Huntress in the news

A new phishing campaign abuses Microsoft Power BI to deploy multiple rogue ScreenConnect clients for persistent remote access, bypassing email security by using legitimate Microsoft domains.

Huntress's Tragic Quadrant identifies the most problematic cyber threats for businesses, prioritizing common and dangerous tactics like RMM abuse, mailbox manipulation, and MFA bypasses.

Attackers are increasingly exploiting legitimate remote monitoring and management (RMM) software to gain persistent access, mimicking IT activities, with Huntress reporting its use in 45% of recent endpoint incidents.

Huntress's inaugural Tragic Quadrant report identifies RMM abuse, identity attacks, and simple initial access via VPN as the most common cyber threats, with a notable rise in device code phishing and highly severe, low-prevalence tactics like ClickFix and BYOVD.

Huntress formed a pan-European distribution partnership with ALSO to make its Agentic Security Platform accessible to VARs and MSPs in 31 countries.

Hackers are exploiting ChatGPT Custom GPTs to spread ClickFix malware, prompting warnings from cybersecurity firm Huntress about ongoing social engineering threats.

Huntress advocates for Australian cyber defenders to have controlled access to advanced AI models to counter the heightened threat of AI-driven cybercrime, which automates existing attack methods and lowers the barrier for attackers.

Huntress analysts identified the Settra ransomware group using MeshAgent RMM and potential BYOVD tactics in recent cyberattacks, highlighting their evasion techniques and double extortion model.

Ben Bernstein, Manager of Cybersecurity Advisors at Huntress, shares insights on the evolving cybersecurity landscape, emphasizing the impact of AI on attacker capabilities and the need for behavioral-focused defense strategies.

Huntress researchers detailed two Settra ransomware incidents, highlighting the consistent post-compromise tactics used, such as MeshAgent RMM deployment, and offering insights for early detection.

Huntress is expanding its cybersecurity platform into Africa through a partnership with QBS Software Africa to provide managed service providers and value-added resellers with access to its security solutions.

Huntress is expanding its cybersecurity services into Africa, starting with South Africa, through a partnership with QBS Software Africa to provide its platform to MSPs and VARs.

Threat actors are exploiting user trust in legitimate AI platforms by weaponizing features like shared content and search placement to deliver malware and steal sensitive data.

Giacom and Huntress partnered to help Managed Service Providers scale managed security services without operating their own 24/7 Security Operations Centres.

Huntress CEO Kyle Hanslovan states that autonomous AI attacks are a real and growing threat, requiring AI-native security workflows and making the role of MSPs more critical.

The document details how attackers abuse legitimate RMM tools for stealthy system access, outlines the challenges in detecting such abuse, and presents solutions like RMM Guard and defensive strategies.

Huntress added four distributors, Ingram Micro, Vertosoft, Liquid PC, and QBS Software, to broaden its channel reach into the mid-market, public sector, and EMEA.

A malicious "ClickFix" website, purporting to remove image backgrounds, infects users with CastleLoader and NetSupportRAT, leading to credential theft and remote access.

Huntress details how fake tech support scams have evolved to deploy highly customized Havoc C2 malware with advanced evasion and persistence techniques, leading to rapid network compromise.

Huntress discovered active exploitation of SolarWinds Web Help Desk vulnerabilities in customer environments, leading to the deployment of persistence tools, C2 frameworks, and exfiltration of system information to attacker-controlled infrastructure.