Out of the Woods: The Threat Hunting Podcast

Hosted by Out of the Woods: The Threat Hunting Podcast

Technology BusinessInterviews guests

Website RSS feed

Episodes

169

Latest episode

Oct 2026

Language

About the show

Intel 471's podcast with a twist! Join us for the first fully interactive threat hunting podcast where you can hang out with threat hunters from all over the world! Join a rag-tag bunch of threat hunters as they come out of the woods to explore some of the most burning issues related to cyber security. The Out of the Woods podcast is a casual talk covering the topics of threat hunting, security research, and threat intelligence, and some ranting and raving along the way, all over a cocktail or two! The Out of the Woods cyber security podcast is filmed in front of a live studio audience, and by that we mean YOU! We're inviting folks to join us once a month for a LIVE evening of great technical discussions, where you can ask questions and give your opinion in real time on a variety of discussions about threat hunting, security research, blue teaming, and wherever else the evening takes us!

Listen to episodes

60 recent

October 22, 2026Episode 1335 min

S4 Ep13: You Had Me at npm install

Having the telemetry is one thing. Knowing what to do with it is another. This episode starts with Tortoiseshell's use of reverse SSH tunneling, masquerading, and familiar infrastructure tricks to maintain access, then turns to a broader problem facing defenders: organizations are logging more attacker activity than ever while still struggling to turn that visibility into meaningful alerts. We break down the gap between collection and detection, why familiar techniques can still slip through mature security stacks, and why threat hunting remains critical after an attacker gets past the front door. ---------- Stay in Touch! Twitter: https://twitter.com/Intel471Inc LinkedIn: https://www.linkedin.com/company/intel-471/ YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg Discord: https://discord.gg/DR4mcW4zBr Facebook: https://www.facebook.com/Intel471Inc/

October 15, 2026Episode 121 hr 1 min

S4 Ep12: Dude, Where's My Alert?

A fake recruiter, a coding challenge, and a Node.js payload walk into a development environment. This week, we break down Mirage Kitten's NodeRabbit and PoleCat malware families, including Trojanized coding challenges, cross-platform persistence, proxy-aware command and control, malicious VS Code extensions, Git hooks, WSL abuse, and JavaScript execution. We also look at the return of exploit-kit style activity and why familiar technologies such as Node.js, JavaScript, curl, scheduled tasks, and legitimate developer tooling continue to give threat actors plenty of room to operate. ---------- Stay in Touch! Twitter: https://twitter.com/Intel471Inc LinkedIn: https://www.linkedin.com/company/intel-471/ YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg Discord: https://discord.gg/DR4mcW4zBr Facebook: https://www.facebook.com/Intel471Inc/

October 8, 2026Episode 1149 min

S4 Ep11: Of Mice and RATs

This week, we dig into a packed threat landscape starting with Silk Parasite and its sprawling ecosystem of modular RATs, DLL sideloading, Google Drive C2, and techniques designed to make familiar attacker behaviors harder to spot. We also explore how AI recommendation poisoning can quietly influence model memory and decision-making, before looking at a Rust supply-chain compromise where simply building a poisoned dependency could be enough to trigger execution. From modular malware to AI trust and developer ecosystems, the common thread is attackers finding new ways to hide inside tools and workflows we already trust. ---------- Stay in Touch! Twitter: https://twitter.com/Intel471Inc LinkedIn: https://www.linkedin.com/company/intel-471/ YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg Discord: https://discord.gg/DR4mcW4zBr Facebook: https://www.facebook.com/Intel471Inc/

July 30, 2026Episode 101 hr 30 min

S4 Ep10: [LIVE] Know Thy Environment: Putting Your Data to Work

Most threat hunters have more data than they know what to do with. The problem isn't access. It's understanding: what your fields actually mean, what normal really looks like, and where your visibility quietly runs out before a hunt even gets started. This session picks up from our last conversation on environmental context and gets into the work that makes data usable. You don't need to have caught the first episode to follow along. What we'll cover: Building data dictionaries that preserve knowledge and help hunters move faster Mapping telemetry fields to the entities and behaviors that matter during a hunt Baselining normal behavior without creating blind spots Working through noisy data, inconsistent logging, and visibility gaps Communicating coverage and gaps in a way that resonates with leadership Join the Conversation on Discord: https://discord.gg/DR4mcW4zBr Watch the episode here: https://youtu.be/usn3Qt435fg

July 22, 2026Episode 940 min

S4 Ep9: Cloudy With a Chance of Malware

Top Headlines: Group-IB | HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels: https://www.group-ib.com/blog/hollowgraph-microsoft-365/ The Hacker News | New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit: https://thehackernews.com/2026/07/new-bit2watt-attack-could-let-cloud.html Elastic | New North Korean campaign uses fake coding interviews to steal developer credentials: https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography Island.io | AgentBaiting: How Fake AI Skills Deliver Malware at Scale: https://www.island.io/blog/agentbaiting-how-800-fake-ai-skills-and-mcp-servers-delivered-malware ---------- Stay in Touch! Twitter: https://twitter.com/Intel471Inc LinkedIn: https://www.linkedin.com/company/intel-471/ YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg Discord: https://discord.gg/DR4mcW4zBr Facebook: https://www.facebook.com/Intel471Inc/

