Rich Mozeleski

Staff Product ManagerHuntress

Rich got into cybersecurity because one newspaper article flipped a switch. Nearly a decade into his Army career, he read about Army Cyber Command and realized he could turn a long-running interest in computers into a mission. That moment kicked off a career spanning red teaming, offensive security tooling, and government software development focused on offensive cyberspace capabilities.

He holds a master’s in Software Engineering from Penn State, along with CISSP, PMP, GXPN, GWAPT, and GNFA certifications.

At Huntress, Rich is the Product Manager for Identity Threat Detection and Response (ITDR), drawn in by the team’s talent, grit, and hacker culture. He’s also one of only a handful of Americans to receive the Chief of the Defence Staff Commendation from Canada.

Outside of work, he’s usually at the beach with his kids or locked into Philly sports. And if you ask him, pulling the plug still beats the adversary every time.

Blog Posts By This Author

Read more about AI, Scripts, Operator - Inside the ConnectWise Attack
Blog Post
AI, Scripts, Operator - Inside the ConnectWise Attack
Microsoft says an AI agent drove the ConnectWise attack. Huntress telemetry is consistent with that: scripted tooling, steered by an operator.
Read more about Railway. LSHIY. Different Auth Flows, but the Same Lesson We Keep Skipping
Blog Post
Railway. LSHIY. Different Auth Flows, but the Same Lesson We Keep Skipping
Two Microsoft 365 attacks got through Conditional Access policies that seemed fully configured. Learn what went wrong and how Huntress Managed ISPM catches these gaps first.
Read more about No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack
Blog Post
No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack
Huntress is seeing an ongoing password spray attack against Microsoft Azure CLI that originates from an IPv6 address range controlled by LSHIY LLC.
Read more about Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
Blog Post
Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
Attackers turned Railway.com's free cloud platform into a Microsoft 365 token-stealing machine, hitting 268+ organizations and 100+ MSPs. Here's the full infrastructure breakdown.

See All Blog Posts by Rich Mozeleski

Featured In These Upcoming Events & On-Demand Virtual Events

Read more about Herd Immunity for Microsoft 365: How We Stop Attacks at Sign-In
Livestream
Herd Immunity for Microsoft 365: How We Stop Attacks at Sign-In
The newest capability in Huntress Managed ITDR, Adversary Infrastructure, turns that one-time fire drill into continuous protection. When our SOC confirms the hosting, relay, or proxy infrastructure behind a compromise in one tenant, our detection engineers validate it against benign traffic. Huntress then deploys a blocking Conditional Access policy to every eligible, opted-in tenant. Attacks from that infrastructure fail at sign-in instead of becoming incidents. One partner’s incident becomes every partner’s protection. We call it herd immunity for identity.
Read more about The Attacker Got There First. ITDR Lookback Hits Rewind.
On-Demand Virtual Event
The Attacker Got There First. ITDR Lookback Hits Rewind.
Meet Lookback: the moment a tenant finishes onboarding, Huntress automatically replays up to 180 days of Microsoft 365 login history through the full Unwanted Access detection stack.
Read more about The Cybersecurity Threat Landscape in 2026
On-Demand Virtual Event
The Cybersecurity Threat Landscape in 2026
This session explores how attackers are evolving their tactics, where organizations remain most vulnerable, and what practical steps businesses can take to strengthen email security as part of a broader cybersecurity strategy.
Read more about The Huntress Product Showcase: Q2 2025 (APAC)
On-Demand Virtual Event
The Huntress Product Showcase: Q2 2025 (APAC)
Join us for an exclusive livestream where we’ll showcase our newest product updates and give you an early look at the changes heading to the platform.
Read more about Identity Is the New Endpoint: The Next Evolution in Threat Detection
On-Demand Virtual Event
Identity Is the New Endpoint: The Next Evolution in Threat Detection
In this session, we’re unveiling the new Managed ITDR powered by our latest capability, Rogue Apps, built from the ground up to protect Microsoft 365 environments without the noise or guesswork.