ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Huntress Detection Engineering”

40 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 17Malware 16Ransomware 12Exploit / PoC 11Phishing & fraud 9Threat actor 7Industry 6Policy & legal 3Data breach 2Research 2AI safety & security 2Advisory 1
SeverityAllcritical 38high 18medium 24low 0info 8

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

A Detection Engineer's Guide for Delegating Work to AI

Huntress argues detection engineers should only delegate security work to AI when outputs can be independently verified.

A Huntress detection engineer argues that the deciding factor for handing tasks to AI is whether the output can be checked, not whether the model is trusted. The piece frames human verification as the gate for delegating security engineering work to AI assistants. It is guidance/opinion aimed at defenders building detections with AI help.

Huntress · 28d agoAI safety & security

Credential Theft: How Attackers Steal & Use Stolen Credentials

Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.

Huntress published an educational overview of credential theft, citing that roughly 70% of confirmed data breaches begin with stolen credentials. It details acquisition methods including phishing, adversary-in-the-middle attacks that capture MFA session tokens, infostealers (nearly a quarter of threats Huntress observed in 2025), Mimikatz-based credential dumping, credential stuffing, and password spraying. The piece then covers post-theft actions such as lateral movement, privilege escalation, account takeover, business email compromise, and ransomware, and closes with behavioral detection guidance and layered prevention strategies.

Huntress · 6d agoResearch

Best Practices for Good Endpoint Hardening | Huntress

Huntress outlines endpoint hardening best practices, citing exposed RDP, RMM tool abuse, and ClickFix social engineering as common SMB intrusion paths.

Huntress published defensive guidance on endpoint hardening for small and mid-sized businesses, drawing on observations from its SOC. The post describes common intrusion vectors: internet-exposed RDP brute-forced by automated scanners, phishing emails delivering attacker-controlled remote monitoring and management (RMM) tools, with Huntress reporting a 277% spike in RMM abuse in 2025, and ClickFix attacks using fake CAPTCHA pages that trick users into running malicious commands. Recommended controls include scanning for exposed RDP, SSH, and VPN interfaces, removing unneeded local admin rights, enabling Windows Defender tamper protection, disabling SMBv1, and standardizing on one approved remote access tool, guided by CIS and NIST frameworks.

Huntress · 6d agoAdvisory

The 12 Best Managed Detection & Response (MDR) Services, Compared and Priced

Buyer's guide compares 12 MDR services, naming Huntress best value, CrowdStrike Falcon Complete for response authority and Expel for transparency.

The article compares 12 managed detection and response providers across response authority, tool bundling and pricing, highlighting Huntress for published SMB pricing and CrowdStrike Falcon Complete for unilateral containment. It stresses the consolidation landscape: Sophos completed its acquisition of Secureworks in February 2025 for approximately $859 million, and Arctic Wolf closed its purchase of BlackBerry's Cylance endpoint assets the same month. It also warns that only full-response contract tiers isolate hosts and kill processes, while lower tiers only triage or guide.

GBHackersupdated · 7d agofirst · 7d agoIndustry 3 sources1

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.

Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.

Huntress · 13d agoExploit / PoC in the wild1

New View for Security Incident Investigations

Huntress launched a new view giving partners visibility into how its SOC investigates security incidents from first signal to resolution.

Huntress announced a new view into its security incident investigation workflow, showing partners how the Huntress SOC progresses cases from first signal to final resolution, including those closed as benign. The feature adds transparency into SOC triage and investigation decisions for managed detection and response customers.

Huntress · 23d agoTools

Operational Resilience: IT Security Risks with Reduced Staffing | Huntress

Huntress blog advises security teams on managing change, risk, and incident response during reduced-staffing holiday periods.

The article discusses how holiday-period staffing reductions change organizational risk profiles around change management, monitoring, and incident response capability. It argues against blanket change freezes when critical vulnerabilities with high exploitation probability demand patching, and stresses retaining decision-making authority, escalation paths, and recovery knowledge. It concludes by promoting Huntress Managed Response, which lets the Huntress SOC take predefined containment actions on confirmed threats without customer intervention.

