Rekoobe Backdoor Discovered in Open Directory, Possibly Targeting TradingView Users

Hunt.io expands on a WarmCookie C2 server flagged by Gen Threat Labs, using certificate history, HTTP response patterns and shared SSH keys to surface additional hosts tied to the updated backdoor.

An exposed open directory tied to The Gentlemen ransomware revealed EtherRAT, a Node.js backdoor that resolves rotating C2 domains from an Ethereum smart contract, plus Sliver tunnels.

Hunt.io dissects DinDoor, a Tsundere-variant backdoor abusing the Deno runtime: MSI-delivered obfuscated JavaScript, a hardcoded JWT leaking campaign data, and a pivot to 20 active C2 servers.

Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.

An ongoing campaign staging 100+ domains on Aeza servers, linked by reused SSH keys and shared ASN, phishes Kuwaiti fisheries, telecom, and insurance organizations via cloned portals.

Dormant APT34-like infrastructure impersonating an Iraqi academic institute and fake UK tech firms reused SSH keys and port 8080 decoy 404s on M247 servers, offering early warning.