Threat hunts from this week's research.

396 of 396 hunts

1. medium

   Research by Huntress

   Credential-driven LOLBin Proxying and Ransomware

   An intruder has used stolen credentials to gain initial access and is now using signed system binaries to proxy execution and encrypt files across the estate.

   3 query2 analytic2 checkpoint1 action2 task

   defense evasion · impact · initial access
2. high Part 2 of 2

   Research by Unit 42

   Post-Intrusion LotL and Extortion Chain

   An adversary uses built-in administrative tools to harvest credentials and stage data in temporary paths before deploying ransomware for extortion, following a successful initial breach.

   5 query2 analytic1 checkpoint1 action2 task

   credential access · defense evasion · exfiltration
3. high Part 1 of 2

   Research by Unit 42

   Perimeter Access and Identity Fraud

   Adversaries target unpatched perimeter assets or use AI-generated personas for initial access, indicated by high-severity vulnerabilities on internet-facing hosts coupled with anomalous sign-ins and successful unauthorized web requests.

   3 query1 analytic1 checkpoint1 action2 task

   credential access · defense evasion · exfiltration
4. medium Part 2 of 2

   Research by ESET Research

   Post-Compromise Evasion and Ransomware Impact

   An adversary is using signed system binaries to proxy execution of infostealers or ransomware, transitioning from stealthy credential harvesting to mass file encryption.

   3 query1 analytic1 checkpoint1 action2 task

   credential access · defense evasion · impact
5. medium Part 1 of 2

   Research by ESET Research

   Initial Access via External Applications and Phishing

   An adversary has gained initial access by either exploiting a critical vulnerability in a public-facing application or by use of stolen credentials from a phishing campaign, resulting in anomalous application crashes or high-risk authentication events on perimeter assets.

   3 query1 analytic1 checkpoint1 action2 task

   credential access · defense evasion · impact
6. high Part 2 of 2

   Research by Cisco Talos

   Cloud Service Enrichment and AI Assessment

   An intruder is using stolen session tokens to query third-party APIs for victim data enrichment and calling LLMs to prioritize assets for exfiltration.

   3 query1 analytic1 checkpoint1 action2 task

   collection · credential access · execution
7. high Part 2 of 2

   Research by Microsoft

   AD CS Certificate Abuse and Lateral Movement

   An adversary is performing discovery against Active Directory Certificate Services to identify vulnerable templates (ESC1) or coercive authentication targets (ESC8), then obtaining certificates for privileged accounts to facilitate Kerberos authentication and data exfiltration.

   4 query1 analytic1 checkpoint1 action2 task

   credential access · discovery · execution
8. high Part 1 of 2

   Research by Microsoft

   Teams Impersonation and Portable Runtime Execution

   An intruder has impersonated help desk staff via Microsoft Teams to establish a remote support session and execute portable runtimes from a user-writable directory to begin system discovery.

   4 query2 analytic1 checkpoint1 action2 task

   credential access · discovery · execution
9. medium Part 2 of 2

   Research by Huntress

   Endpoint Intrusion and Impact Chain

   An intruder has gained a foothold using unauthorized remote management software or encoded scripts and is now attempting to dump credentials and inhibit system recovery.

   5 query2 analytic1 checkpoint1 action2 task

   collection · credential access · execution
10. medium Part 1 of 2

    Research by Huntress

    Identity and Cloud Access Anomalies

    An intruder gained access via credential stuffing or MFA fatigue and established email collection or inhibited system recovery.

    4 query1 analytic1 checkpoint1 action2 task

    collection · credential access · execution
11. high

    Research by Microsoft

    AI-Scaled Social Engineering and Access

    An intruder uses generative AI to produce high-volume tailored lures and trojanized repositories, subsequently deploying agentic frameworks like ARTEX for automated reconnaissance and persistence.

    5 query2 analytic1 checkpoint1 action2 task

    execution · initial access · persistence
12. high Part 2 of 2

    Research by Cisco Talos

    AI-Enhanced C2 and Web Proxy Hijacking

    An adversary has exploited PHP or Node.js vulnerabilities to deploy a Go-based implant that hides its command-and-control activity by hijacking AI API keys and using local proxies.

    3 query1 analytic1 checkpoint1 action2 task

    command and control · credential access · execution
13. high Part 1 of 2

    Research by Cisco Talos

    AI-Driven NIK C2 Implant and Data Theft

    An intruder has deployed the NIK C2 implant to harvest browser credentials and crypto wallets, potentially preparing to deploy screen-locking ransomware.

