Creating macOS Ransomware | Huntress
With the General Availability release of the Huntress macOS agent, we wanted to share some of the Apple-y stuff we’ve been up to behind the…
Category: ThreatIntelligence-IncidentResponse
Do You Have a Security Hygiene Checklist in Place?
As a managed service provider (MSP), you’re the backbone of your customer’s cyber infrastructure. Your team knows what it takes to run operations smoothly: a…
Tradecraft, Shenanigans and Spice: hack_it 2022 Recap
It’s near the end of the year, and that can only mean one thing here at Huntress: it’s hack_it season. Not to brag, but this…
Threat Advisory: Qakbot Activity Is Rising
Qakbot has been spreading like wildfire. Huntress has seen a 400% increase in Qakbot cases in the past two months (several hundred incidents) in comparison…
Incident Response: A Choose Your Own Adventure Exercise
When I was a kid, I loved choose your own adventure books. You made decisions and could become a powerful Sho-Gun warrior—or if you chose…
Meet Andrea Colon, Restoring Peace of Mind in a Paranoid Digital World
In this edition of our “Employee Spotlight” series, I sat down with Andrea Colon, an Account Executive who sees the human side of cyber warfare…
Threat Actors Weaponize Tiflux RMMs in Malspam Attacks
Acknowledgements: Huntress wishes to recognize the contributions of SOC analysts Tanner Filip, Jose Oregon, and Priscilla Ibarra, and Lindsey O’Donnell-Welch for help hunting telemetry for…
Metasploit Wrap-Up 05/15/2026
Weaponizing a text editor for fun and profit Gather round, dear readers, because today, we (by we, we mean @h00die) dropped the ultimate persistence mechanism:…
How EvilTokens Turbocharges Old School Phishing with AI
The first alerts showed up on February 19. Then again, on February 24. Initially, it was just small blips in a sea of alerts. The…
Huntress × Acrisure Cyber Insurance Program
TL;DR: Huntress and Acrisure are partnering to help eligible businesses turn stronger cybersecurity into better cyber insurance outcomes. Through the Huntress × Acrisure Cyber Insurance…
CVE-2026-20182: Cisco SD-WAN Active Exploitation
Multiple critical authentication bypass vulnerabilities in Cisco Catalyst SD-WAN Controller and Manager are under active exploitation by multiple threat clusters, including CVE-2026-20182, which has been…
Strong Stack. Strong Team. Real Security Resilience.
Modern security teams carry a constant mix of pressure. They are balancing risk, cost, visibility, and response while trying to build a stack they can…