TinyLoader Malware: Crypto Theft & C2 Infrastructure

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

Hunt discovered an exposed Czech server hosting an outdated PlugX builder and controller, with victim logs and a VBA script abusing a Nepalese government domain; Nepal's CERT was notified.

Hunt tracks 400+ exposed Viper login pages for the Chinese red-team platform, over half on Tencent servers at default port 60000, and shares detection guidance for tools like Sliver.

Hunt profiles SparkRAT, the Go-based RAT behind attacks tracked by Microsoft and AhnLab, with detection tips for its default port 8000 and login-page fingerprints.

While hunting IOX copies, Hunt found an open directory holding two SuperShell/GOREVERSE payloads and a Linux ELF Cobalt Strike beacon, and shows how /supershell/login panels can be tracked.