Last week, ENISA released its Threat Landscape 2025.
It offers a detailed look at how Europeโs cyber ecosystem is evolving. The picture that emerges shows growing strain, where interconnected systems and persistent threats keep testing resilience.
Among the developments: faketivism blurring lines between actors, phishing services lowering barriers, and AI reshaping how attacks unfold.
๐ Read the report here: https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025
๐ New #blogpost
At H2, we recently moved from authenticator apps to #YubiKey (FIDO2) for company-wide MFA in Entra ID.
Why? Because it enables phishing-resistant, passwordless sign-ins at scale, raising the bar for our security.
But this move didn't come without its challenges. Read about our journey here: https://www.huntandhackett.com/blog/raising-security-with-yubikey
Cyber espionage reaches far beyond governments, it impacts more organisations than you think.
At our next CyberConnect on Sept 9 in The Hague, weโll share real investigations, explain why even low-profile orgs are targeted, and give a live demo on tracking campaigns.
Seats are limited. Sign up today: https://www.huntandhackett.com/understanding-cyber-espionage
โ ๏ธ The Hacker News just spotlighted a growing threat: SEO poisoning campaigns delivering malware through fake tool websites.
Attackers are mimicking trusted apps like PuTTY, Zoom, and ChatGPT, pushing them high in search results. Over 8,500 SMB users were targeted in just four months.
The article breaks it down clearly. If you havenโt read it yet, itโs worth your time.
Read it here: https://thehackernews.com/2025/07/seo-poisoning-campaign-targets-8500.html
๐คThreat Actor Profile: Sandworm
Linked to Russiaโs GRU and active in 60+ countries, Sandworm targets critical infrastructure with sabotage, espionage, and disruption. ๐ท๐บ
๐ Curious to learn more about this APT? Explore their threat profile in our Members' Portal: https://www.huntandhackett.com/members/actors/sandworm
๐ Not a Member yet? Sign-up today: https://www.huntandhackett.com/members/register
๐จNew #blogpost: This week we're unpacking our journey of using open-source software to build an innovative cloud-based IR lab from scratch, highlighting key obstacles we encountered along the road and explaining how we transformed these into opportunities.
We share:
๐ถ Velociraptor + Dissect hiccups;
๐ถ Misinterpretation of IPv6 addresses in Linux UTMP logs;
๐ถ Enhancing Timesketch for large scale investigations.
๐ https://www.huntandhackett.com/blog/turning-incident-response-challenges-into-scalable-solutions
Launching #DetectionsFromTheSOC ๐
We're excited to announce our new series, ๐๐ฆ๐ต๐ฆ๐ค๐ต๐ช๐ฐ๐ฏ๐ด ๐ง๐ณ๐ฐ๐ฎ ๐ต๐ฉ๐ฆ ๐๐๐, in which we share a behind-the-scenes look of how our SOC detects, investigates, and responds to real-world threats.
Case #1: Infostealer via fake CAPTCHA
We intercepted an attack where the intruder didnโt break in, but logged in. The entry point? A fake โIโm not a robotโ CAPTCHA prompt.
๐ Want to read the full story? Head on over to our LinkedIn to check it out: https://www.linkedin.com/feed/update/urn:li:activity:7336321179005165568
Launching #DetectionsFromTheSOC ๐ We're happy to announce our new series, ๐๐ฆ๐ต๐ฆ๐ค๐ต๐ช๐ฐ๐ฏ๐ด ๐ง๐ณ๐ฐ๐ฎ ๐ต๐ฉ๐ฆ ๐๐๐, in which we share a behind-the-scenes look of how our SOC detects, investigates, and responds to real-world threats. ๐ ๐จ๐ซ ๐จ๐ฎ๐ซ ๐๐ข๐ซ๐ฌ๐ญ ๐๐๐ข๐ญ๐ข๐จ๐ง: ๐ข๐ง๐๐จ๐ฌ๐ญ๐๐๐ฅ๐๐ซ ๐๐๐ฉ๐ฅ๐จ๐ฒ๐๐ ๐ฏ๐ข๐ ๐๐๐ค๐ ๐๐๐ฉ๐ญ๐๐ก๐ In the middle of the night, Hunt & Hackettโs 24/7 SOC intercepted the early stages of a broader cyberattack. The attacker didnโt break in, but logged in. An endpoint was compromised using a fake #CAPTCHA page โ you know, one of those โIโm not a robotโ checks. Only this one tricked the user into running a command via the keyboard shortcut Win + R. That command launched a hidden process and deployed a known #infostealer, likely #Cryptbot. ๐๐ก๐๐ญ ๐ก๐๐ฉ๐ฉ๐๐ง๐๐? Our SOC flagged a suspicious mshta.exe process making an outbound connection to a previously unknown domain. This quickly escalated: ๐ User was tricked into copy-pasting a command that secretly launched mshta.exe ๐ mshta.exe triggered PowerShell, which contacted additional anomalous domains and executed fileless malware ๐ PowerShell launched Chrome/Edge with the --remote-debugging-port=9203 flag โ a known abuse method to extract browser credentials ๐ The process accessed files in the Downloads folder All signs pointed to credential theft and system reconnaissance. ๐๐จ๐ฐ ๐ฐ๐ ๐๐๐ญ๐๐๐ญ๐๐ ๐ข๐ญ: One of our behavioural detection rules flagged: ๐ Use of mshta.exe in user context reaching unknown domains ๐Obfuscated PowerShell activity ๐Abuse of --remote-debugging-port in Chrome โ a known credential-stealing tactic This combination triggered a high-confidence detection, prompting an alert at our #SOC and enabling a fast response & remediation โ even at 3AM. ๐๐๐ฆ๐๐๐ข๐๐ญ๐ข๐จ๐ง: ๐ Clean install of the endpoint ๐ Blocked malicious domains ๐ Revoked all sessions and reset credentials This case shows how infostealers can be the first step in modern attacks, giving threat actors access to credentials, browser sessions, and local files. From there, they can move laterally, escalate privileges, and pave the way for bigger attacks like ransomware or business email compromise (#BEC) without you knowing it. In short: infostealers are a launchpad for full-scale breaches. ๐๐๐๐ฌ: ๐พ hxxps[:]//afliam[.]shop ๐พ b[.]watchcollision[.]xyz ๐พ blisspicks[.]shop
๐ค Weโre proud to sponsor and speak at Hague TIX on June 10!
The event is a focused gathering of Europeโs top threat intelligence minds.
We'll explore Europeโs path to cyber resilience and strategic autonomy, and dive into Lazarus and SeaTurtle operations in the Netherlands.
Our next CyberConnect session is coming up: Security in Motion!
In this session, tailored for security, IT, and risk professionals, we explore how changing geopolitical dynamics, growing technological dependencies, and new attack techniques are raising the bar for digital resilience.
Visit our website for more information, and to sign-up: https://www.huntandhackett.com/security-in-beweging
๐จ New blog!
In it, we dive into reverse-engineering AFD.sys (a hidden part of Windows networking) to surface live socket data from other processes. This unlocks new capabilities for forensics, debugging, and reverse engineering.
๐ Read it here: https://www.huntandhackett.com/blog/improving_afd_socket_visibility
๐ง Explore our tool: https://github.com/huntandhackett/AfdSocketViewer
