Launching #DetectionsFromTheSOC 🚀

We're excited to announce our new series, 𝘋𝘦𝘵𝘦𝘤𝘵𝘪𝘰𝘯𝘴 𝘧𝘳𝘰𝘮 𝘵𝘩𝘦 𝘚𝘖𝘊, in which we share a behind-the-scenes look of how our SOC detects, investigates, and responds to real-world threats.

Case #1: Infostealer via fake CAPTCHA

We intercepted an attack where the intruder didn’t break in, but logged in. The entry point? A fake “I’m not a robot” CAPTCHA prompt.

👉 Want to read the full story? Head on over to our LinkedIn to check it out: https://www.linkedin.com/feed/update/urn:li:activity:7336321179005165568

🎤 We’re proud to sponsor and speak at Hague TIX on June 10!

The event is a focused gathering of Europe’s top threat intelligence minds.

We'll explore Europe’s path to cyber resilience and strategic autonomy, and dive into Lazarus and SeaTurtle operations in the Netherlands.

#CyberSecurity #ThreatIntel #HagueTIX #APT

Our next CyberConnect session is coming up: Security in Motion!

In this session, tailored for security, IT, and risk professionals, we explore how changing geopolitical dynamics, growing technological dependencies, and new attack techniques are raising the bar for digital resilience.

Visit our website for more information, and to sign-up: https://www.huntandhackett.com/security-in-beweging

🚨 New blog!

In it, we dive into reverse-engineering AFD.sys (a hidden part of Windows networking) to surface live socket data from other processes. This unlocks new capabilities for forensics, debugging, and reverse engineering.

📃 Read it here: https://www.huntandhackett.com/blog/improving_afd_socket_visibility

🔧 Explore our tool: https://github.com/huntandhackett/AfdSocketViewer

We've updated our threat landscape on the logistics sector 🚛

On it, you'll find detailed actor overviews, analyses of recent cyberattacks in the logistics sector, and insights into emerging cybersecurity trends.

Curious? Take a look: https://www.huntandhackett.com/members/sectors/logistics

Als advocaat ben je vaak het eerste aanspreekpunt bij een cyberincident. Maar hoe zorg je dat jouw cliënt meteen de juiste stappen zet? En hoe werk je optimaal samen met technische experts onder tijdsdruk?

Op 16 mei organiseren we een interactieve workshop voor advocaten die cliënten adviseren op het gebied van privacy, informatiebeveiliging en incident response waarin we praktische kennis over digitale hygiëne combineren met onze ervaringen uit het veld.

Sign-up: https://www.huntandhackett.com/crisisworkshop-advocaten

𝐉𝐨𝐢𝐧 𝐮𝐬 𝐚𝐭 𝐆𝐨𝐨𝐠𝐥𝐞 𝐀𝐦𝐬𝐭𝐞𝐫𝐝𝐚𝐦 𝐟𝐨𝐫 𝐨𝐮𝐫 𝐮𝐩𝐜𝐨𝐦𝐢𝐧𝐠 𝐬𝐞𝐬𝐬𝐢𝐨𝐧:
Securing Operational Technology: Fast Response, Strong Recovery

𝘞𝘩𝘢𝘵 𝘩𝘢𝘱𝘱𝘦𝘯𝘴 𝘸𝘩𝘦𝘯 𝘵𝘩𝘦 𝘴𝘺𝘴𝘵𝘦𝘮𝘴 𝘺𝘰𝘶 𝘳𝘦𝘭𝘺 𝘰𝘯 𝘦𝘷𝘦𝘳𝘺 𝘥𝘢𝘺 𝘴𝘶𝘥𝘥𝘦𝘯𝘭𝘺 𝘴𝘵𝘰𝘱 𝘸𝘰𝘳𝘬𝘪𝘯𝘨?

Together with Xebia, we’re hosting a session on how to boost operational resilience, secure OT environments, and align with evolving regulations.

Sign-up here: https://www.huntandhackett.com/securing-ot

Yesterday, our security experts discussed the evolving threat landscape around the upcoming NATO summit in The Hague.

A great opportunity to highlight cyber threats beyond the traditional security community; cross-domain awareness is key in today’s threat landscape.

Our hunters tackled the 44th edition NN Marathon Rotterdam! 🏁

Their legs might be sore today, but the bliss of victory was more than worth it. After all, every win starts with a challenge.

Huge respect to everyone who took on #demooiste with us. See you at the next one.

New #blog post! A collaboration between Xebia and Hunt & Hackett ⚔️

As businesses become more interconnected, Operational Technology (OT) is increasingly targeted by cyber threats. In this blog, we explore OT security and raise awareness about its growing risks.

Read the full blog here: https://www.huntandhackett.com/blog/evolving-threat-of-ot

Excited to share our 2025 Trend Report, which explores key themes shaping the cybersecurity landscape in the year ahead.

We investigate:
👉 The #cybercrime economy and the rise of Business Email Compromise
👉 The impact of #GenAI and the hype surrounding it
👉 The increasing sophistication of #nationstate threats
👉 Opportunities, challenges and risks of the #NIS2 Directive

Huge thanks to our expert contributors for sharing their insights!

