Hunt.io

is a service that provides threat intelligence data about observed network scanning and cyber attacks.

[Hunt.io @Huntio]

🕵️‍♂️ Exploring Real Attacker Files Hidden in Open Directories

Investigating suspicious infrastructure hosted by a particular provider?

Using Hunt's AttackCapture, we can filter by provider to narrow down malicious infrastructure and investigate what's hosted there.

In this example, we filter for OVH SAS, select a server with hundreds of files, and explore its contents.

We can review malware detections, preview scripts, inspect complete files, and download them for further analysis.

On this occasion, we quickly came across a shell script, dl_chunks.sh, which downloads a payload from 139.170.223[.]9:8081 in 65,536-byte chunks.

And that's just one file. From there, we can keep digging into other scripts, malware samples, and related infrastructure, all within the same investigation.

Start exploring exposed directories and attacker tooling 👉 https://t.co/7yE3U9d4bD

#ThreatHunting #ThreatIntel #CyberSecurity

[Hunt.io @Huntio]

🚩 China-Linked CopperDragon Targets Critical Infrastructure Across Three Continents

https://t.co/AjloRMkpLN

A malware framework called CopperDragon has been linked to several China-linked threat groups, including FamousSparrow, Earth Estries, and TropicTrooper.

Three campaigns, SilentDelivery, OceanGate, and DarkWire, targeted telecom providers, government agencies, and critical infrastructure across Europe, Asia, and Latin America.

The attacks involved watering-hole sites, phishing, Linux backdoors, credential theft, and lateral movement.

The findings suggest these groups may be sharing tools supplied by the same malware developer.

#ThreatIntel #ThreatHunting #FamousSparrow #CopperDragon #CyberSecurity

[Hunt.io @Huntio]

Thanks to @solostalking for the find:
https://t.co/Do6BUEZV9i

[Raaz @solostalking]

Opendir of operator hosting fake mParivahan app/ website

169.58.23.32:8085
https://t.co/o0QIBIBqDp

[Hunt.io @Huntio]

One Contabo server in France. Six ports. An Indian financial fraud operation running in the open.

Port 9090 serves “ASTIK MODULE,” an SMS gateway panel with a cast injection UI listing sender IDs: PAYTM, HDFCBK, SBIINB, ICICIB. Port 3000 hosts a fake “Account Verification / Ministry of Road Transport” page that collects name and mobile number, then asks for a ₹1 “registration fee.” There’s also a mParivahan clone on :8090 and :3005.

The :3000 phishing page passes an API parameter pointing to 13.140.57[.]112 in the URL. That same IP appears in the AttackCapture report as the configured panel endpoint for BlackieDev, the Android root module found on :8085. That’s not a coincidence. The phishing frontend and the device-control backend share infrastructure.

[Hunt.io @Huntio]

Host: 169.58.23[.]32 (AS51167, Contabo GmbH, FR)
PTR: vmi3442832.contaboserver(.)net
Ports observed:
:80/:8085 open directory
:1234 file upload
:3000 fake Ministry of Transport
:3005/:8090 mParivahan clone
:9090 ASTIK MODULE SMS gateway
:9091 Astic Exec Bridge

Full AttackCapture report: https://t.co/hrM6v1dsPy

Create a free account to access the report and file analysis at https://t.co/E6aUhCqvsz

[Hunt.io @Huntio]

🚀 There's More to C2 Infrastructure Than Just IPs

Finding a C2 IP is a good starting point, but the real value comes from understanding the infrastructure behind it.

Our C2 feeds provide host-level context, linking infrastructure to malware families, threat actors, domains, JA4 fingerprints, and related systems.

Instead of spending time manually enriching individual IOCs, analysts can use these connections to explore related infrastructure and find new leads.

We also use over 150 detection techniques to identify malicious activity across the infrastructure we monitor.

Want to see what our C2 feeds can uncover? Try the latest 7 days of data with our two-week free trial.

