Threat View from the Lens of Huntress Adversary Tactics: June 2026

In June, FortiBleed hit ~74,000 internet-facing FortiGate firewalls across 194 countries. It’s not a new vulnerability: Fortinet says it involves reused credentials and brute-forcing weak, MFA-less devices (meaning there’s no CVE or patch, just working admin/VPN passwords). Huntress cross-referenced the listed IP addresses against their own data corpus and identified 845 partner organizations specifically impacted by this credential dump.

What’s notable is the methodology, which Huntress has unique telemetry into. Attackers:

• Brute-forced credentials and cracked hashes with Hashcat on GPU infrastructure via vast[.]ai

• Used access to harvest NTLM and Kerberos hashes from internal network traffic (via packet sniffing on the Fortigate device itself)

• Persisted via a Telegram-based C2 bot

• Created backdoor accounts: admin fgt_admin and SSLVPN user sslvpn

In early June, our SOC identified a webshell infection notable not for its initial access method, but for the lengths the threat actor took to blind defenders once inside. After gaining a foothold, they:

• Uninstalled an IIS Web Application Firewall module to remove visibility from the web server
• Used Image File Execution Options, a Windows debugging mechanism, to blind Sysmon and stop it from logging process creation
• Created WMI event consumers to automatically clear Windows Event Logs, wiping out forensic evidence
• Layered in additional evasion and anti-forensic techniques throughout the intrusion

In late June, our SOC detected a threat actor using a Cloudflare Tunnel as a covert, persistent C2 channel across multiple customer environments, a technique we're seeing with growing frequency. Attackers modified the SafeBoot registry key so the tunnel would keep running even if the endpoint booted into Safe Mode, a Windows diagnostic startup mode that loads only essential drivers and services, letting users troubleshoot problems that prevent the system from running normally.

In a representative incident, here’s what the attack chain looked like:

• Initial access via RDP using compromised credentials

• Cloudflare binary deployed, disguised as WindowsUpdate.exe under AppData\Local\Microsoft\WindowsUpdate\ – and configured with config.yml to establish persistent, encrypted remote access

• Installed as a Windows service, and modified the SafeBoot registry key under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Cloudflared to sidestep security detection

This month the Tactical Response team identified threat actors exploiting CVE-2026-35616, a vulnerability in Fortinet's FortiClient EMS, across at least two customer environments — including an MSP and a downstream hospital customer. CVE-2026-35616 is a critical improper access control flaw that could allow unauthenticated attackers to execute arbitrary code. The flaw was disclosed and patched in April, and since then other researchers have found exploitation activity. For this specific exploitation activity, which was found via a retrospective threat hunt, the tradecraft was clean: the actor deployed a malicious copy of SimpleHelp RMM for persistent remote access and to avoid noisy lateral movement.

June's Patch Tuesday was the largest in Microsoft's history — 200 vulnerabilities, including 33 critical flaws and six zero days. The most urgent: CVE-2026-41091, an actively exploited Microsoft Defender privilege escalation flaw, and CVE-2026-45657, a wormable Windows Kernel RCE (CVSS 9.8) requiring no authentication or user interaction. A BitLocker bypass and an HTTP.sys denial-of-service bug rounded out the zero-day slate. Patch immediately, especially CVE-2026-45657.

The ShinyHunters threat group exploited CVE-2026-35273, a critical unauthenticated RCE in Oracle PeopleSoft Enterprise PeopleTools, to compromise more than 100 organizations between May 27 and June 9. Nearly 70% of victims were higher education institutions. Stolen data included student names, addresses, Social Security numbers, GPAs, and enrollment records. Oracle published its advisory the same day exploitation went public, leaving a zero-day window with no advance warning.

Check Point disclosed CVE-2026-50751 on June 8. This is a critical (CVSS 9.3) authentication bypass in its Remote Access VPN affecting deployments using the deprecated IKEv1 protocol. Exploitation was observed as early as May 7, with dozens of organizations targeted. At least one incident was linked to a Qilin ransomware affiliate. CISA added it to the KEV catalog the following day. Organizations using legacy IKEv1 configurations should patch immediately.

Huntress has been tracking an automated password spray campaign originating from infrastructure controlled by LSHIY LLC (AS32167). Attackers made 81 million login attempts against Microsoft 365 environments, compromising 78 accounts across 64 organizations over the course of two weeks in June.

The campaign abused the deprecated OAuth ROPC flow to bypass MFA entirely — 15 of 23 businesses hit on June 22 alone had MFA enabled but misconfigured. Attacks ceased after Huntress contacted LSHIY, which suspended the responsible user.

