Huntress

Volume 342, Issue 4 · 9 articles from 2 issues

In This Issue

• Operational Resilience: IT Security Risks with Reduced Staffing
• How Attackers Abuse VSS, and How Huntress Detects It
• The Tale of Two INC Ransom Notes: A Ransomware Timeline
• OAuth Token Theft Through Microsoft's Front Door
• Rogue RMM Abuse: How Attackers Exploit Remote Access Tools
• AI Attacks Move Faster. Huntress' Agentic SOC Keeps Up
• The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
• Fighting AI Slop in Production Codebases: How Huntress Improved Fable 5.1's API Recall
• Managed or Modified: Choose How Huntress Hardens Microsoft 365

Operational Resilience: IT Security Risks with Reduced Staffing (Huntress, Tuesday, September 15th, 2026)

Huntress examines how thinner IT and security staffing erodes operational resilience and what teams can do to compensate. Read more

How Attackers Abuse VSS, and How Huntress Detects It (Huntress, Monday, September 14th, 2026)

Huntress explains adversary abuse of Windows Volume Shadow Copy Service for credential theft and ransomware prep, plus detection logic. Read more

The Tale of Two INC Ransom Notes: A Ransomware Timeline (Huntress, Monday, September 21st, 2026)

Huntress reconstructed an INC ransomware attack timeline, including BYOVD driver abuse to disable defenses, despite limited initial telemetry. Read more

OAuth Token Theft Through Microsoft's Front Door (Huntress, Wednesday, September 23rd, 2026)

Huntress details an attack that sideloads a Microsoft-signed AppX package to capture OAuth tokens from a legitimate Microsoft sign-in page. Read more

Rogue RMM Abuse: How Attackers Exploit Remote Access Tools (Huntress, Wednesday, September 23rd, 2026)

Huntress warns attackers use phishing lures to install rogue remote monitoring and management tools, often stacking multiple RMMs for backup access. Read more

AI Attacks Move Faster. Huntress' Agentic SOC Keeps Up (Huntress, Tuesday, September 22nd, 2026)

Huntress' Athena AI orchestrator matched or beat human analysts on identity-threat investigations in a monthlong test, alongside human SOC staff. Read more

The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint (Huntress, Thursday, September 24th, 2026)

Huntress found an attacker compiling a cryptominer on a compromised endpoint after exploiting a Samsung MagicINFO flaw and disabling Defender. Read more

Fighting AI Slop in Production Codebases: How Huntress Improved Fable 5.1's API Recall (Huntress, Tuesday, September 22nd, 2026)

Huntress raised Claude Fable 5.1's API-recall accuracy from about 48% to 100% on its evals using three small changes to its coding agent harness. Read more

Managed or Modified: Choose How Huntress Hardens Microsoft 365 (Huntress, Thursday, September 24th, 2026)

Huntress says most Microsoft 365 tenants are missing over half of recommended identity controls, and offers automated or customizable hardening. Read more

More from Huntress · All section posts · This week