Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Shared SSH Keys Expose Phishing Infrastructure Targeting Kuwait

hunt.io | blog | #phishing | #infrastructure | #ssh-keys | #credential-harvesting | #kuwait | #aeza

Summary

An ongoing campaign staging 100+ domains on Aeza servers, linked by reused SSH keys and shared ASN, phishes Kuwaiti fisheries, telecom, and insurance organizations via cloned portals.
Published
Collected

original ↗

Related coverage

blog · hunt.io
APT34-Like Threat Infrastructure Uncovered Before Activation
Dormant APT34-like infrastructure impersonating an Iraqi academic institute and fake UK tech firms reused SSH keys and port 8080 decoy 404s on M247 servers, offering early warning.
blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
APT Sidewinder Abuses Netlify to Mimic Government and Military Portals in South Asia
Sidewinder-linked phishing pages in Chinese, English, and Japanese lure government and financial targets across Asia with ZIP/RAR document lures and shared download.php kits; 28 pages found.
blog · hunt.io
GoPhish Infrastructure Targets Polish Energy and Government
An exposed GoPhish admin panel on a Microsoft-hosted IP served domains spoofing Poland's energy regulator and a renewable energy firm, staged for sector-specific credential collection.
blog · hunt.io
JSPSpy and ‘Filebroser’: A Custom File Management Tool in Webshell Infrastructure
Four JSPSpy webshell servers across China and the US also host 'Filebroser', a rebranded File Browser panel likely repurposed for covert file management on compromised hosts.
blog · hunt.io
‘JustJoin’ Landing Page Linked to Suspected DPRK Activity Resurfaces
Hunt.io resurfaces a suspected TA444/BlueNoroff cluster: a server hosting a fake 'JustJoin' macOS app landing page, plus two IPs sharing SSH keys pointing to coordinated DPRK-linked infrastructure.
back