Sign up to save your podcasts
Or
Share Out of the Woods: The Threat Hunting Podcast
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Out of the Woods: The Threat Hunting Podcast
Out of the Woods: The Threat Hunting Podcast episodes
- S3 Ep55: Threat Hunting Year in Review: 2025 Trends and What’s Next
*Threat Hunting Workshop: Hunting for Privilege Escalation - Level 2
February 11, 2026 | 12:00 - 1:00 PM ET
Sign Up: https://www.intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-privilege-escalation-level-2----------
Out of the Woods: The Threat Hunting Podcast returned with a live episode focused on the trends threat hunters saw repeatedly throughout 2025 and what those patterns point to next.
This episode serves as a threat hunter’s year in review. The discussion walks through the actors, malware, behaviors, tactics, and techniques that consistently surfaced over the year, ties those findings back to MITRE ATT&CK, and connects themes across recent episodes. The focus is on what stayed consistent, what mattered most during hunts, and what those signals reveal about where attention should remain.
The conversation also looks ahead. Based on what emerged in 2025 and how hunts played out across environments, the panel shares perspectives on what is likely to continue, where focus is expected to remain in 2026, and what threat hunters should keep in mind going forward.
Topics covered include:
- Threat actors, malware, and behaviors that appeared most often in 2025
- Tactics and techniques that consistently surfaced across hunts, mapped to MITRE ATT&CK
- Common hunt themes observed across environments throughout the year
- What 2025 trends suggest about threat hunting focus in 2026
- Behaviors and techniques likely to remain relevant moving forward
Watch the episode here: https://youtu.be/GyYTTMNyjCE?si=WynwmHS1psGN9KqO
----------
Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/1 hr 31 min - S3 Ep54: Stop, Collaborate and Secure
*[LIVE] Out of the Woods: The Threat Hunting Podcast – Threat Hunting Year in Review: 2025 Trends and What’s Next
January 29, 2026 | 12:00 - 1:30 PM ET
Sign Up: https://www.intel471.com/resources/podcasts/threat-hunting-year-in-review-2025-trends-and-whats-next*Threat Hunting Workshop: Hunting for Privilege Escalation - Level 2
February 11, 2026 | 12:00 - 1:00 PM ET
Sign Up: https://www.intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-privilege-escalation-level-2Top Headlines:
Google Cloud Blog | Releasing Rainbow Tables to Accelerate Protocol Deprecation: https://cloud.google.com/blog/topics/threat-intelligence/net-ntlmv1-deprecation-rainbow-tablesBleepingComputer | Hackers exploit security testing apps to breach Fortune 500 firms: https://www.bleepingcomputer.com/news/security/hackers-exploit-security-testing-apps-to-breach-fortune-500-firms/?&web_view=trueCyberArk | UNO reverse card: stealing cookies from cookie stealers: https://www.cyberark.com/resources/all-blog-posts/uno-reverse-card-stealing-cookies-from-cookie-stealersMalwarebytes | Can you use too many LOLBins to drop some RATs?: https://www.malwarebytes.com/blog/news/2026/01/can-you-use-too-many-lolbins-to-drop-some-rats?web_view=true----------
Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/53 min - S3 Ep53: New Year, Old Tricks
*[LIVE] Out of the Woods: The Threat Hunting Podcast – Threat Hunting Year in Review: 2025 Trends and What’s Next
January 29, 2026 | 12:00 - 1:30 PM ET
Sign Up: https://www.intel471.com/resources/podcasts/threat-hunting-year-in-review-2025-trends-and-whats-nextTop Headlines:
- Securonix | Analyzing PHALT#BLYX: How Fake BSODs and Trusted Build Tools Are Used to Construct a Malware Infection: https://www.securonix.com/blog/analyzing-phaltblyx-how-fake-bsods-and-trusted-build-tools-are-used-to-construct-a-malware-infection/
