Hunting off the Red

Blue Team Mastery Through Red Team Insights.

The operational reality of defense requires a deep, current understanding of offensive methodologies. Hunting Off The Red transforms complex, open-source intelligence detailing adversary campaigns and red team activities into actionable defensive knowledge. This resource moves past theory to provide a foundational link between attacker techniques and practical cyber assurance.

A tiered format structures our analysis for immediate value across your entire security organization. We synthesize deeper technical articles into a tiered format, starting with strategic briefings for management and progressing into the operational and technical specifics analysts require for investigation.

This platform bridges the intelligence gap by providing the necessary technical context, culminating in AI-driven detection queries (e.g., KQL and Splunk) that allow your team to translate advanced threat knowledge directly into validated, high-fidelity security controls.

Focused Hunts Logo
Subscribe (RSS)
Published Guide Source
2026-10-22 Storm-0940: ARTEX Agentic AI Drives a ConnectWise Supply Chain Compromise Storm-0940 abused a ConnectWise app and ARTEX agentic AI to hit Microsoft 365 tenants. Behavioral KQL hunting queries, IOCs, and MITRE ATT&CK mappings. Microsoft Security
2026-10-21 php2shell: Hunting Critical PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619) php2shell chains two critical PHP flaws (CVE-2026-109618, CVE-2026-109619) into unauthenticated RCE. Splunk and KQL hunting queries with MITRE mapping. Multiple
2026-10-10 Citrix NetScaler Zero-Days Exploited to Plant Disguised Web Shells and Tunnel Into Internal Networks Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 plant disguised web shells and the SLAPSHOT tunneler. Multiple
2026-10-02 ShinyHunters Renews Mass Exploitation of Oracle PeopleSoft Through a WAF Bypass ShinyHunters (UNC6240) bypasses WAF rules to exploit Oracle PeopleSoft CVE-2026-35273. Google Threat Intelligence Group
2026-09-19 Three Clusters Exploit Cisco Secure Firewall Management Center to Deploy Web Shells, Cyclops Blink, and Qilin Ransomware Three clusters exploit a critical Cisco Secure FMC auth bypass to drop web shells, Cyclops Blink, and Qilin ransomware. Cisco Talos
2026-09-07 Russian Espionage Clusters Abuse Authentication Flows to Phish Individuals Three Russian espionage clusters abuse app passwords, OAuth device codes, and WhatsApp device linking to hijack accounts. Splunk/KQL hunts + MITRE mapping. Google Threat Intelligence Group
2026-09-04 Hunting AI-Generated Attacks on Water Sector OT AI-generated exploit scripts are targeting Siemens PLCs and US water utilities. Threat hunting analysis with Splunk and KQL queries plus MITRE ATT&CK mapping. CISA
2026-08-07 knaithe: Inside an Autonomous AI-Driven Cyberattack Campaign How the knaithe threat actor weaponized AI to autonomously scan, exploit, and exfiltrate. Unit 42 (Palo Alto Networks)
2026-08-04 Pass-ta-Key: Novel Attacks on Synced Passkey Authentication Unit 42 details Pass-ta-Key attacks that steal synced passkeys. Unit 42 (Palo Alto Networks)
2026-07-29 CyberAv3ngers: Hunting Iranian OT Attacks on U.S. Water Systems Analysis of CyberAv3ngers and IOCONTROL attacks on U.S. water and OT systems. Multiple
2026-07-01 UNC6508 and the INFINITERED Backdoor Targeting Medical Research Analysis of UNC6508's INFINITERED backdoor targeting REDCap medical research servers. Google Threat Intelligence Group
2026-07-01 STOCKSTAY: Detecting Turla's Multi-Component Espionage Backdoor Analysis of STOCKSTAY, a Turla espionage backdoor targeting Ukraine and government networks. Google Threat Intelligence Group
2026-06-17 Fox Tempest: AI-Themed Malvertising Delivers Signed Malware at Scale Analysis of Microsoft's Fox Tempest malware-signing service and AI-themed malvertising delivering Vidar, with Splunk and KQL hunting queries and MITRE mapping. Microsoft
2026-06-17 UNK_DeadDrop: North Korean Phishing Turns VS Code Against Developers Analysis of the UNK_DeadDrop DPRK campaign weaponizing VS Code extensions and repos against developers, with Splunk and KQL hunting queries and MITRE mapping. Proofpoint
