Assisted Remediation in Action | Huntress
This week we had the opportunity to help an MSP partner contain and remediate an Emotet/TrickBot infection that impacted a client with 50+ computers and…
Category: ThreatIntelligence-IncidentResponse
Microsoft and Adobe Patch Tuesday, June 2026 Security Update Review
Every Patch Tuesday presents a race between defenders applying fixes and attackers seeking opportunities. Microsoft’s June 2026 release is no exception, delivering security updates for vulnerabilities…
Validating the Bishop Fox Findings in ConnectWise Control
In computer security, responsible disclosure is a vulnerability disclosure model in which an issue is publicly disclosed only after a period of time that allows…
Validating the SolarWinds N-central ‘Dumpster Diver’ Vuln
Additionally, there was a screenshot highlighting how a hacker might find these vulnerable servers online using Shodan. For those not familiar with the Shodan service,…
How One Criminal Tried to Sell an MSP on the Dark Web
In a rare encounter, we found ourselves directly interacting with a cybercriminal that took us down a dark web rabbit hole. But before we dive…
The Impact of Data Breaches
Traced back to a Chinese intelligence group seeking to learn more about U.S. citizens, Marriott’s infamous breach was not uncovered until 2018, four long years…
Hiding In Plain Sight | Huntress
We recently came across something interesting. What do you think this file is? At first glance, it looks like a log for some application. It…
Evolving the Hunt: Removing Obstacles to Innovation
When I first joined Huntress, what drew me to this company was not just the people and their passion for their work; I was enamored…
Investigating suspicious AI workflows in Microsoft Entra Agent ID: Assistive agents
{ "TenantId": "855f09b2-b284-45cb-af48-6d9ee72abb2b", "SourceSystem": "Azure AD", "TimeGenerated": "2026-05-08T15:28:55.5845975Z", "OperationName": "Sign-in activity", "OperationVersion": "1.0", "Category": "NonInteractiveUserSignInLogs", "ResultType": "0", "ResultSignature": "SUCCESS", "ResultDescription": "", "DurationMs": "0", "CorrelationId": "432ea15c-55fa-4132-ae78-cfcfb4405a96",…
Huntress Service: Ransomware Canaries | Huntress
From CryptoLocker to Locky to Sodinokibi to Maze, ransomware has been a staple in the hacker-verse for a long time. For defenders, the solution to…
Huntress Service: External Recon | Huntress
Imagine if the Empire knew that there was a flaw in the Death Star’s thermal exhaust port. How would this change the events of the…
Hiding in Plain Sight: Part 2
We recently uncovered a really peculiar piece of malware, which we’ve jokingly referred to as “the gift that keeps on giving.” And the more we…