Greg Hoglund

Background

Greg Hoglund, born Michael Gregory Hoglund, is an American security researcher, author, and serial entrepreneur in the cybersecurity industry. He built an early reputation in the software security field through work on network vulnerability scanning, buffer overflow exploitation, and Windows-kernel-level rootkit techniques, areas that were still poorly understood by mainstream IT security practitioners in the late 1990s and early 2000s.

Rootkit Research and Rootkit.com

Hoglund is credited with developing one of the first publicly documented Windows NT-based rootkits and, in doing so, founded the website rootkit.com as a hub for rootkit research and discussion. The site grew into a large community resource for offensive and defensive research on kernel-level subversion techniques before it was compromised in 2011. In 2005 he co-authored, with Jamie Butler, "Rootkits: Subverting the Windows Kernel" (Addison-Wesley), widely regarded as one of the first comprehensive technical treatments of rootkit design, detection, and the underlying Windows kernel internals that rootkits exploit. Hoglund and Butler also taught a long-running Black Hat training course on rootkit development and reverse engineering.

Exploiting Software and Broader Security Writing

Beyond rootkits, Hoglund co-authored "Exploiting Software: How to Break Code" (2004) with Gary McGraw, a widely cited text on software vulnerability discovery and exploitation methodology. He later wrote "Exploiting Online Games: Cheating Massively Distributed Systems" (2007) with Gary McGraw, examining security and cheating issues specific to online multiplayer game architectures, an area he had also explored commercially.

HBGary and Entrepreneurship

Hoglund founded or co-founded several security companies over his career, including Cenzic (originally ClickToSecure), a web application security firm, and Bugscan, which was acquired by LogicLibrary in 2004. His best-known venture was HBGary, Inc., a company specializing in malware analysis, digital forensics, and reverse engineering tools, where he served as CEO. HBGary was acquired by ManTech International in 2012. Hoglund later founded Outlier Security, a cloud-based endpoint detection company that was acquired by Symantec in 2017.

The 2011 Anonymous Hack

In February 2011, a related but separate company, HBGary Federal, became the target of a widely publicized breach by members of the hacktivist collective Anonymous. HBGary Federal's CEO, Aaron Barr, had claimed to have identified individuals behind Anonymous and planned to reveal this information. In response, Anonymous compromised HBGary's servers and rootkit.com, a site owned and operated by Hoglund, exfiltrating and publishing tens of thousands of internal emails, defacing websites, and remotely wiping data. The leaked emails revealed discussions of a proposed disinformation and pressure campaign targeting WikiLeaks supporters and journalists, along with details about the Aurora attacks against Morgan Stanley, generating substantial media coverage and public scrutiny of the private security industry's practices. Aaron Barr resigned from HBGary Federal shortly after the incident.

Legacy

Hoglund's early technical work on Windows rootkits and software exploitation is frequently cited as foundational reading in malware analysis and offensive security circles, and his books remain referenced in security training curricula years after publication. The 2011 HBGary breach, though centered on a subsidiary rather than Hoglund personally, remains one of the most cited case studies of hacktivist operations against a security contractor and is frequently discussed in analyses of Anonymous-era hacktivism and the cybersecurity industry's relationship with intelligence and government contracting work.

Timeline

• 2004Co-authored Exploiting Software: How to Break Code with Gary McGraw, published by Addison-Wesley.
• 2004Bugscan, Inc., a company Hoglund founded, was acquired by LogicLibrary.
• 2005Co-authored Rootkits: Subverting the Windows Kernel with Jamie Butler, published by Addison-Wesley.
• 2007Co-authored Exploiting Online Games: Cheating Massively Distributed Systems with Gary McGraw.
• 2011-02HBGary Federal and rootkit.com, the latter owned by Hoglund, were breached by Anonymous following CEO Aaron Barr's claims of having unmasked Anonymous members; internal emails were leaked publicly.
• 2011-03HBGary Federal CEO Aaron Barr resigned in the aftermath of the Anonymous breach.
• 2012HBGary, Inc. was acquired by ManTech International.
• 2017Outlier Security, a company founded by Hoglund, was acquired by Symantec.