Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

APT34-Like Threat Infrastructure Uncovered Before Activation

hunt.io | blog | #infrastructure | #ssh-keys | #apt34 | #oilrig | #m247 | #early-warning

Summary

Dormant APT34-like infrastructure impersonating an Iraqi academic institute and fake UK tech firms reused SSH keys and port 8080 decoy 404s on M247 servers, offering early warning.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Shared SSH Keys Expose Phishing Infrastructure Targeting Kuwait
An ongoing campaign staging 100+ domains on Aeza servers, linked by reused SSH keys and shared ASN, phishes Kuwaiti fisheries, telecom, and insurance organizations via cloned portals.
blog · hunt.io
SolarMarker: Hunt Insights and Findings
Following Recorded Future's report, Hunt identified 20 SolarMarker tier-1 servers on the M247 network, plus SSH keys reused across 100+ hosts and domains spoofing Interac and a payment provider.
blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
GoPhish Infrastructure Targets Polish Energy and Government
An exposed GoPhish admin panel on a Microsoft-hosted IP served domains spoofing Poland's energy regulator and a renewable energy firm, staged for sector-specific credential collection.
blog · hunt.io
JSPSpy and ‘Filebroser’: A Custom File Management Tool in Webshell Infrastructure
Four JSPSpy webshell servers across China and the US also host 'Filebroser', a rebranded File Browser panel likely repurposed for covert file management on compromised hosts.
blog · hunt.io
‘JustJoin’ Landing Page Linked to Suspected DPRK Activity Resurfaces
Hunt.io resurfaces a suspected TA444/BlueNoroff cluster: a server hosting a fake 'JustJoin' macOS app landing page, plus two IPs sharing SSH keys pointing to coordinated DPRK-linked infrastructure.
back