The wait for another exciting chapter in the Hack The Box journey continues...
Hack The Box Season 12: Aero is bringing a fresh lineup of machines for cybersecurity enthusiasts, penetration testers, and aspiring ethical hackers to explore.
This isn't just another Hack The Box season. AERO takes cybersecurity challenges to an entirely new level by introducing a simulated airport infrastructure as the central environment for a Red Team engagement.
According to the official Hack The Box announcement, participants will take on the role of Red Team operators tasked with assessing the security of HTB International Airport.
Instead of approaching the season as a collection of unrelated machines, hackers will explore various assets distributed across an airport network, identifying weaknesses and testing their offensive security skills in a connected, aviation-inspired environment.
9 weeks. 9 machines. One leaderboard.
Starting September 26, 2026, participants will face weekly cybersecurity challenges, earn points, and compete for positions on the seasonal leaderboard.
The initial seven machines announced are Layover, Touch, Stream, Autopilot, DutyBound, Takeoff, and Unclaimed, with two additional machines completing the nine-machine season.
What makes AERO especially exciting is its emphasis on a realistic Red Team scenario. The airport setting introduces a broader operational context, encouraging participants to think beyond individual machines and consider how security weaknesses might affect an interconnected environment.
For cybersecurity enthusiasts, penetration testers, and aspiring Red Team operators, AERO presents an opportunity to practice offensive security techniques within a simulated critical-infrastructure setting.
The mission is clear: Explore HTB International Airport, uncover vulnerabilities, and demonstrate your Red Team skills.
Every new Hack The Box season presents an opportunity to sharpen existing skills, discover unfamiliar attack surfaces, and approach cybersecurity challenges from different perspectives. Whether you enjoy Linux enumeration, Windows privilege escalation, network exploration, or tackling difficult machines that demand patience and persistence, Season 12: Aero has something to look forward to.
With a lineup ranging from Easy to Insane difficulty, Aero offers challenges for players with different experience levels while giving seasoned hackers another reason to test their abilities.
In this article, we’ll look at the Season 12 Aero machines announced so far, what their difficulty ratings suggest, and what players can expect as they begin their journey through the new season.
Hack The Box Season 12: Aero Machines
The Season 12: Aero lineup begins with seven machines spanning Linux and Windows environments. Here is a breakdown of the machines and their published difficulty ratings.
| Machine | Operating System | Difficulty |
|---|---|---|
| Layover | Linux | Medium |
| Touch | Windows | Easy |
| Stream | Linux | Medium |
| Autopilot | Windows | Insane |
| DutyBound | Linux | Medium |
| Takeoff | Linux | Medium |
| Unclaimed | Windows | Medium |
This initial lineup provides a mixture of operating systems and difficulty levels, giving players several ways to approach the season. Windows-focused players can start with Touch, while Linux enthusiasts have multiple Medium-rated machines to investigate.
Autopilot, rated Insane, stands out as a particularly demanding challenge for players who enjoy working through complex attack paths. However, its actual difficulty will become clearer as the community explores the machine and shares its findings.
Note: Machine names, operating systems, and difficulty ratings are presented according to the initial lineup listed above. Check the official Hack The Box platform for the latest information and any subsequent changes.
1. Layover - Medium Linux
Layover is one of the Linux machines opening the Aero season. With its Medium difficulty rating, it offers an opportunity for players to test their enumeration and exploitation methodology beyond the basics.
Medium-rated machines generally require more than identifying a straightforward vulnerability. Players may need to correlate information from multiple services, investigate unexpected behavior, identify weaknesses in exposed applications, and determine how individual findings could contribute to a broader attack path.
For players working through Layover, a structured methodology will be important. Careful enumeration, thorough documentation, and the ability to revisit earlier findings can make a significant difference when the initial approach does not produce results.
2. Touch - Easy Windows
Touch is the Easy-rated Windows machine in the initial Aero lineup, making it a natural starting point for players who want to warm up before moving on to more demanding challenges.
Easy machines can be particularly useful for newer penetration testers who are learning to build a repeatable workflow. They also give experienced players an opportunity to practice efficient enumeration and revisit fundamental Windows security concepts.
