https://www.hackthebox.com/rss/blog/threat-intelligence All the latest news and insights about cybersecurity from Hack The Box. Hacking trends, insights, interviews, stories, and much more en https://www.hackthebox.com/images/landingv3/logo-htb-blog.svg https://www.hackthebox.com/rss/blog/threat-intelligence https://www.hackthebox.com/blog/dissecting-scattered-spider-webinar-ransomware-social-engineering Discover how Scattered Spider blends social engineering with technical precision to launch high-impact ransomware attacks. ]]> Threat Intelligence Wed, 05 Nov 2025 09:57:00 +0000 https://www.hackthebox.com/blog/dissecting-scattered-spider-webinar-ransomware-social-engineering https://www.hackthebox.com/blog/f5-networks-breach-unc5221-brickstorm-supply-chain-attack F5 Networks was breached for over a year by China-linked APT UNC5221. Learn how Brickstorm malware enabled source code theft and supply chain attack risks—and how to defend. ]]> Threat Intelligence Tue, 04 Nov 2025 08:27:00 +0000 https://www.hackthebox.com/blog/f5-networks-breach-unc5221-brickstorm-supply-chain-attack https://www.hackthebox.com/blog/scattered-spider-cyberattack-recovery-plan Learn how organizations can recover from Scattered Spider attacks. Follow our 90-day recovery plan to rebuild systems, strengthen defenses, and boost cyber resilience. ]]> Threat Intelligence Tue, 28 Oct 2025 03:57:00 +0000 https://www.hackthebox.com/blog/scattered-spider-cyberattack-recovery-plan https://www.hackthebox.com/blog/bianlian-nippon-steel-supply-chain-attack A deep dive into the Nippon Steel breach and BianLian’s growing focus on supply chain data theft. Learn how to defend your network. ]]> Threat Intelligence Tue, 28 Oct 2025 02:44:00 +0000 https://www.hackthebox.com/blog/bianlian-nippon-steel-supply-chain-attack https://www.hackthebox.com/blog/apt29-watering-hole-microsoft-device-auth Cozy Bear’s watering-hole attack on Microsoft device code auth used obfuscated JS and redirects to compromise 10% of visitors. Learn how to defend against it. ]]> Threat Intelligence Tue, 23 Sep 2025 01:59:00 +0000 https://www.hackthebox.com/blog/apt29-watering-hole-microsoft-device-auth https://www.hackthebox.com/blog/CVE-2025-54136-cursor-code-editor See how CVE-2025-54136 lets attackers exploit Cursor’s MCP configs for remote code execution and how to protect your environment. ]]> Threat Intelligence Tue, 16 Sep 2025 02:57:00 +0000 https://www.hackthebox.com/blog/CVE-2025-54136-cursor-code-editor https://www.hackthebox.com/blog/unc3886-fireant-chinese-apt-vmware-esxi-hypervisor-attack Discover how Chinese APT UNC3886 used 20+ MITRE techniques in the FireAnt campaign to exploit VMware ESXi hypervisors and evade detection. ]]> Threat Intelligence Wed, 10 Sep 2025 10:34:00 +0000 https://www.hackthebox.com/blog/unc3886-fireant-chinese-apt-vmware-esxi-hypervisor-attack https://www.hackthebox.com/blog/apt-44-sandworm-attack-anatomy-mitre-techniques Explore Sandworm (APT44), the Dune-inspired APT group behind NotPetya, Olympic Destroyer, and power grid attacks — and learn how to defend against their tactics. ]]> Threat Intelligence Wed, 06 Aug 2025 09:39:00 +0000 https://www.hackthebox.com/blog/apt-44-sandworm-attack-anatomy-mitre-techniques https://www.hackthebox.com/blog/how-to-defend-against-apt33-powershell-attacks How the Elfin group made the move from quiet espionage to all-out disruption, and how to stay a few steps ahead of its tactics. ]]> Threat Intelligence Tue, 15 Jul 2025 08:20:00 +0000 https://www.hackthebox.com/blog/how-to-defend-against-apt33-powershell-attacks https://www.hackthebox.com/blog/salt-typhoon-apt-us-telecom-espionage-attack-analysis Call recordings from US presidential campaigns. Wiretaps hijacked. No less than nine telecoms infiltrated—completely undetected—for years. Salt Typhoon didn’t just spy, they embedded. ]]> Threat Intelligence Mon, 30 Jun 2025 10:23:00 +0000 https://www.hackthebox.com/blog/salt-typhoon-apt-us-telecom-espionage-attack-analysis