Trellix SecondSight Threat Hunting Report February 2026

This document is a threat hunting report authored by the Trellix Advanced Research Center, focusing on insights and intelligence gathered from various sources, including Trellix SecondSight. It outlines the top five critical campaigns observed in 2025, emphasizing the importance of proactive threat hunting methodologies. The report details the exploitation of a Microsoft SharePoint vulnerability (CVE-2025-53770) and its impact on organizations in the financial and healthcare sectors. It describes the structured prioritization framework used by Trellix hunters to identify risks early and emphasizes the need for continuous assessment of threat campaigns. The report also provides case studies that illustrate how Trellix connects weak signals to active operations, validating findings through multiple data sources. Additionally, it offers remediation steps for organizations and highlights critical takeaways for threat-hunting teams to enhance their detection capabilities. The insights are based on data collected primarily between July 1, 2025, and December 31, 2025.