Huntress analyzed several incidents involving DPRK remote workers (Famous Chollima) in partner environments. Learn key indicators to detect and prevent North Korean threats.

Fake OpenClaw installers sat quietly on GitHub for over a week, loading GhostSocks and information stealers onto every system that downloaded them. Here's what Huntress found.

Huntress caught active in-the-wild exploitation of a SmarterMail vulnerability that turns an account takeover into remote code execution. If you're running SmarterMail before Build 9511, update now.

Huntress observed threat actors exploiting a Microsoft WSUS remote code execution vulnerability across four customers within days of disclosure. Here's the timeline, the TTPs, and why you need to patch now.

A local file inclusion flaw in Gladinet CentreStack and Triofox was actively exploited before a patch existed. Huntress documented the vulnerability, the exploitation activity, and what to do now.

Nezha is a post-exploitation tool appearing in China-nexus intrusions, and it wasn't built for cybercrime. After Huntress published the research, someone from Mainland China reached out with context.

Reports said the latest Samsung MagicINFO 9 Server version patched CVE-2024-7399. Huntress independently verified it didn't. Here's the rapid response details.

Even non-profits and human rights organizations have adversaries. Huntress investigated an APT campaign targeting Vietnamese human rights defenders. Learn more about the tradecraft and the full attribution.

Malicious activity on MSSQL servers is still a persistent problem. We discuss a recent case where attackers pivoted from a Fortinet EMS MSSQL installation to ScreenConnect, and what Huntress found.