Hunt.io

is a service that provides threat intelligence data about observed network scanning and cyber attacks.

[Hunt.io @Huntio]

🚨 Brevo Supply-Chain Attack Affected Over 100,000 Websites

https://t.co/wZltKKQEgI

A Brevo supply-chain attack potentially affected more than 100,000 websites through infrastructure they already trusted.

Attackers used a compromised Cloudflare API key to deploy a malicious Worker that modified Brevo-hosted scripts at the edge.

Visitors saw fake "prove you’re human" ClickFix prompts, while logged-in WordPress admins could have a malicious plugin installed through their active session.

Brevo’s origin files stayed clean the whole time. The malicious changes happened at the CDN edge.

#ThreatIntel #Brevo #CloudFlare #CyberSecurity

[Hunt.io @Huntio]

🚩 Settra Ransomware Abuses MeshAgent and Windows Recovery Tools

https://t.co/ryigdGo3Z1

A newer Settra ransomware variant is showing a pretty consistent post-compromise playbook across retail and manufacturing attacks.

Threat actors deployed MeshAgent for persistent access, launched ransomware from local folders, cleared Windows Event Logs, disabled Windows Recovery Environment, removed recovery partitions, and used a cipher to make deleted data harder to recover.

Another attack also involved BYOVD to interfere with security tooling.

Encrypted files received the .locked extension, while ransomware binaries were named after the victim’s domain.

#ThreatIntel #ThreatHunting #Settra #Ransomware #CyberSecurity

[Hunt.io @Huntio]

🚨 Handala Deploys HEAVYGRAM Backdoor With Telegram C2

https://t.co/Pghn8BdlOm

Handala, an Iran-linked threat actor, has been tied to HEAVYGRAM, a Python-based Windows backdoor that uses Telegram for C2.

Delivered through scripts, HTA files, embedded archives, and fake apps, it can run commands, capture screenshots, steal saved passwords, collect local Telegram and WhatsApp data, upload or download files, activate the microphone, and deploy additional malware.

A related tool, CRUDEEXCLUDE, prepares the host by adding Microsoft Defender exclusions before later payloads are delivered.

#ThreatIntel #HEAVYGRAM #Telegram #Malware #CyberSecurity

[Hunt.io @Huntio]

3/

📡 The kit ships its own C2: c2_server plus c2_server.go, and two downloader scripts, drop.txt and https://t.co/KXkrBz6bwz, both pulling /elf.<arch> from 196.251.121.181:8081.

One C2 IP, one dropper source file, one wallet string that's enough to go from "random open directory" to a working IOC set before the operator even finishes staging it.

[Hunt.io @Huntio]

⚠️ Someone left their entire botnet build kit sitting in an open directory.

AttackCapture URL: https://t.co/wVK57CHvoR

17 architectures, XMRig welded onto a Mirai scanner, one C2, one wallet. We pulled the IOCs before they finished staging 🧵👇

[Hunt.io @Huntio]

2/

⚙️ Sitting next to it: https://t.co/0QZizc4r8L, a cross-compile script pulling https://t.co/i8d7aSPsFY toolchains to spit out static ELF bot binaries for 17 architectures: arc, arm v4 through v7, i486 to i686, m68k, mips, mipsel, powerpc, powerpc-440fp, sh4, sparc, x86_64. That spread is the same "hit every router and DVR on earth" fingerprint Mirai made standard.

[Hunt.io @Huntio]

🚩 #malicious #opendir hosted on on 129.159.135.190

AttackCapture URL: https://t.co/P4qv9aVy3m

Original find by @Yusufcancakiir https://t.co/uiAEQYiuaZ

Analysis from Hunt

- Not just Roblox: same kit ships bypass tools for Cloudflare, Minecraft anti-DDoS, OVH, and TCPShield

- 6 architectures compiled and ready to drop (x86_64, ARM, ARM5, ARM64, MIPS, MIPSEL), plus a built C2 binary alongside the source.

- 3 separate scripts resolve Roblox targets (Python, JS, and a standalone C tool hitting the public APIs directly).

- dstat logging built into to watch bandwidth/pps/player count live during runs

[Yusuf Can Çakır @Yusufcancakiir]

I came across an exposed server at 129.159.135[.]190 and initially thought it was just another directory full of DDoS tooling. After going through the files, it turned out to be a lot more complete than that.

The server exposes builds of the same Linux bot for x86_64, ARM, ARM64, MIPS and MIPSEL, along with the C2 source, update scripts, Cloudflare worker lists, SSH-related tooling, Roblox scripts, logs and a small DStat dashboard.

The bot and the C2 source line up pretty well. Bots register with the server and report things like architecture, sudo access, ISP, RAM and storage. The C2 can then push attacks, updates and other commands to connected nodes and track whether they acknowledge them.

The persistence side is also built directly into the bot. It copies itself to /usr/sbin/systemd-networkd-sync, makes the file immutable and then adds multiple ways to bring it back through systemd, cron, /etc/profile, .bashrc and .profile.

