Track Threat Actors Using Real-World IOC Pivoting

Check Point reports a surge of COVID-19 themed domains and dark web sales, with malware campaigns (AZORult, Emotet, TrickBot) and APT36, BabyShark operations exploiting the pandemic.

Hunt.io uncovered an open directory revealing an active intrusion into Thai ISP 3BB: FortiGate SSL-VPN exploitation via CVE-2024-21762, MeshCentral persistence, and RADIUS credential theft.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.

APT36 expands beyond military targets to Indian Railways, oil and gas, and the Ministry of External Affairs, using .desktop lures, cron persistence, and the Poseidon backdoor.