Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

WarmCookie Infrastructure Update: Uncovering New C2 Servers and Threats

hunt.io | blog | #threat-hunting | #backdoor | #ssh-keys | #c2-infrastructure | #warmcookie | #fakeupdate

Summary

Hunt.io expands on a WarmCookie C2 server flagged by Gen Threat Labs, using certificate history, HTTP response patterns and shared SSH keys to surface additional hosts tied to the updated backdoor.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Rekoobe Backdoor Discovered in Open Directory, Possibly Targeting TradingView Users
Hunt.io unearths APT31-linked Rekoobe backdoor samples in an open directory, pivoting via shared SSH keys to TradingView-lookalike domains that suggest the trading community is in the crosshairs.
blog · hunt.io
The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2
An exposed open directory tied to The Gentlemen ransomware revealed EtherRAT, a Node.js backdoor that resolves rotating C2 domains from an Ethereum smart contract, plus Sliver tunnels.
blog · hunt.io
DinDoor Backdoor: Deno Runtime Abuse and 20 Active C2 Servers
Hunt.io dissects DinDoor, a Tsundere-variant backdoor abusing the Deno runtime: MSI-delivered obfuscated JavaScript, a hardcoded JWT leaking campaign data, and a pivot to 20 active C2 servers.
blog · hunt.io
Shared SSH Keys Expose Phishing Infrastructure Targeting Kuwait
An ongoing campaign staging 100+ domains on Aeza servers, linked by reused SSH keys and shared ASN, phishes Kuwaiti fisheries, telecom, and insurance organizations via cloned portals.
blog · hunt.io
APT34-Like Threat Infrastructure Uncovered Before Activation
Dormant APT34-like infrastructure impersonating an Iraqi academic institute and fake UK tech firms reused SSH keys and port 8080 decoy 404s on M247 servers, offering early warning.
blog · hunt.io
Malicious Signal, Line, and Gmail Installers Target Chinese-Speaking Users with Backdoors
Fake download pages on a Hong Kong server distribute backdoored Signal, Line, and Gmail installers to Chinese-speaking users, relying on search engine manipulation rather than lookalike URLs.
back