Huntress
Day 8 after signup
The data hackers hope you never see
Straight from the Huntress SOC, no sales pitch.
Why it works
- Open with a concrete incident to make a broad security pattern feel relevant and easy to understand.
- Use short examples to show several angles on the same theme, then offer one deeper resource for readers who want more.
How it is built
- Threat story opening
- SOC detection example
- Featured attack report
- Four incident summaries
Email copy
Have you ever downloaded a tax form? One user thought they were doing exactly that, but unfortunately, they were on a malicious site. What they actually got was a fake RMM installer. That’s a standard IT tool that attackers love to abuse to gain control over their victims’ devices. Thankfully, the Huntress SOC caught the malicious RMM because it was running from the downloads folder. In the process, we discovered four other devices across our customer base that had downloaded the same file. This is nothing new. Attackers have been leaning hard on the remote tools your team already trusts instead of writing new malware. Here's the pattern, straight from our SOC: RMM Abuse: Your Trusted IT Tools Are Now Hackers' Favorite Weapon → RMM abuse isn't the only attack path we're watching: A vendor payment email that was actually a $100,000 BEC attempt. It looked routine, right down to the account details. A Huntress employee followed procedure and picked up the phone before wiring anything. A fake Claude Desktop ad that ended in a RAT. Someone searching for a legitimate AI tool clicked a malicious ad instead. The install that followed dropped a fully functional remote access trojan. Suspected DPRK IT workers hiding inside partner organizations. Not malware, not a phishing link. A fraudulent employee, hired and onboarded like anyone else, quietly funneling a paycheck back to a sanctioned regime. A ransomware affiliate that rebooted into Safe Mode to kill EDR, and broke their own attack doing it. Safe Mode disabled our agent the way they wanted. It also disabled the malware they needed to encrypt anything. Four different playbooks, all counting on a tool or a login you already trust. – Jamie Levy P.S. Prefer video to reading? Tradecraft Tuesday is our monthly livestream that walks through real attacker behavior our team is seeing out in the wild. Unsubscribe | Manage Preferences Huntress Labs Inc., 6996 Columbia Gateway Drive, Ste. 101, Columbia, MD,21046 USA 833-HUNT-NOW © 2026 Huntress. All Rights Reserved.