Will

Senior Threat Intel Advisor @TeamCymru
Co-founder @CuratedIntel
Co-author @SANSForensics FOR589
Co-founder @BSidesBournemth
#126: REvil @darknetdiaries

[Will @BushidoToken]

📝 Looking to get into infrastructure analysis for CTI? I recommend studying the following aspects/topics in-depth:

PDNS
WHOIS Records
BGP Peers
HTTP Titles, Response Headers & ETags
X509 Cert Issuers & Subjects & JA4X
JARM
SSH Host Keys & HASSH
Favicon Hashes
OpenDirs

[Will @BushidoToken]

Check out these Infra Trends below 👇

[Team Cymru Research @teamcymru_S2]

INTEL DROP

Top 20 tools in Total Insights detection pipeline, ranked by the number of distinct IPs observed today per family.

C2 by IP count:
1,200+ CyberStrikeAI
500+ VShell
400+ PureRAT
300+ Cobalt Strike
300+ Sliver
200+ AdaptixC2
200+ XWorm
200+ Metasploit
200+ DarkSword
200+ OverlordRAT
200+ Hak5 Cloud C2
200+ Mirai
200+ RemcosRAT
100+ Mythic
90+ QuasarRAT
70+ PlugX
70+ Stealc
60+ Havoc
50+ SuperShell
50+ AsyncRAT

Offensive-security tools by IP count:
2,000+ Nessus
1,400+ ARL
1,400+ GoPhish
1,200+ ARTEX
1,200+ Interactsh
1,200+ Acunetix
600+ Burp Collaborator
400+ PentAGI
200+ Kali Linux
200+ Scope Sentry
200+ Java-Chains
80+ DeepAudit
60+ Hashtopolis
60+ reNgine
50+ Ligolo-ng
50+ Evilginx
40+ Xingrin
20+ Modlishka
10+ HTTP-revshell
10+ JspSpy

**This is not meant to convey a detection priorities ranking and is purely statistical observation (with unknowns). All organizations detection priorities are unique.

#TotalInsights #ThreatIntel #ThreatHunting #C2

https://t.co/nDqrsELahM

[Will @BushidoToken]

New Blog! 🇬🇧 UK Cybercrime Journal: Teenage Online Extremism Cases in 2026

- Scattered Spider Sentenced for TfL Hack
- TheCom Sextortionist Sentenced
- Teen Convicted of Cybersecurity Provisioning for Al-Qaeda
- Man Caught Sharing Islamist Terror Videos

https://t.co/lOYiwSJbYF

[Will @BushidoToken]

@craiu Incredible, Andy Burnham could learn something

[Will @BushidoToken]

We’ve curated an incredible line up of talks for @BSidesBournemth this year, with a focus on the realities, history, and psychology of ransomware 🔒☣️

You wont want to miss these sessions:
https://t.co/XbB9I6K5f4

[Will @BushidoToken]

Didn’t realise the GRU were Halo fans 🎮

[Nextron Research ⚡️ @nextronresearch]

#APT28 is using weaponized Office documents to deliver the Covenant Grunt backdoor.

We detected a cluster of seven malicious .docm and .xls files between July 8 and July 14, with some having AV detection ratios as low as 5/62 at the time of first submission. Our THOR APT Scanner's YARA rules caught what traditional engines missed.

The documents use obfuscated VBA macros that assemble strings at runtime to evade static analysis, perform XOR-encoded host reconnaissance, and drop a 64-bit Covenant Grunt loader DLL disguised as a log file. The campaign uses Russian-language lures like "Прайс.xls" (Price List) and business-themed filenames like "accounts.xls", consistent with APT28 targeting patterns. Network analysis shows Dropbox being used as C2 infrastructure.

This activity aligns with Zscaler's reporting on Operation NeuSploit (CVE-2026-21509).

Analysis & IOCs: https://t.co/ALVVYK2ZZb

[Will @BushidoToken]

This further justifies why ASM tools need to incorporate a way for users to run their own cryptographic bill of materials (CBOM) and why orgs need to start planning to migrate 👇
https://t.co/vPRsqCFP8f

[Will @BushidoToken]

Me to Scammer: 🫵😂

[Chainalysis @chainalysis]

One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.

In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told to add their own money in order to get paid.

On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.

[Will @BushidoToken]

@uwu_underground Based on the use of Gh0st RAT and the contacted Aliyuncs URLs in VT (https://t.co/zM8ebRFIxv), it looks a lot like this campaign Check Point wrote about in Feb 2025 (https://t.co/3rY92pnBGV)

[Will @BushidoToken]

@CroodSolutions Yep, best to not own any crypto tbh

[Will @BushidoToken]

New Blog! 🇬🇧 UK Cybercrime Journal: Police Crypto Crime Operations in 2026

- Cryptocurrency Theft via Physical Violence
- Gang Arrested for Seed Phrase Vishing
- Gang Jailed Over £4 Million Police Impersonation Fraud
- FCA Crackdown on Illegal P2P Crypto

https://t.co/lzKlQJsMen

[Will @BushidoToken]

@uwu_underground Interesting find. PDNS on 18.158.31[.]107 shows it paired w/ 3.77.8[.]153 hosting ~120 genuine Thyssenkrupp domains incl. the thyssenkrupp[.]com apex. It looks like their real web frontend to me, not C2.

Could you share any timestamps, hostnames/URIs or hashes? Happy to dig in.

