An ESXi VM escape exploit appeared in the wild with simplified Chinese development paths and the characteristics of a zero-day. Huntress traced the intrusion from SonicWall VPN all the way through.

During a ransomware intrusion, Huntress found a script full of clear English comments walking through each step. Old playbooks don't die. Attackers just keep running them.

A tool called 'defendnot' disables Windows Defender by registering a fake antivirus through undocumented Windows Security Center APIs. Huntress covers the technique and how to detect it.

RedCurl is an APT known for cyberespionage that goes undetected for months. In late 2024, Huntress uncovered RedCurl activity across multiple Canadian organizations. Read about the full investigation.

SocGholish's newest campaign started July 4, 2024, and ended in something unexpected: BOINC volunteer computing software being silently installed. Huntress tracks the infection chain from fake update to payload.