u/Straight-Practice-99

An operator left their full working directory exposed on an open HTTP server. Hunt.io crawled it, 2,616 files, and rebuilt the campaign from the corpus.

• Three exploitation paths in parallel: an asyncio credential brute-forcer, a CVE-2021-33044/33045 auth-bypass chain, and P2P relay abuse reaching cameras by serial number
• The relay path never authenticates the connecting party, only the session, via a cloud-issued token obtainable with the fixed SDK credentials in every Dahua client
• Two CVE labels in the tooling don't hold up: CVE-2024-39943 is an unrelated Rejetto HFS flaw, and CVE-2025-31702 is a narrower post-auth case, not the unauthenticated relay abuse (that path is a separate non-CVE issue documented by ITRES)
• Full PTCP tunnel breakdown, including the Inverted STUN packet and the bind-to-127.0.0.1 technique

Neutral attribution throughout, the corpus shows how the operation was built and run, not who ran it.

Check the full breakdown, IOCs and mitigation strategies:
https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised

Writeup on two open directories we recovered, with a defender-focused breakdown of the camera and router compromise techniques and the network behavior their proxy tooling produces.

Detection and mitigation angles worth pulling out:

• Edge devices opening outbound connections on port 4444 (chisel reverse tunnels) is a strong compromise signal
• Sequential ONVIF and RTSP discovery and repeated hits on camera ports show up better at the network boundary than in camera logs, which are usually shallow or absent
• Credential guessing was the primary access path before any CVE was tried, so default and weak creds on cameras and routers are still the main exposure
• Exploited camera CVEs are years old and long patched (Hikvision, Dahua); TP-Link Archer and MikroTik were the router targets
• Every targeted device answered directly from the internet, so pulling cameras and routers behind a VPN or onto isolated VLANs removes most of this

Outcomes against the government and military sites in the operator's bash history are not confirmed from the files. Full mitigations and ATT&CK mapping in the post:
https://hunt.io/blog/russian-speaking-operator-ukrainian-camera-toolkit 

Breaking down EtherRAT recovered from a The Gentlemen staging server. The MSI drops a Node.js bootstrapper, a decoder/persistence component, and an XOR-encrypted backdoor. The decoder uses a repeating XOR key with a position-dependent operation, writing the decrypted payload to disk, then sets a Run key to relaunch it through headless conhost.

C2 resolution runs off an Ethereum smart contract. Hardcoded in the sample are the contract address, a lookup key and a call function selector, with several public Ethereum RPC endpoints for redundancy. It polls the contract roughly every five minutes for a new C2.

Tasking model: each host gets a UUID bot ID separate from a hardcoded build ID. Polling generates random file-like paths (png, jpg, css, ico, webp) with random parameters to blend in. Any response over ten characters is passed to a newly constructed async function with access to require, process, Buffer, console, __dirname, __filename and log, so arbitrary JS in the user context. Requests hold up to 120 seconds, then a ~500ms gap before the next poll.

Full technical write-up, hashes and IOCs: https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2

Joint investigation with NetAskari. Starting from two IPs named in a June 2026 Chinese state media notice, we pivoted on Let's Encrypt certificate subjects and an AdminPro panel fingerprint (302 to HTTPS, Strict-Transport-Security: max-age=31536000, /login?redirect=list/basic-list route) to identify 170 active servers, concentrated across Antbox Networks Limited, Cognetcloud, CTG Server Limited, and Zillion Network Inc. in Hong Kong.

A misspelled environment variable (SECRIT_KEY) in the source archive led to an open directory with a Windows XAMPP deployment of the same codebase.

HuntSQL queries, full IOC tables, and APK builder analysis included:

https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon

Caught an open directory mid-campaign on a Singapore VPS. The host was pulling double duty, staging the exploits and standing by to receive whatever reverse shells they produced.

