Using Backup Utilities for Data Exfiltration
Background As an MDR provider supporting over 2.7 million endpoints across an extremely diverse customer base, Huntress sees a great deal of both legitimate and…
Category: ThreatIntelligence-IncidentResponse
Managing Attack Surface | Huntress
Background Given a diverse customer base, Huntress sees a wide range of activity even when it comes to persistent threat actors. When such a threat…
7 Don’ts of Security Awareness Training
Security awareness training (SAT) is needed now more than ever. Just look at the barrage of ransomware attacks debilitating healthcare. And it’s no longer just…
How Huntress Managed EDR Stands Against the Competition
Cybercrimes are no longer reserved for the Fortune 500. It’s more than just major banks, national retailers, and hospital networks at risk. Hackers are now…
MSSQL to ScreenConnect | Huntress
Background Huntress SOC analysts continue to see alerts indicating malicious activity on endpoints running MSSQL Server or MSSQL Express, either as stand-alone installations, or as…
Analyzing a Malicious Advanced IP Scanner Google Ad Redirection
So you found yourself responding to an alert about one of your employees downloading a malicious version of Advanced IP Scanner? This has become fairly…
The 60ms Window: How Event 5156 Solves the ADWS Attribution Problem
The BloodHound Slack challenge Coincidentally, as I was drafting my post on the ADWS blind spot (originally scoped to be part 6, but now Part…
What a Fake Claude Download Says About Security Today
Most people expect scams and hacks to show up in their inbox or DMs, not in a place they’ve been conditioned to trust, like the…
Your Staging Site Is More Important than You Think
A third-party security researcher recently found a vulnerability in our staging environment. That’s not a fun sentence to write, even when the person finding it…
Your Security Program Was Built for a Threat Landscape That No Longer Exists
More tools. Healthy budgets. Hard-working teams. And yet, security is still falling behind. The problem isn’t a lack of effort. It’s that many security programs…
Tenable Hexa AI for vulnerability prioritization and remediation
See how Tenable Hexa AI custom agents empower you to counter machine-speed threats by automating vulnerability remediation. Learn how the Model Context Protocol (MCP) automates…
Rapid7 Analysis: ClickFix-style Phishing Campaign Uses Fake Claude Installer
Overview It is no secret that phishing campaigns utilizing various ClickFix techniques have been a commonly used method of social engineering. One of the main…