RunningRAT’s Next Move: From Remote Access to Crypto mining For Profit

Using open directories, Hunt.io shows how XWorm RAT samples masquerade as browsers, security tools and file-transfer apps—including a lone SecurityHealthService.exe on a Thai-hosted server.

How open directories aid threat hunting and incident response: exposed C2 executables, configs, bash history and RAT logs can reveal victims; Hunt automates finding and pivoting on them.

The launch of Hunt.io: a threat-hunting platform with feeds of active C2 servers across 125+ malware families, open-directory counterintelligence and malicious-infrastructure data.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

A fake 'prettier-vscode-plus' extension on the official VSCode Marketplace delivered the Anivia loader and OctoRAT—a RAT with 70+ commands—in a supply-chain attack that rotated payloads.

Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.