Threat View from the Lens of Huntress Adversary Tactics: August 2026

After Black Hat and DEF CON, a threat actor posed as a CoinDesk executive and contacted a Huntress researcher on X with a fake conference-planning proposal. The lure led to a Google Doc containing a malicious Apps Script sidebar, fake decryption instructions, and ClickFix-style commands. A second document impersonated DocSend and delivered different payloads to macOS and Windows users, including AMOS, NetSupport RAT, a Ledger implant, and a traffic-intercepting proxy. The campaign shows how attackers can turn trusted collaboration tools into malware delivery systems while adapting payloads to the victim’s platform. Check out our upcoming Tradecraft Tuesday episode, where we’ll go through this attack in more detail!

The X account messaging our researcher about the "conference," sharing the Google Doc and encryption key

We recently saw an incident where an Akira affiliate entered through an exposed SonicWall VPN, moved to the domain controller, enumerated Active Directory, archived file shares, and exfiltrated data. Before deploying ransomware, the attacker rebooted the host into Safe Mode with Networking, adding AnyDesk to the Safe Mode service list so remote access would continue while the Huntress agent and Defender real-time protection stayed offline. The plan partially worked, but Akira then ran out of virtual memory in the stripped-down environment and failed to encrypt the system. The attackers still collected credentials and stolen files, however.

End-to-end timeline of the intrusion

Two macOS Screen Sharing vulnerabilities, CVE-2026-43760 and CVE-2026-65400, surfaced within days of each other. The more serious flaw abuses an error in Secure Remote Password handling to bypass authentication and read or write arbitrary files as root, enabling remote code execution. Huntress identified useful detection signals, including unusual Screen Sharing sessions under the root account, SRP authentication, and execution of Apple’s privileged SSFileCopySender helper. Hosted macOS infrastructure is particularly exposed when Screen Sharing is internet-facing or provisioned from outdated images.

A public-facing Java/Tomcat application accepted unsanitized input, enabling an SQL injection attack against its Oracle backend. Instead of dropping a conventional payload, the attackers stored a post-exploitation toolkit called khunt inside Oracle as Java source and PL/SQL objects. From the database, khunt could execute Windows commands, explore files, retrieve usernames and passwords, and copy the SAM, SECURITY, and SYSTEM registry hives. The attacker ultimately achieved SYSTEM-level access, demonstrating how a database compromise can lead to operating-system control while leaving malicious code outside the usual file-based detection paths.

Detections firing for suspicious credential theft activity

Australian authorities charged two Western Australian men, aged 21 and 23, following an AFP, FBI, and Western Australia Police investigation. Police allege the pair helped operate a syndicate that inserted malicious code into open-source software, potentially compromising more than 1,000 organizations, stealing over 500,000 credentials, and exfiltrating at least 300 GB of data.

Sygnia identified a China-linked intrusion set, tracked as “Fire Ant,” compromising Cisco IOS XR routers and TACACS servers. The attackers used the routers to capture traffic, steal TACACS credentials, and suppress logs and command output, limiting defenders’ visibility while maintaining access. Targeting network infrastructure gave the group both privileged access and a way to interfere with the evidence needed to detect it. The activity reinforces that routers and authentication servers are active security boundaries, not passive background systems.

The U.S. Department of Justice and FBI seized domains supporting QScan and QTRouter, platforms allegedly operated and used by the China-linked QTFY group. The infrastructure helped scan and compromise internet-facing IoT devices, then route attack traffic through those devices to conceal activity against sensitive networks. The disruption exposes a model in which vulnerable edge devices become both a target and an operational shield. It also shows how state-linked operators can build scale by aggregating compromised routers, cameras, and other network-connected systems.

Lumen’s analysis of the QTROUTER platform

On August 1 and 2, N-able disclosed a critical authentication bypass in N-central, its remote monitoring and management (RMM) platform for managing customer environments. Attackers could obtain administrative access without credentials, then use N-central’s Take Control feature to reach downstream endpoints, including domain controllers. Huntress saw active exploitation, traced suspicious remote-control sessions, identified unpatched servers, and contacted at-risk partners and customers while tuning detections and hunting across telemetry. N-able released a second, hardening-focused hotfix on August 6.

Timeline of threat actors tearing through downstream hosts on two impacted organizations

On August 27, PaperCut warned that attackers were exploiting a pre-authentication vulnerability in PaperCut NG and MF. Huntress confirmed exploitation in two customer environments, recovered encoded discovery commands, and reproduced a complete remote code execution chain against a stock PaperCut server. The chained flaws let an unauthenticated attacker alter trusted configuration and execute Java code in the Application Server process. PaperCut released emergency patches, including Release 3 on September 1.

