Latrodectus Malware Masquerades as AhnLab Security Software to Infect Victims

Hunt.io shows a simple hunting recipe for Oyster backdoor infrastructure—pivoting from Rapid7's domains via 'Soon.' HTML titles, body hashes and TLS certificate details to surface new C2 servers.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

A step-by-step infrastructure hunting walkthrough: from an AsyncRAT-linked IP, pivoting through ASN data, ports, services and TLS certificates to uncover a wider cluster of systems.

Hunt 2.5 adds a Pivots table tying IPs to certificate subjects, hashes, and TLS fingerprints, 50+ certificate fields in HuntSQL, an Add to Query button, and a downloadable phishing feed.

A newly seen LightSpy server shows an expanded command list targeting Facebook and Instagram database files, as Hunt tracks eight active servers via TLS certificates.

After PupyRAT slipped past its old parser, Hunt.io adopted Google's Certificate Transparency library and added HuntSQL anomaly flags for malformed, expired, and rogue certificates.