Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Targeting Innovation: Sliver C2 and Ligolo-ng Used in Operation Aimed at Y Combinator

hunt.io | blog | #threat-intelligence | #c2 | #sliver | #ligolo-ng | #tunneling | #y-combinator

Summary

Hunt.io reconstructs an intrusion set aimed at Y Combinator that paired Sliver C2 with Ligolo-ng tunnels, illustrating how attackers chain modern open-source tooling for stealthy operations.
Published
Collected

original ↗

Related coverage

blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.
blog · hunt.io
Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia
Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.
blog · hunt.io
PCPJack Hijacked 230 AWS, GCP, and Azure Servers to Run a Hidden SMTP Relay Network
Hunt.io recovered a 12-file SMTP proxy toolkit from exposed PCPJack infrastructure, showing how 230 hijacked cloud servers were turned into a persistent email relay network with Sliver and Chisel.
blog · hunt.io
Legacy Threat: PlugX Builder/Controller Discovered in Open Directory
Hunt discovered an exposed Czech server hosting an outdated PlugX builder and controller, with victim logs and a VBA script abusing a Nepalese government domain; Nepal's CERT was notified.
blog · hunt.io
Into the Viper’s Nest: Observations from Hunt’s Scanning
Hunt tracks 400+ exposed Viper login pages for the Chinese red-team platform, over half on Tencent servers at default port 60000, and shares detection guidance for tools like Sliver.
back