โ ๏ธ The Hacker News just spotlighted a growing threat: SEO poisoning campaigns delivering malware through fake tool websites.
Attackers are mimicking trusted apps like PuTTY, Zoom, and ChatGPT, pushing them high in search results. Over 8,500 SMB users were targeted in just four months.
The article breaks it down clearly. If you havenโt read it yet, itโs worth your time.
Read it here: https://thehackernews.com/2025/07/seo-poisoning-campaign-targets-8500.html
๐คThreat Actor Profile: Sandworm
Linked to Russiaโs GRU and active in 60+ countries, Sandworm targets critical infrastructure with sabotage, espionage, and disruption. ๐ท๐บ
๐ Curious to learn more about this APT? Explore their threat profile in our Members' Portal: https://www.huntandhackett.com/members/actors/sandworm
๐ Not a Member yet? Sign-up today: https://www.huntandhackett.com/members/register
๐จNew #blogpost: This week we're unpacking our journey of using open-source software to build an innovative cloud-based IR lab from scratch, highlighting key obstacles we encountered along the road and explaining how we transformed these into opportunities.
We share:
๐ถ Velociraptor + Dissect hiccups;
๐ถ Misinterpretation of IPv6 addresses in Linux UTMP logs;
๐ถ Enhancing Timesketch for large scale investigations.
๐ https://www.huntandhackett.com/blog/turning-incident-response-challenges-into-scalable-solutions
Launching #DetectionsFromTheSOC ๐
We're excited to announce our new series, ๐๐ฆ๐ต๐ฆ๐ค๐ต๐ช๐ฐ๐ฏ๐ด ๐ง๐ณ๐ฐ๐ฎ ๐ต๐ฉ๐ฆ ๐๐๐, in which we share a behind-the-scenes look of how our SOC detects, investigates, and responds to real-world threats.
Case #1: Infostealer via fake CAPTCHA
We intercepted an attack where the intruder didnโt break in, but logged in. The entry point? A fake โIโm not a robotโ CAPTCHA prompt.
๐ Want to read the full story? Head on over to our LinkedIn to check it out: https://www.linkedin.com/feed/update/urn:li:activity:7336321179005165568
Launching #DetectionsFromTheSOC ๐ We're happy to announce our new series, ๐๐ฆ๐ต๐ฆ๐ค๐ต๐ช๐ฐ๐ฏ๐ด ๐ง๐ณ๐ฐ๐ฎ ๐ต๐ฉ๐ฆ ๐๐๐, in which we share a behind-the-scenes look of how our SOC detects, investigates, and responds to real-world threats. ๐ ๐จ๐ซ ๐จ๐ฎ๐ซ ๐๐ข๐ซ๐ฌ๐ญ ๐๐๐ข๐ญ๐ข๐จ๐ง: ๐ข๐ง๐๐จ๐ฌ๐ญ๐๐๐ฅ๐๐ซ ๐๐๐ฉ๐ฅ๐จ๐ฒ๐๐ ๐ฏ๐ข๐ ๐๐๐ค๐ ๐๐๐ฉ๐ญ๐๐ก๐ In the middle of the night, Hunt & Hackettโs 24/7 SOC intercepted the early stages of a broader cyberattack. The attacker didnโt break in, but logged in. An endpoint was compromised using a fake #CAPTCHA page โ you know, one of those โIโm not a robotโ checks. Only this one tricked the user into running a command via the keyboard shortcut Win + R. That command launched a hidden process and deployed a known #infostealer, likely #Cryptbot. ๐๐ก๐๐ญ ๐ก๐๐ฉ๐ฉ๐๐ง๐๐? Our SOC flagged a suspicious mshta.exe process making an outbound connection to a previously unknown domain. This quickly escalated: ๐ User was tricked into copy-pasting a command that secretly launched mshta.exe ๐ mshta.exe triggered PowerShell, which contacted additional anomalous domains and executed fileless malware ๐ PowerShell launched Chrome/Edge with the --remote-debugging-port=9203 flag โ a known abuse method to extract browser credentials ๐ The process accessed files in the Downloads folder All signs pointed to credential theft and system reconnaissance. ๐๐จ๐ฐ ๐ฐ๐ ๐๐๐ญ๐๐๐ญ๐๐ ๐ข๐ญ: One of our behavioural detection rules flagged: ๐ Use of mshta.exe in user context reaching unknown domains ๐Obfuscated PowerShell activity ๐Abuse of --remote-debugging-port in Chrome โ a known credential-stealing tactic This combination triggered a high-confidence detection, prompting an alert at our #SOC and enabling a fast response & remediation โ even at 3AM. ๐๐๐ฆ๐๐๐ข๐๐ญ๐ข๐จ๐ง: ๐ Clean install of the endpoint ๐ Blocked malicious domains ๐ Revoked all sessions and reset credentials This case shows how infostealers can be the first step in modern attacks, giving threat actors access to credentials, browser sessions, and local files. From there, they can move laterally, escalate privileges, and pave the way for bigger attacks like ransomware or business email compromise (#BEC) without you knowing it. In short: infostealers are a launchpad for full-scale breaches. ๐๐๐๐ฌ: ๐พ hxxps[:]//afliam[.]shop ๐พ b[.]watchcollision[.]xyz ๐พ blisspicks[.]shop
๐ค Weโre proud to sponsor and speak at Hague TIX on June 10!
