Kiber sarlavhalar ko'pincha shov-shuvli hujumlarga e'tibor qaratadi, lekin haqiqatan ham OH $#!T lahzalarini keltirib chiqaradiganlar — siz allaqachon ishonadigan vositalar va ish jarayonlarini suiiste'mol qiladigan taktikalar. Agar siz kichik yoki o'rta o'lchamli tashkilotni boshqarsangiz, ITni o'zingiz boshqarasizmi yoki tashqi manbaga topshirasizmi, bu hujumchilar va ularning doimiy o'zgarib boradigan taktikalariga yetib olish uchun doimiy poyga.
Asosiy xulosa shuki, siz o'zingiznikiga o'xshash muhitlarda qaysi hujumlar sodir bo'layotganini bilishingiz va ularga qarshi himoyangizni qanday ustuvorlashtirishni tushunishingiz kerak.
Tragic Quadrant Bir Qarashda
Shuning uchun Huntress Tragic Quadrantni yaratdi — bu bizneslarni xavf ostiga qo'yadigan kiber taktikalar reytingi bo'lib, haftadan haftaga nima trendda bo'lishidan qat'i nazar, e'tiboringizni qayerga qaratish kerakligini ko'rsatish uchun mo'ljallangan.
1-rasm: Huntress Tragic Quadrant
Bu Tahdidlarni Birinchi Navbatda Tuzating: OH $#!T Burchagi
Bu taktiklarning har biri sizning jamoangiz har kuni foydalanadigan narsaning ichida yashirinadi, masalan, masofaviy kirish vositasi yoki Microsoft 365 kirish sahifasi.
RMM Suiiste'moli Barqaror va Davom Etmoqda
Masofaviy monitoring va boshqaruv (RMM) vositalari IT jamoalari uchun asosiy vosita, shuning uchun hujumchilar ularni suiiste'mol qiladi. Bitta noqonuniy RMM o'rnatilishi hujumchiga oddiy admin ishi kabi ko'rinadigan doimiy kirish imkonini beradi.
2026-yilning 1-choragida Huntress tekshirgan endpoint bilan bog'liq hodisalarning 45% RMM suiiste'molini o'z ichiga olgan. Hujumchilar shuningdek, AI dan foydalanib, foydalanuvchilarni istalmagan RMM larni o'rnatishga aldash uchun ishonarli soxta hujjat almashinuvi va xizmat shartnomasi jozibalarini yaratmoqda.
Pochta Qutisi Manipulyatsiyasi BEC ga Kirish Nuqtasi
2026-yil boshidan beri Identifikatsiya Tahdidini Aniqlash va Javob (ITDR) signallarining 24,6% pochta qutisi manipulyatsiyasi va doimiylikka ishora qiladi. Pochta qutisiga kirish bilan hujumchi pochta qutisi qoidalarini o'zgartirishi va sotuvchi javoblarini hech kim kuzatmaydigan papkalarga, masalan, RSS Kanallari yoki Arxivga yo'naltirishi mumkin.
U yerdan ular hisob-faktura tafsilotlarini o'zgartirishi va to'lovlarni o'z hisoblariga yo'naltirishi mumkin, bularning barchasi aniqlash vositalari uchun hech qanday zararli dastur belgisiz.
MFA ni Aylanib O'tadigan Hisobni Egallash
O'rta-adversar (AiTM) hujumlari Huntress 2025-yilda kuzatgan identifikatsiya asosidagi tahdidlarning 18,9% ni tashkil etdi. Hujumchi jabrlanuvchi va haqiqiy Microsoft 365 kirish sahifasi o'rtasida turadi, tranzitda sessiya tokenini o'g'irlaydi va hamma narsani foydalanuvchiga hech narsa noto'g'ri ko'rinmasligi uchun yo'naltiradi.
Bu sessiya amal qilguncha, hujumchi parol yoki yangi MFA so'rovisiz hisobga kirishi mumkin.
Agar sizga ransomware hujumi sodir bo'lsa, nima qilasiz?
Fayllaringiz shifrlangan, operatsiyalaringiz to'xtagan, hujumchi o'z narxini aytgan va sizning javobingizni kutmoqda. To'laysizmi? Muzokara qilasizmi? Umuman aloqaga kirasizmi?
