ClickRat simulates a real-world SOC investigation into an Active Directory workstation compromise orchestrated by an Initial Access Broker (IAB).

After being lured to a convincing but deceptive Web portal, an MIRAI HR staff member unknowingly sets off a silent compromise on their workstation. As the team responsible for safeguarding the organization, you must work together to uncover the hidden foothold the attacker has established, trace their quiet expansion of control, and prevent your environment from becoming a target for further exploitation.

This environment is composed of critical infrastructure components typically found in a corporate network and together with your team, you will collaborate to:

New exclusive content has been released on Dedicated Labs which feature an end-to-end compromise of a modern automation platform as well as observed activity by real ransomware groups in the wild.

This Sherlock is based on a real-life Ransomware and data exfiltration incident on a corporate network documented by the Triskele Lab DFIR Team, a Hack The Box partner. You will utilize several artifacts from two triage images and correlate the data to create a timeline and understanding of the whole incident.

A Very Easy Linux machine that demonstrates an exploit chain leading to unauthenticated RCE on a n8n workflow automation platform via two CVEs: CVE-2026-21858 (Ni8mare) and CVE-2025-68613.

Control, Push, Sidecar and Intercept are now available on HTB Labs!

and are small Active Directory scenarios that simulate configuration gaps in enterprise systems.

Skills you’ll build:

and are small Active Directory scenarios simulating real-world Windows environments (2 machines, 2 flags each).

Skills you’ll build:

We’ve added a new ICS challenge category which includes 11 hands-on challenges covering OT, ICS, and SCADA systems.

Designed for professionals of all experience levels, users will learn how to:

HTB Labs has moved to fully . That means no more shared Machines. Every session is yours from start to finish.

This upgrade applies to all , but you’ll need to take one quick step to keep playing.

:

This shift lets us deliver a faster, more reliable platform and produce more content for you on HTB Labs.

On December 29, 2025, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-14847 to its Known Exploited Vulnerabilities (KEV) catalog, and only a few days later, the MangoBleed Sherlock was released.

In HTB’s newest CVE Sherlock, you’ll be tasked with handling a high‑priority incident involving a suspected compromised server hosted on mongodbsync, a secondary MongoDB server.

After receiving root-level access to facilitate your investigation, you’ll perform a rapid triage analysis of the collected artifacts to determine whether the system has been compromised, identify any attacker activity (initial access, persistence, privilege escalation, lateral movement, or data access/exfiltration), and summarize your findings with an initial incident assessment and recommended next steps.

The “In Progress” tab in HTB Labs now gives users a more accurate view of what is actively being worked on by showing progress the moment a user starts engaging with content rather than only showing progress after milestones have been achieved.

New exclusive content has been released on Dedicated Labs which features a vulnerable web application as well as data and triage acquisition from Windows Endpoints.

This Sherlock provides players with an opportunity to use KAPE for Forensic Triage acquisition from Windows systems. Players also get to explore the structure of KAPE images, utilizing different types of targeted acquisition.

An Easy Linux machine featuring a web application vulnerable to an SQL injection flaw in the Django framework (CVE-2025-64459).

The module provides a deep technical analysis of WMI tradecraft from both attacker and defender perspectives. While completing the module, you will learn how WMI is abused for execution, lateral movement, persistence, and stealthy backdoor deployment, as well as how to detect, hunt, and investigate malicious WMI activity using logs, ETW, and low-level artifacts.

Key learning outcomes:

HTB Academy’s defensive portfolio just got deeper, sharper, and more job-aligned with the addition of nine LetsDefend courses.

These new modules strengthen critical defensive capabilities across the workflows defenders rely on every day, including PKI, malware analysis, threat frameworks, network traffic analysis, DFIR, and threat hunting across SIEM, DNS, and IPS/IDS environments.

Courses included in this release are: