Sign Up for Huntress Updates
Get insider access to Huntress tradecraft, killer events, and more.
The Huntress Cybersecurity Blog
The Huntress Cybersecurity Blog
Welcome to the Huntress Cybersecurity Blog, where we cut through the noise with real-world tradecraft to help you stay ahead of today’s threat actors. Our authors bring diverse backgrounds and hands-on experience to make cybersecurity education engaging, accessible, and grounded in the threats you actually face.
Featured Categories
Threat Research
Threat Research is where the Huntress SOC shows its work. We cover real intrusion investigations, malware and ransomware analysis, threat actor profiles, and the tradecraft attackers lean on: persistence, defense evasion, and living-off-the-land techniques. Whether it broke this week or has been around for years, this is where you see how attacks unfold and how we stop them.
No posts found.
Rapid Response & Vulnerabilities
When a vulnerability starts getting exploited, the clock starts. Rapid Response & Vulnerabilities covers CVE disclosures, vulnerability advisories, the exploitation activity we see in the wild, patch guidance, and disclosure timelines. Timely, focused, and built around what to do next.
No posts found.
The Latest
Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing
Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing
Threat actors used a convincing Microsoft Teams meeting-booking lure to conceal device code phishing and trick victims into authorizing attacker access.
November 12, 2026
SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints
SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints
Attackers are using cloud-hosted ScreenConnect panels to install rogue clients on hundreds of managed endpoints.
November 11, 2026
Beyond the clipboard: The evolving tradecraft of ClickFix
Beyond the clipboard: The evolving tradecraft of ClickFix
ClickFix techniques are evolving. Huntress breaks down four attack chains: lateral movement, hidden PNG payloads, Node.js RATs and cache seeing.
November 10, 2026
N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit Chains
N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit Chains
UPDATE: N-able took N-central offline after 33 critical flaws were disclosed, including chains enabling remote code execution and privilege escalation.
November 9, 2026
Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant
Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant
Follow-up on AhsayCBS intrusion: new webshells, a second miner, and a host-bound Python implant found on exploited backup servers.
November 9, 2026
Sasha Roshan Takes Security Education Beyond the Demo
Sasha Roshan Takes Security Education Beyond the Demo
Meet Sasha Roshan, Senior Sales Engineer at Huntress, a passionate advocate for cybersecurity. See how he makes a difference every day.
November 9, 2026