The event is a focused gathering of Europeโs top threat intelligence minds.
We'll explore Europeโs path to cyber resilience and strategic autonomy, and dive into Lazarus and SeaTurtle operations in the Netherlands.
Our next CyberConnect session is coming up: Security in Motion!
In this session, tailored for security, IT, and risk professionals, we explore how changing geopolitical dynamics, growing technological dependencies, and new attack techniques are raising the bar for digital resilience.
Visit our website for more information, and to sign-up: https://www.huntandhackett.com/security-in-beweging
๐จ New blog!
In it, we dive into reverse-engineering AFD.sys (a hidden part of Windows networking) to surface live socket data from other processes. This unlocks new capabilities for forensics, debugging, and reverse engineering.
๐ Read it here: https://www.huntandhackett.com/blog/improving_afd_socket_visibility
๐ง Explore our tool: https://github.com/huntandhackett/AfdSocketViewer
We've updated our threat landscape on the logistics sector ๐
On it, you'll find detailed actor overviews, analyses of recent cyberattacks in the logistics sector, and insights into emerging cybersecurity trends.
Curious? Take a look: https://www.huntandhackett.com/members/sectors/logistics
Als advocaat ben je vaak het eerste aanspreekpunt bij een cyberincident. Maar hoe zorg je dat jouw cliรซnt meteen de juiste stappen zet? En hoe werk je optimaal samen met technische experts onder tijdsdruk?
Op 16 mei organiseren we een interactieve workshop voor advocaten die cliรซnten adviseren op het gebied van privacy, informatiebeveiliging en incident response waarin we praktische kennis over digitale hygiรซne combineren met onze ervaringen uit het veld.
Sign-up: https://www.huntandhackett.com/crisisworkshop-advocaten
๐๐จ๐ข๐ง ๐ฎ๐ฌ ๐๐ญ ๐๐จ๐จ๐ ๐ฅ๐ ๐๐ฆ๐ฌ๐ญ๐๐ซ๐๐๐ฆ ๐๐จ๐ซ ๐จ๐ฎ๐ซ ๐ฎ๐ฉ๐๐จ๐ฆ๐ข๐ง๐ ๐ฌ๐๐ฌ๐ฌ๐ข๐จ๐ง:
Securing Operational Technology: Fast Response, Strong Recovery
๐๐ฉ๐ข๐ต ๐ฉ๐ข๐ฑ๐ฑ๐ฆ๐ฏ๐ด ๐ธ๐ฉ๐ฆ๐ฏ ๐ต๐ฉ๐ฆ ๐ด๐บ๐ด๐ต๐ฆ๐ฎ๐ด ๐บ๐ฐ๐ถ ๐ณ๐ฆ๐ญ๐บ ๐ฐ๐ฏ ๐ฆ๐ท๐ฆ๐ณ๐บ ๐ฅ๐ข๐บ ๐ด๐ถ๐ฅ๐ฅ๐ฆ๐ฏ๐ญ๐บ ๐ด๐ต๐ฐ๐ฑ ๐ธ๐ฐ๐ณ๐ฌ๐ช๐ฏ๐จ?
Together with Xebia, weโre hosting a session on how to boost operational resilience, secure OT environments, and align with evolving regulations.
Sign-up here: https://www.huntandhackett.com/securing-ot