    3 query2 analytic2 checkpoint1 action2 task

    command and control · credential access · execution
14. high Part 1 of 2

    Research by ESET Research

    Amatera Infostealer Initial Access and Persistence

    An intruder has used social engineering to trick a user into executing PowerShell commands from the Run dialog, leading to the installation of the Amatera infostealer and persistent scheduled tasks.

    5 query2 analytic1 checkpoint1 action2 task

    collection · credential access · defense evasion
15. high Part 3 of 3

    Research by Cisco Talos

    AI-Secret Theft and Ransomware Post-Exploitation

    An adversary is targeting hosts with AI development tools to scrape keychain secrets, moving laterally using discovery tools before exfiltrating data via Rclone and deploying ransomware like VYPR or Interlock.

    5 query2 analytic1 checkpoint1 action2 task

    credential access · defense evasion · execution
16. critical Part 2 of 3

    Research by Cisco Talos

    EDR Impairment and RMM-Driven Ransomware Execution

    An adversary has established a foothold and is systematically disabling security controls via process termination and Bring Your Own Vulnerable Driver (BYOVD) techniques to facilitate ransomware execution via RMM tools.

    3 query1 analytic1 checkpoint1 action2 task

    credential access · defense evasion · execution
17. high Part 1 of 2

    Research by Cisco Talos

    NIK C2: Host Persistence and Evasion

    An intruder has established persistence for the NIK C2 implant by placing masqueraded binaries in user profile paths and creating Registry Run keys to maintain an AI-augmented remote access session.

    4 query2 analytic1 checkpoint1 action2 task

    command and control · credential access · defense evasion
18. critical

    Research by Sekoia

    Pre-Patch Web Runtime Exploitation

    An attacker has exploited a zero-day vulnerability in an internet-facing web runtime during the four-day pre-patch window (Oct 17-21, 2026) to gain remote code execution, established botnet C2, and leveraged stolen credentials to persist via remote access services.

    5 query2 analytic1 checkpoint1 action2 task

    command and control · execution · impact
19. high Part 2 of 2

    Research by ESET Research

    LiteLLM Supply Chain Poisoning and Persistence

    An adversary has installed a poisoned version of the LiteLLM library to establish persistence via Python startup files and exfiltrate host credentials.

    4 query2 analytic2 checkpoint1 action2 task

    credential access · execution · initial access
20. high Part 2 of 2

    Research by ESET Research

    MDaemon Exploitation and Backdoor Lifecycle

    An adversary has exploited a public-facing MDaemon mail server or successfully phished a user, subsequently deploying a backdoor and using script-based decoys to evade security analysis by triggering AI safety guardrails.

    5 query2 analytic1 checkpoint1 action2 task

    credential access · defense evasion · execution
21. critical Part 1 of 2

    Research by ESET Research

    Development Pipeline Credential Abuse and Injection

    An adversary has compromised developer credentials to harvest sensitive repository secrets and inject malicious code into private source code repositories, bypassing standard CI/CD protections.

    3 query1 analytic1 checkpoint1 action2 task

    credential access · defense evasion · execution
22. high

    Research by Huntress

    Rogue MDM and RMM Deployment

    An attacker uses social engineering to enroll a device into an unauthorized MDM tenant, providing a persistent and privileged path to deploy a rogue RMM tool for remote access.

    5 query2 analytic1 checkpoint1 action2 task

    command and control · execution · initial access
23. high Part 2 of 2

    Research by Unit 42

    Autonomous AI Retail Intrusions and Cloud Fraud

    An adversary has compromised a retail employee account via social engineering and is now using an autonomous AI agent to conduct high-velocity reconnaissance and fraudulent gift card issuance within a sub-10-hour window.

    3 query2 analytic2 checkpoint1 action2 task

    credential access · execution · impact
24. high Part 1 of 2

    Research by Unit 42

    E-Commerce Edge Exploitation and API Abuse

    Adversaries are exploiting e-commerce vulnerabilities like CosmicSting to gain initial access, followed by credential stuffing against customer APIs and the injection of digital skimmers into checkout flows.

    4 query2 analytic2 checkpoint1 action2 task

    credential access · execution · impact

No hunts match those filters.