Sign Up for Huntress Updates
Get insider access to Huntress tradecraft, killer events, and more.
The Huntress Cybersecurity Blog
The Huntress Cybersecurity Blog
Welcome to the Huntress Cybersecurity Blog, where we cut through the noise with real-world tradecraft to help you stay ahead of today’s threat actors. Our authors bring diverse backgrounds and hands-on experience to make cybersecurity education engaging, accessible, and grounded in the threats you actually face.
Featured Categories
Threat Research
Threat Research is where the Huntress SOC shows its work. We cover real intrusion investigations, malware and ransomware analysis, threat actor profiles, and the tradecraft attackers lean on: persistence, defense evasion, and living-off-the-land techniques. Whether it broke this week or has been around for years, this is where you see how attacks unfold and how we stop them.
No posts found.
Rapid Response & Vulnerabilities
When a vulnerability starts getting exploited, the clock starts. Rapid Response & Vulnerabilities covers CVE disclosures, vulnerability advisories, the exploitation activity we see in the wild, patch guidance, and disclosure timelines. Timely, focused, and built around what to do next.
No posts found.
The Latest
Reports of SIEM's Death Have Been Greatly Exaggerated
Reports of SIEM's Death Have Been Greatly Exaggerated
SIEM isn't dead... its bloated pricing model is. Discover why legacy models need to go, how AI fits in, and how to build a smarter, cost-effective security logging strategy.
October 29, 2026
Managed for Malice: How Attackers Turn MDM into Remote Access
Managed for Malice: How Attackers Turn MDM into Remote Access
Attackers abuse legitimate MDM platforms to deploy rogue RMM tools, turning device management into a pathway for remote access and persistence.
October 28, 2026
Camera Management Software Compromise Leads to Malware Deployment
Camera Management Software Compromise Leads to Malware Deployment
Attackers compromised camera management software to deploy malware, establish persistence, and beacon to C2. Huntress breaks down the attack chain and IOCs.
October 27, 2026
AI, Scripts, Operator: Inside the ConnectWise Attack
AI, Scripts, Operator: Inside the ConnectWise Attack
Microsoft says an AI agent drove the ConnectWise attack. Huntress telemetry is consistent with that: scripted tooling, steered by an operator.
October 26, 2026
Unboxing Phishing Kits: Huntress Examines 3 Real Kits
Unboxing Phishing Kits: Huntress Examines 3 Real Kits
Huntress examines 3 phishing kits that hand beginner attackers everything they need to steal tokens. See what the attacks look like from the inside.
October 22, 2026
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.
October 22, 2026