Apply here 👉 https://t.co/MevWob7ePV

#ThreatIntel #ThreatHunting #CyberSecurity

[NetAskari @NetAskari]

During our investigation we followed one possible trail to a Chinese IP that is associated to KeyPlug ( and maybe APT41 ), using @Huntio . But many questions are still unresolved. Some red-flags and some genuine observations await. 2/3

[Hunt.io @Huntio]

⚠️ APT Turla Uses Microsoft Exchange Servers to Spy on Governments

https://t.co/6Xs8ceQ175

The Russia-linked group Turla has been using a malware toolkit called Cereal to spy on government organizations in Kazakhstan and Romania.

The malware turns compromised Microsoft Exchange servers into backdoors, allowing attackers to execute commands, extract credentials, and steal selected emails and attachments.

In Romania, the attackers specifically targeted communications involving NATO and EU addresses.

No external C2 infrastructure was observed. Instead, the compromised Exchange servers themselves were used to receive commands.

#ThreatIntel #MicrosoftExchange #Turla #CyberSecurity

[Clandestine @akaclandestine]

🚨 CTI ALERT | Exposed phishing + carding + C2 infrastructure
Open directory active at 124.198.131.63 (AS210558 – 1337 Services GmbH / https://t.co/CpTMEyyErG).
Full toolkit of a Brazilian actor targeting @prefcaruaru, Cifal Distribuidora, FullCRM and “Valores a Receber” campaigns.
TLP:AMBER+
Full analysis below 🧵
2/14
Hosting
IP: 124.198.131.63
Prefix: 124.198.131.0/24
ASN: AS210558 (1337 Services GmbH – Germany)
Type: Datacenter / RDP
History: high abuse density (phishing, malware, C2, brute-force)
Open directory listing on the web root.
3/14
Main campaign – “Valores a Receber”
Scripts: stage50_send50.py + https://t.co/mQgjIQZfOW
Subject: “Você tem valores a receber - Aviso oficial”
Link: https://t.co/GABE911O0u
List: ~50k records in email;name;cpf format (real Brazilian data).
4/14
SMTP accounts used (hardcoded)
• [email protected] : Pmc@123456
(https://t.co/zedgjbpodw) – @prefcaruaru
• [email protected] : 1wTE[369
(Hostinger)
• [email protected] : uvdnwrzfueecmdxc
(impersonation of Clube do Servidor)
5/14
Staging
PHP scripts (stage50_stage50.php / stage2.php) copy the files from a path under /selecoes-caruaru/ to /crechefacil/ and launch the sender via nohup python3.
The phishing landing page returned 404/“Teste” at the time of analysis.
6/14
Deep compromise – Cifal Distribuidora
Real Brazilian tobacco distributor (CIFAL COMERCIAL DE TABACOS LTDA – Bebedouro/SP, ~35k clients).
File n8n_creds.txt exposes:
• Google OAuth (Drive/Sheets/Calendar) with valid tokens
• IMAP [email protected] : T!@Cif@|525_525
• Postgres, FTP, pfSense, Metabase, Grafana, OpenAI keys, Notion, etc.
7/14
Additional scripts targeting Cifal:
• https://t.co/RpTpp3w6Lu / https://t.co/B5M8L2xXAB – IMAP scanning for credentials and API keys
• https://t.co/SOYpv1QD7y – PFX/P12 cracking (Cifal-related certificates)
• https://t.co/wUTJ3w19Xt – SSH brute-force against 31.97.23.110 with passwords linked to Cifal / Modavest / G4Pay
8/14
Carding
• parse_cards.py – parser for SQL dump (cards.sql.gz) with Luhn validation
• Generates cards_full.tsv (PAN, EXP, CVV, name, document)
• Boleto/PDV-related files (ServidorPDV.exe/.rar, boleto.rar)
9/14
Custom C2 (c2/c2_server.py)
Ports: 443 (C2), 8080 (panel), 1080 (SOCKS)
Panel: operador / Byt3c2!2026Rk
Salt: BYT3S1ST_C2_2026_x7Kq9
Capabilities: file ops, screenshot, sysinfo, clipboard, elevate, proxy, etc.
agents.json was empty at collection time.
10/14
Other targets
• FullCRM: phishing campaign for “mandatory update v2026.10”
SMTP [email protected] : Alex1200
Link pointing to the same IP (port 8090)
Recon shows .c2agent.php and .goagent on their server
• AWS S3 enumeration with Access Key AKIAQI5LREYDWWTP2OAE
Buckets: modavest, group-rhcolaborador-bucket, etc.
11/14
Additional toolkit
• Donut (shellcode generator)
• Obfuscated loaders (sys_agent.py)
• .pfx certificates (Cifal, GO, SP)
• Portscan, IMAP, elevation and staging tools
• Directories: c2/, rce/, live/, launcher/, svc/
12/14
Main IoCs
IP: 124.198.131.63
ASN: AS210558
SMTPs: [email protected], [email protected], [email protected]
Email: [email protected]
C2 Panel: operador:Byt3c2!2026Rk
AWS: AKIAQI5LREYDWWTP2OAE
Paths: /crechefacil/ + /8aeeb9f76efc/
13/14
Assessment
Actor with real operational capability:
• Large-scale phishing using legitimate accounts
• Deep access to a mid/large Brazilian company (Cifal)
• Custom C2
• Carding pipeline
Major OPSEC failure (open directory) allowed full mapping of the operation.
14/14
Recommendations:
• Block 124.198.131.0/24 and AS210558
• Rotate all exposed credentials
• Report to @prefcaruaru, Cifal Distribuidora, PaySaude and @certbr
Open directory was still accessible at the time of analysis (07/11/2026).
Purely defensive CTI analysis.
#CTI #ThreatIntel #Phishing #Brazil #Caruaru

[Hunt.io @Huntio]

🚩 Anubis Ransomware Deploys New Lindnor Backdoor and 13 Security-Killing Tools

https://t.co/9Km47oDGKG

In an October 2026 attack, Anubis ransomware operators deployed a new custom backdoor called Lindnor alongside multiple tools designed to disable security software.

Lindnor runs as a Windows service, collects system information, and communicates with C2 servers over port 443.

The attackers also deployed 13 security-killing tools, including several using vulnerable signed drivers (BYOVD) to gain kernel-level access.

They also installed AnyDesk for remote access.

#ThreatIntel #ThreatHunting #Ransomware #CyberSecurity

[Shanholo @ShanHolo]

A few more WHisKEY #C2 panels… starting to look less like threat hunting and more like a pub crawl. 🥃😂

@Huntio 👇
html.head.title:"WHisKEY - Remote Device Management"

hxxp://tarboun65nnect.store/
tarbounconnect66[.]shop
hxxps://ta8bounconnectfhn.ink/
blackfalconcorex.]com

[Yusuf Can Çakır @Yusufcancakiir]

During infrastructure hunting with @Huntio, I identified an exposed HTTP directory containing 1,785 files across 21 subdirectories (~780 MB in the captured snapshot).

The directory contained more than staged payloads.

I found PowerShell TCP beacons configured to connect on port 8443, paired with a Python listener. The beacon sends a BEACON|hostname|username|cwd banner, executes received commands using Invoke-Expression, and returns output between BEGIN and END markers.
Additional payload variants used Base64-encoded PowerShell and XOR-obfuscated content. One loader also attempted AMSI tampering through .NET reflection.
The Metabase scripts submitted native PostgreSQL queries through /api/dataset, attempting OS command execution via COPY ... FROM PROGRAM. Other scripts attempted payload deployment and trigger-based persistence.
The exposed workspace also contained Masscan results covering 40,922 open-port records across 21,745 unique IPs, along with Redis, Elasticsearch, MongoDB, MySQL, and SMTP enumeration tools.

SMTP credentials were stored in plaintext, alongside scripts attempting to transmit them to an external mailbox.

Most concerning were the NAS collection scripts and logs: 109 client directories were enumerated, with 16 archive operations reporting approximately 6.6 GB of collected data.

These findings document the tooling and recorded activity, not confirmed success across every stage. Live C2 sessions, successful Metabase exploitation, and the contents of the reported NAS archives remain unverified.

Sensitive credentials and potential victim data have been excluded from the screenshots.

[Pierluigi Paganini - Security Affairs @securityaffairs]

@Huntio Inside #ARTEX: AI Hacking Tools, Exposed Servers and South Korean Bank Breaches
https://t.co/54bnA4Dehk
#securityaffairs #hacking #artificialintelligence

[Justin Elze @HackingLZ]

Spent a couple more hours looking at open directories on @Huntio for people using LLMs pentest frameworks.

All I have learned is this

[Hunt.io @Huntio]

🚨 Russian APT29 Targets iOS and Android Users Through Watering Hole Attacks

https://t.co/uAr0mCjPl8

The Russia-linked group APT29 (aka Cozy Bear) has been tied to a watering hole campaign targeting mobile users through compromised websites, fake domains, and a hijacked Ukrainian analytics service.

The attackers injected malicious JavaScript to collect information about visitors' devices and deliver exploit chains targeting vulnerable iOS and Android versions.

The campaign used DarkSword against iOS and AndroSnitch against Android, stealing browser cookies, credentials, messages, and other sensitive data.

All exploits targeted previously patched vulnerabilities, with no zero-days involved.

#ThreatIntel #APT29 #Android #iOS #CyberSecurity

[Hunt.io @Huntio]

🚩 China-Aligned SlippyNunchucks Uses DNS Hijacking to Deliver Malware

https://t.co/gcaA0SssGm

The China-aligned group SlippyNunchucks abused Sogou Input Method, a popular Chinese keyboard app, to distribute DarkVigil, a modular .NET malware toolkit with over 20 plugins.

The attack used DNS hijacking to redirect unencrypted HTTP requests to attacker-controlled servers, which delivered malicious configurations that made Sogou download and execute the malware.

Victims were identified across six countries, including Japan, Thailand, and Vietnam.

Sogou 16.10 addressed the issue by switching to HTTPS and adding certificate pinning. The exact source of the DNS hijacking remains unknown.

#ThreatIntel #DarkVigil #Malware #CyberSecurity

[Hunt.io @Huntio]

Thanks to @JustWantToQ1 for the find:
https://t.co/Phb6CXefhE

[Voidwalker @JustWantToQ1]

am too lazy to even submit it, it's there if you want it

[Hunt.io @Huntio]

Three open directories on the same host, captured over five weeks. All of them pointing at one target: Tamkang University in Taiwan 🇹🇼

The operator built a custom blind SQLi framework against the university’s IP registration system at 163.13.240[.]200. Boolean oracle over SOCKS5, TRUE/FALSE detection via Chinese error strings.

The companion script enumerates information_schema, samples rows from 10 tables. The output file confirms it worked: 212 IP ranges, 170 support tickets going back to 2005, full network inventory with usernames, department codes, room numbers, phone extensions, equipment, OS types.

On a different port, the same server holds SEP14E64A.exe, a Windows RAT named to look like a Symantec installer. WSS C2 via SChannel, systeminfo beacon, file transfer with chunking and resume, process/registry/service enumeration, browser detection. Config is encoded behind a CFG! marker, not plaintext. Next to it: wisp_agent_linux, a Go binary with shell + SOCKS components supporting five transport modes including DNS.

Then the http.log on :8899. A TANet IP (163.13.121[.]218, MoE Computer Center TW) listed the directory and pulled bdgrab.exe with a 200 on Oct 11.

The server also stages credential stuffing scripts, SSH pivots via sshpass and Paramiko, MS17-010/EternalBlue targeting five Tamkang hosts, CVE-2023-46604 ActiveMQ payload builders, and FortiSIEM CVE-2025-25256 + CVE-2025-64155 PoCs.

No actor attributed.

[Hunt.io @Huntio]

Host: 193.36.119[.]24 (AS206804, EstNOC-Global, HK) Target: Tamkang University, Taiwan (TANet 163.13.x) Three AttackCapture reports covering ports 80, 8080, and 8899:
https://t.co/yZGRFfxtoC

Create a free account to access the full reports and file analysis on https://t.co/aojFWxKETZ.