- https://mp.weixin.qq.com/mp/wappoc_appmsgcaptcha?poc_token=HM4cYGmjT2nsqEAFwWn2Sj9R90gqZmI2tEvjWdak&target_url=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzUyMjk4NzExMA%3D%3D%26mid%3D2247507757%26idx%3D1%26sn%3Dcf6b118e88395af45a000aae80811264
- CYFIRMA | APT36 : Multi-Stage LNK Malware Campaign Targeting Indian Government Entities: https://www.cyfirma.com/research/apt36-multi-stage-lnk-malware-campaign-targeting-indian-government-entities/
- BleepingComputer | VSCode IDE forks expose users to "recommended extension" attacks: https://www.bleepingcomputer.com/news/security/vscode-ide-forks-expose-users-to-recommended-extension-attacks/?&web_view=true
----------
Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/42 min - S3 Ep52: The Threat Hunting SoapboxTop Headlines:welivesecurity.com | LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan: https://www.welivesecurity.com/en/eset-research/longnosedgoblin-tries-sniff-out-governmental-affairs-southeast-asia-japan/Resecurity | DIG AI: Uncensored Darknet AI Assistant at the Service of Criminals and Terrorists: https://www.resecurity.com/blog/article/dig-ai-uncensored-darknet-ai-assistant-at-the-service-of-criminals-and-terrorists?&web_view=truekoi.ai | NPM Package With 56K Downloads Caught Stealing WhatsApp Messages: https://www.koi.ai/blog/npm-package-with-56k-downloads-malware-stealing-whatsapp-messageszscaler.com | Zscaler Threat Hunting Catches Evasive SideWinder APT Campaign: https://www.zscaler.com/blogs/security-research/zscaler-threat-hunting-catches-evasive-sidewinder-apt-campaign?&web_view=true----------
Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/50 min - S3 Ep51: Same Break-In, New Front DoorTop Headlines:Unit 42 | Exploitation of Critical Vulnerability in React Server Components (Updated December 12): https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/hackread.com | New PyStoreRAT Malware Targets OSINT Researchers Through GitHub: https://hackread.com/pystorerat-rat-malware-github-osint-researchers/?web_view=trueCheck Point Research | Ink Dragon's Relay Network and Stealthy Offensive Operation: https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/KOI.ai | Inside GhostPoster: How a PNG Icon Infected 50,000 Firefox Users: https://www.koi.ai/blog/inside-ghostposter-how-a-png-icon-infected-50-000-firefox-browser-users----------
Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/53 min - S3 Ep50: Game of Nodes: Persistence Is ComingTop Headlines:securelist.com | The Tsundere botnet uses the Ethereum blockchain to infect its targets: https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/Group-IB | Bloody Wolf: A Blunt Crowbar Threat To Justice: https://www.group-ib.com/blog/bloody-wolf/welivesecurity.com | MuddyWater: Snakes by the riverbank: https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/Fortinet Blog | ShadowV2 Casts a Shadow Over IoT Devices: https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices?&web_view=truedarktrace.com | ShadowV2: An emerging DDoS for hire botnet: https://www.darktrace.com/blog/shadowv2-an-emerging-ddos-for-hire-botnet
----------
Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/43 min - S3 Ep49: Guess Who: The Adversary Edition - 2Can You Identify the Nation-State Actor?
Out of the Woods: The Threat Hunting Podcast returns for another special edition episode that challenges how you think about adversary behavior. This live, interactive session will focus on a nation-state actor, revealing one phase of their campaign at a time as our hosts provide tradecraft clues and analysis. Participants will examine how observed techniques align to MITRE ATT&CK, how vertical-specific targeting shapes operational decisions, and how behavioral patterns emerge across campaigns. Before the final reveal, attendees will have the chance to submit their best guess on which nation-state threat actor is behind the activity.
