cyber.hendryadrian.com
Security Report · huntress.com

Huntress Report Highlights RAT Use, Infostealers and Shifting Ransomware Tactics

· Original article ↗

Summary

Huntress says its analysis of thousands of organizations and millions of endpoints in 2024 found widespread RAT use, rising infostealer and script activity, and ransomware shifts toward data theft and extortion.

Key points

  • Huntress reports that RATs such as AsyncRAT and Jupyter were involved in more than 75% of remote-access incidents it observed.
  • Nearly 24% of incidents involved infostealers, while scripts using PowerShell, VBScript, and JavaScript made up 22% of detected attacks.
  • The report says attackers misused legitimate RMM tools, including TeamViewer and LogMeIn, for lateral movement and persistent access.
  • Huntress describes ransomware tactics shifting from encryption toward data theft and extortion, and says smaller affiliates filled gaps after major-group takedowns.
  • The report identifies increased use of legitimate tools and LOLBins to evade detection, as well as QR-code phishing and brand impersonation.
  • Huntress recommends layered defenses, tighter controls and monitoring for RMM tools, restricting unnecessary software, and improving security awareness.

Article Details

Publisher
Huntress
Report Period
2024
Scope
Threat patterns observed by Huntress across organizations and industries.
Sample Size
Data from thousands of organizations and millions of endpoints; exact counts not disclosed.
Key Statistics
  • Over 75% of remote access incidents utilized RATs.
  • Nearly 24% of incidents involved infostealers.
  • Scripts accounted for 22% of detected attacks.
Recommendations
  • Use layered defenses, including endpoint detection and response.
  • Increase vigilance, strengthen access controls, and closely monitor remote monitoring and management tools.
  • Remove unnecessary software and enforce strict execution policies.
  • Improve security awareness training and use layered defenses against phishing.

MITRE ATT&CK

T1059.001 · PowerShellPowerShell is named among the scripting languages used in detected attacks.T1219 · Remote Access ToolsThe report says attackers weaponize legitimate remote monitoring and management tools, including TeamViewer and LogMeIn, for lateral movement and long-term access.

Threat Actors

AkiraNamed as a ransomware group that incentivizes stolen data with rewards.HiveNamed as a large ransomware group that was subject to a takedown.LockBitNamed as a large ransomware group that was subject to a takedown.RansomHubNamed as a ransomware group that incentivizes stolen data with rewards.

Malware

AsyncRATRemote access trojans (RATs) are more popular: Over 75% of remote access incidents utilized RATs such as AsyncRAT and Jupyter. These tools are becoming more sophisticated, making multilayered defenses like endpointJupytertrojans (RATs) are more popular: Over 75% of remote access incidents utilized RATs such as AsyncRAT and Jupyter. These tools are becoming more sophisticated, making multilayered defenses like endpoint detection and

Vendors

HuntressHuntress 2025 Cyber Threat Report: Proliferating RATs, Evolving Ransomware, and Other Findings

Products

LogMeIn(RMM) tools are being exploited. Attackers are weaponizing legitimate software like TeamViewer and LogMeIn to facilitate lateral movement and maintain long-term access to systems. For environments that use RMMTeamViewerand management (RMM) tools are being exploited. Attackers are weaponizing legitimate software like TeamViewer and LogMeIn to facilitate lateral movement and maintain long-term access to systems. For environments

Tools

Sysinternals Suiteland” techniques are on the rise: Threat actors are doubling down on using legitimate tools like Sysinternals Suite and LOLBins to evade detection. Organizations must remove unnecessary software and enforce strict

Industries

Educationhackers operate today. Our threat analysts observed patterns across industries like healthcare, education, government, and manufacturing, and these growing trends stood out:Governmentdouble extortion) strategies—a trend driven by the efficacy of EDR solutions and mounting pressure from government takedown efforts.Healthcareof how malicious hackers operate today. Our threat analysts observed patterns across industries like healthcare, education, government, and manufacturing, and these growing trends stood out:ManufacturingOur threat analysts observed patterns across industries like healthcare, education, government, and manufacturing, and these growing trends stood out:

Related Articles