company
Huntress is a cybersecurity company offering managed detection and response (MDR), threat hunting, and SOC services mainly for small and midsize businesses.
No evidence-backed relationships are recorded.
Huntress found legitimate remote management software abused in 45% of the endpoint incidents it logged in the first quarter of 2026. A rogue copy can behave like IT's approved one, so defenders have to know which tools are sanctioned and how each install arrived.
Reality
Huntress details four ways attackers who already hold administrator rights add Microsoft Defender exclusions to keep malicious files out of every scan. A registry value can also hide those exclusions from any admin who checks for them.
Reality
Huntress says a threat actor turned member-account file uploads into webshells on three web servers of a shared recreation-management platform. The same upload path served every tenant, and the attacker returned after one server was cleaned but not locked down.
Reality
Huntress traced a RAT campaign that hides its first-stage lure in a ChatGPT Custom GPT on the real chatgpt.com, across at least 40 incidents. Because the page sits on a trusted domain, blocking the ClickFix PowerShell paste is the control that works.
Perspective Coverage
8 publishersReality
Huntress traced at least two of more than 40 ClickFix malware incidents to fake custom GPTs on OpenAI's chatgpt.com. On that route every hop before the PowerShell command sat on a Google or OpenAI address, so staff taught to trust familiar domains would click through each one.
Reality
ShinyHunters says the two to three terabytes it took from the FBI include psychiatric and medical evaluations of bureau staff. Beside a Reuters sample tying named staff to counterintelligence jobs, those files are exposure no password reset can fix.
Reality
An affiliate entered through an MFA-less SonicWall VPN, then used Safe Mode with Networking to kill endpoint controls. The encryptor ran out of virtual memory instead of running.
Perspective Coverage
3 publishersReality
Huntress counted 81 million login attempts against Azure CLI in two weeks of June and 78 compromises. Most of the victims had MFA. It just did not apply to the flow the attacker used.
Reality
An Iran-linked intrusion kept a British generator down for four days while US wastewater plants lost pressure across 12 states. The number that matters now is restoration time.
Perspective Coverage
4 publishersReality
Huntress has seen exploitation in two customer environments. One flaw hands over PaperCut's configuration without a login, the second turns that configuration into a class loader, so patching and config review are one job.
Perspective Coverage
10 publishersReality
Huntress found suspected DPRK workers inside an Australian healthcare company and a sales hire wearing a stolen identity, which puts the screening that catches them in the hands of recruiters and background-check vendors.
Reality
ConnectWise's September 3 advisory promises a CVE and a fix within the week, so until one lands the only control is a per-role permission change. Huntress says the spread is already worm-like across newly connected machines.
Perspective Coverage
3 publishersReality
N-able shipped N-central 2026.3 HF4 on Saturday and says nothing confirms production exploitation, while Huntress calls the bug a possible zero-day and has one compromised customer console whose logs had already rotated.
Perspective Coverage
7 publishersReality
The fraudulent request passed domain authentication because it genuinely came from the agency's mail domain, sent by an account the agency had not authorised. Revolut found out only when it called the agency to check.
Perspective Coverage
8 publishersReality
Federal agencies now have three separate patch deadlines inside twelve days. The lowest-scoring pair of the five flaws added to KEV is the one with a documented 24-day intrusion campaign behind it.
Perspective Coverage
13 publishersReality
Huntress worked two Settra intrusions, in July and September, and found MeshAgent installed for remote control, Windows event logs cleared and recovery partitions removed. SOCRadar counts 93 victims claimed since June.
Reality
A single operator is distributing fake "desktop apps" for three US payroll platforms that have no desktop product. Each installer silently sets up ScreenConnect for unattended control of the payroll operator's machine, Allure Security found.
Reality
Huntress traced a September 2026 intrusion in which the actor compiled a Monero miner on the endpoint, using a MagicINFO flaw Samsung fixed 16 months earlier. The build step is loud in telemetry, but it ran only after Defender had been disabled.
Reality
Huntress says three of its SOC investigations began with document lures and ended with victims installing rogue ITarian and ScreenConnect clients, and its responders now find RMM abuse in almost 40% of the incidents they work.
Reality
Huntress found the same one-megabyte PIF in two customer environments, pulled down by a link that promised a PNG. Everything after it is the 2024 DarkMe chain, down to the rundll32 /sta GUID from that campaign.
Reality
Security · September 23, 2026 · 1 publisher
Security · September 22, 2026 · 1 publisher
Security · September 22, 2026 · 1 publisher
Security · September 14, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Security · September 11, 2026 · 1 publisher
Security · September 11, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Security · September 8, 2026 · 1 publisher
Build · September 8, 2026 · 1 publisher
Build · September 8, 2026 · 1 publisher
Security · September 4, 2026 · 1 publisher
Security · September 1, 2026 · 1 publisher
Security · September 1, 2026 · 1 publisher
Security · September 1, 2026 · 1 publisher
Build · August 28, 2026 · 1 publisher
Security · August 28, 2026 · 1 publisher
Security · August 25, 2026 · 1 publisher
Security · August 24, 2026 · 1 publisher
Science · August 23, 2026 · 1 publisher
Security · August 20, 2026 · 2 publishers
Build · August 19, 2026 · 1 publisher
Security · August 18, 2026 · 1 publisher
Invest · August 17, 2026 · 1 publisher
Security · August 16, 2026 · 1 publisher