Ababil of Minab Exposed: LA Metro SCADA Backups and Israeli Victim Data Left Open on an Iranian Staging Server

An exposed UAE-hosted VPS revealed an Iranian-nexus operation against Oman: a webshell on the Justice Ministry, 26,000+ citizen and judicial records stolen, and operator sessions into April 2026.

Hunt.io links a UK council breach to mass exploitation of SonicWall SMA1000 CVE-2026-15409: LDAP credentials from 168 appliances, secretsdump run on-device, DCSync in five AD environments.

Hunt.io captured an open directory staged three days into the KACE SMA CVE-2025-32975 exploitation wave, exposing the attacker's toolkit and a 512 MB database dump from an MSP managing 60+ clients.

One year after Colonial Pipeline, Semperis' Sean Deuby on the state of infrastructure security: ransomware groups keep targeting utilities, healthcare and food supply; Gartner counts 400% more attacks; SCADA/IoT estates remain hard to secure.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.