[Will @BushidoToken]

So funny this @DarknetDiaries episode is sponsored by two other ransomware gangs, DoppelPaymer and Maze 😂

1. https://t.co/L2IqKegKAk
2. https://t.co/LHwE5zlERM

[Will @BushidoToken]

@BSidesBournemth The GOAT 🐐 of Ransomware Tracking

[Will @BushidoToken]

This could be your chance to work for Team Cymru! 🏴󠁧󠁢󠁷󠁬󠁳󠁿

[Team Cymru Research @teamcymru_S2]

Want to be a part of Team Cymru's Detection Team which creates the network tracking, signatures, and data enrichment behind many of our posts?
We are looking for a US-based teammate (remote) that is obsessed with infrastructure hunting and is excellent at building things. Create hard times for bad people in order to save and improve lives. 😃
Apply below 👇
https://t.co/3slmnyc8NR

[Will @BushidoToken]

@NetAskari Indeed, I was the first to notice it being used in the wild back in Jan :)

[Will @BushidoToken]

The CyberStrikeAI and ARTEX combination by Chinese-speaking offensive actors is an interesting trend we’re following closely 👇

[Team Cymru Research @teamcymru_S2]

INTEL DROP

AI-native offensive tooling is stacking on single hosts. Total Insights Feed detection pipeline currently sees 1,989 IPs running an AI pentest framework, and 48 of them run two or more. Many share IPs with classic C2, stolen AI API relays, and exposed gen-AI apps. A sample of 8, in the US, China, Hong Kong, Singapore, and Iran:

192.236.166.73 cyberstrikeai + artex + mythic + scopesentry + ai-relay:grok2api
192.253.229.113 cyberstrikeai + artex + pentagi + xingrin
149.104.24.91 cyberstrikeai + artex + arl + ai-relay:sub2api
151.243.126.22 cyberstrikeai + sliver + gen-ai:n8n + gen-ai:openclaw + ai-relay:new-api
103.101.176.236 cyberstrikeai + pentagi + malware-hosting + open-dir
64.20.61.134 pentagi + ai-relay:sub2api + ai-relay:grok2api + open-dir
1.14.104.208 pentagi + adaptixc2 + cobaltstrike
119.45.122.90 deepaudit + gen-ai:ollama + gen-ai:open-webui + gen-ai:openclaw + scanner

Several also expose a Known-Exploited-Vulnerability service (kev-vulnerable) on the same host that runs the attack tooling.

Happy hunting!

#TotalInsights #ThreatIntel #AI #OffensiveSecurity #CyberStrikeAI

https://t.co/nDqrsELahM

[BGPHorizon @BGPHorizon]

Automating BGP Analysis: A Deep Dive into the BGPHorizon API & MCP

https://t.co/3ky4qOV7dp

#bgp #mcp #ai

[Will @BushidoToken]

@C5pider @k0zmer Need this in Claude

[Will @BushidoToken]

When analysing large-ish internet telemetry datasets, never underestimate how the humble pivot table can turn up interesting threads to follow

[Will @BushidoToken]

If you’re not tracking ARTEX now is the time to start! 👇

[Team Cymru Research @teamcymru_S2]

INTEL DROP
*daily double

ARTEX is an open-source autonomous AI pentest platform, multi-agent software that plans attack paths, maps assets, and validates vulnerabilities without an operator. Total Insights has it running on 52 hosts that are also stood up as AI relay stations, the LLM API gateways built on sub2api, new-api, and grok2api. The same boxes proxy model access and run autonomous offensive automation.

ARTEX + ai-relay:sub2api, 40 hosts stepping through two adjacent /24s at regular intervals (United States):
38.11.173.1
38.11.173.5
38.11.173.10
38.11.173.14
38.11.173.19
38.11.173.23
38.11.173.28
38.11.173.32
38.11.173.37
38.11.173.41
38.11.173.46
38.11.173.50
38.11.173.59
38.11.173.68
38.11.173.77
38.11.173.86
38.11.173.95
38.11.173.104
38.11.173.108
38.11.173.113
38.11.173.117
38.11.173.122
38.11.221.9
38.11.221.18
38.11.221.27
38.11.221.36
38.11.221.45
38.11.221.49
38.11.221.54
38.11.221.58
38.11.221.63
38.11.221.72
38.11.221.76
38.11.221.81
38.11.221.85
38.11.221.90
38.11.221.94
38.11.221.103
38.11.221.112
38.11.221.121

ARTEX + AI relay, spread across the US, Hong Kong, and China:
198.46.198.206 ost:artex + ai-relay:sub2api + vps
173.254.220.78 ost:artex + ai-relay:sub2api + vps
47.253.69.182 ost:artex + ai-relay:sub2api
47.82.118.105 ost:artex + ai-relay:sub2api
103.117.121.13 ost:artex + ai-relay:sub2api + socks
198.200.59.86 ost:artex + ai-relay:sub2api
14.103.211.223 ost:artex + ai-relay:new-api
103.116.247.42 ost:artex + ai-relay:new-api
81.71.120.246 ost:artex + ai-relay:new-api
154.12.94.223 ost:artex + ai-relay:grok2api

Also running AI-driven C2 and recon:
192.236.166.73 ost:artex + ai-relay:grok2api + controller:cyberstrikeai + controller:mythic + ost:scopesentry + vps
149.104.24.91 ost:artex + ai-relay:sub2api + controller:cyberstrikeai + ost:arl + risknet + vps

Block the set. Prioritize the two hosts running AI-driven C2 and the two /24s.

#TotalInsights #ThreatIntel #ARTEX #AIsecurity

https://t.co/nDqrsELahM