Huntress · 1d agoIndustry

Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence

Phishing emails with browser-in-the-browser fake Adobe pages trick users into installing rogue ScreenConnect clients granting persistent remote access.

Huntress SOC investigated two August incidents where phishing links led to fake CAPTCHA checks and Adobe PDF Reader lures rendered as browser-in-the-browser (BiTB) pages spoofing legitimate domains like get.adobe.com. Victims downloaded what they believed was Acrobat Reader but actually installed ScreenConnect.ClientSetup.exe from attacker infrastructure, yielding two rogue ScreenConnect clients with service-based persistence. The attacker used cmd.exe and curl to stage a second client connecting to 144.172.115.59, leveraged a ScreenConnect Trial Relay domain for stealth, and ran HideCursor.exe as a defense-evasion binary. Incident 2 arrived via AT&T Office@Hand (RingCentral), with both chains stopped before broader impact.

Huntress · 7d agoPhishing & fraud in the wild

How Attackers Abuse VSS, and How Huntress Detects It

Huntress details how attackers abuse Windows Volume Shadow Copies for ransomware recovery sabotage and NTDS.dit credential theft, plus detection logic.

Huntress explains that attackers abuse VSS in three ways: deleting shadow copies to inhibit recovery before ransomware detonation, creating shadow copies to extract the NTDS.dit Active Directory database for offline credential theft, and manipulating shadow copy configuration. Because backup agents and RMM tools routinely create and delete shadow copies, raw events are too noisy to alert on alone. Huntress detections instead correlate VSS activity with lateral movement and credential harvesting over a time window, such as an observed sequence of PsExec spawning SYSTEM shells on a domain controller, vssadmin create shadow, a blocked deletion attempt, and DNS reconnaissance against another host.

Huntress · 2d agoResearch

Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress

Huntress details modern phishing tactics including ClickFix, browser-in-the-browser, and OAuth consent phishing beyond basic credential harvesting.

Huntress describes a shift in phishing attacks beyond basic credential harvesting toward advanced tactics. Covered techniques include ClickFix social engineering, browser-in-the-browser (BitB) attacks, and OAuth consent phishing. The post recommends training users on these patterns through Huntress SAT simulations.

Huntress · 19d agoPhishing & fraud in the wild1

New Huntress Managed ITDR Dashboard: Faster Identity Investigations

Huntress redesigned its Managed ITDR dashboard, adding Rapid Identity Triage, Failed Login Characterization, and Quick SIEM search to speed identity investigations.

Huntress announced a redesigned Managed ITDR dashboard aimed at accelerating identity threat investigations. New capabilities include Rapid Identity Triage, Failed Login Characterization, and Quick SIEM search. The update is a vendor product change with no incident or vulnerability details attached.

Huntress · 20d agoTools

What Good Identity Hardening Looks Like

Huntress guidance defines mature identity hardening beyond baseline MFA, covering exception cleanup and detecting identity configuration drift before attackers do.

Huntress argues MFA is only a starting point and outlines what mature identity hardening actually looks like in practice. The guidance covers closing MFA exceptions and coverage gaps that create unauthenticated attack paths. It also stresses catching identity configuration drift before attackers can exploit it.

Huntress · 22d agoResearch

A Beginner’s Guide to Phishing Simulation Training for Employees | Huntress

Huntress published a beginner's guide to phishing simulation training that simulates real phishing attacks to protect organizations.

Huntress released a beginner's guide to phishing simulation training for employees. The guide covers the essentials of simulating real phishing attacks to improve organizational security awareness. It serves as educational content tied to Huntress's training products.

Huntress · 19d agoIndustry

Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware

Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.

