📌 Inside an AI-Assisted PaperCut Attack Campaign
Two weeks ago, we published our findings on an AI-assisted PaperCut attack campaign.
Using AttackCapture, we uncovered three exposed directories containing AI-agent instructions, exploit code, operational logs, and victim data.
We also found a second RCE path through XML-RPC, along with tools for credential theft and internal network access.
The operator's own records covered 1,005 hosts across 45+ countries.
Read our full analysis 👉 hunt.io/blog/papercut-attack…
#ThreatIntel #ThreatHunting #PaperCut #AISecurity #CyberSecurity
🇵🇭 68 GB stolen from a Philippine government agency, exposed by the thief’s own open directory
An operator copied 68 GB out of a government agency, logged every byte, then left that log open on the internet. We captured the directory while it was still serving.
The log is an rclone transfer record: 68.837 GiB across 27 SQL Server backups, finished in under 24 minutes on 6 September 2026.
What else sat in the open directory:
- A GodPotato privilege-escalation tool rebuilt and renamed "Wrqsnx," with the pipe, namespace and metadata changed and internal identifiers left intact
- A PowerShell stager that rebuilds the payload in memory from base64 fragments, so no DLL touches disk
- Two builds from two compilers, plus the full source tree
- A complete Impacket environment with LDAP/MSSQL relay checks and a Windows Server 2025 DC filter
What we did not find: the initial access vector, a C2 channel, or any confirmed payload execution. The log establishes a completed transfer and the staging of the tooling, nothing past it.
Full report + IOCs here 👇
hunt.io/blog/philippine-gove…
🕵️♂️ Which Popular Platforms Are Being Abused in Threat Activity?
Threat Activity Enablers is our way of mapping that abuse at the provider level.
We track platforms and URL patterns commonly seen in malicious campaigns, then connect them with IOC Hunter matches and recently scanned C2s.
In this AWS example, we can review abused service patterns and move directly into matching hosts, C2 domains, IPs, ports, malware, and source reporting.
You can start with a widely used platform, then quickly narrow down to the infrastructure behind the activity.
Book a demo and bring this workflow into your next hunt 👉 hunt.io/get-started
#ThreatHunting #ThreatIntel #CyberSecurity
Hunt.io retweeted
🚨#APT #Sidewinder targets #Pakistan Ministry of Federal Education and Professional Training
Tracked by @Huntio
mail-mofept-gov-pk-verification2lerserverupdate84jhbhjgbhc[.]pages[.]dev
cc: @500mk500 @MichalKoczwara @malwrhunterteam
🚀 Bring Live C2 Data Into Your Security Stack
C2 intelligence is more useful when it fits directly into the tools your team already uses.
Our C2 feeds can be integrated into your platform to support detections, enrichment, and investigation without building the collection and validation pipeline yourself.
The feed includes live C2 data, actor and malware mappings, JA4s, domains, and other infrastructure context, with automated validation helping reduce manual work.
Want to test it with your own workflow? Start a two-week free trial and explore the latest 7 days of C2 data.
Apply here 👉 hunt.io/oem-c2-threat-feeds
#ThreatIntel #ThreatHunting
Hunt.io retweeted
While hunting for suspicious infrastructure on @Huntio, I came across an exposed staging directory containing 57 artifacts, including 24 Python scripts, a Windows Chisel binary, operational logs, and Base64-encoded PHP tooling.
The Python scripts covered Oracle and SSRS authentication attempts, WinRM access checks, ASP.NET probing, API enumeration, and credential attacks against multiple services. Several scripts were configured with specific targets and hardcoded credentials.
One of the more interesting findings was a pair of Base64-encoded PHP scripts designed to relay SOAP requests to an internal payment service.
After decoding them, I identified code that accepts parameters through HTTP requests, constructs SOAP envelopes, and forwards them using HTTP POST with SOAPAction headers.
Two operations stood out:
ConsultaSdo: Account balance inquiries
AplicaPago: Payment processing
A separate Chisel log recorded a reverse-tunneling listener starting on port 8443.
What made this directory interesting wasn't any single tool, but the combination of authentication attacks, internal service probing, tunneling infrastructure, and code targeting financial operations.
