Adversary Infrastructure New Huntress ITDR Feature
Huntress, Thursday, November 5th, 2026
Huntress Managed ITDR's Adversary Infrastructure blocks attacker infrastructure at Microsoft 365 sign-in across all opted-in tenants.
Huntress added Adversary Infrastructure to Managed ITDR after a phishing-as-a-service campaign used the Railway developer platform to run device code phishing against 344 organizations.
A hand-built Conditional Access policy blocking Railway IP ranges stopped 305 attack attempts with no legitimate logins affected, but attackers moved to new infrastructure.
The new feature turns infrastructure confirmed by the Huntress SOC in one tenant into blocking Conditional Access policies in every eligible, opted-in tenant.
Huntress notes that 5,086 distinct attacker IPs hit its fleet in a 14-day window and that groups like EvilTokens use AI-written lures and clean cloud hosting.