IDLE

Capstone: APT ShadowFox

Name: Capstone: APT ShadowFox
Brand: Hacker Labs

INSTANCE: hl-attackaptshado · IP: 10.10.31.41 · eu-west-1

TIME04:00:00

Mixed

Lab not running

Click Launch above to provision a fresh Mixed VM. Takes ~30s.

Submit flag

0/5 objectives

Scenario

Live-fire APT ShadowFox capstone. Chain T1190 → T1059 → T1003 → T1021 → T1041 end-to-end.

Objectives — click to toggle

Step-by-step walkthrough

1
Kick-off
Read the threat intel pack on APT ShadowFox. Confirm the in-scope range.
2
Detect
Identify the initial Struts exploit (T1190) within the first 30 minutes.
3
Hunt
Pivot to lateral movement via SMB and WinRM (T1021.002 / T1021.006).
4
Investigate
Trace credential dumping (T1003) and pinpoint patient zero.
5
Respond
Contain affected hosts, rotate creds, kill persistence.
6
Report
Produce the full incident report + ATT&CK Navigator layer + risk score.

Submission requirements

Upload deliverables via the Files tab before claiming points.