Threat Researcher at @Huntio eCTHP | CTIA | CRTO | CRTA DM me for Collaboration on Threat Intel & Hunting 🤝 All Views are my Own⚠️
Joined November 2024
- Tweets944
- Following60
- Followers1.6K
- Likes339
Pinned Tweet
New #threatintel research using @Huntio 🔥
Two exposed #opendir revealed targeting #Vietnamese & #Pakistani government/military infrastructure, NDU, #Mexican systems, and self-hosted #LLM gateways.
Link: infrahunter.com/research/two…
+1
https://qr-fir-punjabpolice-gov-pk[.]com/
ref: teapawt.net/volrant136/status/2094…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
🚨 Fake page impersonating #Pakistan #Punjab #Police
+1
https://officers16-punjabpolice-gov-pk-login-for-hrmis[.]pages[.]dev/
Ref: teapawt.net/volrant136/status/2081…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
🚨#APT #Sidewinder targets #Pakistan Ministry of Federal Education and Professional Training
Tracked by @Huntio
mail-mofept-gov-pk-verification2lerserverupdate84jhbhjgbhc[.]pages[.]dev
cc: @500mk500 @MichalKoczwara @malwrhunterteam
Demon retweeted
Noticed a fully FUD on VT Cobalt archive that was seen from Singapore. It's a strange one:
C2 domain base: PNAlumni.dgitd.anchorbolnorth[.]com - the registrant is supposedly from Pakistan
IP: 119.160.105[.]93 - belongs to a Pakistani telecom company, and in 2024, the "official website of the Pakistan Navy War College (PNWC)" was seen resolving to this IP...
🤔
🤷♂️
🚨 New #research using @Huntio
An attacker targeting #Vietnam government networks left their entire #toolkit exposed in an #opendir: 484 files, 587 MB, one operator.
🧵infrahunter.com/research/ins…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
@douglasmun
Full Analysis 👇
🚨 #APT #Sidewinder Targets #Nepal Ministry Of Foreign Affairs (MOFA) 🇳🇵
Tracked by @Huntio
🔗https://newnepalmofa-production[.]up[.]railway[.]app/?dnfbnds64438mddnncmxnc=0
cc: @500mk500 @MichalKoczwara @malwrhunterteam
#Malware #ioc
2/ Beyond the known #Tapestry #bypass (CVE-2026-81578 / CVE-2026-82078), the actor’s own notes document a second #RCE path by abusing PaperCut’s XML-RPC API when token/network controls are weak.
Almost 9 hosts from different #countries were targeted in #undocumented Exploit.
3/
A full post-exploitation pipeline: Windows credential/#LSA #harvesting, #PaperCut servers converted into internal network pivots via reverse #SOCKS5, automated #Metasploit exploitation at scale, and ready-to-redeploy “kits” for confirmed victims.
🚨 #APT #Sidewinder Targets #Pakistan #Ordnance #Factories (POF)
Tracked by @Huntio
⚠️https://mail-pof-gov-pk[.govtpak[.workers[.dev
⚠️http://acc0unts-pof-gov-pk-bhisdwhh9hwuwbwdbwd-c0m[.shazad-gids[.workers[.dev
cc: @500mk500 @MichalKoczwara @malwrhunterteam
#APT #Sidewinder second attempt on #Pakistan #Navy
Tracked by @Huntio
https://mail-paknavy-gov-pk-chi[.]vercel[.]app/home/?dgkjshfskdjhghgrehjhvjshdfoerowiuifg=ZG5vMUBwYWtuYXZ5Lmdvdi5waw==
ref: teapawt.net/volrant136/status/2022…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
#APT #Sidewinder Targets #Pakistan #Navy
Interesting!
Using icewarp[.]com ?
Tracked by @Huntio
🔗https://navy-pk-dils-maint213-ifwcnxl4[.]leapcell[.]dev/home/?dgkjshfskdjhghgrehjhvjshdfoerowiuifg=ZG5vMU8wYWtuYXZ5Lmdvdi5waw==
cc: @500mk500 @MichalKoczwara @malwrhunterteam
Excited to share that #InfraHunter is now sponsored by @Huntio 🤝
Independent APT infrastructure hunting and malware research runs on good data, and Hunt.io has been a key part of that toolkit.
Thanks for backing the work.
🔗infrahunter.com
🚨 New #threatintel research using @Huntio🔥
#Three open directories. One #Malaysian VPS. A live breach of #Brazil Federal Botanical Research Institute, plus an intrusion kit already sitting inside a #state #government network.
Blog Link: infrahunter.com/research/a-l…
Hunt.io Attack Capture flagged 3 open dirs on a Kuala Lumpur VPS (AS45839) between Aug 27–29.
111.90.145[.]92
@500mk500 @malwrhunterteam @MichalKoczwara
🚨 #APT #Sidewinder Targets #Pakistan National Telecom Corporation (#NTC)
Tracked by @Huntio
hxxps://ntc-net-pk-ochre[.]vercel[.]app/login/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo=1
ref: teapawt.net/volrant136/status/2105…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
🚨 #APT #Sidewinder Targets #Pakistan National Telecom Corporation (#NTC)
Tracked by @Huntio
hxxps://email-pmsa-gov-pk[.]httpx[.]sbs/
ref: teapawt.net/volrant136/status/2088…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
Demon retweeted
🔥 New blog drop! My research introduces UAT-11587, a China-nexus group targeting government and policy organizations in 8 countries with the Antino backdoor. After a preview at @labscon_io, full technical analysis, campaign details & IoCs are now live:
blog.talosintelligence.com/c…
🚨 #APT #Sidewinder Targets #Pakistan National Telecom Corporation (#NTC)
Tracked by @Huntio
hxxps://email-pmsa-gov-pk[.]httpx[.]sbs/
ref: teapawt.net/volrant136/status/2088…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
🚨 #APT #Sidewinder Targets #Pakistan National Telecom Corporation (#NTC)
Tracked by @Huntio
https://ntccc[.]vercel[.]app/login/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo=1
ref:teapawt.net/volrant136/status/2085…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
🚨#Fake Website impersonating #Dhaka North City Corporation (#DNCC) of #Bangladesh
Tracked by @Huntio
⚠️http://erevenue-dncc-gov-bd[.]xyz/
cc: @500mk500 @MichalKoczwara @malwrhunterteam
