Over 100 SonicWall SSLVPN devices compromised across multiple customer environments in days. Attackers weren't brute-forcing — they had valid credentials. Here's the scope and the activity Huntress observed.

macOS adoption is up and so is Mac malware. From Adload adware to LightSpy spyware to LockBit's macOS ransomware variant, Huntress covers what's targeting Macs and what Apple is doing about it.

A second pass on SlashAndGrab — same vulnerability, additional context. If you haven't patched ScreenConnect yet, here's everything you need to understand why the exploit is so serious.

RATs proliferating. Ransomware evolving. Attackers getting quieter. The Huntress 2025 Cyber Threat Report is out. Check out the key findings from a year of tracking threats across millions of endpoints.

Before the countdown to 2025, Huntress looks back at everything the year threw at defenders — the incidents, the trends, the lessons, and what they revealed about where the threat landscape is heading.

Huntress identified mass exploitation of Cleo's file transfer software on December 3 — before a CVE was officially assigned. Here's the full picture of what was observed and what defenders need to do.

In October 2024, Huntress observed two separate SafePay ransomware deployments across unrelated customer environments. Here's what the analysts found — the TTPs, the indicators, and how it ended.

Phishing keeps evolving, and defenders who only understand the user's perspective are always a step behind. Huntress and Sr. Director Chris Henderson take you through the attacker's eye view.

Hackers have traded the black hoodie for a cloak of invisibility — hiding inside legitimate tools and moving covertly before striking. Here's what the Huntress 2024 Cyber Threat Report found.

Ransomware is on a winning streak — and the 2024 Huntress Cyber Threat Report explains why. Check out key insights on what changed, who got hit, and what the tactics behind the surge look like.

Trivially easy' and 'embarrassingly simple' were how Huntress researchers described exploiting SlashAndGrab. Here's the plain-English explanation of what the vulnerability is and why it spread so fast.

After SlashAndGrab went public, Huntress tracked the exploitation in real time — ransomware deployment, reconnaissance, Cobalt Strike drops, cryptocurrency miners, and more. Here's everything observed.

Huntress researchers recreated a working exploit for the ScreenConnect authentication bypass the same day ConnectWise disclosed it. Here's the full technical breakdown of CVE-2024-1709 and CVE-2024-1708.

ConnectWise disclosed two critical ScreenConnect vulnerabilities. Huntress reproduced and weaponized the exploit within hours. Here's the detection guidance for organizations trying to identify exposure.

Huntress reproduced the ScreenConnect vulnerability and found a temporary mitigation for over 1,000 vulnerable systems, but the real fix is patching. Here's what was found and why it can't wait.