Huntress Labs has published a ranking of attack techniques it says are causing the most harm to organisations, with a strong focus on methods that abuse legitimate software, trusted accounts and normal IT processes rather than obvious malware alone. The findings reflect a wider shift in cybercrime: attackers increasingly try to look like ordinary users or administrators so they can move through a business environment without immediately triggering traditional defences.

What happened

According to Huntress Labs, the threats affecting businesses most seriously are not limited to classic malicious files or clearly suspicious tools. The company says attackers are increasingly using legitimate remote management and administrative software, hijacked Microsoft 365 sessions, and standard business workflows to gain access, persist in systems and escalate attacks.

The report is presented as Huntress' assessment of which techniques deserve the most urgent defensive attention and which are still emerging. While the exact ranking reflects Huntress' own research and observations, the broader pattern is consistent with a long-running security trend: account compromise, identity abuse and “living off the land” tactics are becoming central to real-world incidents.

Why it matters for European businesses

For European companies, especially SMEs, this matters because many organisations still structure their security around older assumptions: block malware, filter email and keep endpoints patched. Those controls remain important, but they may not be enough when an attacker uses a real user session, a genuine cloud login or trusted admin tools already allowed inside the business.

This has practical implications for companies that depend on Microsoft 365, cloud collaboration platforms, managed IT tooling and outsourced support workflows. If attackers can reuse authenticated sessions or operate through legitimate software, a business may not see the usual warning signs associated with a conventional breach.

The result can be delayed detection, broader lateral movement and a higher risk of business interruption, data theft, email compromise or ransomware deployment. For SMEs with limited in-house security capacity, these techniques are particularly challenging because they often require better visibility into identity events, cloud logs and administrator activity rather than only antivirus alerts.

The findings are also relevant in the context of European compliance and risk management. Although the Huntress report does not create new legal obligations, businesses already subject to GDPR, sector-specific requirements or cybersecurity frameworks such as NIS2-related obligations may need to show they are taking proportionate steps to protect accounts, systems and business data.

Who may be affected

The techniques described are relevant across a wide range of organisations, but some groups may face more immediate exposure:

• SMEs using Microsoft 365: especially those without strong conditional access, session monitoring or centralised identity controls.
• Businesses relying on managed service providers or remote IT tools: legitimate admin software can be abused if access is not tightly controlled.
• E-commerce and digitally dependent companies: account compromise or admin abuse can affect storefronts, payment-related operations, customer communications and back-office workflows.
• Marketing and commercial teams: email account takeover can be used for invoice fraud, phishing, internal impersonation and customer-targeted scams.
• Organisations with limited logging and monitoring: they may struggle to distinguish normal admin behaviour from malicious activity.

What companies should consider

European businesses do not need to wait for a specific incident to act. The report points to several practical areas worth reviewing:

• Strengthen identity security: review multi-factor authentication coverage, privileged account controls, conditional access policies and session management for Microsoft 365 and other core platforms.
• Reduce unnecessary admin access: limit standing privileges, review dormant accounts and tighten access to remote management and scripting tools.
• Improve monitoring of legitimate tools: security teams should not assume approved software is always safe. Logging and alerts should cover unusual use of remote administration, PowerShell, sign-ins and mailbox activity.
• Review cloud and email detection capabilities: many attacks now begin or expand through business email and cloud identities rather than only endpoint malware.
• Test incident response for account compromise: ensure the business can revoke sessions, reset credentials, isolate affected users and investigate suspicious mailbox or admin activity quickly.
• Assess supplier and MSP access: where third parties manage systems, businesses should confirm how privileged access is secured, monitored and audited.
• Train staff beyond basic phishing awareness: employees should understand account takeover risks, MFA fatigue, suspicious login prompts and impersonation attempts.

For many businesses, the core message is straightforward: the highest-priority threats are increasingly hiding inside normal digital operations. That makes identity protection, visibility and rapid response at least as important as traditional malware prevention.