Threat actors are weaponizing the Volume Shadow Copy Service (VSS) for two purposes: destroying local recovery points via vssadmin.exe, wmic.exe, diskshadow.exe, wbadmin.exe, and bcdedit.exe before encryption, and accessing static copies of locked files such as NTDS.dit and SAM for credential theft. Ransomware families tied to shadow-copy removal include Akira, Black Basta, BlackCat, Conti, LockBit, Qilin, RansomHub, REvil, Ryuk, and WannaCry. Huntress's analysis of the Nightmare-Eclipse tool showed the BlueHammer technique chaining a Windows Defender timing issue with a VSS snapshot to dump the SAM database and decrypt NT hashes. Defenders should correlate VSS operations with parent process, hive access, and subsequent encryption activity, and maintain immutable off-host backups.

GBHackers · 1d agoResearch in the wild1

Insights into Suspected DPRK Workers

Huntress details incidents involving suspected DPRK remote workers (Famous Chollima) in partner environments and shares detection indicators.

Huntress analyzed several incidents involving suspected North Korean remote workers, associated with the activity cluster known as Famous Chollima. The report describes indicators defenders can use to detect and prevent DPRK worker infiltration in customer environments. The scheme centers on operatives obtaining remote jobs at Western companies under assumed identities.

Huntress · 21d agoThreat actor in the wild

Top 10 Best Ransomware Protection Solutions in 2026

A 2026 buyer's guide ranks ten ransomware protection tools by kill-chain role as extortion shifts from encryption to data theft.

The roundup organizes defenses across the ransomware kill chain: prevention-grade EPP/EDR platforms, containment layers, rollback specialists, and immutable recovery. Recommended products include CrowdStrike, Microsoft Defender, Sophos, SentinelOne, Bitdefender, Trend Micro, Halcyon, Huntress, and Malwarebytes. It stresses that many crews now extort on stolen data without encrypting, making exfiltration detection and response speed as important as rollback.

Cyber Security News · 6d agoIndustry1

Teach Yourself to Phish | Huntress

Huntress outlines the strategy behind phishing simulations to help organizations build resilience against real phishing threats.

Huntress published guidance on the strategy behind phishing simulation programs. The piece argues simulations should mirror real attacker behavior to train employees and measure organizational resilience. The content promotes Huntress's security awareness training offering.

Huntress · 19d agoIndustry

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business News · 9d agoPhishing & fraud in the wild1

Huntress API Update: New Endpoints, Webhooks, and Automation

Huntress expanded its API from six read-only endpoints into an automation platform adding webhooks and Model Context Protocol support.

Huntress announced a major expansion of its API, growing from six read-only endpoints into a full integration and automation platform. New capabilities include webhook support, additional endpoints, and MCP (Model Context Protocol) support to enable AI-assisted automation. The update targets defenders building integrations and automated workflows around the Huntress managed detection and response platform.

Huntress · 16d agoTools

Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware

Huntress tracked fake GTA 6 downloads distributing NJRAT, DCRAT, Mercurial Grabber, and Chaos ransomware used as a wiper against gamers.

Cybercriminals are pushing fake Grand Theft Auto VI downloads through poisoned search results, gaming forums, torrent sites, and social media, targeting players seeking a leaked build before release. Huntress analyzed a sample bundling NJRAT, DCRAT, Mercurial Grabber, and Chaos ransomware in one package; fake ISO files exceed 100GB largely with junk data, and Russian-language prompts suggest the operators target Russian-speaking gamers. Chaos ransomware acts as a wiper, overwriting files larger than 200MB with random data, deleting shadow copies for admin users, and disabling recovery options rather than offering genuine ransom payment paths.

Cyber Security News · 6d agoMalware in the wild 3 sources

How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface

Huntress details campaigns abusing Claude Artifacts, claude.ai/share links, and ChatGPT/Grok conversations to deliver SectopRAT, MacSync, and AMOS stealers.

