GoKawiilHuntress ranks RMM abuse, mailbox manipulation and AiTM as top SMB cyber threats
Cybersecurity firm Huntress published its 'Tragic Quadrant,' a ranked list of attack tactics most frequently hitting small and mid-sized businesses. The data shows remote monitoring and management (RMM) tool abuse accounted for 45% of endpoint incidents in Q1 2026, mailbox manipulation made up 24.6% of identity threat signals so far in 2026, and adversary-in-the-middle attacks that bypass multi-factor authentication represented 18.9% of identity-based threats tracked in 2025.
GoKawiil's interpretation of the reporting above, not reported fact.
These figures suggest attackers increasingly exploit everyday IT tools and workflows rather than deploying detectable malware, which could make such intrusions harder for traditional security software to catch. For resource-constrained SMBs, Huntress's ranking offers a prioritization framework, implying that defenses against trusted-tool abuse and email persistence tactics may need more urgent attention than flashier, headline-grabbing attack types.
- RMM tool abuse drove 45% of endpoint incidents Huntress investigated in Q1 2026.
- Mailbox manipulation accounted for 24.6% of identity threat signals in 2026 so far, often enabling invoice fraud without malware.
- AiTM attacks that circumvent MFA made up 18.9% of identity-based threats tracked in 2025.
YubiKey 5 NFC Security Key — Since so many of these attacks hinge on compromised logins and abused admin credentials, hardware-backed MFA is one of the simplest ways to shut that door. A YubiKey adds a phishing-resistant second factor to your Microsoft 365 and RMM logins, directly hardening the exact entry points this report flags as highest risk.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-27
Published there as: “The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.