July 17, 2026Episode 842 min

S4 Ep8: We’re Going Threat Hunting Through the Quad Into the Gymnasium

Top Headlines: JFrog | Miasma Worm Returns to npm: https://research.jfrog.com/post/miasma-worm-returns-to-npm/ Mind Gard | Cursor 0day: When Full Disclosure Becomes the Only Protection Left: https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left Level Blue | QuimaRAT: A Java RAT with burning ambitions: https://www.levelblue.com/hubfs/Web/Library/Documents_pdf/Threat_Spotlight_An_In_Depth_Analysis_of_QuimaRAT.pdf Blackpoint Cyber | LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA Software: https://blackpointcyber.com/blog/labubarat-a-rust-based-remote-access-tool-masquerading-as-nvidia-software/ ---------- Stay in Touch! Twitter: https://twitter.com/Intel471Inc LinkedIn: https://www.linkedin.com/company/intel-471/ YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg Discord: https://discord.gg/DR4mcW4zBr Facebook: https://www.facebook.com/Intel471Inc/

July 9, 2026Episode 739 min

S4 Ep7: Threat Report - Q2 2026

In this episode of Out of the Woods, Scott Poley and Tom Kostura review key findings from the Q2 2026 Threat Hunt Report and discuss what stood out across the quarter. They cover supply chain compromises , growing abuse of Node.js and Bun runtimes , a surge in credential harvesting following the Florida Bleed campaign, and a shrinking window between vulnerability disclosure and exploitation tied to the MS Nightmare vulnerabilities. The episode also touches on recent threat profiles, including the Iranian-linked actor Cavern Manticore and a fast-moving intrusion that went from an SEO-poisoned download to full ransomware encryption in under 48 hours, with a focus on what these patterns mean for threat hunters and defenders. Download the full Q2 2026 Threat Hunt Report: https://www.intel471.com/resources/whitepapers/threat-hunt-report-q2-2026 ---------- Stay in Touch! Twitter: https://twitter.com/Intel471Inc LinkedIn: https://www.linkedin.com/company/intel-471/ YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg Discord: https://discord.gg/DR4mcW4zBr Facebook: https://www.facebook.com/Intel471Inc/

July 1, 2026Episode 647 min

S4 Ep6: Built to Blend In

Top Headlines: welivesecurity | Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances: https://www.welivesecurity.com/en/eset-research/gamaredon-2025-leveraging-tunnels-workers-dead-drops-new-alliances/ Adversa AI | AI coding agents vulnerability: GuardFall shell injeciton: https://adversa.ai/blog/opensource-ai-coding-agents-shell-injection-vulnerability/ JFrog Security Research | Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer: https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/ Blackpoint Cyber | A Djinn in the Machine: TaskWeaver’s Node.js Intrusion Chain: https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/ ---------- Stay in Touch! Twitter: https://twitter.com/Intel471Inc LinkedIn: https://www.linkedin.com/company/intel-471/ YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg Discord: https://discord.gg/DR4mcW4zBr Facebook: https://www.facebook.com/Intel471Inc/

June 25, 2026Episode 552 min

S4 Ep5: Forti Shades of Breach

Top Headlines: JFrog | From PostCSS Masquerading to Windows RAT: https://research.jfrog.com/post/from-postcss-typosquat-to-windows-rat/ Elastic | Lost in relocation: analysis of a new loader distributing CASTLESTEALER: https://www.elastic.co/security-labs/oxloader-malware-loader-infostealer SOCRadar | Dismantling-FortiBleed: https://socradar.io/wp-content/uploads/2026/06/Dismantling-FortiBleed.pdf SANS | Own AI Securely: The SANS Secure AI Blueprint: https://www.sans.org/white-papers/own-ai-securely-sans-secure-ai-blueprint ---------- Stay in Touch! Twitter: https://twitter.com/Intel471Inc LinkedIn: https://www.linkedin.com/company/intel-471/ YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg Discord: https://discord.gg/DR4mcW4zBr Facebook: https://www.facebook.com/Intel471Inc/

June 16, 2026Episode 445 min

S4 Ep4: Old Flaws, New Attacks

Top Headlines: Trend Micro | Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open: https://www.trendmicro.com/en_us/research/26/f/old-winrar-flaw-fuels-attacks-on-ukraine.html The Hacker News | Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models: https://thehackernews.com/2026/06/researchers-build-self-replicating-ai.html Huntress | Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix | Huntress: https://www.huntress.com/blog/unpatched-ntlm-leak-windows-search-uri-handler aikido.dev | Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm: https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm?_gl=1*8wn4a9*_up*MQ..*_gs*MQ..&gclid=Cj0KCQjw_vnQBhCxARIsADcZyxL-SVitznmoZxhQ5DpjJdXLfpMZyybysJ0YaiJmipzBYpqtqpTk2GUaAtsMEALw_wcB&gbraid=0AAAAApQ3BFhNDUDPZ7DnB3pGVCSCcmPoZ ---------- Stay in Touch! Twitter: https://twitter.com/Intel471Inc LinkedIn: https://www.linkedin.com/company/intel-471/ YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg Discord: https://discord.gg/DR4mcW4zBr Facebook: https://www.facebook.com/Intel471Inc/

Is this your show?

Claim this listing to keep it up to date, reach guests who want to pitch you, and manage bookings with Guestify.

Claim this listing

More Technology podcasts

This Week in Privacy

Privacy Guides

Technology

The Bottom Line

Alexander Spencer

BusinessInterviews guests