Threat Research

Threat Research is where the Huntress SOC shows its work. We cover real intrusion investigations, malware and ransomware analysis, threat actor profiles, and the tradecraft attackers lean on: persistence, defense evasion, and living-off-the-land techniques. Whether it broke this week or has been around for years, this is where you see how attacks unfold and how we stop them.


Managed for Malice: How Attackers Turn MDM into Remote Access

Attackers abuse legitimate MDM platforms to deploy rogue RMM tools, turning device management into a pathway for remote access and persistence.

Oct 28, 2026

The Latest Threat Research Blog Posts

AI, Scripts, Operator - Inside the ConnectWise Attack
AI, Scripts, Operator - Inside the ConnectWise Attack
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
Oct 16, 2026
Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client
Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Oct 7, 2026
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint