Blog Post
SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints
Attackers are using cloud-hosted ScreenConnect panels to install rogue clients on hundreds of managed endpoints.
Blog Posts By This Author
All Categories
- Read more about SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints
- Read more about Beyond the clipboard: The evolving tradecraft of ClickFixBlog Post
Beyond the clipboard: The evolving tradecraft of ClickFix
ClickFix techniques are evolving. Huntress breaks down four attack chains: lateral movement, hidden PNG payloads, Node.js RATs and cache seeing.
- Read more about N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit ChainsBlog Post
N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit Chains
UPDATE: N-able took N-central offline after 33 critical flaws were disclosed, including chains enabling remote code execution and privilege escalation.
- Read more about Unboxing Phishing Kits: Advanced Cred Theft for Entry-Level HackersBlog Post
Unboxing Phishing Kits: Advanced Cred Theft for Entry-Level Hackers
Huntress examines 3 phishing kits that hand beginner attackers everything they need to steal tokens. See what the attacks look like from the inside.
- Read more about M365 Token Spray and Replay Campaign Compromises Business Email AccountsBlog Post
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.
- Read more about Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform ServersBlog Post
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
Huntress SOC found a threat actor exploiting a file upload flaw in recreation management to breach 3 municipal servers and steal payment data.
