Discovering a Ransomware Remedy in the Wild
Within the ThreatOps department at Huntress, we actively hunt for malware and adversary activity. We look for persistent footholds: the tell-tale sign and smoking gun…
Category: ThreatIntelligence-IncidentResponse
How Are Hackers Sneaking Past Your Automated Systems?
Many organizations today rely on preventive software and automation to keep cybersecurity threats at bay. Unfortunately, it’s just not enough to keep hackers away. Human…
Creating a Better Why for Cyber Security Awareness Training
The game has changed for employee cyber security awareness training. For most organizations, the reason why they implemented a security awareness training program was to…
Google Threat Intelligence in Elastic Security — Elastic Security Labs
Elastic Security natively ingests Google Threat Intelligence: known-malicious IPs, domains, URLs, and file hashes matched against your telemetry the moment they appear, each carrying a…
Critical Vuln.: PrintNightmare Exposes Windows Servers to RCE
On June 29, Huntress was made aware of CVE-2021-1675 (now termed CVE-2021-34527), a critical remote code execution and local privilege escalation vulnerability dubbed “PrintNightmare.” Microsoft…
Investigating suspicious AI workflows in Microsoft Entra Agent ID: Agent’s user account
{ "TenantId": "855f09b2-b284-45cb-af48-6d9ee72abb2b", "SourceSystem": "Azure AD", "TimeGenerated": "2026-05-08T13:08:24.0156057Z", "OperationName": "Sign-in activity", "OperationVersion": "1.0", "Category": "NonInteractiveUserSignInLogs", "ResultType": "0", "ResultSignature": "SUCCESS", "ResultDescription": "", "DurationMs": "0", "CorrelationId": "763730e5-d671-4457-b429-fc78d823daaf",…
The Hunt to Find Origins of Kaseya’s VSA Mass Ransomware
Kaseya has a customer base of roughly 35,000 businesses and organizations. These consist of approximately 17,000 managed service providers, 18,000 direct/VAR customers and a significant…
Why Persistence Is a Staple for Today’s Hackers
Chances are that you lock your doors as you leave your house to prevent any unwanted visitors from entering while you’re gone. Although it isn’t…
Lessons Learned During the Kaseya VSA Supply Chain Attack
On July 2, 2021, as many people in the United States were preparing for the July 4 holiday, a major ransomware attack began to unfold.…
A Brief Evolution of Hacker Tradecraft
Sometimes change happens so gradually it’s easy to miss. That’s often the case in cybersecurity. We see statements like “the security landscape is evolving” or…
Microsoft Exchange Servers Still Vulnerable to ProxyShell
Attackers are actively scanning for vulnerable Microsoft Exchange servers and abusing the latest line of Microsoft Exchange vulnerabilities that were patched earlier this year. Back…
Bullseye: A Story of a Targeted Cyberattack
At Huntress, we work to understand hackers’ nefarious activities and analyze a lot of malware. And I mean, a lot of malware. At the time…