TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Huntress

Tradecraft Tuesday Recap | Huntress

2025-12-23 · Read original ↗

ATT&CK techniques detected

8 predictions
T1204.001Malicious Link
91%
“why this category hits so hard : react is ubiquitous and typically internet - facing by default. the exploit becomes a copy - paste exercise, and once github proof - of - concepts spread, the barrier to entry collapses. the clickfix remix henderson and milbier also spent time dis…”
T1190Exploit Public-Facing Application
89%
“tradecraft tuesday recap | huntress every security professional knows the drill. you go home for the holidays and, without volunteering, you become the family ’ s help desk, incident responder, and fraud advisor. somewhere between dinner and dessert, someone will ask why their ph…”
T1204.004Malicious Copy and Paste
89%
“reality, what you ' ve just done is become a threat actor, ” henderson explained. “ they ' re simply leveraging you to become the malware operator and install their payload for them. ” milbier connected it to the “ old ” scams of fake antivirus popups, full - screen warnings, and…”
T1566.002Spearphishing Link
81%
“machine. henderson and milbier also emphasized that this isn ’ t theoretical. huntress ’ soc is seeing real victims, at scale. henderson predicted most people will encounter some form of this over the next six months as distribution broadens. living off trusted sites ( lots ) the…”
T1190Exploit Public-Facing Application
78%
“is very quickly climbing to ‘ log4shell ’ levels, ” henderson said, sharing data from greynoise that shows exploitation accelerating from near zero to hundreds of attacks per hour in days, underscoring how sharply the window for detection and response is collapsing. huntress has …”
T1204.004Malicious Copy and Paste
66%
“why this category hits so hard : react is ubiquitous and typically internet - facing by default. the exploit becomes a copy - paste exercise, and once github proof - of - concepts spread, the barrier to entry collapses. the clickfix remix henderson and milbier also spent time dis…”
T1204.001Malicious Link
51%
“reality, what you ' ve just done is become a threat actor, ” henderson explained. “ they ' re simply leveraging you to become the malware operator and install their payload for them. ” milbier connected it to the “ old ” scams of fake antivirus popups, full - screen warnings, and…”
T1598Phishing for Information
42%
“is often impossible for a teenager, but the shame barrier makes them afraid to tell family or police. milbier cited fbi - reported spikes ( he referenced a 140 % + increase ) and stressed how ai tools are now changing the mechanics. he noted that ai chatbots can maintain long - r…”

Summary

From "React2Shell" exploitation to sophisticated "Living off Trusted Sites" phishing, Huntress experts break down the threats targeting both enterprises and families today.