Huntbase Hub

Huntbase Hub

Threat hunts from this week's research.

Each hunt turns a piece of public threat research into something you can run: a hypothesis, the queries that test it, what a hit looks like, and what the hunt cannot see.

Want to run them against your own data? Sign up to Huntbase →

341 of 341 hunts

  1. medium
    Research by ESET Research

    Email Bombing and Identity Takeover Correlation

    An attacker is using an email sign-up flood as a smokescreen to hide security alerts while they perform account takeovers and install remote access tools via tech support scams.

    5 query2 analytic1 checkpoint1 action2 task
    defense evasion · execution · impact
  2. critical
    Research by Huntress

    ConnectWise M365 Application Abuse

    An adversary has exploited compromised ConnectWise (SkyKick) vendor credentials to access M365 tenants, escalate directory privileges, and persist by adding secrets to secondary applications.

    4 query2 analytic1 checkpoint1 action2 task
    credential access · initial access · persistence
  3. medium Part 2 of 2
    Research by Unit 42

    Delivery and Payload Execution Monitoring

    An adversary has established initial access through a compromised supply chain or a phishing attachment, resulting in unusual package installations or rare process execution from browser-originating downloads.

    3 query1 analytic1 checkpoint1 action2 task
    initial access
  4. high Part 2 of 2
    Research by CISA

    BeyondTrust Appliance Identity Persistence and Evasion

    An attacker who has exploited CVE-2026-102764 is establishing persistence by creating administrative accounts or modifying MFA factors while disabling logging services to hide their presence.

    4 query1 analytic1 checkpoint1 action2 task
    defense evasion · execution · initial access
  5. critical Part 1 of 2
    Research by CISA

    BeyondTrust Appliance Compromise and Execution

    An adversary has exploited CVE-2026-102764 to bypass authentication on a BeyondTrust Remote Support appliance, resulting in unauthorized file operations and the execution of unrecognized scripts.

    3 query1 analytic1 checkpoint1 action2 task
    defense evasion · execution · initial access
  6. high Part 2 of 2
    Research by Unit 42

    Interactive Shells and Data Collection (CL-UNK-1211)

    An adversary is using in-memory reverse shells to conduct interactive discovery and exfiltrate government mailboxes, likely use AI-assisted scripting patterns for efficiency.

    3 query2 analytic2 checkpoint1 action2 task
    collection · command and control · credential access
  7. high Part 1 of 2
    Research by Unit 42

    Linux Persistence and Credential Hijacking

    An adversary has established persistence on Linux web servers using AI-generated PHP web shells and hijacked administrative credentials by tampering with shell profiles and configuration files.

    3 query1 analytic1 checkpoint1 action2 task
    collection · command and control · credential access
  8. high
    Research by CISA

    Thermo Fisher Torrent Suite Path Traversal Exposure

    An authenticated intruder is exploiting a path traversal vulnerability (CVE-2026-107777) in Thermo Fisher Torrent Suite Software to exfiltrate sensitive configuration and system files from healthcare servers.

    4 query1 analytic1 checkpoint2 task
    collection · initial access
  9. medium
    Research by Proofpoint

    Autonomous AI Agent and Shadow AI Activity

    An adversary is using AI-assisted exploitation or fraudulent identity onboarding to gain initial access, followed by the deployment of automated synthetic insiders that move data to unauthorized LLM providers at machine speed.

    5 query2 analytic1 checkpoint1 action2 task
    defense evasion · execution · exfiltration
  10. medium
    Research by ESET Research

    Medicare Open Enrollment Social Engineering

    An adversary is using lookalike domains during the Medicare Open Enrollment season to harvest personal and medical data via social engineering, subsequently using those credentials to access sensitive health and banking portals.

    3 query2 analytic2 checkpoint1 action2 task
    credential access · impact · initial access
  11. medium
    Research by Huntress

    Anonymizing Infrastructure and Tor Usage

    An intruder or unauthorized user is using commercial VPNs or the Tor Browser to bypass network security controls, leaving evidence in software inventory, rare outbound port patterns, and proxy-flagged authentications.

    3 query2 analytic2 checkpoint1 action2 task
    command and control · defense evasion · initial access
  12. high
    Research by CISA

    J4Care dcm4che Vulnerability Exposure

    An adversary is exploiting unauthenticated REST services or malformed JPEG parsing in dcm4chee-arc-light to delete medical records or cause a denial-of-service condition on exposed healthcare assets.