There is a separate L7 side too. The bot can pull proxy lists, retrieve Cloudflare worker endpoints from lol.eacn[.]fun and download an additional l7_degrade.py module from the same exposed server.

But the part that caught my attention was the amount of Roblox-specific code.

The bot contains handlers for RakNet and UDMUX-related methods, and one of the scratch scripts shows how targets are selected. It takes a Roblox username, resolves the user and their current game instance, uses a hardcoded session cookie to request the join data and extracts the UDMUX address, port and token.

That information is then handed off to the botnet backend.

So that part of the workflow looks roughly like:

username -> presence -> game instance -> UDMUX endpoint/token -> botnet

There is even a separate Flask-based DStat panel on the server that records bandwidth, PPS, packet count, player count, server FPS and memory. It looks like it was built to watch what was happening to a game server while the rest of the tooling was running.

One thing still doesn't line up perfectly. Some of the scratch Roblox code treats localhost:1337 as the backend and uses a different credential, while the exposed c2_vps.c defines 1337 as the bot listener and 5000 as the admin listener. There are also multiple C2 binaries sitting in the directory.

So I wouldn't assume every file belongs to exactly the same build. It looks more like an exposed development/operation directory with different revisions left behind.

Either way, this is clearly more than a random collection of flood scripts. The server gives a pretty good view of a multi-architecture Linux botnet being developed around generic L4/L7 capabilities, with a surprisingly large amount of custom Roblox/RakNet/UDMUX tooling layered on top of it.

IOC: 129.159.135[.]190

[Yusuf Can Çakır @Yusufcancakiir]

Found an interesting exposed server while hunting on @Huntio. It was hosting multiple Linux and Windows beacon payloads, along with deployment and lateral movement scripts.

The beacons turned out to be generated by CyberStrikeAI v1.7.18. The Linux and Windows samples were built from the same framework revision:

6edc70f3fc6ece3678009b58c1900de02832690d

The Linux samples contained separate cleartext HTTP C2 configurations pointing to:

180.178.60[.]13:38080
180.178.60[.]13:8443
Both use /check_in, /result and the X-Implant-Token header. Reverse also showed that these were separate listener configurations, with different 43-byte ImplantTokens and AES-256 keys embedded in each beacon.

The Windows sample was a bit more interesting. It was generated from the same CyberStrikeAI revision but communicated with:

http://52.128.241[.]98:8443

The same IP was also being used on port 9000 to serve payloads, so 52.128.241[.]98 appears to have been used for both payload staging and Windows C2.

The files around the beacons also included scripts for SSH key reuse against internal systems, MySQL FILE abuse to write a PHP loader, and Windows deployment through WMI with ATExec as a fallback.

One of the deployment chains pulled the Windows beacon from an internal staging host before execution.

So far the activity looks roughly like:

webshell / foothold
-> Linux CyberStrikeAI beacon
-> credential and SSH key discovery
-> internal pivoting
-> Windows deployment
-> Windows CyberStrikeAI beacon

Initial infrastructure discovery was through https://t.co/BWT7fdXtBj. The rest came from digging through the recovered files and reversing the beacons.

[Hunt.io @Huntio]

📌 Inside an AI-Orchestrated Intrusion Campaign

A couple of weeks ago, we published research into a Chinese-speaking operator using AI agents across real intrusion workflows.

SecFlow, an AI orchestration framework, coordinated workers using Claude, Qwen, and DeepSeek for recon, exploitation, collection, and reporting.

The campaign also relied on much more familiar tooling: webshells, public exploits, stolen credentials, proxies, and custom implants.

Check out the full article here 👉 https://t.co/sbhy84k99r

#ThreatHunting #ThreatIntel #CyberSecurity

[Pierluigi Paganini - Security Affairs @securityaffairs]

@Huntio #SilkParasite Infrastructure Links #SpiceRAT to Central Asian Targets
https://t.co/MqvRS04hJ9
#securityaffairs #hacking #malware

[Hunt.io @Huntio]

⚠️ FamousSparrow Targets Latin American Governments With SparroWocky

https://t.co/l5vF9h9IlN

FamousSparrow, a China-linked APT known for targeting governments and organizations worldwide, is now using a new C++ backdoor called SparroWocky across Latin America.

It’s deployed through DLL side-loading, with a loader decrypting an RC4-encoded .dat payload and mapping it directly into memory.

SparroWocky can execute commands and BOFs, proxy traffic, manage files, capture screenshots, and spawn processes in other user sessions.

For evasion, it spoofs call stacks, resolves APIs dynamically, hooks CreateThread with MinHook, and disguises malicious in-memory code as legitimate Windows components.

#ThreatIntel #FamousSparrow #SparroWocky #Malware #CyberSecurity

[Guy Y @Shto_ota]

Real pleasure working with https://t.co/XJnrs5L57c on SilkParasite!

