Threat Actor’s Self-Deployment of EDR Exposes Their Tools and Workflows

Huntress Security Operations Center (SOC) analysed alerts from a self-deployed EDR instance to gain unprecedented insight into an adversary’s day-to-day workflows, tool usage and evolving tradecraft, the article notes.

The researchers published detailed findings after confirming that the target host was malicious, balancing privacy obligations with threat dissemination to illustrate how the actor researched and adopted security software, leveraged AI for automation, hunted running Evilginx instances, and staged multi-month reconnaissance campaigns.

Browser history revealed the actor first evaluated Bitdefender before following a comparison link to a Huntress trial, after which the Huntress agent was downloaded and installed, inadvertently chronicle every subsequent action, with interest shown in Malwarebytes and its browser-guard extension. A key red flag emerged when the machine name matched one tracked in prior intrusion incidents, and Huntress later confirmed the attacker’s activities by retroactively hunting for related threats.

Over the period from May 29 to July 9, 2025, the analysis documented the actor’s focus on Nigerian banking and cryptocurrency exchanges and uncovered over 2,400 compromised identities, enabling high-confidence detections and faster responses for future incidents. According to Huntress, sharing raw EDR telemetry alongside contextual analysis aims to help defenders anticipate threat tradecraft and refine detection rules.