Threat Research
Threat Research is where the Huntress SOC shows its work. We cover real intrusion investigations, malware and ransomware analysis, threat actor profiles, and the tradecraft attackers lean on: persistence, defense evasion, and living-off-the-land techniques. Whether it broke this week or has been around for years, this is where you see how attacks unfold and how we stop them.
The Latest Threat Research Blog Posts
AI, Scripts, Operator - Inside the ConnectWise Attack
AI, Scripts, Operator - Inside the ConnectWise Attack
Oct 26, 2026
Unboxing Phishing Kits: Advanced Cred Theft for Entry-Level Hackers
Unboxing Phishing Kits: Advanced Cred Theft for Entry-Level Hackers
Oct 22, 2026
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Oct 22, 2026
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
Oct 21, 2026
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
Oct 16, 2026
Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client
Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client
Oct 13, 2026
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Oct 7, 2026
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Oct 6, 2026
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
Sep 30, 2026
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
Sep 28, 2026
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
Sep 24, 2026