The artifacts provide evidence of attack preparation and attempted access, but don't establish a successful compromise or payment manipulation.
⚡ Extract, Enrich, and Pivot From the Same Workflow
Need to turn raw indicators into something you can investigate right away?
With Bulk Enrichment, we let you paste unstructured text and automatically extract IPs and domains.
Once the indicators are extracted, enrichment is just one click away.
In this example, we enrich a mixed list to surface C2/malware hosts, AttackCapture matches, IOC Hunter activity, location, ASN, registrar details, and more.
You can then click into individual results to pivot directly into the related host or domain data and keep the investigation moving.
Give Bulk Enrichment a try and turn an IOC list into useful investigation context 👉 hunt.io/get-started
#ThreatHunting #ThreatIntel #CyberSecurity
🚨 #PHP2Shell (CVE-2026-109618, CVE-2026-109619): everyone is staging the leaked PHP RCE, no one has landed it 🫠
We mapped the exposed PHP footprint and went into the attacker open directories after the Oct 21 leak.
What we found:
→ 683,922 IPs leaking a PHP version in one day of scans, mostly end-of-life builds
→ ~a dozen open-dir workspaces staging php2shell tooling, zero victims or shells in any of them
→ one mass operator sprayed up to 123 servers via a ~97-proxy farm, zero shells
→ scanning started ~20 min after the patch, driven by an existing Mirai-style botnet
→ no public PoC lands code exec on x86-64 yet (OOM corruption vs ASLR)
Patch now: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.
Full research + network observables: hunt.io/blog/php2shell-cve-2…
📌 Hunting BraZetsu Infrastructure Through TLS Certificates
A couple of weeks ago, we published our hunt into BraZetsu infrastructure, starting from a previously reported seed IP and following the TLS trail.
Using HuntSQL, we mapped certificate history, pivoted on naming patterns, and uncovered 80.78.27[.]252, where c2.installscenter[.]com appeared on port 2083 alongside painel.installscenter[.]com on 8083 and 8443.
The infrastructure changed providers, but the painel./c2. naming and Hestia Control Panel setup stayed remarkably consistent.
Read the full article on our blog 👉 hunt.io/blog/brazetsu-access…
#ThreatHunting #ThreatIntel #CyberSecurity
Hunt.io retweeted
🚨 New #research using @Huntio
An attacker targeting #Vietnam government networks left their entire #toolkit exposed in an #opendir: 484 files, 587 MB, one operator.
🧵infrahunter.com/research/ins…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
@douglasmun
Full Analysis 👇
🔍 Explore the Files Behind Active Threat Infrastructure
What can an exposed attacker directory tell you beyond a few IOCs?
AttackCapture gives analysts a deeper look at the files, tooling, and artifacts attackers leave behind on live infrastructure.
You can search code and text across archived files, identify credentials, review sandboxed content, map findings to MITRE ATT&CK techniques, and explore servers behaving like C2s.
Our team also adds hand-written observations to notable directories, helping analysts quickly understand what may be worth investigating further.
Get a demo and see AttackCapture in action 👉 hunt.io/get-started
#ThreatHunting #ThreatIntel #CyberSecurity
Someone built a watering hole toolkit targeting aapscoms[.]go[.]ke, a Kenyan government site hosted on Treasury infrastructure.
The open directory on 82.158.193[.]146 lays out the whole chain: plant a stored XSS through Royal Elementor Addons (CVE-2026-4803, no authentication required), wait for a site admin to trigger it, then wh_core.js hijacks their browser session to upload PHP markers through Slider Revolution or the WordPress plugin installer.
The interesting part is what didn’t happen. poll.log contains hundreds of marker checks. Every single one came back 500 or connection failure. No HTTP 200. No beacon callback. The toolkit was staged but never landed.
🧵 1/3
Directory listing and file previews from the open directory, including poll.log entries and the watering hole Python script.
Hunt.io retweeted
Establishing persistence via creation a SSH tunnel on port 80
Using @Huntio intelligence, we can see the port 80 SSH has been active since July 7th
SSH-80-B28C99448F18AC8DC35214910E0BE900