Huntress SOC documented nine months of campaigns in which attackers weaponized trusted AI platform features—Claude Artifacts, public claude.ai/share links, and indexable ChatGPT/Grok conversations—to deliver malware. The July FakeAgent campaign hit more than 29 organizations via a malicious Claude Artifact posing as a Claude Desktop download page that redirected to SectopRAT. A claude.ai/share link disguised as an Apple Support guide tricked a victim into running a curl command that deployed the MacSync stealer, harvesting cookies, credentials, keychain secrets, Telegram sessions, and SSH/cloud keys, while SEO-poisoned ChatGPT and Grok conversations delivered the AMOS stealer via ClickFix-style instructions.

BleepingComputer · 5d agoPhishing & fraud in the wild

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business News · 14d agoData breach in the wild1

Guide to Cybersecurity Budget Planning: How Much + How To | Huntress

Huntress publishes guidance on planning cybersecurity budgets and getting more value from security spend.

Huntress released a guide aimed at helping businesses plan their cybersecurity budgets without overspending. The content is promotional guidance on prioritizing security spend rather than incident reporting. No vulnerabilities, incidents, or threat activity are described.

Huntress · Aug 12, 2026Industry

Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.

Huntress identified three unrelated August 2026 incidents using a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form to install rogue ScreenConnect clients. Each client repeatedly spawned wscript.exe to run 1.vbs through 4.vbs, which profiled the host, enumerated installed security products, and downloaded stage-specific payloads from Dropbox. Depending on detected state, payloads included a user-level ScreenConnect backdoor, UAC-bypass privilege escalation tooling, or tunneling utilities with an XMRig cryptocurrency miner. Infected clients re-infected newly connected hosts, creating worm-like propagation, and ConnectWise issued an advisory about affected file transfer behavior in ScreenConnect.

The Hacker News · 9d agoMalware in the wild

Boardroom Battles 2026: ASD’s Cyber Priorities & AI Risk

Huntress analyzes the Australian Signals Directorate's 2026 board cyber priorities and frontier AI guidance on managing AI-era threats.

Huntress analyzed the Australian Signals Directorate's 2026 boardroom cyber priorities and its guidance on frontier AI risk. The piece argues that rapid AI adoption alone will not counter AI-era cyber threats and outlines what boards should focus on. No specific incident, vulnerability, or regulation change is described.

Huntress · 17d agoPolicy & legal

Critical N-able N-central Vulnerability and Active Exploitation

N-able N-central pre-auth RCE zero-day CVE-2026-86218 (CVSS 10.0) is exploited in the wild; on-prem admins must upgrade to 2026.3 HF4.

N-able disclosed a third N-central vulnerability, CVE-2026-86218, a pre-authentication RCE rated CVSS 10.0, and released hotfix 2026.3 HF4 superseding build 2026.3.1.13. Huntress reproduced an exploit chain involving an authentication bypass (CVE-2026-86206/CVE-2026-86207) after a fully patched customer's N-central production server was compromised on September 4. Attackers appended strings like .invalid to account names and probed the /remoteControlAction.do?method=getPierDetails endpoint; Huntress worked with Cloudflare to disable adversary tunnel infrastructure. Hosted N-central instances are already patched; on-prem administrators must upgrade immediately.

Huntress · 10d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-86207+2 CVEs

Mapping out your unknown: A threat hunter’s guide to GitHub

Datadog Security Labs publishes a threat-hunting guide with audit-log queries to detect GitHub token theft, device code phishing, and source code exfiltration.

Datadog's threat-hunting guide covers GitHub audit log queries for detecting compromised accounts, stolen personal access tokens, and malicious OAuth app authorizations. Attackers typically obtain credentials through phishing, credential stuffing, leaked secrets, or device code phishing, then map private repositories, exfiltrate source code, and pivot into connected cloud and CI/CD environments. The guide maps detections to MITRE techniques like T1078 and T1528 and documents GitHub logging quirks affecting attribution, token metadata, and visibility fields.

Datadog Security Labs · 17h agoResearch in the wild

10 Hacker Summer Camp Standouts at Black Hat and DEF CON

Huntress researchers recap standout talks, panels, and villages from this year's Black Hat and DEF CON conferences.

