C2 Hunters Research

We find exposed attacker infrastructure, read what they leave behind, and publish it as a case file.

[C2 Hunters Research @C2HuntersLabs]

Coruna iOS exploit kit, new IOCs:
- 88 lure hosts
- 37 compromised sites used as watering holes

New IOCs (1/3):
iphone[.]apiforx[.]work
trigger[.]translatevv[.]com
mobilecare[.]me
carolineschaay[.]nl

IOCs below. Full list + CSV: https://t.co/oaiktEq2uh

#Coruna #iossecurity

[C2IntelFeedsBot @drb_ra]

Added two new items to the feeds, courtesy of the item below and @C2HuntersLabs

- VShell C2
- DesRedTeam (a.k.a. DesShell)

items should be live soon.

[C2 Hunters Research @C2HuntersLabs]

218[.]1[.]219[.]233:51010 🇨🇳
218[.]1[.]219[.]233:51030 🇨🇳
218[.]1[.]219[.]233:51050 🇨🇳
45[.]113[.]200[.]6:8082 🇨🇳
111[.]229[.]112[.]115:8082 🇨🇳
132[.]232[.]203[.]63:8082 🇨🇳
101[.]37[.]80[.]76:8095 🇨🇳
36[.]138[.]100[.]216:45991 🇨🇳

Credit to @modat_magnify for the scan data.

[C2 Hunters Research @C2HuntersLabs]

Pivoted further using @modat_magnify and found 16 active VShell panels across 13 IPs. All serving the same Chinese-language login page.

IOC thread 🧵

#ThreatIntel #C2 #VShell

[C2 Hunters Research @C2HuntersLabs]

VShell C2 (v4.9.3) panel identified.

VShell is a cross-platform post-exploitation framework popular with Mandarin-speaking threat actors.

WebSocket connection found in the panel: wss://www.haiwoi[.]top/api/v2/sync

IOC: https://t.co/JPHLc6jaNN

#ThreatIntel #C2 #VShell

[C2 Hunters Research @C2HuntersLabs]

Active VShell panel IOCs:

23[.]238[.]80[.]171:8082 🇺🇸
143[.]92[.]51[.]145:8082 🇸🇬
8[.]138[.]112[.]168:23333 🇨🇳
38[.]60[.]227[.]210:81 🇭🇰
38[.]60[.]227[.]210:443 🇭🇰
23[.]226[.]132[.]147:8082 🇺🇸
119[.]28[.]13[.]158:80 🇭🇰
38[.]55[.]192[.]71:17777 🇺🇸

[C2 Hunters Research @C2HuntersLabs]

An interesting observation: much of the recorded activity originated from private or loopback IPs, with repeated landing-page tests.

This suggests possible operator-side testing, although external deployment cannot be ruled out.

#darksword #coruna #ios #exploitkit (4/4)

[C2 Hunters Research @C2HuntersLabs]

We identified an exposed server hosting infrastructure for a suspected #DarkSword iOS exploit operation.

The exposed files included a SQLite database (darksword.db), exploit delivery code, post-exploitation scripts and server logs.

Here's what we uncovered:
🧵(1/4)

[C2 Hunters Research @C2HuntersLabs]

We also recovered group.html and post_exploit.js.

The code contains a staged iOS exploit loader, sandbox-escape routines, device identification, command polling and data collection capabilities.

Server logs confirm repeated requests to the exploit delivery page. (3/4)

[C2 Hunters Research @C2HuntersLabs]

An interesting observation: much of the recorded activity originated from private or loopback IPs, with repeated landing-page tests.

This suggests possible operator-side testing, although external deployment cannot be ruled out.

#darksword #coruna #ios #exploitkit (4/4)

[C2 Hunters Research @C2HuntersLabs]

We also recovered group.html and post_exploit.js.

The code contains a staged iOS exploit loader, sandbox-escape routines, device identification, command polling and data collection capabilities.

Server logs confirm repeated requests to the exploit delivery page.

(3/4)

[C2 Hunters Research @C2HuntersLabs]

The recovered database contained:

• 18,054 HTTP activity logs
• 3,109 exploit telemetry records
• 5 landing-template records
• 8 configured command scripts
• 469 administrative audit events

The data provides a glimpse into the backend infrastructure.

