https://www.focusedhunts.com/blog/hunting Technical threat intelligence guides — public reports turned into actionable hunting guidance with detection queries. en-us Fri, 31 Jul 2026 14:12:02 GMT https://www.focusedhunts.com/img/blog/hunting-off-the-red-small.png https://www.focusedhunts.com/blog/hunting https://www.focusedhunts.com/blog/hunting/CyberAv3ngers-IOCONTROL-Water-OT-Attacks https://www.focusedhunts.com/blog/hunting/CyberAv3ngers-IOCONTROL-Water-OT-Attacks Wed, 29 Jul 2026 00:00:00 GMT Analysis of CyberAv3ngers and IOCONTROL attacks on U.S. water and OT systems. https://www.focusedhunts.com/blog/hunting/INFINITERED-REDCap-Medical-Research-Backdoor https://www.focusedhunts.com/blog/hunting/INFINITERED-REDCap-Medical-Research-Backdoor Wed, 01 Jul 2026 00:00:00 GMT Analysis of UNC6508's INFINITERED backdoor targeting REDCap medical research servers. https://www.focusedhunts.com/blog/hunting/STOCKSTAY-Turla-Espionage-Backdoor https://www.focusedhunts.com/blog/hunting/STOCKSTAY-Turla-Espionage-Backdoor Wed, 01 Jul 2026 00:00:00 GMT Analysis of STOCKSTAY, a Turla espionage backdoor targeting Ukraine and government networks. https://www.focusedhunts.com/blog/hunting/Fox-Tempest-AI-Malvertising-Signed-Malware https://www.focusedhunts.com/blog/hunting/Fox-Tempest-AI-Malvertising-Signed-Malware Mon, 08 Jun 2026 00:00:00 GMT Analysis of Microsoft's Fox Tempest malware-signing service and AI-themed malvertising delivering Vidar, with Splunk and KQL hunting queries and MITRE mapping. https://www.focusedhunts.com/blog/hunting/UNK-DeadDrop-VSCode-Developer-Targeting https://www.focusedhunts.com/blog/hunting/UNK-DeadDrop-VSCode-Developer-Targeting Mon, 08 Jun 2026 00:00:00 GMT Analysis of the UNK_DeadDrop DPRK campaign weaponizing VS Code extensions and repos against developers, with Splunk and KQL hunting queries and MITRE mapping. https://www.focusedhunts.com/blog/hunting/PhantomRPC-Windows-RPC-Privilege-Escalation https://www.focusedhunts.com/blog/hunting/PhantomRPC-Windows-RPC-Privilege-Escalation Wed, 29 Apr 2026 00:00:00 GMT Analysis of PhantomRPC Windows RPC privilege escalation with Splunk and KQL threat hunting queries. https://www.focusedhunts.com/blog/hunting/F5-BIG-IP-BRICKSTORM-Backdoor-Detection https://www.focusedhunts.com/blog/hunting/F5-BIG-IP-BRICKSTORM-Backdoor-Detection Mon, 30 Mar 2026 00:00:00 GMT Analysis of CVE-2025-53521 and BRICKSTORM backdoor targeting F5 BIG-IP APM with Splunk and KQL hunting queries, MITRE mappings, and behavioral indicators. https://www.focusedhunts.com/blog/hunting/GRIDTIDE-Global-Espionage-Google-Sheets-C2 https://www.focusedhunts.com/blog/hunting/GRIDTIDE-Global-Espionage-Google-Sheets-C2 Mon, 23 Mar 2026 00:00:00 GMT Analysis of GRIDTIDE backdoor used by UNC2814 for global espionage. Splunk and Microsoft hunting queries with MITRE ATT&CK mappings and detection strategies. https://www.focusedhunts.com/blog/hunting/VEN0m-Ransomware-BYOVD-Detection https://www.focusedhunts.com/blog/hunting/VEN0m-Ransomware-BYOVD-Detection Thu, 19 Mar 2026 00:00:00 GMT Analysis of VEN0m ransomware leveraging BYOVD driver exploitation with Splunk and KQL hunting queries. Includes MITRE ATT&CK mappings and behavioral detection. https://www.focusedhunts.com/blog/hunting/UAT-8837-Critical-Infrastructure-APT https://www.focusedhunts.com/blog/hunting/UAT-8837-Critical-Infrastructure-APT Sat, 14 Mar 2026 00:00:00 GMT Analysis of UAT-8837 China-nexus APT targeting North American critical infrastructure with Splunk and KQL detection queries. MITRE ATT&CK mappings included. https://www.focusedhunts.com/blog/hunting/Notepad-Plus-Plus-Update-Hijacking https://www.focusedhunts.com/blog/hunting/Notepad-Plus-Plus-Update-Hijacking Mon, 02 Feb 2026 00:00:00 GMT Analysis of the Notepad++ supply chain compromise targeting telecom and finance sectors. https://www.focusedhunts.com/blog/hunting/VoidLink-Cloud-Native-Malware https://www.focusedhunts.com/blog/hunting/VoidLink-Cloud-Native-Malware Tue, 13 Jan 2026 00:00:00 GMT A sophisticated modular malware framework called VoidLink is purpose-built for modern cloud and container environments. https://www.focusedhunts.com/blog/hunting/Hunting-Pro-Russia-Hacktivists-OT-VNC-Exploits https://www.focusedhunts.com/blog/hunting/Hunting-Pro-Russia-Hacktivists-OT-VNC-Exploits Wed, 10 Dec 2025 00:00:00 GMT Technical analysis and