Huntress Says VPN Intrusion at Small Manufacturer Was Stopped Before Ransomware

Summary

Huntress says an attacker accessed a small U.S. manufacturer through its VPN, stole credentials, and tried to disable security tools. Its SOC isolated the network; the company was brought back online after response steps including enabling 2FA.

Key points

Huntress reports that a small U.S. construction manufacturer was accessed through a compromised VPN without two-factor authentication.
The attacker used RDP to explore the network, moved to a server, and dumped credentials, according to Huntress.
The attacker tried to disable Microsoft Defender and the Huntress agent; the attempt failed.
Huntress analysts investigated alerts and isolated the network, cutting off the attacker’s connection.
The response team recommended disabling compromised accounts and enabling 2FA; Huntress says the situation was resolved within hours.
The article describes a near-miss, not a completed ransomware attack: it does not report that files were encrypted or a ransom demanded.

Article Details

Victim Organization: Unnamed small US-based construction manufacturing company
Incident Type: VPN compromise and attempted ransomware attack
Disclosure Date: 2026-03-13
Data Types Exposed: Usernames and passwords
Operational Impact: The network was isolated, cutting off the attackers. The incident was resolved within a few hours; no ransomware shutdown or lasting operational disruption was reported.
Ransom Or Extortion: No ransom demand or extortion was reported. The attackers were stopped before a ransomware event occurred.
Claim Status: confirmed