James Northey

A fake WatchGuard VPN download site steals SSL VPN credentials, then serves the real signed client. Learn how it works and how to spot it.

DarkMe, an APT-linked VB6 RAT known for using zero day exploits, turned up in two Huntress incidents stripped down to a plain .pif infostealer malware.

An Akira affiliate rebooted into Safe Mode to kill EDR and Defender, then Safe Mode broke their own ransomware. Here’s the full attack chain.

A developer used OpenAI’s Codex to handle suspicious Linux activity, leading to unexpected outcomes found by Huntress SOC analysts during an investigation.

A Linux user's attempt to use OpenAI's Codex to troubleshoot and respond to malicious activity on their system complicated a subsequent DFIR investigation by the Huntress SOC because the AI-generated commands were flagged as suspicious, making it difficult to distinguish legitimate user actions from the two active threat actors.

Understand a malware operation using a signed Potentially Unwanted Program (PUP) from Dragon Boss Solutions LLC to silently deploy a PowerShell-based AV killer with SYSTEM privileges. The most critical finding was that the malware's primary update domain, chromsterabrowser[.]com, was unregistered, creating a supply-chain risk where anyone could've registered the domain to push ransomware or other payloads to the 23,565 compromised endpoints.