Players approaching Touch should focus on understanding the available attack surface rather than rushing through familiar techniques. Developing good habits on easier machines can help establish the foundation needed for the more challenging systems later in the season.
3. Stream - Medium Linux
Stream adds another Medium-rated Linux challenge to the Aero lineup. Its inclusion gives Linux-focused players another opportunity to develop their investigative skills and explore a different machine environment.
As with any Hack The Box machine, the first objective is to understand what is exposed and how the available services interact. Enumeration should guide the next steps rather than assumptions based on the machine's name or operating system.
The interesting part of a Medium challenge is often the process of connecting seemingly unrelated clues. Players who document their findings and systematically test their hypotheses will be better prepared to identify a viable path forward.
4. Autopilot - Insane Windows
Autopilot is the Insane-rated Windows machine in the initial Season 12 Aero lineup, and it is likely to attract attention from experienced players looking for a substantial challenge.
Insane-rated machines are intended for players who are comfortable with complex investigations and the possibility that progress may require several stages of analysis. They can demand persistence, a strong understanding of Windows internals, and the ability to investigate unfamiliar attack paths.
Rather than relying on a single technique, players tackling an especially difficult machine need to evaluate the relationships between services, permissions, configurations, and other potential weaknesses.
Autopilot is an opportunity for experienced hackers to test their methodology, refine their troubleshooting skills, and learn from a challenge that may not yield its answers immediately.
Its specific vulnerabilities and exploitation path should remain an open question until they are established through legitimate research.
5. DutyBound - Medium Linux
DutyBound continues the Linux portion of the Aero season with a Medium difficulty rating.
One of the most valuable aspects of Hack The Box is the opportunity to encounter environments that challenge players to think beyond a standard checklist. A machine may require a familiar technique applied in an unfamiliar context, or it may reward a closer examination of something initially overlooked.
DutyBound provides another opportunity to practice that investigative mindset. Players should approach it methodically, record their observations, and avoid discarding potentially useful evidence too early.
For those documenting their progress, keeping detailed notes throughout the process can also make it easier to explain the reasoning behind each discovery in a future walkthrough.
6. Takeoff - Medium Linux
Takeoff adds another Medium-rated Linux machine to the opening Aero lineup.
With several Linux challenges available, players can compare their approaches across different environments and identify areas where their methodology needs improvement. Repeated practice helps build familiarity with enumeration, service analysis, Linux permissions, and privilege escalation concepts.
However, a machine's Linux classification does not reveal its specific attack path. Players should treat Takeoff as an independent investigation and allow their findings to determine the direction of their testing.
For anyone working toward a more professional penetration-testing workflow, the ability to explain why a particular lead was pursued—and why another was rejected—is just as valuable as reaching the final objective.
7. Unclaimed - Medium Windows
Unclaimed completes the seven-machine opening lineup with another Medium-rated Windows challenge.
Windows environments can expose a broad range of areas to investigate, including authentication mechanisms, service configurations, access controls, application behavior, and user privileges. The relevant opportunities depend on the machine itself, so players should avoid assuming that any particular technique will be required.
For Unclaimed, the most productive approach will be to establish a clear picture of the environment before choosing a direction. Each discovery should be evaluated in context, with attention given to how it might connect to other findings.
The machine also provides another opportunity for Windows-focused players to strengthen their skills before tackling the more demanding challenges in the season.
What Has Changed in Hack The Box Season 12: Aero?
A new season naturally brings a new set of machines to explore, but the most interesting question is how the challenges will test the community.
Based on the initial Aero lineup, several characteristics stand out.
1. A mix of Linux and Windows environments
Aero begins with four Linux machines and three Windows machines. This gives players opportunities to work across both operating systems rather than concentrating exclusively on one environment.
For penetration testers, maintaining competence across Linux and Windows is essential. Different environments expose different technologies, configuration patterns, and administrative concepts, so switching between them can help develop a more flexible approach to security assessments.
2. Multiple Medium-rated challenges
Five of the seven machines listed in the opening lineup are rated Medium. This places a substantial part of the initial selection beyond the introductory Easy level.
For players, Medium challenges can be a useful opportunity to strengthen the transition from basic enumeration toward more involved investigations, multi-step exploitation, and privilege escalation.