My friends at Hunt chose a conservative approach on attribution :)
But guttribution-speaking, SilkParasite looks like the current reincarnation of IndigoZebra as several pivot points lead to ESET’s Speccom &gt;&gt;

[NetAskari @NetAskari]

Good find by @Huntio: Chinese issued TLS certs lead to a SpiceRAT cluster already flagged by Bitdefender in their report on 'SilkParasite'. The cluster hosted copies of official state energy companies from Central Asia. https://t.co/Cd3Anwi2oN 's research could reveal that SpiceRAT, NodeEdgeRAT and NomadRAT share the same infra. https://t.co/skLCYpX47F

[Hunt.io @Huntio]

🔍 Turning JA4X Fingerprints Into Threat Hunting Pivots

How far can one JA4X fingerprint take an investigation?

JA4+ gives you another way to connect infrastructure that may look unrelated at first glance.

In this case, we started with a JA4X certificate fingerprint, opened its recent sightings in Hunt, and followed the hosts sharing it.

One pivot led to 213.218.160[.]174, a host with active Sliver activity on port 31337.

That’s where JA4+ becomes useful: not just as a fingerprint, but as a path from a shared TLS pattern to infrastructure worth investigating.

See what a JA4+ fingerprint can uncover 👉 https://t.co/7yE3U9d4bD

#ThreatHunting #ThreatIntel #CyberSecurity

[Hunt.io @Huntio]

⚠️ New Research: Spicerat infrastructure tied to energy and government targets across Central Asi

With the help of Guy Yasur (@Shto_ota), we tracked a cluster of SpiceRAT C2 servers active from late 2025 through August 2026 and connected it to the #SilkParasite infrastructure Bitdefender reported last month.

What we found:

-> A cloned RTX Corporation homepage, reused as a decoy, that pulled 13 servers from a single page hash

-> A TLS certificate from TLC, a Chinese state-funded CA, impersonating Uzbekistan's state railway

-> That same certificate connecting SpiceRAT to NodeEdgeRAT and NomadRAT

-> Domains spoofing Türkmengaz, the Galkynysh gas field, Tojiktelecom, and Turkmenistan's Ministry of Foreign Affairs

-> Passive DNS placing the activity back to at least mid-2022, so four years and counting

Full writeup and indicators 👇 https://t.co/mQKJfRCGQ6

[Hunt.io @Huntio]

🚩 China-Aligned Actors Hide PeckBirdy C2 Behind Casino and Adult Websites

https://t.co/9gwb9BrYNI

China-aligned threat actors are hiding PeckBirdy C2 activity behind low-quality casino and adult websites.

The sites embed malicious JavaScript that can register service workers and establish WebSocket connections to related infrastructure.

PeckBirdy has been active since at least 2023, supports remote JavaScript execution and modular backdoor delivery, and has been associated with MKDOOR and HOLODONUT. Previous activity targeted government, private-sector, education, and gambling organizations across Asia.

#ThreatIntel #PeckBirdy #CyberSecurity

[Hunt.io @Huntio]

🕵️‍♂️ Using HuntSQL to Find Malware on Unusual Ports

Malware infrastructure does not always sit on the ports you expect.

With HuntSQL, you can filter active detections, exclude common ports like 80 and 443, and quickly surface hosts worth a closer look.

Here, we use Cobalt Strike as an example and find activity on ports like 9999, 8075, 5521, 43001, and more.

From there, each result becomes a pivot into the host, network, open services, and related infrastructure.

See what HuntSQL can uncover when you stop looking only at the obvious 👉 https://t.co/7yE3U9d4bD

#ThreatHunting #ThreatIntel #CyberSecurity

[Hunt.io @Huntio]

🚀 Turn Fresh C2 Data Into Investigation Context

Hunt’s OEM C2 feed brings recently observed C2 infrastructure straight into your security workflow, including servers that may never appear in public OSINT, with up to 10x more coverage.

It adds host details, malware and threat actor context, related domains, JA4 fingerprints, and findings across 150+ detection techniques.

We review our data daily to reduce noise and outdated entries.

Start a 14-day free trial and explore C2 activity identified over the latest seven days.

Apply here 👉 https://t.co/MevWob7ePV

#ThreatHunting #ThreatIntel

[Hunt.io @Huntio]

⚠️ AsyncRAT Uses AutoIt, PowerShell, and Trusted Windows Processes

https://t.co/7QCBqxPycu

A new AsyncRAT campaign is abusing AutoIt and trusted Windows processes to stay under the radar.

The chain starts with a fake invoice .bat, launches hidden PowerShell, drops an AutoIt loader, then injects AsyncRAT into charmap.exe, a legitimate Windows utility.

The malware runs in memory, adds Startup persistence, patches AMSI to bypass script scanning, and can capture the victim’s screen.

#ThreatIntel #AsyncRAT #Windows #Malware #CyberSecurity