#iOS (2/4)

[C2 Hunters Research @C2HuntersLabs]

CVE-2026-66373 (Redis 8.6.4) confirmed exploited in the wild.

Actor used a DEBUG-free, self-restoring RCE chain → dumped Redis cache creds → pivoted to DB → stole records → cleaned up their tracks.

Patch: Redis 8.6.5 / 8.8.0

#cve-2026-66373 #CTI #RCE #redis

[C2 Hunters Research @C2HuntersLabs]

VShell C2 (v4.9.3) panel identified.

VShell is a cross-platform post-exploitation framework popular with Mandarin-speaking threat actors.

WebSocket connection found in the panel: wss://www.haiwoi[.]top/api/v2/sync

IOC: https://t.co/JPHLc6jaNN

#ThreatIntel #C2 #VShell

[C2 Hunters Research @C2HuntersLabs]

IOCs (2/2)

23[.]148[.]228[.]177
43[.]165[.]4[.]16
154[.]94[.]233[.]234
176[.]122[.]134[.]61
177[.]4[.]41[.]61
64[.]90[.]20[.]4
134[.]122[.]140[.]213
dawnlily[.]win
clickpairs[.]shop
ssc.vever3eds[.]com
chitchathub[.]shop

#ios #coruna

[C2 Hunters Research @C2HuntersLabs]

Coruna iOS exploit kit — new IOCs, part 2.

Additional infra found via @modat_magnify

New IOCs (1/2):
https://fcsvip[.]icu
https://btvm888[.]xyz
18[.]141[.]188[.]98
203[.]189[.]235[.]62
186[.]244[.]241[.]222
205[.]234[.]170[.]172
177[.]5[.]75[.]142
154.219[.]112[.]16

#coruna

[C2 Hunters Research @C2HuntersLabs]

Coruna iOS exploit kit, new IOCs:
- 88 lure hosts
- 37 compromised sites used as watering holes

New IOCs (1/3):
iphone[.]apiforx[.]work
trigger[.]translatevv[.]com
mobilecare[.]me
carolineschaay[.]nl

IOCs below. Full list + CSV: https://t.co/oaiktEq2uh

#Coruna #iossecurity

[C2 Hunters Research @C2HuntersLabs]

@nZafri00 You can check the full attack sequence in this link: https://t.co/oaiktEq2uh

[C2 Hunters Research @C2HuntersLabs]

Coruna iOS exploit kit, new IOCs:
- 88 lure hosts
- 37 compromised sites used as watering holes

New IOCs (1/3):
iphone[.]apiforx[.]work
trigger[.]translatevv[.]com
mobilecare[.]me
carolineschaay[.]nl

IOCs below. Full list + CSV: https://t.co/oaiktEq2uh

#Coruna #iossecurity

[C2 Hunters Research @C2HuntersLabs]

@nZafri00 2 host types here:
1) Lure domains = attacker-made decoy pages w/ hidden iframe (VT misses it since the page content itself looks benign — no JS execution).
2) Waterholes = compromised legit sites, same injection. Both load same payload via a cloaked kit.

[C2 Hunters Research @C2HuntersLabs]

This is what a watering-hole injection for the Coruna iOS exploit kit looks like in a site's HTML: two hidden 1x1 iframes, identical on every compromised site we checked.

Hunt for both hostnames in your page source and proxy logs.

IOCs: https://t.co/oaiktEq2uh

#Coruna

[C2 Hunters Research @C2HuntersLabs]

@baeby_precious Yes, I've been following DarkSword infrastructure. Feel free to DM me.

[C2 Hunters Research @C2HuntersLabs]

New IOCs (3/3)

182[.]16[.]91[.]162 (video-streaming lure)
154[.]36[.]161[.]227 (video-streaming lure)
206[.]119[.]179[.]60 (video-streaming lure)
64[.]177[.]42[.]252 (CAPTCHA-style gate)
rohanbhagat[.]com
zwoschnack[.]de
captaintonys[.]com
tebexerol[.]vn

[C2 Hunters Research @C2HuntersLabs]

New IOCs (2/3)

bombardier-air[.]shop
lumix3t8[.]top
xtxt0[.]bar
www[.]usto2[.]icu
916k[.]com
trxenergy-receive[.]com
ph-phcku[.]com
fbabe9[.]shop
admin[.]88ym[.]site

#ios #malware