The ratings alone do not establish which techniques the machines will require, but they do provide an initial indication of the expected difficulty.
3. An entry point for newer players
Touch, rated Easy, gives players an accessible starting point within the initial lineup.
Newcomers can use easier challenges to establish a consistent workflow before attempting the Medium machines. More experienced players can also use them to warm up, practise efficient enumeration, and maintain familiarity with the fundamentals.
4. A high-difficulty challenge for experienced hackers
Autopilot's Insane rating provides a clear high-difficulty target within the opening selection.
For players who enjoy complex investigations, this is an opportunity to test their patience, research skills, and ability to connect multiple findings into a coherent attack path.
The actual nature of the challenge remains to be discovered, which is part of what makes a new machine release exciting.
An important distinction: The machine lineup and difficulty distribution are known from the information presented here. Specific changes to the season format, scoring system, release schedule, or underlying machine design should not be assumed without confirmation from Hack The Box.
What Should Players Expect From Aero Season 12?
Although the exact vulnerabilities and attack paths of these machines should not be guessed in advance, players can prepare for the season by strengthening the skills that make Hack The Box challenges rewarding.
Consistent enumeration. Begin by understanding the available attack surface. Build a clear picture of the environment before committing to an exploitation strategy.
Stronger Linux and Windows fundamentals. Review the operating-system concepts relevant to your chosen machines, including permissions, services, authentication, and privilege management.
Persistence when a lead fails. Not every promising discovery will produce progress. Learn to test assumptions, revisit evidence, and change direction when the facts do not support your initial theory.
Better technical documentation. Record commands, outputs, observations, and the reasoning behind each step. Good notes help you learn from the process and make it easier to produce accurate technical write-ups later.
Responsible research and disclosure. Keep testing within the scope and rules of the Hack The Box platform. When sharing research, focus on your own methodology, analysis, and lessons learned, and respect any applicable content and disclosure requirements.
Why We Are Excited About Hack The Box Season 12
The excitement surrounding a new Hack The Box season is about more than adding machines to a list. It is about having new problems to solve, new concepts to investigate, and new opportunities to learn alongside the cybersecurity community.
Aero's opening lineup offers a mixture of Linux and Windows environments, several Medium-rated challenges, an accessible Easy machine, and an Insane-rated Windows target.
That combination gives players different ways to engage with the season. Beginners can work on their fundamentals, intermediate players can challenge themselves with more involved investigations, and experienced hackers can set their sights on Autopilot.
There is also the community aspect. New machine releases encourage technical discussions, comparisons of methodologies, and the development of research notes and walkthroughs that help others understand the reasoning behind a solution.
For ethical hackers, each machine is another opportunity to practise looking at systems from a security perspective, understand how weaknesses can combine, and improve the way vulnerabilities are identified and explained.
Final Thoughts
Hack The Box Season 12: Aero begins with seven machines: Layover, Touch, Stream, Autopilot, DutyBound, Takeoff, and Unclaimed.
With four Linux machines, three Windows machines, and difficulty ratings ranging from Easy to Insane, the initial lineup offers a variety of challenges for the community to explore.
The real excitement, however, lies in the discoveries that have yet to be made. The machines' actual attack paths, technical lessons, and most challenging moments will become clearer as players investigate them and share their findings.
As the Aero season progresses, we will continue exploring the machines, documenting our research, and sharing technical insights from the perspective of ethical hacking and practical cybersecurity.
Which Season 12: Aero machine are you most excited to tackle? Are you planning to start with Touch, explore the Medium-rated Linux machines, or take on the challenge of Autopilot?
Share your thoughts, prepare your tools, and get ready for another season of learning, enumeration, and ethical hacking.
Stay tuned for more Hack The Box machine walkthroughs and cybersecurity research.
Disclaimer: This article is an independent discussion of Hack The Box Season 12: Aero. Hack The Box and the machine names referenced are associated with their respective rights holders. This blog is not affiliated with or endorsed by Hack The Box.
Tags: Hack The Box, HTB Season 12, Aero, Airport Simulation, Airport Cybersecurity, Ethical Hacking, Penetration Testing, CTF, Linux, Windows, Hack The Box Machines
0 Comments