Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX

VMware ESX systems are a recurring target in ransomware campaigns. Threat groups including SCATTERED SPIDER, BlackBasta, Royal (aka BlackSuit), Akira, and the ESX-focused ransomware as a service (RaaS) platform shinysp1d3r have demonstrated that once an adversary reaches the hypervisor layer, they can rapidly encrypt virtual machines, disable logging, and cripple an entire data center.

CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates

The CrowdStrike 2026 Threat Hunting Report illustrates the next evolution in trust abuse. Adversaries are targeting trusted users and tools across identity systems, cloud environments, SaaS applications, AI services, software supply chains, and developer workflows to blend into legitimate business activity and reach critical assets before defenders can detect them. Our frontline intelligence in this year’s report underscores this shift.

Unpacking the CrowdStrike 2026 Threat Hunting Report with CrowdStrike's Katie Blankenship

The CrowdStrike 2026 Threat Hunting Report is now live! The report sheds light on how our threat hunters and analysts hunt and defend against the world’s most sophisticated adversaries. It’s packed with stories from the front lines and trends that define the modern threat landscape.

When Claude Code Hunts Cobalt Strike: Agentic Security Operations in Action

Security teams enter an asymmetric battle when adversaries freely use AI to wage attacks. The aggressors are armed with top-tier capabilities. Defenders hesitate to adopt AI they can't see, trust, or control. SecOps teams are drowning in alerts and outpaced by adversaries who are unafraid to automate everything. The solution isn't another dashboard or another AI chatbot offering recommendations.

Why Threat Hunting Isn't Optional

27 seconds That is the fastest breakout time recorded last year. In less time than it takes to read this sentence, an adversary can gain access and begin moving through your network. Join us as we explore why proactive threat hunting is no longer optional in a world where 82% of attacks are malware-free. From AI-amplified reconnaissance to adversaries "living off the land" with your own IT tools, we break down how to stop intrusions before they become breaches.

What Are Insider Threats?

Cybersecurity isn’t only about defending against external attackers. Some of the most damaging risks come from within an organization. These are known as insider threats. An insider threat occurs when someone with authorized access—whether intentionally malicious or simply negligent—compromises systems, exposes data, or undermines security controls. This can result in data breaches, financial loss, regulatory issues, and long‑term reputational damage.

Manic Monday: A Day in the Life of Threat Hunting

John, a Cyber Threat Intelligence (CTI) analyst, turns to look at his CISO. He seems a bit rattled. John responds, “Yeah. Huge story.” “Massive. The board is worried and wants to know if this puts us at risk. We’re secure, right?” John hesitates.“Let me get back to you on that.” The CISO walks away. John races to his desk.

Threat hunting to detection engineering: Analyzing real malware with Claude Code, LimaCharlie, and Linux

Claude Code, originally just auto-complete on steroids for IDEs, shows a lot of promise for becoming a major tool in the DFIR/detection engineering/security analyst’s toolbox. Whether it’s Claude Code’s support of MCP, agent skills, or general ability to quickly figure out how to accomplish a given task, it is rapidly becoming more than a code generation tool. This is the first of a three-part series.