Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

South Korean Organizations Targeted by Cobalt Strike ‘Cat’ Delivered by a Rust Beacon

hunt.io | blog | #rust | #threat-hunting | #cobalt-strike | #open-directory | #south-korea | #sqlmap

Summary

A briefly exposed Japanese server hosted a Rust-compiled loader delivering Cobalt Strike 'Cat', plus sqlmap, dirsearch, and Web-SurvivalScan, in attacks on South Korean organizations.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure
A PowerShell shellcode loader found in a Chinese open directory executes in memory, fetches stage two from Baidu Cloud Functions, and beacons to Cobalt Strike infrastructure in Russia.
blog · hunt.io
Discovering & Disrupting Malicious Infrastructure
Hunt shows proactive hunting: pivoting on certificate names from Microsoft's Flax Typhoon report yielded four unreported SoftEther servers, plus Cobalt-related files found via keyword search.
blog · hunt.io
Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged
An exposed Hong Kong staging server revealed Hermes, an autonomous AI agent run unattended, an unreported Go implant named Hades, and tooling targeting Thailand's Ministry of Finance.
blog · hunt.io
Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries
An exposed open directory reveals an operator staging NGINX Rift, Ghost CMS, and other recent CVEs against government and finance, using DNS callbacks to verify execution.
blog · hunt.io
Ababil of Minab Exposed: LA Metro SCADA Backups and Israeli Victim Data Left Open on an Iranian Staging Server
Hunt.io AttackCapture found Ababil of Minab's staging server wide open: 5 GB of victim data including LA Metro SCADA backups and Israeli organizations' credentials, configs, and database dumps.
blog · hunt.io
The Complete Guide to Hunting Cobalt Strike - Part 4: Operationalizing C2 Feeds with API Automation
Part 4 of the Cobalt Strike series: automating the C2 feed via API—normalizing indicators into core, network and endpoint outputs for SIEM, IDS/EDR and sandbox pipelines.
back