• macOS auto-ejects deceptive installers: When Huntress detects that a mounted DMG is a deceptive installer, the Huntress Agent now automatically ejects the volume before the bundled payload can launch — stopping infostealers in their tracks.
• macOS Gatekeeper override detection: The Huntress Agent for macOS now detects when a user bypasses Apple's Gatekeeper protections to open a quarantined or unsigned file — closing a critical visibility gap in how infostealers get executed. Available for macOS 14 and later.
• Redesigned Managed Antivirus dashboard: The redesigned dashboard puts recent Defender activity, noisiest orgs, and busiest endpoints front and center — with a new AV Events view, top agent surfacing, and recently installed agent compliance tab.

• Enhanced Detections in ITDR for Google Workspace (GWS): Identity attacks don't stop at Microsoft. For those running GWS, you likely face session hijacking and credential theft attempts daily. That’s why we’re excited to announce enhanced ITDR detections in GWS. Building out our GWS solution, we now detect credential theft, which flags account takeover patterns including phishing-harvested credentials, password spray attempts, and anomalous login behaviors, as well as session hijacking, which identifies stolen or forged session tokens used to bypass MFA and gain unauthorized access to GWS accounts without credentials. These detections are our latest step in bringing our GWS solution up to parity with our Microsoft 365 offering. Check out Understanding the Differences Between ITDR for Microsoft 365 and ITDR for Google Workspace to learn more.

• Managed ISPM General Availability (GA): Managed ISPM, Huntress' fully managed solution for continuously hardening Microsoft 365 environments, reached GA on July 1. Read this blog post from Aimee Simpson and Scott Riley to learn more about ISPM and how it helps organizations define the gold standard for M365 identity security, deploy the right controls, and keep them enforced over time.

• macOS log collection is now available in Managed SIEM: Teams can now collect and query logs across Windows, Linux, and macOS from a single platform, giving broader visibility across the operating systems attackers move through.
• Okta is now a supported log source in Managed SIEM: This new functionality comes with built-in SOC detections covering credential attacks, MFA bypass and fatigue, privilege escalation, and account takeover for organizations using Okta as their IdP or SSO provider.
• Azure Government (GCC High) is now a supported log source in Managed SIEM: Organizations operating in US Government cloud environments can now connect their Azure log sources to Managed SIEM, extending the same SOC-backed visibility and detection coverage to GCC High tenants.
• AI-powered search is now available in Managed SIEM: Type your search in plain English and Managed SIEM will build the query for you — no ESQL knowledge required. Click the ESQL button to see exactly what the query looks like under the hood, and save or schedule it as a recurring alert anytime.

• Managed SAT admin activity is now visible in SIEM: Audit logs from the SAT interface can be reviewed and queried directly from the Huntress portal, giving partners a unified place to track administrative actions alongside security telemetry.

• SCORM export support is now generally available: Partners who want to deliver SAT content through their own Learning Management System can download SCORM 1.2 compatible files directly from the portal.

• A new PDF summary report is available for SAT Assignments: Designed for boards, auditors, and compliance teams, the exportable report includes episode details, learner completion status with scores, and a full list of non-completers. Works across both individual company and multi-tenant assignments.

• OSINT 2 simulation is now Generally Available: A fresh take on the OSINT simulation experience, letting learners step through what it looks like to use open-source intelligence to compromise a target account. Available to opt into from the learner dashboard.

• Localized Managed Phishing for Canada: Canadian learners enrolled in Managed Phishing will now receive English-language phishing simulations built around familiar brands and scenarios, like Tim Hortons and Interac.

• New Deepfake Phishing Scenarios: Our new Deepfake Phishing scenario compromised over 1,000 learners in just the first week of being available on Managed Phishing. That means that one third of learners who clicked the link to join a fake meeting took it a step further and clicked "download driver" to compromise themselves. This is a new tactic we’re observing in the wild where attackers send users a fake meeting invite, which brings them to a legitimate-looking video conference (complete with deepfake attendees), and deploys malware under the guise of a mandatory app or driver update. You can try it out for yourself here.

During this month’s Tradecraft Tuesday, Huntress Principal Product Researchers Jenko Hwong and Dave Kleinatland broke down the rise of device code phishing, which is an attack that abuses Microsoft’s OAuth 2.0 device authorization flow to steal valid authentication tokens and skirt around multi-factor authentication (MFA) protections. In particular, modern phishing-as-a-service (PhaaS) platforms like EvilTokens and Kali365 have been leading to more device code phishing, and Hwong and Kleinatland talked about the steps organizations can take to defend against this type of attack. Check out our recap blog to learn more.

The June Tradecraft Tuesday episode was focused on device code phishing and other identity woes

Congrats to Andrew Schwartz for his CVE recognition by Microsoft! Andrew was credited for two Windows Kerberos denial-of-service flaws (CVE-2026-42914 and CVE-2026-42903).