Huntress haqiqiy bizneslarga qarshi ishlatilgan taktikalar asosida yaratilgan simulyatsiya qilingan ransomware hodisasida keyingi harakatingizni tanlang. Siz ransomware operatorlari o'zlarini nazoratda deb o'ylaganlarida qanday harakat qilishlarini va hujumni muzokaraga aylanishidan oldin ushlash uchun qanday qadamlar qo'yishingiz mumkinligini ko'rasiz.
Simulyatorni Sinab Ko'ring →
Keyingi To'xtash Joyingiz: Boshqa Uch Burchak
Yuqori o'ng burchakdagi taktikalarni qamrab olganingizdan so'ng, qolganlari ham reja talab qiladi. Har biri tez rivojlanmoqda va istalgan vaqtda OH $#!T burchagiga o'tishi mumkin.
Qurilma Kodi Fishingi Past Darajada Xavfli Bo'lmoqda
Qurilma kodi fishingi kamroq uchraydi, lekin u Microsoftning haqiqiy qurilma kodi kirish oqimiga tayanadi, shuning uchun "URL ni tekshiring" maslahati yordam bermaydi. Ishonchli so'rov kimnidir haqiqiy Microsoft sahifasida qisqa kodni kiritishga undaydi va hujumchi parolni qayta o'rnatishdan ham uzoqroq yashashi mumkin bo'lgan kirish tokeni bilan ketadi.
16 kunlik davrda EvilTokens deb nomlangan fishing-xizmat (PhaaS) to'plami besh mamlakat bo'ylab 344 tashkilotni urdi. Himoyachilar g'ayrioddiy qurilma kodi so'rovlari va g'alati token faoliyatidan shubhalanishlari kerak.
ClickFix Kundalik Kirish Zararkunandasi
ClickFix odamlar kundalik to'siqlarni yengish uchun foydalanadigan nusxa-yopishtirish mushak xotirasiga tayanadi. Soxta CAPTCHA yoki "tasdiqlash muvaffaqiyatsiz" so'rovi kimnidir terminaliga zararli buyruqni yopishtirishga aldashadi. Yopishtirishning o'zi zararli kodni ishga tushiradi, shuning uchun hech qanday ekspluatatsiya zanjiri ishtirok etmaydi va bu infostealer zararli dasturi yoki ransomware ga olib kelishi mumkin.
ClickFix 2026-yil boshidan beri Boshqariladigan Endpoint Aniqlash va Javob (EDR) aniqlash signallarining taxminan 2,2% ni tashkil etadi, lekin bu aniqlashlarning deyarli 99% yuqori jiddiylikka ega.
AI Platformasi Suiiste'moli Hozircha Ortiqcha Baholangan
Bu burchak ortiqcha baholangan burchakda joylashgan, chunki u hali ham rivojlanayotgan naqsh. Hujumchilar zararli kontentni odamlar ishonadigan haqiqiy AI vositalari va ish jarayonlari ortida yashirishadi.
Soxta "ish stoli mijozi" yoki "mahsuldorlik yordamchisi" umumiy suhbat yoki Claude yoki ChatGPT kabi ishonchli AI domenida joylashgan artefakt ichida yashashi mumkin, bu esa nima zararli ekanligini aniqlashni qiyinlashtiradi.
Bir holatda FakeAgent haqiqiy claude.ai domenida zararli Claude Artifact dan foydalanib, Claude Desktop ni qidirayotgan odamlarni SectopRAT ga yo'naltirdi va ikki kunda 29 tashkilotga yetdi.
4-rasm: FakeAgent haqiqiy claude.ai domenida zararli Claude Artifact ni joylashtirib, SectopRAT ni tarqatdi.
Tragic Quadrantni Boshlang'ich Nuqtangiz Qiling
Tragic Quadrant hamma narsa shoshilinch tuyulganida birinchi navbatda nimani tuzatishni tanlashga yordam beradi.
Yuqori o'ng burchakdan boshlang va bir nechta oddiy savollar bering: Qaysi masofaviy vositalar tasdiqlangan va pochta qutisi qoidalari o'zgarishlari va g'alati sessiya xatti-harakatlarini ular yomonroq narsaga aylanishidan oldin qanday ushlaymiz?
Tragic Quadrantning nusxasini oling va har bir burchakni o'z vaqtingizda ko'rib chiqing va qaysi bo'shliqlarni keyin yopishni hal qiling.
Huntress Labs tomonidan homiylik qilingan va yozilgan.
Cyber headlines often focus on the flashy attacks, but the ones that actually cause OH $#!T moments are the tactics that abuse the tools and workflows you already trust. If you run a small or mid-sized organization, whether you handle IT yourself or outsource it, it’s a constant race to keep up with attackers and their evolving tactics.
