```
The most damaging intrusions into businesses today rarely involve a novel malware strain. They involve software the victim's own IT team installed, approved and monitored: remote monitoring agents, signed executables and living-off-the-land binaries already present on the network.
That is the core finding of a threat ranking published by Huntress Labs and covered by BleepingComputer, which sorts the attack techniques currently hitting organizations into a "tragic quadrant" — separating the threats burning through helpdesks now from the ones still gathering steam on the horizon. The common thread across both tiers is that attackers no longer need to bring their own tools. They use the ones already wearing the uniform of the IT department.
No malware, no signature, no alert
The report highlights a cluster of techniques built around legitimate-tool abuse: RMM agents repurposed for persistence, LOLBins used to execute payloads without ever writing suspicious files to disk, and signed binaries that slip past allowlisting because they were always meant to be there. Because nothing is downloaded and nothing is flagged as malicious, defenders who filter on "known-bad" signatures see nothing at all.
The practical consequence is a shift in what detection is supposed to answer. The operative question is no longer "is this file malicious?" but "is this behaviour expected for this account, at this hour, on this device?"
Session tokens as the new perimeter
Grouped among the higher-priority techniques in the ranking is Microsoft 365 session hijacking. Attackers using adversary-in-the-middle phishing kits can capture valid session cookies after a user completes a genuine MFA prompt — the second factor is satisfied, then stolen. The result is an authenticated session that password resets may not invalidate, because the token lives independently of the credential.
This is well-established industry context rather than a new revelation, but the report's placement of it in the immediate-attention tier rather than as an emerging curiosity is the notable part. Session lifetime semantics and revocation discipline, long treated as an edge concern, are now positioned as a frontline control.
A ranking built for finite attention
The immediate-versus-emerging split is arguably the report's most useful output. Security budgets and analyst hours are finite, and horizon-watching — tracking sophisticated-but-rare techniques while helpdesk tickets pile up — consumes attention that the threats already in the building demand. The quadrant structure exists to force that triage explicitly.
The emerging tier, summarised briefly, covers techniques that are gaining traction but are not yet the volume driver: deeper abuse of automated workflows and collaboration platforms, where a compromised integration or poisoned shared workflow grants persistent access with legitimate credentials.
What this means for lean IT teams
For a Hong Kong SME or a regional managed service provider running security with a small or one-person team, the uncomfortable takeaway is that the controls most often assumed to be working — MFA, application allowlisting, antivirus — are precisely the ones being routed around. MFA does not stop a stolen session token. Allowlisting does not stop a signed binary doing exactly what it was installed to do.
The suggested reinvestment is not another signature-based product. It is identity hygiene — conditional access, short session lifetimes, token revocation on offboarding — paired with behavioural monitoring that flags anomalies of routine rather than signatures of malice.
For managed service providers specifically, the risk compounds: a single set of privileged credentials reused across client tenants turns one phished session into a cascade across every organisation under management — a common operating model in Hong Kong's SME landscape, as a general observation rather than a finding of this report. Credential separation and per-tenant MFA enforcement are the cheapest breakers available.
None of this is exotic. That is the point. The attacks squeezing businesses hardest are ordinary, delivered with ordinary tools — which is why they keep working.
Source: BleepingComputer — The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest
```
現今針對企業最具破壞性的入侵事件，極少涉及新型惡意軟件。它們動用的，往往是受害者自身 IT 團隊安裝、批准並監控的軟件：遠端監控代理、已簽署的執行檔，以及網絡上原已存在的 living-off-the-land 二進制程序（LOLBins）。
這正是 Huntress Labs 發布、並由 BleepingComputer 報導的威脅排名的核心發現。該排名把目前打擊企業的攻擊手法劃分為「悲劇象限」—— 將正在令服務台疲於奔命的威脅，與仍在遠處蓄勢待發的威脅分隔開來。兩個層級之間的共通點是：攻擊者已無須自備工具，他們動用的，本身就是 IT 部門制服的一部分。
沒有惡意軟件、沒有特徵、沒有警報
報告重點介紹了一組圍繞合法工具濫用的手法：RMM 代理被重新用於持久化駐留、LOLBins 用來執行 payload 而無須在磁碟寫入任何可疑檔案，以及因原本就應該存在而得以繞過 allowlisting 的已簽署二進制程序。由於沒有任何下載行為，亦沒有任何東西被標記為惡意，防守方若只憑「已知惡意」特徵過濾，將完全看不到任何跡象。
實際後果是：檢測所要回答的問題已經轉變。當前的關鍵問題不再是「這個檔案是否惡意？」，而是「這個帳戶在此時、此裝置上的行為，是否符合預期？」
Session token 成為新邊界
排名中被列為較高優先級的手法，包括 Microsoft 365 session hijacking。攻擊者利用 adversary-in-the-middle（AiTM）釣魚工具包，可在用戶完成真實 MFA 驗證提示後擷取有效的 session cookie —— 第二重驗證因素先通過，隨後被竊取。結果是一個經認證的 session，密碼重設未必能使其失效，因為該 token 獨立於憑證而存在。
這已是業界相當熟悉的背景，並非新發現；值得注意的是，報告將其歸入「即時關注」層級，而非僅視為新興的研究對象。Session 生命週期語義（session lifetime semantics）與撤銷機制，長期以來被視為邊緣議題，如今已被定位為前線防護控制。
為有限注意力而設的排名
即時與新興之間的劃分，可謂報告最有用的產出。保安預算與分析人員工時終究有限；而放眼遠方 —— 在服務台工單不斷堆積之時追蹤精密但罕見的手法 —— 所消耗的注意力，正是已進入企業內部的威脅所急需的。象限結構的存在，就是要逼使這類分類檢視（triage）變得明確。
新興層級簡而言之，涵蓋正在獲得動力、但尚未成為主要流量來源的手法：更深入地濫用自動化工作流程及協作平台 —— 一旦 integration 被入侵或共享 workflow 被污染，攻擊者便可憑合法憑證取得持久訪問權限。
這對精簡 IT 團隊意味著什麼
對於香港中小企，或以小團隊甚至一人團隊營運保安的區域性 managed service provider（MSP），最令人不安的是：那些最常被假定運作正常的控制措施 —— MFA、application allowlisting、防病毒 —— 恰恰正是被繞道而行的對象。MFA 無法阻止被竊取的 session token；allowlisting 無法阻止一個已簽署的二進制程序執行其本來安裝來做的事。
建議的再投資方向，不是另一款基於特徵的產品，而是 identity hygiene —— conditional access、縮短 session 生命週期、員工離職時撤銷 token —— 並配合行為監控，標記常規行為中的異常，而非惡意意圖的特徵。
對 managed service provider 而言，風險更會疊加：一套特權憑證跨客戶 tenant 重複使用，會令一次釣魚得手的 session，演化成遍及所有受管企業的連鎖事故 —— 這是香港中小企生態中常見的營運模式，屬一般觀察而非本報告的結論。憑證分離與按 tenant 強制 MFA，是最廉價而現成的斷路器。
以上沒有一樣是奇異的手法。這正是重點所在。最令企業窒息的攻擊，其實是平凡的，動用的是平凡的工具 —— 正因如此，它們才屢試屢效。
Source: BleepingComputer — The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest