Blog Post
Daisy-Chaining Trust: Investigating Faronics Deploy Abuse
Bad actors are abusing Faronics Deploy in phishing campaigns to run PowerShell, deploy ScreenConnect, and evade detection by using trusted tools.
Blog Posts By This Author
All Categories
- Read more about Daisy-Chaining Trust: Investigating Faronics Deploy Abuse
- Read more about Daisy-Chaining Rogue RMM Tools: How Threat Actors Abuse Remote Management Software for Initial AccessBlog Post
Daisy-Chaining Rogue RMM Tools: How Threat Actors Abuse Remote Management Software for Initial Access
Attackers aren't just abusing one RMM tool — they're chaining them together for layered persistence that's hard to detect and harder to remove. Every tier of threat actor is doing this now.
- Read more about Exploitation of Windows Server Update Services Remote Code Execution Vulnerability (CVE-2025-59287)Blog Post
Exploitation of Windows Server Update Services Remote Code Execution Vulnerability (CVE-2025-59287)
Huntress observed threat actors exploiting a Microsoft WSUS remote code execution vulnerability across four customers within days of disclosure. Here's the timeline, the TTPs, and why you need to patch now.
- Read more about Plain Text Passwords: The Risks of Storing ThemBlog Post
Plain Text Passwords: The Risks of Storing Them
A threat actor got in through SonicWall, then found a plaintext password file sitting on someone's desktop. This companion post to the SonicWall advisory is a cautionary tale in one screenshot.
- Read more about Ave Maria and the Chambers of Warzone RATBlog Post
Ave Maria and the Chambers of Warzone RAT
A large wave of PowerShell malware hit on a Friday afternoon and Huntress analysts dove in immediately. What they found was a Warzone RAT infection chain that tested their detectors in real time.
