Introducing IOC Hunter Feed and Attribution for Enhanced Threat Intelligence

Hunt.io's 2024 recap: a C2 Feed tracking 125+ malware families, a stats page processing up to a million observations per second, plus AttackCapture and Hunt SQL launches and the year's top research.

Hunt.io announces its IP Enrichment API: enrich any IPv4 address with TLS certificate, malware, JARM, protocol, open-directory, honeypot and phishing data through a documented interface.

Hunt.io uncovered an open directory revealing an active intrusion into Thai ISP 3BB: FortiGate SSL-VPN exploitation via CVE-2024-21762, MeshCentral persistence, and RADIUS credential theft.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.