Section
Research
Threat intelligence and technical research from vendor labs, coordination centers and independent researchers.
27 matching records, 4 with confirmed exploitation.
-
Trimble Cityworks Remote Code Execution Attack
What is the Attack? Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS)…
-
Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
69 Critical 1337 Important 0 Moderate 1 Low Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates…
-
Patch Tuesday - October 2026
Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday , including 1,102 vulnerabilities in Windows. Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026…
-
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
ConnectWise (SkyKick) vendor credentials are being abused to access Microsoft 365 tenants. Disable the apps now and check your logs here.
-
There's only so much code: the rise in vulnerability numbers
The September Microsoft Patch Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they…
-
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical."
-
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos. The post From help desk impersonation to AD CS abuse: Investigating ESC1 and…
-
Microsoft, Adobe, Apple, and Foxit vulnerabilities
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. The vulnerabilities mentioned in this blog post have been patched by their respective vendors…
-
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments. The post AI-driven, large-scale nation-state campaign using ARTEX…
-
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
A recent phishing campaign abused Microsoft Power BI links to deliver multiple rogue ScreenConnect clients.
-
Microsoft Patch Tuesday, October 2026 Security Update Review
Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services. As organizations continue to navigate an evolving threat landscape, applying security patches…
-
Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
Microsoft wants EDR out of the Windows kernel, and the preview binaries show wesp.sys telling a user-mode client that a process is starting, with nothing in its imports to let that client block it.
-
AI, Scripts, Operator: Inside the ConnectWise Attack
Microsoft says an AI agent drove the ConnectWise attack. Huntress telemetry is consistent with that: scripted tooling, steered by an operator.
-
SEO Poisoning Campaign Delivers New Armorsteal Malware
IntroductionIn September 2026, Zscaler Threat Hunting identified an SEO poisoning campaign that used fake websites impersonating the Chocolatey package manager and the Microsoft Activation Scripts (MAS) tool to distribute a…
-
ConnectWise Cloud Backup application abused in cross-tenant token sweep
Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants Categories: Threat Research Tags: connectwise
-
The October 2026 Security Update Review
Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland , because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I…
-
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it. The post Inside a malicious Claude Code-branded extension and its persistent SSH backdoor…
-
Infostealer riding the AI Train
Key Points Introduction Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection routines for AI applications and…
-
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.
-
The Science of Exploitability: Decoding BlueHammer
Executive Summary BlueHammer (CVE-2026-33825) is an eight-stage local privilege-escalation chain targeting the Windows Defender Antimalware Platform before 4.18.26030.3011. It does not grant initial access; an attacker needs…
-
Identity Posture Assessment for Microsoft 365
Build identity resilience with Identity Posture Assessment, an on-demand Microsoft 365 report that scores your identity defenses and shows how fast you can fix the gaps.
-
Introducing ITDR Lookback: Find Out Who Was in Your Microsoft 365 Tenant Before You Were
Attackers may be in your tenant before you connect it. Huntress Managed ITDR Lookback reviews 180 days of Microsoft 365 logins & our SOC acts on active incidents.
-
Tracking AI adoption in North Korean threat actor tradecraft
As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and efficiency of attacks, we’ve identified North Korean threat actors expanding their use of AI with varying levels of…
-
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today&#;x26;#;39;s…
-
Unmasking the robots: Why it’s critical to discover AI agent identities and how Tenable helps you secure them
Discover how to secure AI agents in your cloud environment with Tenable One Cloud Exposure. We explore Microsoft Entra Agent ID and provide essential best practices for robust agentic AI identity security. Key takeaways…
-
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit marketplace (tracked as Storm-3119) selling tools and infrastructure for…
-
Microsoft VSS: Still Essential, But Not the Whole Story
Microsoft VSS remains a cornerstone of Windows data protection, but its architectural limits matter. Learn when to rely on it and when to go beyond it.
Reuse this view
Same filters as JSON: /api/items?category=research&window=30d&vendor=Microsoft&limit=100. RSS for this section: feed.xml.