TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Huntress

Attackers Love Your VPN To-Do List

2026-04-17 · Read original ↗

ATT&CK techniques detected

6 predictions
T1486Data Encrypted for Impact
96%
"github, attributed to nightmare - eclipse. before tool execution, analysts observed a familiar sequence of hands - on - keyboard enumeration commands : whoami / priv, cmdkey / list, net group. this signaled that someone was inside the environment, figuring out what they had to wo…"
T1486Data Encrypted for Impact
89%
") and managed microsoft defender fired off fast warning signals, and our soc analysts jumped in before encryption had a chance. without this resilience plan, this business would ' ve faced operational downtime, pricey recovery, reputational damage, and days of disruption. instead…"
T1204.002Malicious File
63%
"implementation can be messy in practice, especially for the 99 %. the businesses we protect may not have access to an enterprise budget : medical offices, law firms, local construction companies, veterinarians, etc. legacy systems complicate rollouts, service accounts break, work…"
T1078Valid Accounts
54%
". they can force their way in, but these days, most prefer to simply log in as you. exploits and zero days are still around, but they ' re noisy, which kills the stealth factor. legitimate logins are quieter and far more effective, according to analysis in the huntress 2026 cyber…"
T1078Valid Accounts
38%
"will keep exploiting. red carpet access in another case, a threat actor compromised sonicwall sslvpn credentials and landed inside the target environment with administrative privileges that were handed to them on a silver platter by two compounding gaps : no mfa and no network or…"
T1068Exploitation for Privilege Escalation
38%
"will keep exploiting. red carpet access in another case, a threat actor compromised sonicwall sslvpn credentials and landed inside the target environment with administrative privileges that were handed to them on a silver platter by two compounding gaps : no mfa and no network or…"

Summary

VPN misconfiguration is behind 70% of intrusions. See real Huntress SOC incidents and learn the simple steps to close your biggest open door before attackers walk through it.