Huntress researchers and SOC analysts published a recap of highlights from Black Hat and DEF CON, covering panels, villages, and standout sessions from Hacker Summer Camp. The post is a community roundup rather than an incident, vulnerability, or research disclosure.

Huntress · Aug 14, 2026Industry

The 12 Best Endpoint Detection & Response (EDR) Solutions, Compared and Priced

An editorial scorecard ranks 12 EDR platforms, with CrowdStrike and SentinelOne tied at 8.6/10 and telemetry retention identified as the hidden cost driver.

An editorial comparison scores twelve EDR platforms on detection, response, analyst burden, pricing transparency, and coverage. CrowdStrike and SentinelOne tie at 8.6/10, with Microsoft Defender for Endpoint close behind at 8.5 and described as effectively free in Microsoft 365 E5 estates. The guide argues that telemetry retention, not per-endpoint price, drives real cost, with fully-priced quotes frequently diverging 2-3x from headline rates. Managed detection offerings, including Cynet's bundled 24/7 SOC, factor into the buyer-fit rankings.

GBHackers · 7d agoIndustry 2 sources

Securing Your Business: The Vital Role of Cyber Insurance | Huntress

Huntress explains cyber insurance coverage types, insurer security requirements, and the shift toward documented evidence of controls.

Huntress outlines first-party and third-party cyber insurance coverage, including business interruption, data recovery, extortion, privacy liability, and regulatory fines. Insurers now commonly require EDR, MFA, security awareness training, patching, tested backups, least-privilege access, and incident response plans. With ransomware accounting for 91% of insurance losses in H1 2025 and average US breach costs at $10.22 million, underwriters increasingly demand evidence packs rather than self-attestation.

Huntress · 15d agoIndustry

Inside Knight Office, a New M365 AiTM Phishing Kit

Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.

Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.

Huntress · 14d agoPhishing & fraud in the wild1

North Korean remote workers are broadening their job hunt beyond IT

Huntress links suspected North Korean remote workers to sales, marketing, and healthcare jobs using stolen identities, VPNs, proxies, and KVM hardware.

Huntress investigations identified suspected DPRK remote workers hired beyond IT in sales, marketing, and healthcare/financial organizations, sometimes actually performing the work they were hired for. Fraudulent documents included passports from the same city issued one day apart, ID cards with identical validity dates, and electricity bills built from the same online template with matching typos. A financial-services case found a PiKVM and Guermok USB capture card on a new hire's laptop within hours of delivery, suggesting a laptop farm, and another hire used a police mugshot with the photo digitally swapped. Researchers urge rigorous background checks and identity verification at the interview stage.

Help Net Security · 19d agoPhishing & fraud in the wild

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

North Korea's IT worker scheme (Famous Chollima/PurpleDelta) has expanded from IT into healthcare, sales, and financial services roles worldwide.

Huntress and Recorded Future documented DPRK-linked fraudulent workers landing remote jobs beyond IT, including at an Australian healthcare company, a financial services firm, and a sales hire with a stolen identity. The scheme, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta, UNC5267, and Wagemole, uses forged identity documents, VPNs, proxies, and laptop farms with PiKVM and capture cards to fund Pyongyang's weapons programs. Recorded Future found the PurpleDelta cluster applied to 1,100+ companies between late 2024 and early 2025 with 22 fabricated personas, some AI-generated, using ChatGPT and AI transcription during interviews. Analysts assess the activity is ongoing and likely to expand in scale and sophistication.

The Hacker News · 15d agoThreat actor in the wild

Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

Huntress uncovered post-DEF CON phishing via X direct messages using a malicious Google Doc to deliver AMOS and NetSupport RAT malware.

Huntress uncovered a phishing campaign targeting attendees after Black Hat and DEF CON. Attackers used X direct messages pointing to a malicious Google Doc as the delivery vehicle. Payloads include AMOS, a macOS infostealer, and the NetSupport RAT, among other malware.

Huntress · 28d agoPhishing & fraud