What makes it worth a look is the target selection. The lists weren't a flat IP dump, they were organised by country and by sector, eleven countries deep, concentrated on government, universities, healthcare, and financial services.

The toolkit backing it ran from a 2017 WebLogic bug up to a Splunk RCE staged within a week of disclosure, with NGINX Rift (CVE-2026-42945) and Ghost CMS (CVE-2026-26980) as the newest additions, plus an AdaptixC2 server on the same box.

Read more: https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve

DNSAudit ran active resolution checks against the Cloudflare Radar Top 100 domains in early February. Only live A records pointing to public IPs were counted.

3,649,938 candidates tested. 2,585,395 resolved. 77,053 of those match non-production naming indicators like dev, staging, qa, test, old, sandbox.

Classification is naming-based, so no vulnerability claim attached. Some of the developer-labeled records have been resolving since 2014.

Our research team pivoted off known TencShell C2 infrastructure and found an open directory exposing an active intrusion, tooling, victim data, operator logs, and cloned login pages, all with notes in Simplified Chinese. The part worth sitting with is how the LLMs were used: Claude Code handled execution and session persistence while DeepSeek-v4-pro drove the reasoning, a split we could trace across the recovered logs.

Government systems in Afghanistan, Thailand, and Taiwan were hit directly, with recon and staged phishing against U.S. portals and a parallel campaign against financial services firms. It lines up with Anthropic's November 2025 disclosure of a China-linked operation that used Claude Code to automate intrusions. Full IOCs and the HuntSQL queries in the post.

Over a three-month window Hunt.io mapped malicious infrastructure across 10 Eastern European countries and tracked more than 3,900 active C2 servers across 302 hosting providers.

A single Bulgarian host, Friendhosting, was running 2,100 of them, roughly 53.5% of the regional total. We also linked specific infrastructure to Cloud Atlas, ShinyHunters' PeopleSoft exploitation, and Nemesys ransomware sharing the same provider networks.

Read the full story: https://hunt.io/blog/eastern-europe-malicious-infrastructure-report

Ababil of Minab is a pro-Iranian group that claimed destructive intrusions against targets in the US, Israel, Saudi Arabia, and Turkey this year. LA Metro confirmed their breach in April. A later report described the campaign but held back the additional victims.

Hunt.io researchers found the operator's own staging server filling that gap: 5 GB of data, the upload tooling, the bash history, and folders named after each target, including over a gigabyte of LA Metro SQL backups down to SCADA configs.

Read the full story here: https://hunt.io/blog/ababil-of-minab-iranian-hackers-exposed-la-metro-breach-open-directory

Hunt.io researchers found around 5 GB of exfiltrated data sitting on an open server tied to Ababil of Minab, a pro-Iranian group that hit targets across the US, Israel, Saudi Arabia, and Turkey. 2,238 files across 545 subdirectories. A custom Flask upload tool, the operator's bash history, plaintext Chrome password dumps, and a 404 page that quietly redirected to fbi.gov to look harmless. The server stayed open for weeks after the campaign was already public, which let researchers recover the Israeli and Turkish victims a public report had withheld.

Full research here: https://hunt.io/blog/ababil-of-minab-iranian-hackers-exposed-la-metro-breach-open-directory

12 files sitting exposed on port 8444, source code, compiled binaries, and deployment state logs for a toolkit that hijacked 230 cloud servers to run a hidden SMTP relay network. A second open directory on port 9443 exposed the operator's live working directory including active scanners, exploitation tooling, and a live Sliver C2 config.

👉 Full breakdown here: https://hunt.io/blog/pcpjack-230-cloud-servers-smtp-proxy-network-sliver-chisel

1,628 phishing URLs across 33 backend IPs mapped from a single domain pivot. Infrastructure spans Tencent Cloud (15 IPs), Alibaba Cloud (3 IPs), Cloudflare anycast (14 IPs), and ALEXHOST Moldova (2 IPs).