The bottom line is that you need to know which attacks are landing in environments like yours, and how to prioritize your defenses against them.
The Tragic Quadrant at a Glance
That’s why Huntress created theTragic Quadrant, a ranked list of the cyber tactics putting businesses at risk, built to show you where to focus regardless of what’s trending week to week.
Figure 1: The Huntress Tragic Quadrant
Fix These Threats First: The OH $#!T Corner
Each of these tactics hides inside something your team uses every day, like a remote access tool or a Microsoft 365 login.
RMM Abuse Is Steady and Holding
Remote monitoring and management (RMM) tools are a staple for IT teams, which is exactly why attackers abuse them. One rogue RMM install gives an attacker persistent access that looks like ordinary admin work.
In Q1 2026, 45% of endpoint-related incidents Huntress investigated involved RMM abuse. Attackers are also using AI to build convincing fake document shares and service agreement lures that trick users intoinstalling unwanted RMMs.
Mailbox Manipulation Is an Entry Point to BEC
So far in 2026, 24.6% of Identity Threat Detection and Response (ITDR) signals point to mailbox manipulation and persistence. With mailbox access, an attacker can change inbox rules and send vendor replies to folders nobody is watching, like RSS Feeds or Archive.
From there, they can tweak invoice details and redirect payments to their own accounts, all without any malware for detection tools to flag.
Account Takeover That Sidesteps MFA
Adversary-in-the-middle (AiTM) attacks made up 18.9% of all identity-based threats Huntress tracked in 2025. The attacker sits between the victim and the real Microsoft 365 login page, steals the session token in transit, and forwards everything along so nothing looks off to the user.
As long as that session is valid, the attacker can access the account without a password or a fresh MFA prompt.
If you were hit with ransomware, what would you do?
Your files are encrypted, your operations are down, an attacker has named their price, and they're waiting for you to respond. Do you pay? Do you negotiate? Do you even engage at all?
Choose your next move in a simulated ransomware incident, built from tactics Huntress has seen used against real businesses. You'll see how ransomware operators behave when they think they're in control, and what steps you can take for catching an attack before it becomes a negotiation.
Try the Simulator →
Your Next Stop: The Other Three Corners
Once you’ve covered the top-right tactics, the others still deserve a plan. Each one is evolving fast, potentially moving toward the OH $#!T corner at any time.
Device Code Phishing Turns Low-Key Deadly
Device code phishing is less common, but it rides on Microsoft’s real device code login flow, so “check the URL” advice doesn’t help. A convincing prompt nudges someone to enter a short code on a genuine Microsoft page, and the attacker walks away with an access token that can outlive a password reset.
In one 16-day window, a phishing-as-a-service (PhaaS) kit called EvilTokens hit 344 organizations across five countries. Defenders should be suspicious of unusual device code prompts and odd token activity.
ClickFix Is a Daily Intrusion Pest
ClickFix leans on the copy-paste muscle memory people use to get past everyday friction. A fake CAPTCHA or “verification failed” prompt tricks someone into pasting a malicious command into their terminal. The paste itself triggers the malicious code, so no exploit chain is involved, and it can lead to infostealer malware or ransomware.
ClickFix accounts for about 2.2% of Managed Endpoint Detection and Response (EDR) detection signals so far in 2026, but nearly 99% of those detections are high severity.
AI Platform Abuse Is Overhyped, for Now
This one sits in the overhyped corner because it’s still an emerging pattern. Attackers hide malicious content behind real AI tools and workflows people trust.
A fake “desktop client” or “productivity helper” might live inside a shared conversation or a hosted artifact on a trusted AI domain like Claude or ChatGPT, which makes it tricky to tell what’s malicious.
In one case, FakeAgent used a malicious Claude Artifact on the real claude.ai domain to send people looking for Claude Desktop toSectopRAT, reaching 29 organizations in two days.
Figure 4: FakeAgent hosted a malicious Claude Artifact on the real claude.ai domain to spread SectopRAT.
Make the Tragic Quadrant Your Starting Point
The Tragic Quadrant helps you pick what to fix first when everything feels urgent.
Start in the top right corner and ask a few simple questions: Which remote tools are approved, and how do we catch mailbox rule changes and odd session behavior before they turn into something worse?
Grab your copy ofthe Huntress Tragic Quadrant to work through every corner on your own timeline and decide which gaps to close next
Sponsored and written by Huntress Labs.