7 Takeaways from the Executive Order on Improving Cybersecurity
On May 12, 2021, President Biden signed an Executive Order (EO) to improve U.S. cybersecurity standards and further combat cyber threats against the nation. Though…
Category: ThreatIntelligence-IncidentResponse
Cyber Security Insurance Perspective on Ransomware
It’s not the first time I’ve seen something like this happen, and it certainly won’t be the last. During my time as an auditor at…
Endpoint Protection: Promises vs. Reality
One of the major challenges in the cybersecurity industry is that vendors tend to overpromise and underdeliver. I see it time and time again. In…
How a College Student Lost $10,000 to “The IRS”
Back when I worked in the division of student affairs, I came across an unsettling report from our university’s police department. One of my students…
Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix
Acknowledgments:A special thank you to Tyler Bohlmann, Jon Semon, Lindsey O’Donnell-Welch, Aaron Deal, and Beth Robinson for their contributions and edits to this blog. And…
Discovering a Ransomware Remedy in the Wild
Within the ThreatOps department at Huntress, we actively hunt for malware and adversary activity. We look for persistent footholds: the tell-tale sign and smoking gun…
How Are Hackers Sneaking Past Your Automated Systems?
Many organizations today rely on preventive software and automation to keep cybersecurity threats at bay. Unfortunately, it’s just not enough to keep hackers away. Human…
Creating a Better Why for Cyber Security Awareness Training
The game has changed for employee cyber security awareness training. For most organizations, the reason why they implemented a security awareness training program was to…
Google Threat Intelligence in Elastic Security — Elastic Security Labs
Elastic Security natively ingests Google Threat Intelligence: known-malicious IPs, domains, URLs, and file hashes matched against your telemetry the moment they appear, each carrying a…
Critical Vuln.: PrintNightmare Exposes Windows Servers to RCE
On June 29, Huntress was made aware of CVE-2021-1675 (now termed CVE-2021-34527), a critical remote code execution and local privilege escalation vulnerability dubbed “PrintNightmare.” Microsoft…
Investigating suspicious AI workflows in Microsoft Entra Agent ID: Agent’s user account
{ "TenantId": "855f09b2-b284-45cb-af48-6d9ee72abb2b", "SourceSystem": "Azure AD", "TimeGenerated": "2026-05-08T13:08:24.0156057Z", "OperationName": "Sign-in activity", "OperationVersion": "1.0", "Category": "NonInteractiveUserSignInLogs", "ResultType": "0", "ResultSignature": "SUCCESS", "ResultDescription": "", "DurationMs": "0", "CorrelationId": "763730e5-d671-4457-b429-fc78d823daaf",…
The Hunt to Find Origins of Kaseya’s VSA Mass Ransomware
Kaseya has a customer base of roughly 35,000 businesses and organizations. These consist of approximately 17,000 managed service providers, 18,000 direct/VAR customers and a significant…