2026-04-29 PhantomRPC: Windows RPC Privilege Escalation via Server Impersonation Analysis of PhantomRPC Windows RPC privilege escalation with Splunk and KQL threat hunting queries. Multiple
2026-03-30 F5 BIG-IP CVE-2025-53521: BRICKSTORM Backdoor and Nation-State Exploitation Analysis of CVE-2025-53521 and BRICKSTORM backdoor targeting F5 BIG-IP APM with Splunk and KQL hunting queries, MITRE mappings, and behavioral indicators. Multiple
2026-03-23 GRIDTIDE: Detecting Google Sheets C2 in a Global Espionage Campaign Analysis of GRIDTIDE backdoor used by UNC2814 for global espionage. Splunk and Microsoft hunting queries with MITRE ATT&CK mappings and detection strategies. Multiple
2026-03-19 VEN0m Ransomware: BYOVD-Enabled File Encryption with AV/EDR Neutralization Analysis of VEN0m ransomware leveraging BYOVD driver exploitation with Splunk and KQL hunting queries. Includes MITRE ATT&CK mappings and behavioral detection. xM0kht4r (GitHub)
2026-03-14 UAT-8837: China-Nexus APT Targeting North American Critical Infrastructure Analysis of UAT-8837 China-nexus APT targeting North American critical infrastructure with Splunk and KQL detection queries. MITRE ATT&CK mappings included. Cisco Talos
2026-02-02 Notepad++ Update Hijacking Analysis of the Notepad++ supply chain compromise targeting telecom and finance sectors. Multiple
2026-01-13 VoidLink: Detecting Advanced Cloud-Native Linux Malware A sophisticated modular malware framework called VoidLink is purpose-built for modern cloud and container environments. Check Point Research
2025-12-16 Hunting Pro-Russia Hacktivists Targeting OT VNC Technical analysis and detection guidance for pro-Russia hacktivist campaigns targeting operational technology infrastructure via VNC vulnerabilities. CISA
2025-11-25 APT24 Multi-Vector BADAUDIO Campaign Analysis Deep dive into the BADAUDIO malware distribution campaign used by Chinese APT24. Detection techniques and IOAs for multiple attack vectors. Google Threat Intelligence Group
2025-11-05 Detecting SSH Tor Backdoors in Military Networks How to identify and respond to SSH-based persistent backdoors establishing Tor connectivity in government and military systems. Multiple
2025-10-27 Qilin Ransomware Attack Chain Detection Complete attack chain analysis for Qilin ransomware. How to identify reconnaissance, lateral movement, and encryption phases. Multiple
2025-10-22 Detecting Premier Pass as a Service APT Collaboration Analysis of Premier Pass abuse in APT collaboration networks. How to identify shared infrastructure and coordinated campaigns. Trend Micro
2025-10-17 Hunting EtherHiding: UNC5342 Analysis Technical deep dive into the EtherHiding stealth malware used by UNC5342. Detection techniques for network-level evasion. Google Threat Intelligence Group
2025-10-15 Flax Typhoon ArcGIS Server Web Shell Compromise How Flax Typhoon exploits ArcGIS Server vulnerabilities to establish persistent web shells. ReliaQuest
2025-10-13 Vibe Hacking: AI Data Extortion Techniques Emerging attack techniques using AI tools for data exfiltration and extortion. Detection strategies for AI-assisted intrusions. Anthropic
2025-10-13 The Rise of Malware-Free Identity-Focused Intrusions Modern attack techniques bypassing malware detection through credential theft and identity abuse. Multiple
2025-10-12 Hunting Microsoft Teams Threats - Detection Guide How attackers abuse Microsoft Teams for command and control, data exfiltration. Hunting techniques and defensive measures. Microsoft
2025-09-22 Exposing the Espionage Tactics of China-Aligned TA415 Detailed exposure of TA415 intelligence gathering operations. Tools, techniques, and indicators for detecting espionage campaigns. Proofpoint
2025-09-22 Analyzing Fake CAPTCHA Phishing Attacks How attackers abuse CAPTCHA mechanisms in phishing campaigns. Detection techniques for fake verification pages and credential harvesting. Trend Micro
2025-09-16 Talos Overview: Static Tundra Threat Analysis Technical indicators for Static Tundra threat group. APT tactics, techniques, and detection methods from Talos research. Cisco Talos
2025-09-16 TrendMicro: Unmasking the Gentlemen Ransomware Complete analysis of Gentlemen ransomware operations. Targeted industries, delivery mechanisms, and detection strategies. Trend Micro