Blog Post
Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client
A fake WatchGuard VPN download site steals SSL VPN credentials, then serves the real signed client. Learn how it works and how to spot it.
Blog Posts By This Author
All Categories
- Read more about Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client
- Read more about Up a Creek Without a Command Line: Mapping an Akira Ransomware AttackBlog Post
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
How Huntress researchers reconstructed an Akira ransomware attack using Registry artifacts, Akira logs, and other post-compromise evidence.
- Read more about The Not So Silent Miner: Threat Actor Compiles Cryptominer on the EndpointBlog Post
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
Threat actors exploited Samsung MagicINFO to install AnyDesk, disable Defender, and compile a Monero miner directly on a victim endpoint. Learn the detection signals.
- Read more about Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMMBlog Post
Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
Huntress has recently seen two incidents involving Settra, a ransomware variant that was first publicly reported in June 2026.
- Read more about Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like ActivityBlog Post
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Huntress is tracking a pattern across multiple customer environments where rogue ScreenConnect clients repeatedly spawn the Windows Script Host to execute a series of four VBScript files.
- Read more about Inside Knight Office, a New M365 AiTM Phishing KitBlog Post
Inside Knight Office, a New M365 AiTM Phishing Kit
An inside look at Knight Office, a newly discovered AiTM phishing kit featuring custom control panels, Cloudflare Turnstile, and M365 Token theft.