• macOS Screen Sharing visibility and root-session abuse detection: Managed EDR now observes Screen Sharing sessions on supported macOS endpoints, including the source address, session user, and authentication type. It also detects a session attaching to a root user session via the legacy authentication handshake, providing defenders with visibility into remote graphical access that was previously difficult to confirm.
• Last logged-in user visibility for macOS endpoints: The endpoint overview now shows the most recent interactive user and login time for managed macOS hosts. System-owned login and shutdown records are excluded, helping operators attribute endpoint activity to a real user during triage and asset review.
• Full IPv4 address visibility in the Huntress portal: The platform now displays all IPv4 addresses collected by the Base Agent survey, rather than only the first address returned. This helps operators understand systems with multiple network interfaces, and the complete list is also available through the REST API and exports.
• macOS Gatekeeper bypass via quarantine stripping is now detected: Huntress now detects macOS Gatekeeper bypasses that strip a file’s quarantine attribute, allowing unsigned or unnotarized payloads to launch without prompts on endpoints running Agent v0.14.196. Common in AMOS, Poseidon, Odyssey, and MacSync campaigns, this activity was previously invisible. Detection targets system call, catching shell, scripted, and compiled callers alike.
• New MAV Configuration Settings: Network File Scanning and Archive File Scanning (GA): You can now configure Network File Scanning and Archive File Scanning for Microsoft Defender via the Managed Antivirus (MAV) capability. These settings were previously fixed to Huntress defaults but are now partner-configurable. The default settings remain in place, so there is no immediate change to endpoint configurations.
• You can now export EDR & SIEM incident reports & timelines via PDF (GA): Partners and customers can now download any EDR or SIEM incident report as a polished PDF. Includes full investigation timeline and SOC response in one clean artifact.

• Redesigned ITDR dashboard is now live: The redesigned Managed ITDR dashboard is now generally available to all partners and customers! Built to help you investigate identity threats faster and get the context you need in one place, the new dashboard brings powerful investigation capabilities directly into your ITDR workflow, including Rapid Identity Triage, Failed Login Characterization, and Quick SIEM Search. Starting now, the redesigned dashboard will be the default dashboard when you access Managed ITDR. Get more ITDR dashboard details in our new blog.
• Executive Summaries now in ITDR incident reports: We're excited to announce that all ITDR incident reports now include an Executive Summary. The Executive Summary automatically turns deep technical ITDR findings into plain-English reports you can hand directly to business leaders, insurers, and legal without rewriting. The summary clearly explains what happened, why it matters, and what’s been done/what to do, saving hours per incident while building client trust and speeding decisions. The Executive Summary appears in plain text at the top of every ITDR incident report, and is also available to download as a standalone PDF from the portal, ready to share directly.
• New per-identity notification escalations model: Huntress Managed ITDR has officially begun using per-identity escalations for new unexpected country and unexpected VPN activity. With this change, each identity that generates new escalatable activity will receive its own Huntress escalation and notification, making it easier to see exactly which identity needs your attention.
• IP-based expected access rules: Partners can now allowlist individual IP addresses and CIDR ranges at the identity, organization, or account level. This gives teams a more precise alternative to allowlisting an entire country or VPN and helps reduce recurring unexpected-login escalations.
• Microsoft 365 usage-location inference: When an identity lacks a Microsoft 365 usage location, Managed ITDR can now use the tenant’s default country instead of generating a missing-location escalation. The change reduces predictable noise while preserving the underlying login protection.

• Additional security controls in Managed ISPM: We are now approaching 80 security controls in Managed ISPM, having recently added seven new controls for Exchange Online Protection and Microsoft Defender for Office 365.

• Cato Networks log source: Managed SIEM now supports Cato Networks as a log source through HEC. The integration brings security, firewall, IPS, and DNS events from the SASE layer into the platform, with IPS events enriched with MITRE ATT\&CK context.
• Hyper-V virtual machine and virtual disk detections: Managed SIEM now detects Hyper-V virtual machine registration and virtual hard disk creation. The detections provide the machine name, machine ID, VHDX path, host, and associated user context so analysts can identify suspicious hypervisor activity without wading through the entire Hyper-V event channel.
• You can now export EDR & SIEM incident reports & timelines via PDF (GA): Partners and customers can now download any EDR or SIEM incident report as a polished PDF. Includes full investigation timeline and SOC response in one clean artifact.

• Fake meeting phishing scenarios: Managed SAT now includes deepfake phishing scenarios modeled on Zoom, Microsoft Teams, and Google Meet. Each scenario uses a fake meeting experience and a prompt to install a driver or update, giving learners practice recognizing a social-engineering path that moves beyond a conventional phishing email.
• Crypto investment fraud episode: This new episode teaches learners how pig-butchering schemes build trust over time, use persuasive investment narratives, and direct victims toward fraudulent cryptocurrency platforms.
• Custom HTML phishing scenarios: Admins can create more tailored phishing scenarios with custom HTML, including scenarios modeled on internal branding, familiar vendors, or real messages seen by their organization. Managed SAT sanitizes links in these scenarios to reduce the risk of accidental or malicious phishing of learners.

In August’s Tradecraft Tuesday, Security Operations Analyst Josh Kiriakoff and Principal Security Operations Center Analyst Ryan Dowd broke down a MacSync infection that began with a sponsored Google result for Claude. The link led to a legitimate claude.ai share page posing as Apple Support and instructed the victim to paste a curl command into Terminal. Josh and Ryan walked through MacSync’s six-stage chain: in-memory AppleScript execution, Full Disk Access prompts, password validation, credential and browser-data theft, LaunchAgent persistence, screen-recording access, and tampered crypto-wallet apps. They also explained how an analyst recovered samples from attacker infrastructure after the host went offline. Check out the full recap here—and make sure to sign up for our September 8 Tradecraft Tuesday!

The August Tradecraft Tuesday episode was focused on a Fake Claude install guide that led to a macOS stealer