What You’ll Learn: - Real adversary behavior – A phase-by-phase look at a real nation-state campaign
- MITRE ATT&CK in context – How techniques appear in real incidents
- Recognizing tradecraft patterns – What links behaviors across operations
- Sector-specific targeting – How industries influence attacker decisions
- Interactive analysis – Submit your guess before the reveal
Watch the episode here: https://youtu.be/GyYTTMNyjCE?si=WynwmHS1psGN9KqO1 hr 33 min - S3 Ep48: Familiar Moves, Novel Grooves*[LIVE] Out of the Woods: The Threat Hunting Podcast – Guess Who Edition
November 19, 2025 | 12:00 - 1:30 PM ET
Sign Up: https://www.intel471.com/resources/podcasts/guess-who-the-adversary-edition-2
----------
Top Headlines:Secure Annex | SleepyDuck malware invades Cursor through Open VSX: https://secureannex.com/blog/sleepyduck-malware/Arctic Wolf | UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities: https://arcticwolf.com/resources/blog/unc6384-weaponizes-zdi-can-25373-vulnerability-to-deploy-plugx/Unit 42 | Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild: https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/Unit 42 | Suspected Nation-State Threat Actor Uses New Airstalk Malware in a Supply Chain Attack: https://unit42.paloaltonetworks.com/new-windows-based-malware-family-airstalk/
----------
Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/42 min - S3 Ep47: Common, but Deadly*Threat Hunting Management Workshop: The Business Value of Threat Hunting
October 29, 2025 | 12:00 - 12:30 PM ET
Sign Up: https://www.intel471.com/resources/webinars/threat-hunting-management-workshop-the-business-value-of-threat-hunting
*[LIVE] Out of the Woods: The Threat Hunting Podcast – Guess Who Edition
November 19, 2025 | 12:00 - 1:30 PM ET
Sign Up: https://www.intel471.com/resources/podcasts/guess-who-the-adversary-edition-2
----------
Top Headlines:Koi | GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace: https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplaceCisco Talos Blog | BeaverTail and OtterCookie Evolve with a New Javascript Module: https://blog.talosintelligence.com/beavertail-and-ottercookie/Synacktiv | LinkPro: eBPF Rootkit Analysis: https://www.synacktiv.com/en/publications/linkpro-ebpf-rootkit-analysisBleepingComputer | American Airlines Subsidiary Envoy Confirms Oracle Data Theft Attack: https://www.bleepingcomputer.com/news/security/american-airlines-subsidiary-envoy-confirms-oracle-data-theft-attack/?&web_view=true
----------
Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/1 hr 2 min - S3 Ep46: Here We Go Again...*Threat Hunting Management Workshop: The Business Value of Threat Hunting
October 29, 2025 | 12:00 - 12:30 PM ET
Sign Up: https://www.intel471.com/resources/webinars/threat-hunting-management-workshop-the-business-value-of-threat-hunting
----------
Top Headlines:Cisco Talos | Velociraptor Leveraged in Ransomware Attacks: https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/GBHackers Security | Hackers Use Court-Themed Phishing to Deliver Info-Stealer Malware: https://gbhackers.com/info-stealer-malware/?web_view=trueFortiGuard Labs | New Stealit Campaign Abuses Node.js Single Executable Application: https://www.fortinet.com/blog/threat-research/stealit-campaign-abuses-nodejs-single-executable-applicationeSecurity Planet | AI Chatbots Used as Backdoors in New Cyberattacks: https://www.esecurityplanet.com/news/ai-exploited-prompt-injection/?&web_view=true
----------
Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/42 min
About Out of the Woods: The Threat Hunting Podcast
From the publisher's feed
Intel 471's podcast with a twist! Join us for the first fully interactive threat hunting podcast where you can hang out with threat hunters from all over the world!
Join a rag-tag bunch of threat hunters as they come out of the woods to explore some of the most burning issues related to cyber security. The Out of the Woods podcast is a casual talk covering the topics of threat hunting, security research, and threat intelligence, and some ranting and raving along the way, all over a cocktail or two!
The Out of the Woods cyber security podcast is filmed in front of a live studio audience, and by that we mean YOU! We're inviting folks to join us once a month for a LIVE evening of great technical discussions, where you can ask questions and give your opinion in real time on a variety of discussions about threat hunting, security research, blue teaming, and wherever else the evening takes us!
More shows like Out of the Woods: The Threat Hunting Podcast
Hacked
188 Listeners
Security Now (Audio)
2,011 Listeners
Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec
372 Listeners
Risky Business
375 Listeners
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
648 Listeners
CyberWire Daily
1,024 Listeners
Smashing Security
318 Listeners
Click Here
415 Listeners
Darknet Diaries
8,058 Listeners
Cybersecurity Today
177 Listeners
CISO Series Podcast
193 Listeners
Cybersecurity Headlines
138 Listeners
Risky Bulletin
46 Listeners
Microsoft Threat Intelligence Podcast
23 Listeners