COMING SOONBeginner
Fighting Ursa: Car-for-Sale Lure to HeadLace
A diplomatic attache clicked a link offering a discounted vehicle for sale, and a trusted Windows program started behaving like malware. Follow the chain from a spearphishing link through an abused web-service redirector and a staged archive to a side-loaded HeadLace loader running under a legitimate signed binary.
30m
6 tasks
25 points
FreeLaunches today
Jul 3, 2026
Create your free accountFriday, July 3, 2026 at 9:00 AM
Be ready the moment it drops — free forever.
Training Tools
XDREmailSIEM
What you'll investigate
6 objectives unlock when this operation goes live.
1Read the case file
2Find the way in
3Recover the payload archive
4Spot the trusted decoy
5Unmask the loader
6Confirm the technique
Be first when it launches
Create your free account now. The moment this operation goes live on Jul 3, 2026, you can jump straight in — and you'll have the rest of the catalog to train on meanwhile.
Get Started FreeNo credit card required — free forever