Ctrl-Alt-Intel

Threat Research

[Ctrl-Alt-Intel @ctrlaltintel]

9 McNuggets & a McChicken burger helped us link a Russian hacker to 🇷🇺 government😅

Denis Obrezko was put on the international wanted listed by Russia, following an FBI arrest in Phuket last November.

Our independent investigation shows Obrezko has closes ties to the Moscow👇

[avery @avery_town]

@huntio Threat actor running automatic earning scripts for Litecoin & Solana 💸 (with goodies!)

Let's take a look:

[avery @avery_town]

i love @Huntio <3

[Ctrl-Alt-Intel @ctrlaltintel]

Establishing persistence via creation a SSH tunnel on port 80

Using @Huntio intelligence, we can see the port 80 SSH has been active since July 7th

SSH-80-B28C99448F18AC8DC35214910E0BE900

[Ctrl-Alt-Intel @ctrlaltintel]

Interesting reporting on APT28/Fancy Bear by @symantec

"Russian Espionage Group Targets Defense Firms in Two NATO Countries"

https://t.co/AAP1BwANPg
👇

[Ctrl-Alt-Intel @ctrlaltintel]

@vxunderground @malwrhunterteam Was this one of the publicly available Coruna/DarkSword toolkits found on GitHub?

[OSINT Industries @OSINTindustries]

A gang stole more than 1,600 logins from Western trucking companies through a phishing website. 🚛

@ctrlaltintel and @beensquatted used OSINT Industries to trace it back to Russian logistics firms.

Read how 👇
https://t.co/Xq3z13tPDb

[Ctrl-Alt-Intel @ctrlaltintel]

More information can be found here including some source code:

https://t.co/HIeRqpIEmb

[Ctrl-Alt-Intel @ctrlaltintel]

On @Huntio OpenDir 144.172[.]118[.]80:443
⛏️ XMRig + ftrace rootkit src
🐚 PHP webshells (Magento paths)
💳 Skimmer hidden in a PNG
🦀 Rust implants posing as systemd-*
Implant C2: update[.]ssl-certificate-verify[.]com
Exfil: google-ad-analytics[.]com, gfhiko[.]xyz

[Ctrl-Alt-Intel @ctrlaltintel]

⚙️ Persistence

Rootkit: klogd.ko → /etc/bL6qMsQz, loaded by /etc/init.d/bL6qMsQz + /etc/rc3.d/S55bL6qMsQz

Miner: cron */50 runs /etc/kworker/kworker (/etc/cron.d/javae, /etc/crontab) → /etc/javae/javae

Files chattr +ia, ps/top/pstree wrapped to grep out javae

[Have I Been Squatted @beensquatted]

Have I Been Squatted registered аррӏө.com.

It looks like Apple’s website address, but it’s a completely separate domain using different characters.

We registered 20 lookalike .com domains in total as part of our latest research. Here’s what we found.

1/5 ⬇️

[Josh Allman @xorJosh]

Crosshair X RCE: SVG Injection via crosshair-x:// URI and Steam Workshop

Fixed in 15.5.4 by the GOAT Graham from @CenterPointG fixed on the same day on a weekend while moving house 👑

[Ctrl-Alt-Intel @ctrlaltintel]

https://t.co/uYsPMVxuP2

[Ctrl-Alt-Intel @ctrlaltintel]

New blog: Russian and Allied Government Systems Compromised in Targeted Campaigns ❗️

Notable victims include:

- Russian Ministry of Emergency Situations
- Kyrgyz Ministry of Foreign Affairs
- Syrian Government Customs dept.

🧵👇

[Ctrl-Alt-Intel @ctrlaltintel]

Case 3: A threat actor attempted to exploit Roundcube CVE-2025-49113 against Kyrgyz National Security Service (https://t.co/JA4VPKv5Ab)

Other known CVEs and public POCs were used by this threat actor to target

Found via 89.124.123[.]216:8080 - @Huntio

Link to full article 👇

[Ctrl-Alt-Intel @ctrlaltintel]

Payloads linked to campaign have been tracked by @smica83 @skocherhan @malwrhunterteam

[Ctrl-Alt-Intel @ctrlaltintel]

Interesting reporting by FIND on a OPSEC L from Armenian-linked cargo-theft threat actors deploying "GaloyanRAT" & an assortment of RMMs

500+ payloads were exposed on cloud storage, linked to targeting of carriers 🧵

[Ctrl-Alt-Intel @ctrlaltintel]

Reference:

https://t.co/P0xbYF67K5

[Ctrl-Alt-Intel @ctrlaltintel]

RMMS installed by the group included:

- MeshCentral
- ScreenConnect
- PulseWireX