    3 query1 analytic1 checkpoint2 task
    impact · initial access
  13. high
    Research by Cisco Talos

    Regional Government and Infrastructure Espionage Activity

    An espionage actor has established a beachhead via edge appliance exploitation or archive delivery, established persistence through scheduled tasks, and is maintaining access via a PowerShell-based reverse shell.

    5 query2 analytic1 checkpoint1 action2 task
    command and control · execution · initial access
  14. medium
    Research by Huntress

    Ransomware Recovery Inhibition and Encryption

    An adversary is inhibiting system recovery by deleting volume shadow copies using standard tools or scripts before performing mass file encryption with rare extensions.

    4 query1 analytic1 checkpoint1 action2 task
    impact
  15. medium Part 2 of 2
    Research by Huntress

    M365 Session Hijacking and Mailbox Manipulation

    An adversary has hijacked an authenticated Microsoft 365 session using stolen cookies, bypassing MFA to create stealthy inbox rules and perform fraudulent financial transactions.

    3 query2 analytic2 checkpoint1 action2 task
    credential access · execution · impact
  16. medium Part 1 of 2
    Research by Huntress

    ClickFix Shell Execution and Cookie Theft

    An intruder has used a social engineering lure to trick a macOS user into executing a malicious shell command in Terminal that steals browser session cookies for account takeover.

    3 query1 analytic1 checkpoint1 action2 task
    credential access · execution · impact
  17. medium Part 2 of 2
    Research by Huntress

    Identity Compromise and SaaS Persistence

    An adversary has bypassed MFA via session hijacking or proxy usage and is establishing persistence through malicious inbox rules or unauthorized OAuth applications in a SaaS environment.

    3 query1 analytic1 checkpoint1 action2 task
    credential access · exfiltration · impact
  18. medium Part 1 of 2
    Research by Huntress

    AI Social Engineering and Ransomware Operations

    An adversary uses an AI-crafted social engineering lure to execute a loader that performs data staging or ransomware encryption.

    4 query2 analytic2 checkpoint1 action2 task
    credential access · exfiltration · impact
  19. medium
    Research by Huntress

    Identity-Centric Business Email Compromise

    An adversary has hijacked an identity through an Adversary-in-the-Middle proxy or by exploiting a public-facing vulnerability, then manipulates mailbox rules to hide fraudulent communication and spreads malicious internal attachments.

    5 query2 analytic1 checkpoint1 action2 task
    credential access · execution · initial access
  20. high
    Research by Huntress

    Passkey-Themed Phishing and Identity Lifecycle Abuse

    An attacker uses social engineering lures themed around passkey enrollment to trick users into authorizing a device-code login flow, subsequently registering unauthorized authenticators and establishing persistence via cloud application grants or unapproved browser extensions.

    5 query2 analytic1 checkpoint1 action2 task
    execution · initial access · persistence
  21. high Part 2 of 2
    Research by Huntress

    Unauthorized VPN Access via Stolen WatchGuard Credentials

    Adversaries are using credentials stolen from lookalike WatchGuard VPN download sites to authenticate to corporate VPNs from anomalous geographic regions or hosting provider IP space.

    3 query1 analytic1 checkpoint1 action2 task
    credential access · execution · initial access
  22. high Part 1 of 2
    Research by Huntress

    WatchGuard VPN Lookalike Phishing and Payload Delivery

    An adversary is using SEO poisoning to lead users to fake WatchGuard VPN download sites that harvest credentials via a JavaScript modal before delivering the legitimate, signed installer.

    5 query2 analytic1 checkpoint1 action2 task
    credential access · execution · initial access
  23. critical
    Research by Unit 42

    Fortinet Management Plane Exploitation and PEERSTITCH Deployment

    An attacker has exploited a central management appliance to exfiltrate configurations and then used stolen credentials to deploy a memory-resident ARM64 implant on managed firewalls.

    5 query2 analytic1 checkpoint1 action2 task
    defense evasion · execution · exfiltration
  24. high Part 1 of 2
    Research by Microsoft

    Masqueraded MSP360 RMM Installer and Persistence

    An attacker is distributing a legitimate but masqueraded MSP360 RMM installer via phishing lures to establish persistent, service-based administrative access on endpoints.

    4 query2 analytic2 checkpoint1 action2 task
    collection · command and control · execution