AkatsukiLegion

🏴‍☠️ Akatsuki Research
🎯Threat Hunters | 🦠Malware Researchers |🔍 Intelligence Analysts |

[AkatsukiLegion @_AkatsukiLegion]

The Flask app uses sandboxed Jinja2. The operator intentionally leaked JWT_SECRET through template rendering but blocked direct #RCE methods, protecting their own infrastructure from other attackers while still exposing sensitive config values.

[AkatsukiLegion @_AkatsukiLegion]

An open directory on 124.223.221[.]83:9999 (Tencent Cloud, Shanghai) exposes a full #offensive toolkit. #CobaltStrike 4.7, Chrome XXE #exploit, internal network scan results, a web shell, and a custom #C2. Let's break it down. 🧵👇

Found via @Huntio

[AkatsukiLegion @_AkatsukiLegion]

#PowerShell web shell on port 8899. Base64 commands in the URL, executed through cmd.exe, output returned in the HTTP response

[Itachi 🥷👨‍💻💾 @TIE__SUN]

PHISHING INFRASTRUCTURE ALIVE 🚨
A # leads to multiple nodes hosting the same site
IOCS:
fbi-investingationunit[.]com
digitalassetsreclaim[.]com
www.fbi-sec.globalfundrecoveryunit[.]com
auracyber-investigation[.]com
198.251.84[.]200
172.67.162[.]245
66.85.46[.]67
51.195.95[.]80

[AkatsukiLegion @_AkatsukiLegion]

wiki.txt is the full documentation for #Ladon 9.1.7.
160 usage examples covering #MS17010 scanning, #SMBGhost detection, password spraying, privilege escalation, credential dumping, and lateral movement. The operator left their entire post-exploitation playbook on the server.

[AkatsukiLegion @_AkatsukiLegion]

A #CobaltStrike teamserver operation is exposed on 101.42.136[.]73 (Tencent Cloud, Beijing). The #opendirectory contains #beacon keys, #teamserver config, subdomain wordlists, and post-exploitation tooling.

Credits @Huntio

[AkatsukiLegion @_AkatsukiLegion]

SubDomain.dic is a #wordlist for subdomain #bruteforcing. Entries target common subdomains like www, blog, admin, portal, mail, vpn, secure, dashboard, api, cdn, and more.

Broad target discovery across internet-facing infrastructure.

[Itachi 🥷👨‍💻💾 @TIE__SUN]

Multiple MFA-themed phishing infrastructures are currently active.🚨

Themes:
mfa-option
mfa-register
mfa-setup
mfa-auth
mfa-enroll

Root domain: mfa-options[.]com first reported by : @SansLimit3 🤝
#threathunting #UNC6671

[Draco @curious_drac0]

GOVT #PK PHISHING KIT

#SideWinder targets Pak's KPT, NRTC, and POF via phishing domains dropping malicious .doc files with VBA macro downloaders for C&C and RAT deployment

IOCs:
*mail-kpt-gov-pk.shazad-gids.workers[.]dev
*email-nrtc-com-pk-auth.shazad-gids.workers[.]dev

(1/n)

[Draco @curious_drac0]

Day 1/30 of posting #CTI findings every day.

kjjt.pages[.]dev is distributing a #trojanized executable disguised as a screenshot uploader tool. The site hosts a functional landing page with a Windows download option

[AkatsukiLegion @_AkatsukiLegion]

@Huntio This infrastructure is currently active. Organizations should block 159.223.5[.]148. The login page is live and accessible. The panel is operational.

[AkatsukiLegion @_AkatsukiLegion]

A live #Quasar #C2 panel is exposed on 159.223.5[.]148 (DigitalOcean, Amsterdam). The #opendirectory contains the #admin login, #database credentials, #encryption keys, and full bot management interface.

Credits @Huntio

[AkatsukiLegion @_AkatsukiLegion]

@Huntio The #C2 #encryption relies on a default placeholder key and a static zero IV. Here is the encryption function from config.php: