
