As reported by BleepingComputer, Huntress Labs has published its Tragic Quadrant — a ranked threat model identifying the attack techniques causing the most real-world damage to small and mid-sized businesses. The findings reinforce a uncomfortable truth: the threats that matter most aren't zero-days or novel malware families. They're the ones that weaponize the tools your IT team already trusts.

Key Takeaway: As reported by BleepingComputer, Huntress Labs has published its Tragic Quadrant — a ranked threat model identifying the attack techniques causing the most real-world damage to small and mid-sized businesses.

The Core Problem: Legitimacy as a Weapon

Traditional security stacks are designed to detect malicious activity — unknown binaries, suspicious network connections, anomalous process chains. But the top threats in the Tragic Quadrant share a different DNA: they operate inside legitimate tools and authenticated sessions. RMM software, mailbox rules, and active Microsoft 365 sessions all look like normal admin work to most detection engines. That's not a gap in any single product — it's an architectural blind spot in how many organizations approach monitoring.

The Three Threats Huntress Prioritized

ThreatPrevalence (per Huntress)Why It Works
RMM Tool Abuse45% of endpoint incidents (Q1 2026)Persistence via legitimate admin software; blends in with normal IT workflows
Mailbox Manipulation24.6% of ITDR signals (2026 YTD)Hidden inbox rules redirect vendor emails; no malware required
AiTM / Session Token Theft18.9% of identity threats (2025)Stolen session cookies bypass MFA entirely; no password or second factor needed

Why This Matters for SMBs Specifically

Small and mid-sized businesses are disproportionately exposed because they rely heavily on MSPs and outsourced IT — environments where RMM tools are ubiquitous and mailbox access is shared across support staff. Attackers know this. A single rogue RMM install in an MSP environment can cascade across dozens of downstream clients, creating a supply-chain-style compromise without ever touching a traditional malware delivery chain.

The mailbox manipulation finding is equally significant. When attackers create inbox rules that route vendor payment emails to an "Archive" or "RSS Feeds" folder, they establish a hidden channel for business email compromise that can persist for weeks or months. Invoice details get quietly modified, payment instructions get redirected, and no EDR on the planet will flag it — because nothing malicious happened on any endpoint. The crime happened entirely inside an authenticated SaaS application.

The common thread across all three top threats is that they exploit identity and trust, not software vulnerabilities. Defenders who invest primarily in patch management and endpoint detection will miss these attacks entirely.

Shield53 Recommendations

Shield53 Recommendations
Inventory and restrict RMM tools: Maintain an authoritative list of approved RMM software. Block unauthorized RMM binaries at the endpoint (EDR application control / AppLocker / Windows Defender Application Control). Alert on any new RMM installation originating from user-context sessions or phishing-sourced downloads.
Audit mailbox rules continuously: Deploy automated checks for new inbox rules — especially those referencing RSS Feeds, Archive, or custom folders — across all Microsoft 365 tenants. Flag rules created via Graph API or from unfamiliar IP ranges. Microsoft Purview Audit Log (Premium) provides the necessary telemetry.
Implement session-based protections: Enforce Conditional Access policies with session risk evaluation. Require reauthentication for high-risk actions. Evaluate FIDO2 security keys, which are resistant to AiTM token theft because they're cryptographically bound to the legitimate origin. Consider session revocation policies for suspicious sign-ins.
Deploy ITDR capabilities: If you rely on Microsoft 365, invest in identity threat detection that goes beyond sign-in logs — monitoring for suspicious inbox rule creation, OAuth app consent abuse, and anomalous Graph API activity. Tools like Microsoft Defender for Identity or third-party ITDR platforms address this gap.
Train finance teams on BEC lures: Since mailbox manipulation ultimately serves invoice fraud, finance departments need independent verification workflows for any payment detail changes — regardless of how legitimate the email appears.

Broader Implications

The Tragic Quadrant validates what incident responders have observed anecdotally for years: the threat landscape is bifurcating. On one side, sophisticated nation-state actors pursue zero-days and supply-chain compromises. On the other, the threats that actually hit most businesses are mundane, persistent, and designed to evade detection by blending in. Security programs that treat these as the same problem will over-invest in one and under-invest in the other.

For SMBs and MSPs, the priority is clear. Stop chasing the latest CVE headline and start monitoring the tools, identities, and workflows you already trust. That's where attackers are actually operating.