Download the report here: https://www.huntandhackett.com/2025-trend-report

🚜 𝐖𝐞’𝐯𝐞 𝐔𝐩𝐝𝐚𝐭𝐞𝐝 𝐨𝐮𝐫 𝐓𝐡𝐫𝐞𝐚𝐭 𝐋𝐚𝐧𝐝𝐬𝐜𝐚𝐩𝐞 𝐨𝐧 𝐭𝐡𝐞 𝐀𝐠𝐫𝐢𝐜𝐮𝐥𝐭𝐮𝐫𝐞 𝐒𝐞𝐜𝐭𝐨𝐫 🌱

The Netherlands is a global leader in #Agriculture, driving innovation and shaping the future of farming. But with this leadership comes increased #cyber risk. To help you stay ahead, we’ve updated our threat landscape on the Agriculture sector.

🔗 Explore it here: https://www.huntandhackett.com/threats/sectors/agriculture

Want to dive deeper? Our full, in-depth insights are available exclusively in our MemberPortal. 🔐

🚨Dutch universities are increasingly targeted by cybercriminals, but many still lack fundamental security protections.

In an interview with De Telegraaf, Hunt & Hackett co-founder Ronald Prins highlighted the risks of poor threat detection and the urgent need for proactive security measures. Without continuous monitoring, cyberattacks go unnoticed for too long.

Read the article here ➡️ https://www.telegraaf.nl/nieuws/295152965/universiteiten-kwetsbaar-voor-cyberaanvallen-bevinden-ons-in-kennisoorlog

While TU Eindhoven works on mitigating the incident, it’s worth asking: how do we ensure that institutions leading in innovation can continue to do so securely? Are we doing enough to protect the data and research that drive progress? Or how can we help, let us know!

Find out more about how different threat actors operate and the evolving threat landscape by visiting our member portal.

Become a member: https://www.huntandhackett.com/members/register

Direct (member) link: https://www.huntandhackett.com/_hcms/mem/login?redirect_url=https%3A%2F%2Fwww.huntandhackett.com%2Fmembers%2Factors%2Fapt29

6/🧵

𝐓𝐡𝐞 𝐁𝐢𝐠𝐠𝐞𝐫 𝐏𝐢𝐜𝐭𝐮𝐫𝐞

This isn’t a story about a single university, it’s an issue that affects the entire education sector. The attack raises important questions about #resilience, #preparedness, and the steps organizations must take to safeguard their systems and knowledge.

5/🧵

𝐖𝐡𝐲 𝐝𝐨𝐞𝐬 𝐭𝐡𝐢𝐬 𝐦𝐚𝐭𝐭𝐞𝐫?

This incident highlights how educational institutions are not just centers of learning but also drivers of innovation, with the potential for their research and data to have global implications. Moreover, under the #NIS2 directive, institutions like TU Eindhoven may be considered “essential entities”, meaning they would have to meet stringent cybersecurity standards and report incidents within specific timelines.

4/🧵

As one of the Netherlands' top technical universities, TU Eindhoven handles critical research and knowledge is valuable and potentially attractive to various threat actors. From intellectual property theft to operational disruption or even state-sponsored #espionage, universities leading in innovation are increasingly vulnerable due to the significant value of the data they safeguard.

3/🧵

𝐖𝐡𝐚𝐭 𝐝𝐨 𝐰𝐞 𝐤𝐧𝐨𝐰 𝐬𝐨 𝐟𝐚𝐫?

It’s been over 72 hours since the attack, and publicly available information remains limited. TU Eindhoven has not reported any evidence of stolen data and has yet to confirm the nature of the attack. Could it be #ransomware, similar to the Maastricht University case in 2020? Or could it involve attempts to access sensitive research or disrupt operations?

2/🧵

𝐂𝐲𝐛𝐞𝐫𝐚𝐭𝐭𝐚𝐜𝐤 𝐚𝐭 𝐓𝐔 𝐄𝐢𝐧𝐝𝐡𝐨𝐯𝐞𝐧: 𝐖𝐡𝐚𝐭 𝐜𝐚𝐧 𝐰𝐞 𝐥𝐞𝐚𝐫𝐧?

This weekend, TU Eindhoven’s network was taken offline after detecting a #cyberattack. As a result various services been inaccessible since, and education has been put on hold until at least Tuesday. While the university investigates, it is unclear if they do this themselves, or with external help, it raises questions: what risks do institutions like TU Eindhoven face, and how can they prepare?

https://www.tue.nl/en/news-and-events/news-overview/13-01-2025-update-on-cyberattack-no-education-on-tuesday

1/🧵

Sector Threat Profile: #Energy

Discover the energy #threatlandscape, where innovation meets risk. As the sector transitions from fossil fuels to renewable energy, it has become a prime target for cyber threats. Learn about the key motivations driving these attacks, practical steps to protect your business, and insights into past incidents like SolarWinds

Access the full report through our Member's Portal: https://www.huntandhackett.com/members/register