Huntress CTF 2025 Retrospective Highlights Malware Analysis and Forensics Challenges
Summary
Huntress recaps its month-long 2025 CTF, featuring challenges in malware analysis, forensics, and threat hunting. The event drew 11,898 registered users; organizers also describe an early platform outage and antivirus alerts when some players analyzed malware outside V
Key points
- The month-long October CTF had 11,898 registered users and 6,892 teams.
- The Sandy challenge involved decompiling an AutoIT executable, decoding Base64 data, and finding a cryptocurrency stealer targeting browser wallet extensions.
- Other challenges covered supply-chain malware, an infostealer, a Linux kernel rootkit, phishing in Entra ID environments, and digital forensics.
- Organizers said heavy early traffic overloaded the platform database, causing 404 errors and increased backend log streams; restarting the database resolved the issue.
- Some participants analyzed malware without isolated virtual machines, prompting Microsoft Defender Antivirus alerts on affected hosts.
- Challenge writeups and a video walkthrough are linked at github[.]com, mresecurity[.]com, and youtube[.]com.
Article Details
- Topic
- Huntress CTF 2025 retrospective and its cybersecurity challenges
People
Adam RiceCreator of the “Lizard” challenge.Ben FollandCreator of the “NetSupport, Webshellz” challenges.Brady HeilmanCreator of the “Follow the Money” challenge.Chris MyersFounder at CourseStack, featured in a discussion about the CTF event.John HammondHuntress principal security researcher, CTF host, and creator of the “My Hawaii Vacation” challenge.Lindsey O'Donnell-WelchNamed as an author of the article.Matt KielyCreator of the “Root Canal” challenge; also identified as HuskyHacks.NordgarenCreator of the “Rust Tickler” challenge.Tim SwordCreator of the “Angler” challenge.
Products
AutoItImagine this: you’re a hacker, and you’re working through an executable file made up of a compiled AutoIT script.CourseStackIn 2025, we also switched our CTF platform to CourseStack as our number of registered users continued to ramp up above 10,000.Microsoft Defender AntivirusIn a few cases, this even led to our Security Operations Center (SOC) analysts noticing Microsoft Defender Antivirus (MAV) alerts on impacted hosts, which pointed to files that were part of the CTF (such as Sandy.exe,