Detection artifact: 128-character metadata hash present in every phishing page. HuntSQL queries included in the report below:

https://hunt.io/blog/massive-smishing-campaign-governments-postal-telecoms 

Hunt.io researchers spent the last 3 months mapping malicious infrastructure across Middle Eastern hosting providers.

Key findings:

• 1,357 C2 servers across 98 providers in 14 countries
• STC (Saudi Telecom) alone accounts for 72.4% of all regional C2 activity, 981 servers in 90 days
• Türk Telekom leads in malware diversity: 6 distinct families across 9 C2 endpoints
• Regxa (Iraq) carries the highest bulletproof rating of any provider in the dataset
• Active campaigns include Eagle Werewolf espionage ops, DYNOWIPER hitting Poland's energy sector, and RondoDox botnet on Iranian hosting

A small set of providers keeps appearing across completely unrelated campaigns. That's the pattern worth tracking.

Full report: https://hunt.io/blog/middle-east-malicious-infrastructure-report

The Hunt.io research team dug into the second-stage Python toolkit TeamPCP drops after the Mini Shai-Hulud supply chain compromise. Wiz and others covered the delivery and flagged some payload behavior. We went deeper into what actually runs on the machine after that.

Key findings for anyone following this group:

• FIRESCALE dead-drop: primary C2 down? The malware queries all public GitHub commit messages globally for a signed server redirect, verified with an embedded RSA-4096 key. Nothing to take down, no fixed repo, no fixed account. Watch for api.github.com/search/commits?q=FIRESCALE in egress logs.
• Victim-account fallback: if FIRESCALE fails too, the malware uses the victim's own GitHub token to create a public repo and push the credential harvest there. Operator pulls it via the public API. Zero attacker infrastructure required. Look for repos matching two Slavic words plus three digits with description PUSH UR T3MPRR.
• US government cloud in scope: both GovCloud partitions, us-gov-east-1 and us-gov-west-1, are explicitly in the AWS collector target list. Not accidental.
• Geopolitical wiper: timezone and locale checks identify Israeli and Iranian machines. A 1-in-6 gate triggers audio at max volume then full file deletion. Russian-locale machines exit clean before any payload runs.
• New infrastructure: HTTP header fingerprint pivot in HuntSQL surfaced four GCP addresses linked to this campaign not in any existing blocklist or prior report.

Full breakdown, IOCs, HuntSQL queries, and MITRE mapping: https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown

Drop questions below if you are tracking this.

CVE-2025-32975 is a CVSS 10.0 authentication bypass in Quest KACE SMA that allows an unauthenticated attacker to impersonate any user, including admins, without credentials. The patch dropped in May 2025. Active exploitation was tracked as recently as March 9, 2026.

On March 12, Hunt.io AttackCapture indexed an exposed directory at 216.126.225[.]156:8000 while it was still live. What was inside:

• 219 files, 308 MB, no auth required
• Full post-exploitation toolkit: Python reverse shell, custom TCP-multiplexed SOCKS5 tunnel, SMB credential sprayer, domain-wide WMI recon via runspace pool
• Six Next.js prototype pollution payloads alongside the KACE toolkit, confirming parallel initial access vectors
• A 512 MB MariaDB dump from a production KACE appliance belonging to HIQ, a Boston-area MSP
• 60+ named downstream client organizations across law enforcement, government, healthcare, and education
• Hardcoded credentials from at least two additional victim environments embedded in the scripts
• LNK metadata identifying the operator's machine as a Windows Server 2019 VPS with hostname windows-utah-8g, running as built-in Administrator

The report includes a full script-by-script breakdown, operator OPSEC assessment, database analysis, IOCs, and the detection logic to find exposed KACE instances.

Over 12,000 K1000 appliances are still internet-facing and disclosing version strings below the patch threshold.

Full research: https://hunt.io/blog/cve-2025-32975-quest-kace-sma-open-directory-60-victims