Toneshell Backdoor Used to Target Attendees of the IISS Defence Summit

This threat intelligence report documents active targeting of critical national infrastructure and defense contractors through edge application vulnerabilities.

An exposed open directory tied to The Gentlemen ransomware revealed EtherRAT, a Node.js backdoor that resolves rotating C2 domains from an Ethereum smart contract, plus Sliver tunnels.

Hunt.io dissects DinDoor, a Tsundere-variant backdoor abusing the Deno runtime: MSI-delivered obfuscated JavaScript, a hardcoded JWT leaking campaign data, and a pivot to 20 active C2 servers.

Fake download pages on a Hong Kong server distribute backdoored Signal, Line, and Gmail installers to Chinese-speaking users, relying on search engine manipulation rather than lookalike URLs.

Hunt.io follows certificate patterns—'AES' organizational units and shared issuers—to extend infrastructure tied to DarkPeony, a Chinese espionage group targeting governments and militaries.

Hunt.io unearths APT31-linked Rekoobe backdoor samples in an open directory, pivoting via shared SSH keys to TradingView-lookalike domains that suggest the trading community is in the crosshairs.