About

I’m Josh. I work in tactical response at Huntress, investigating intrusions and piecing together what happened.

I started as an apprentice in a computer repair shop, moved into infrastructure, then into security. People took the time to help me learn at every stage. I owe a lot to them.

“If I have seen further, it is by standing on the shoulders of Giants.” — Isaac Newton, echoing Bernard of Chartres

Outside Huntress, I co-founded CtrlAltInt3l. I keep this site for the research and tools I work on myself, plus anything from response work I can talk about publicly.

Training and Certifications

• eJPT
• BLT2
• Mitten Mac Threat Hunting Training
• Empire operations - II

Selected Work Elsewhere

• Uptick in Bomgar RMM Exploitation
• Untold Tales from Tactical Response
• Using Shodan Images to Hunt Down Ransomware Groups
• Insights into Suspected DPRK Workers (investigation and writeup contribution)
• Medusa Ransomware
• CrushFTP Exploitation
• BianLian
• INC Ransomware
• Response to a legacy exploit
• Apache ActiveMQ
• Threat Hunting RMM
• SlashAndGrab
• Utilizing ASNs for Hunting & Response
• Ransomware Initial Access Brokers Exposed
• Persistent Chinese Operation Against Vietnamese Universities
• Bsides How we hacked into a Polar Orbit Satellite
• Active Exploitation of SonicWall VPNs
• OWASSRF Response
• Huntress Cambridge & Bristol roadshow
• Bsides Cymru 2025:These Hackers Fucking Suck
• Huntress London Roadshow