https://polymathmonkey.github.io/weblog/tags/osint/index.htmlHugoen-usFri, 26 Jun 2026 09:31:55 +0200https://polymathmonkey.github.io/weblog/writeups/htb-sherlock-winnti/index.htmlTue, 23 Jun 2026 00:00:00 +0200https://polymathmonkey.github.io/weblog/writeups/htb-sherlock-winnti/index.htmlOverview Attribute Value Challenge Type Sherlock (Investigation) Difficulty Medium Focus Threat Intelligence & OSINT Key Techniques Vendor Attribution, Malware Analysis, Cluster Correlation Status COMPLETED The investigation starts with a cold lead (“Winnti behind this”) and requires classic OSINT: vendor reports, GitHub source analysis, conference presentations, and leaked data correlation. Scenario & Investigation Approach You’re a Threat Intelligence Analyst with a new assignment: all you know is that Winnti is behind this mess. Your organization has detected suspicious activity targeting manufacturing and energy companies, and the SOC needs answers fast.