grep -rl "huntress" ./articles
Ahsay has confirmed that the build it shipped for two exploited backup-server flaws did not address them. A hotfix exists and Huntress has verified it. We reported on 12 October that no patch was available, which was already wrong by two days — this is why.
Huntress saw attackers chaining two AhsayCBS flaws into SYSTEM-level code execution on 7 October, three days after NVD published them. There is no patch, every version through 10.3.4 is affected despite earlier reporting, and the remediation advice is to re-image from a trusted backup.
Huntress traced a remote access trojan back to a Custom GPT called Plus 5.6, hosted on OpenAI's own domain and reached through a sponsored Google result for the word chatgpt. The page it sent people to imitated a Cloudflare check and asked them to paste a line into PowerShell. OpenAI removed the GPT on 25 September; a replacement appeared on the 27th.
Huntress found ScreenConnect clients that write a four-stage VBScript chain onto machines as they connect, profile each host, and then request a different payload depending on how much RAM it has and which EDR is installed. There is no code execution vulnerability to patch — it abuses file transfer, and ConnectWise says the fix is to turn the permission off.
One cluster ran 22 fabricated personas, submitted 60-plus applications a day across 10 platforms, and reached more than 1,100 companies. The advice — interview in person, check backgrounds — describes the hiring process that remote-first work removed.