Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exposing the Deception: Russian EFF Impersonators Behind Stealc & Pyramid C2

hunt.io | blog | #gaming | #eff | #open-directory | #pyramid-c2 | #russian-actor | #stealc

Summary

An open directory tied to EFF-impersonating actors targeting Albion Online players exposed decoy documents and Stealc/Pyramid C2 malware; shared SSH keys linked 11 more servers.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Russian-Speaking Threat Actor Abuses Cloudflare & Telegram in Phishing Campaign
The Russian-speaking actor behind earlier EFF impersonation now runs Cloudflare-branded DMCA phishing with LNK files, Telegram-bot victim filtering, and Pyramid C2; an open directory exposed it.
blog · hunt.io
Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged
An exposed Hong Kong staging server revealed Hermes, an autonomous AI agent run unattended, an unreported Go implant named Hades, and tooling targeting Thailand's Ministry of Finance.
blog · hunt.io
Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries
An exposed open directory reveals an operator staging NGINX Rift, Ghost CMS, and other recent CVEs against government and finance, using DNS callbacks to verify execution.
blog · hunt.io
Ababil of Minab Exposed: LA Metro SCADA Backups and Israeli Victim Data Left Open on an Iranian Staging Server
Hunt.io AttackCapture found Ababil of Minab's staging server wide open: 5 GB of victim data including LA Metro SCADA backups and Israeli organizations' credentials, configs, and database dumps.
blog · hunt.io
Exposed BYOB C2 Infrastructure Reveals a Multi-Stage Malware Deployment
A live BYOB C2 open directory revealed a multi-stage deployment: droppers, stagers and post-exploitation modules for Windows, Linux and macOS, seven persistence mechanisms, plus XMRig miners.
blog · hunt.io
AsyncRAT Campaigns Uncovered: How Attackers Abuse ScreenConnect and Open Directories
ConnectWise ScreenConnect installers were trojanized to deliver AsyncRAT from at least eight hosts, with payloads unseen on VirusTotal, ClickOnce /Bin/ pivots and scheduled-task persistence.
back