detection guidance for pro-Russia hacktivist campaigns targeting operational technology infrastructure via VNC vulnerabilities. https://www.focusedhunts.com/blog/hunting/APT24-Multi-Vector-BADAUDIO-Campaign https://www.focusedhunts.com/blog/hunting/APT24-Multi-Vector-BADAUDIO-Campaign Mon, 08 Dec 2025 00:00:00 GMT Deep dive into the BADAUDIO malware distribution campaign used by Chinese APT24. Detection techniques and IOAs for multiple attack vectors. https://www.focusedhunts.com/blog/hunting/Vibe-Hacking-AI-Data-Extortion https://www.focusedhunts.com/blog/hunting/Vibe-Hacking-AI-Data-Extortion Fri, 05 Dec 2025 00:00:00 GMT Emerging attack techniques using AI tools for data exfiltration and extortion. Detection strategies for AI-assisted intrusions. https://www.focusedhunts.com/blog/hunting/detecting-ssh-tor-backdoor-military-targeting https://www.focusedhunts.com/blog/hunting/detecting-ssh-tor-backdoor-military-targeting Fri, 28 Nov 2025 00:00:00 GMT How to identify and respond to SSH-based persistent backdoors establishing Tor connectivity in government and military systems. https://www.focusedhunts.com/blog/hunting/qilin-ransomware-attack-chain-detection https://www.focusedhunts.com/blog/hunting/qilin-ransomware-attack-chain-detection Thu, 20 Nov 2025 00:00:00 GMT Complete attack chain analysis for Qilin ransomware. How to identify reconnaissance, lateral movement, and encryption phases. https://www.focusedhunts.com/blog/hunting/talos-overview-static-tundra https://www.focusedhunts.com/blog/hunting/talos-overview-static-tundra Sat, 15 Nov 2025 00:00:00 GMT Technical indicators for Static Tundra threat group. APT tactics, techniques, and detection methods from Talos research. https://www.focusedhunts.com/blog/hunting/Hunting-Microsoft-Teams-Threats-Detection-Guide https://www.focusedhunts.com/blog/hunting/Hunting-Microsoft-Teams-Threats-Detection-Guide Mon, 10 Nov 2025 00:00:00 GMT How attackers abuse Microsoft Teams for command and control, data exfiltration. Hunting techniques and defensive measures. https://www.focusedhunts.com/blog/hunting/The-Rise-of-Malware-Free-Identity-Focused-Intrusions https://www.focusedhunts.com/blog/hunting/The-Rise-of-Malware-Free-Identity-Focused-Intrusions Wed, 05 Nov 2025 00:00:00 GMT Modern attack techniques bypassing malware detection through credential theft and identity abuse. https://www.focusedhunts.com/blog/hunting/Hunting-EtherHiding-UNC5342 https://www.focusedhunts.com/blog/hunting/Hunting-EtherHiding-UNC5342 Tue, 28 Oct 2025 00:00:00 GMT Technical deep dive into the EtherHiding stealth malware used by UNC5342. Detection techniques for network-level evasion. https://www.focusedhunts.com/blog/hunting/Flax-Typhoon-ArcGIS-Server-Object-Extension-Web-Shell-Compromise https://www.focusedhunts.com/blog/hunting/Flax-Typhoon-ArcGIS-Server-Object-Extension-Web-Shell-Compromise Mon, 20 Oct 2025 00:00:00 GMT How Flax Typhoon exploits ArcGIS Server vulnerabilities to establish persistent web shells. https://www.focusedhunts.com/blog/hunting/TrendMicro-unmasking-the-gentlemen-ransomware https://www.focusedhunts.com/blog/hunting/TrendMicro-unmasking-the-gentlemen-ransomware Sun, 12 Oct 2025 00:00:00 GMT Complete analysis of Gentlemen ransomware operations. Targeted industries, delivery mechanisms, and detection strategies. https://www.focusedhunts.com/blog/hunting/Exposing-the-Espionage-Tactics-of-China-aligned-Threat-Actor-TA415 https://www.focusedhunts.com/blog/hunting/Exposing-the-Espionage-Tactics-of-China-aligned-Threat-Actor-TA415 Sun, 05 Oct 2025 00:00:00 GMT Detailed exposure of TA415 intelligence gathering operations. Tools, techniques, and indicators for detecting espionage campaigns. https://www.focusedhunts.com/blog/hunting/Detecting-Premier-Pass-as-a-Service-APT-Collaboration https://www.focusedhunts.com/blog/hunting/Detecting-Premier-Pass-as-a-Service-APT-Collaboration Sun, 28 Sep 2025 00:00:00 GMT Analysis of Premier Pass abuse in APT collaboration networks. How to identify shared infrastructure and coordinated campaigns. https://www.focusedhunts.com/blog/hunting/Analyzing-Fake-CAPTCHA-Phishing https://www.focusedhunts.com/blog/hunting/Analyzing-Fake-CAPTCHA-Phishing Sat, 20 Sep 2025 00:00:00 GMT How attackers abuse CAPTCHA mechanisms in phishing campaigns. Detection techniques for fake verification pages and credential harvesting.