Huntress

Huntress researchers identified a credential stuffing campaign targeting SonicWall VPN and firewall accounts, compromising 30 organizations in two days and 92 accounts in 41 hours. The attacks, which ceased abruptly, may involve pre-positioning for future intrusions, with attackers using valid credentials obtained through unknown means. SonicWall is investigating, while CISA has cataloged 17 exploited vulnerabilities in its products since 2021, including those linked to ransomware campaigns.

Cybersecurity researchers have identified a password spray attack targeting Microsoft's Azure CLI, compromising at least 78 accounts through 81 million+ login attempts. The attack, tracked by Huntress, originates from an IPv6 range controlled by LSHIY LLC (AS32167) and occurred between June 12 and June 26.

Cybersecurity researchers disclosed an unpatched vulnerability in the Windows search: URI handler that could allow attackers to steal NTLMv2 hashes. The issue is similar to CVE-2026-33829, which affected the Windows Snipping Tool's ms-screensketch: URI handler, and was identified by Huntress.

Arctic Wolf laid off 250 employees to invest more in AI and position the company for long-term strategy. The layoffs represent less than 10 percent of the total workforce. The company aims to operate more efficiently and deliver strong value to customers.

Huntress warns that three zero-day vulnerabilities in Microsoft Defender—BlueHammer, RedSun, and UnDefend—are being actively exploited by threat actors to gain elevated system privileges. Two of these vulnerabilities remain unpatched, posing ongoing security risks.