Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Pentester or Threat Actor? Open Directory Exposes Test Results and Possible Targeting of Government Officials

hunt.io | blog | #pentesting | #credential-theft | #phishing | #espionage | #open-directories | #m247

Summary

Hunt.io examines a 15,923-file server where pentest tools sit alongside credential caches and phishing target lists for government officials in Egypt, Moldova, Nepal, Nigeria, Canada and Ukraine.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight
A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.
blog · hunt.io
Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged
An exposed Hong Kong staging server revealed Hermes, an autonomous AI agent run unattended, an unreported Go implant named Hades, and tooling targeting Thailand's Ministry of Finance.
blog · hunt.io
Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries
Suspected Chinese operators used Claude Code and DeepSeek-v4-pro to breach government systems in Afghanistan, Thailand and Taiwan, and scanned 5,890+ government hosts worldwide.
blog · hunt.io
Iranian-Nexus Operation Against Oman's Government: 12 Ministries Hit and 26,000 Citizen Records Exposed
An exposed UAE-hosted VPS revealed an Iranian-nexus operation against Oman: a webshell on the Justice Ministry, 26,000+ citizen and judicial records stolen, and operator sessions into April 2026.
blog · hunt.io
The Complete Guide to Hunting Cobalt Strike – Part 1: Detecting in Open Directories
Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.
blog · hunt.io
Inside the 2025 Energy Phishing Wave: Chevron, Conoco, PBF, Phillips 66
Over 1,465 energy-sector phishing detections in a year: Chevron, ConocoPhillips, PBF and Phillips 66 cloned via HTTrack, blending credential theft with investment scams, and missed by most vendors.
back