Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

JSPSpy and ‘Filebroser’: A Custom File Management Tool in Webshell Infrastructure

hunt.io | blog | #infrastructure | #webshell | #persistence | #lazarus | #jspspy | #filebroser

Summary

Four JSPSpy webshell servers across China and the US also host 'Filebroser', a rebranded File Browser panel likely repurposed for covert file management on compromised hosts.
Published
Collected

original ↗

Related coverage

blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
Iranian-Nexus Operation Against Oman's Government: 12 Ministries Hit and 26,000 Citizen Records Exposed
An exposed UAE-hosted VPS revealed an Iranian-nexus operation against Oman: a webshell on the Justice Ministry, 26,000+ citizen and judicial records stolen, and operator sessions into April 2026.
blog · hunt.io
Exposed BYOB C2 Infrastructure Reveals a Multi-Stage Malware Deployment
A live BYOB C2 open directory revealed a multi-stage deployment: droppers, stagers and post-exploitation modules for Windows, Linux and macOS, seven persistence mechanisms, plus XMRig miners.
blog · hunt.io
AsyncRAT Campaigns Uncovered: How Attackers Abuse ScreenConnect and Open Directories
ConnectWise ScreenConnect installers were trojanized to deliver AsyncRAT from at least eight hosts, with payloads unseen on VirusTotal, ClickOnce /Bin/ pivots and scheduled-task persistence.
blog · hunt.io
APT MuddyWater Targets CFOs with Multi-Stage Phishing & NetBird Abuse
Spear-phishing impersonating a Rothschild & Co recruiter targets CFOs worldwide with Firebase-hosted phishing pages, VBS downloaders, and NetBird for persistent access; overlaps with MuddyWater.
blog · hunt.io
Shared SSH Keys Expose Phishing Infrastructure Targeting Kuwait
An ongoing campaign staging 100+ domains on Aeza servers, linked by reused SSH keys and shared ASN, phishes Kuwaiti fisheries, telecom, and insurance organizations via cloned portals.
back