Demon

Threat Researcher at @Huntio
eCTHP | CTIA | CRTO | CRTA
DM me for Collaboration on Threat Intel & Hunting 🤝
All Views are my Own⚠️

[Demon @volrant136]

New #threatintel research using @Huntio 🔥

Two exposed #opendir revealed targeting #Vietnamese & #Pakistani government/military infrastructure, NDU, #Mexican systems, and self-hosted #LLM gateways.

Link: https://t.co/i39XHjhK83

[Demon @volrant136]

Suspected Operator: Turkish
Four tracks, zero hits: blind XSS got no callbacks, 9,469 cookie guesses rate-limited out, Brotli CVE probe just got 403s, TLS intercept threw SSLEOFError

[Demon @volrant136]

🚨#opendir from @Huntio at 31.77.229[.]26:80 with #PentAGI running and route through test-api[.claude[.gg using a letum-max model to target rbxcrate[.com.

#Attacks: Cloudflare bypass, SSRF, payment webhooks, IDOR, race conditions, CVE-2026-111497 as a Brotli probe hypothesis.

[Demon @volrant136]

An AI-powered #offensive platform (aiscan + DeepSeek v4-pro) that read 22 #attack playbooks, downloaded 17 security tools, and #confirmed operational readiness in under 9 minutes.

Full dissection 👇
https://t.co/R1RdJAI11a

[Demon @volrant136]

New Investigation on Palo Alto #Exploitation

@Huntio AttackCapture™ caught a fully operational exploitation #toolkit at 130.94.67[.]235:8080. Inside: a 4-stage #exploit chain (#PHP memory corruption → #Fragnesia kernel LPE) that achieves root on #Palo #Alto firewalls.

[Demon @volrant136]

Post-exploitation:

#AD enumeration, #GlobalProtect bypass (CVE-2026-0257), #Keycloak SSO recon, reverse #SSH tunnels, SOCKS5 proxies — the works.

[Demon @volrant136]

Full Blog: https://t.co/FCSuBiWgqY

[Demon @volrant136]

New Blog on #ARTEX from @Huntio

#Pivoted from the known console host 38.244.50[.]120 to a second #opendir at 23.248.226[.]250 — a Hong Kong jump server exposing .secrets files, reverse SSH tunnels, Claude Code + DeepSeek/GLM/Grok routing shims, and a staged JNDI/LDAP #RCE chain.

[Demon @volrant136]

@500mk500
@malwrhunterteam
@MichalKoczwara

[Demon @volrant136]

New #threatintel research using @Huntio 🔥

An exposed #opendir on 193.29.104[.]84:8099 leaked 48 files from what looks like an active #APT #DONOT operation targeting #Pakistan’s nuclear and energy sectors.

Full breakdown:
https://t.co/QzAYu3Zqfi

[Demon @volrant136]

+1

https://qr-fir-punjabpolice-gov-pk[.]com/

ref: https://t.co/uEZUb4mcha

cc: @500mk500 @MichalKoczwara @malwrhunterteam

[Demon @volrant136]

🚨 Fake page impersonating #Pakistan #Punjab #Police
+1

https://officers16-punjabpolice-gov-pk-login-for-hrmis[.]pages[.]dev/

Ref: https://t.co/A8s6pNVcmo

cc: @500mk500 @MichalKoczwara @malwrhunterteam

[Demon @volrant136]

@skocherhan @TraceLabs Congratulations 👏

[Demon @volrant136]

🚨#APT #Sidewinder targets #Pakistan Ministry of Federal Education and Professional Training

Tracked by @Huntio

mail-mofept-gov-pk-verification2lerserverupdate84jhbhjgbhc[.]pages[.]dev

cc: @500mk500 @MichalKoczwara @malwrhunterteam

[MalwareHunterTeam @malwrhunterteam]

Noticed a fully FUD on VT Cobalt archive that was seen from Singapore. It's a strange one:
C2 domain base: PNAlumni.dgitd.anchorbolnorth[.]com - the registrant is supposedly from Pakistan
IP: 119.160.105[.]93 - belongs to a Pakistani telecom company, and in 2024, the "official website of the Pakistan Navy War College (PNWC)" was seen resolving to this IP...
🤔
🤷‍♂️

[Demon @volrant136]

@Huntio The #operator built a rogue #LDAP federation provider pointing to their own server, a script-based authenticator running Runtime.getRuntime().exec("id"), and a custom theme provider targeting a writable path.

All of it configured inside the #ministry’s #Keycloak instance.

[Demon @volrant136]

🚨 New #research using @Huntio

An attacker targeting #Vietnam government networks left their entire #toolkit exposed in an #opendir: 484 files, 587 MB, one operator.

🧵https://t.co/gakhSS6IUQ

cc: @500mk500 @MichalKoczwara @malwrhunterteam
@douglasmun

Full Analysis 👇

[Demon @volrant136]

@Huntio The #primary target: the #MoFA’s Keycloak SSO at sso-ingo[.mofa[.gov.]vn.

The toolkit confirms admin-level access — a 420 KB /admin/serverinfo export, realm #config dumps for cucngoaivu and master, and a captured #JWT with impersonation + manage-users permissions.

[Demon @volrant136]

🚨 #APT #Sidewinder Targets #Nepal Ministry Of Foreign Affairs (MOFA) 🇳🇵

Tracked by @Huntio

🔗https://newnepalmofa-production[.]up[.]railway[.]app/?dnfbnds64438mddnncmxnc=0

cc: @500mk500 @MichalKoczwara @malwrhunterteam

#Malware #ioc

[Demon @volrant136]

3/
A full post-exploitation pipeline: Windows credential/#LSA #harvesting, #PaperCut servers converted into internal network pivots via reverse #SOCKS5, automated #Metasploit exploitation at scale, and ready-to-redeploy “kits” for confirmed victims.

[Demon @volrant136]

🚨New Research from @Huntio

A #PaperCut attacker left their #AI exploitation workbench exposed on an #opendir. We got a look inside: agent instructions, exploit code, a second #RCE path, and victims in 45+ countries.

Full writeup: https://t.co/ixuRjdK2v9

[Demon @volrant136]

2/ Beyond the known #Tapestry #bypass (CVE-2026-81578 / CVE-2026-82078), the actor’s own notes document a second #RCE path by abusing PaperCut’s XML-RPC API when token/network controls are weak.

Almost 9 hosts from different #countries were targeted in #undocumented Exploit.