🚨 New #research using @Huntio An attacker targeting #Vietnam government networks left their entire #toolkit exposed in an #opendir: 484 files, 587 MB, one operator. 🧵infrahunter.com/research/ins… cc: @500mk500 @MichalKoczwara @malwrhunterteam @douglasmun Full Analysis 👇

@Huntio Attack Capture #flagged 212.232.23[.]75:8877 on Sep 21. What looked like a routine #opendir turned into a #forensic window into an active intrusion campaign against #Vietnam’s Ministry of Foreign Affairs, insurance infrastructure, and more.

🔍 Explore the Files Behind Active Threat Infrastructure What can an exposed attacker directory tell you beyond a few IOCs? AttackCapture gives analysts a deeper look at the files, tooling, and artifacts attackers leave behind on live infrastructure. You can search code and text across archived files, identify credentials, review sandboxed content, map findings to MITRE ATT&CK techniques, and explore servers behaving like C2s. Our team also adds hand-written observations to notable directories, helping analysts quickly understand what may be worth investigating further. Get a demo and see AttackCapture in action 👉 hunt.io/get-started #ThreatHunting #ThreatIntel #CyberSecurity

Establishing persistence via creation a SSH tunnel on port 80 Using @Huntio intelligence, we can see the port 80 SSH has been active since July 7th SSH-80-B28C99448F18AC8DC35214910E0BE900

i love @Huntio <3

🕵️‍♂️ Pivot From Targeted Industries to Actor Infrastructure Do you know which threat actors are targeting the sector you care about? We can help with that. On our platform, you can filter the threat actor dataset by sector, open a matching profile, and review the activity tied to that actor. In this example, we start with Information Technology, narrow the list to actors tied to that sector, and land on WageMole, a North Korean state-sponsored group. From there, we can pivot into its IPs, hosts, SHA256s, and related activity. See which actors are targeting your sector 👉 hunt.io/get-started #ThreatHunting #ThreatIntel #CyberSecurity

🚀 Go Beyond a List of C2 IPs A C2 IP is useful, but knowing what sits around it is much better. Our C2 feeds include host-level context that helps connect infrastructure to malware families, threat actors, domains, JA4 fingerprints, and related systems. That gives analysts more places to pivot without starting from a static IOC and doing the enrichment by hand. Our platform also uses 150+ detection techniques to identify malicious behavior across the infrastructure we track. Ready to explore the latest 7 days of C2 feed data with our two-week free trial? Apply here 👉 hunt.io/oem-c2-threat-feeds #ThreatIntel #ThreatHunting

🚨 #APT #Sidewinder Targets #Nepal Ministry Of Foreign Affairs (MOFA) 🇳🇵 Tracked by @Huntio 🔗https://newnepalmofa-production[.]up[.]railway[.]app/?dnfbnds64438mddnncmxnc=0 cc: @500mk500 @MichalKoczwara @malwrhunterteam #Malware #ioc

🎯 Find Infrastructure Reused Across Multiple Malware Campaigns A simple HuntSQL query can be surprisingly strong for finding reused infrastructure. The query from the first screenshot finds the top 10 IPs associated with the highest number of unique malware families over the last 30 days. That quickly highlights hosts reused across multiple malware campaigns. From the results, we can open a matching IP and move straight into its network context, risk signals, open ports, software, and active malware to keep expanding the investigation. Use this query to start your next hunt 👉 hunt.io/get-started #ThreatHunting #ThreatIntel #CyberSecurity

🚨New Research from @Huntio A #PaperCut attacker left their #AI exploitation workbench exposed on an #opendir. We got a look inside: agent instructions, exploit code, a second #RCE path, and victims in 45+ countries. Full writeup: hunt.io/blog/papercut-attack…

🤖𝗡𝗲𝘄 𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵: 𝗜𝗻𝘀𝗶𝗱𝗲 𝗮 𝗣𝗮𝗽𝗲𝗿𝗖𝘂𝘁 𝗔𝘁𝘁𝗮𝗰𝗸𝗲𝗿’𝘀 𝗔𝗜 𝗧𝗼𝗼𝗹𝗸𝗶𝘁: 𝗔𝗴𝗲𝗻𝘁 𝗜𝗻𝘀𝘁𝗿𝘂𝗰𝘁𝗶𝗼𝗻𝘀, 𝗘𝘅𝗽𝗹𝗼𝗶𝘁 𝗖𝗼𝗱𝗲, 𝗮 𝗦𝗲𝗰𝗼𝗻𝗱 𝗥𝗖𝗘, 𝗮𝗻𝗱 𝗩𝗶𝗰𝘁𝗶𝗺𝘀 𝗔𝗰𝗿𝗼𝘀𝘀 𝟰𝟱+ 𝗖𝗼𝘂𝗻𝘁𝗿𝗶𝗲𝘀 After GreyNoise and Blackpoint Cyber published on the PaperCut campaign, our team used AttackCapture to dig into the infrastructure and recovered new intelligence from the operator’s own files. Three open directories on the attacker’s server were still in use when we pulled them What we found: ➜ A second RCE path through PaperCut’s XML-RPC API, independent of the Tapestry vulnerability chain ➜ The full AI agent instructions (19KB, Russian and English) directing a DeepSeek model through OpenAI Codex with up to 25 concurrent subagents ➜ Custom Rust credential collectors targeting Windows LSA secrets, plus chisel/cron persistence for reverse SOCKS5 tunnels ➜ Packaged victim kits covering 46 Active Directory domains, ready for reuse ➜ 1,005 hosts in the recon pool across 45+ countries, with 45 targets confirmed to have live internal pivots at time of capture This wasn’t a smash-and-grab... The operator’s own journal entries show an iterative process: batching targets, retrying failures, debugging tooling, and reorganizing victim lists with minimal human intervention. Our research reconstructs the full pipeline from the attacker’s own files 👇 hunt.io/blog/inside-papercut…

📌 A Cloned RTX Page Led Us to a Wider SilkParasite Cluster A cloned RTX webpage led us to 13 servers tied to a wider SilkParasite infrastructure cluster across Central Asia. We published this investigation last month, tracing links through reused domains, TLS certificates, and registration patterns that connected infrastructure associated with SpiceRAT, NodeEdgeRAT, and NomadRAT. We also found domains impersonating government, energy, and telecom organizations across the region, with passive DNS showing parts of the infrastructure dating back to at least 2022. Read the full article on our blog 👉 hunt.io/blog/silkparasite-sp… #ThreatHunting #ThreatIntel #CyberSecurity