Huntress outlines 2026 threat priorities: RMM abuse up 277%, ClickFix, AI-enabled cybercrime, multi-extortion ransomware and BEC
A Huntress thought-leadership post sets out five priorities for security leaders in 2026: abuse of trusted IT tools, AI-enabled cybercrime, social engineering, multi-extortion ransomware and identity-based attacks including BEC. The article cites internal Huntress telemetry showing RMM abuse rising roughly 277% year over year, with ScreenConnect named as an example platform. It also states that more than half of observed loader activity is tied to social engineering scams, and that time-to-ransom has lengthened from about 17 to about 20 hours as groups favor data exfiltration and extortion leverage over speed. No specific incident, victim, vulnerability or threat actor is described, and the post promotes Huntress products (Managed EDR, ITDR, SIEM and SAT).
Technical Details
- RMM abuse: attackers hijack approved remote management tools such as ScreenConnect to blend into normal admin activity and evade controls that trust sanctioned software.
- Social engineering: ClickFix and fake CAPTCHA flows get users to run malicious commands themselves, alongside AI-assisted smishing and vishing. More than half of observed loader activity in Huntress telemetry is tied to such scams.
- AI-enabled crime: deepfake executive impersonation, adaptive malware, automated vulnerability discovery and hyper-personalized phishing.
- Ransomware: a shift from "spray and encrypt" to exfiltrate first, then negotiate, with double and triple extortion. Time-to-ransom has grown from about 17 to about 20 hours, which lengthens adversary dwell time before encryption.
- Identity attacks: session hijacking, rogue OAuth apps, suspicious inbox rules, impossible travel and BEC in Microsoft 365 and Google Workspace, often with no malware or exploit involved.
Remediation
- Monitor behavior (persistence, unusual process chains, lateral movement) even when it originates from sanctioned RMM tools.
- Detect pre-encryption activity, including lateral movement, credential abuse and data staging.
- Enforce strong MFA and least-privilege access, and require verification workflows for financial transactions.
- Maintain offline backups, network segmentation and a tested incident response plan.
- Run security awareness training built on current threats (ClickFix, smishing, vishing, deepfakes) rather than generic phishing simulations.
Linha do tempo
-
Huntress outlines 2026 threat priorities: RMM abuse up 277%, ClickFix, AI-enabled cybercrime, multi-extortion ransomware and BEC
ler a análise desta fonte ocultar
A Huntress thought-leadership post sets out five priorities for security leaders in 2026: abuse of trusted IT tools, AI-enabled cybercrime, social engineering, multi-extortion ransomware and identity-based attacks including BEC. The article cites internal Huntress telemetry showing RMM abuse rising roughly 277% year over year, with ScreenConnect named as an example platform. It also states that more than half of observed loader activity is tied to social engineering scams, and that time-to-ransom has lengthened from about 17 to about 20 hours as groups favor data exfiltration and extortion leverage over speed. No specific incident, victim, vulnerability or threat actor is described, and the post promotes Huntress products (Managed EDR, ITDR, SIEM and SAT).
Technical Details
- RMM abuse: attackers hijack approved remote management tools such as ScreenConnect to blend into normal admin activity and evade controls that trust sanctioned software.
- Social engineering: ClickFix and fake CAPTCHA flows get users to run malicious commands themselves, alongside AI-assisted smishing and vishing. More than half of observed loader activity in Huntress telemetry is tied to such scams.
- AI-enabled crime: deepfake executive impersonation, adaptive malware, automated vulnerability discovery and hyper-personalized phishing.
- Ransomware: a shift from "spray and encrypt" to exfiltrate first, then negotiate, with double and triple extortion. Time-to-ransom has grown from about 17 to about 20 hours, which lengthens adversary dwell time before encryption.
- Identity attacks: session hijacking, rogue OAuth apps, suspicious inbox rules, impossible travel and BEC in Microsoft 365 and Google Workspace, often with no malware or exploit involved.
Remediation
- Monitor behavior (persistence, unusual process chains, lateral movement) even when it originates from sanctioned RMM tools.
- Detect pre-encryption activity, including lateral movement, credential abuse and data staging.
- Enforce strong MFA and least-privilege access, and require verification workflows for financial transactions.
- Maintain offline backups, network segmentation and a tested incident response plan.
- Run security awareness training built on current threats (ClickFix, smishing, vishing, deepfakes) rather than generic phishing simulations.