Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Secret Ingredient: Unearthing Suspected SpiceRAT Infrastructure via HTML Response

hunt.io | blog | #threat-hunting | #rat | #c2-infrastructure | #spicerat | #sneakychef

Summary

Hunt.io hunts SpiceRAT C2 servers by fingerprinting a tiny 21-byte HTML response body hash from Talos' report, surfacing five additional IPs tied to the SneakyChef-linked remote access trojan.
Published
Collected

original ↗

Related coverage

blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
Malicious VSCode Extension Launches Multi-Stage Attack Chain with Anivia Loader and OctoRAT
A fake 'prettier-vscode-plus' extension on the official VSCode Marketplace delivered the Anivia loader and OctoRAT—a RAT with 70+ commands—in a supply-chain attack that rotated payloads.
blog · hunt.io
Unlock SSL Intelligence: How SSL History Boosts Threat Hunting
SSL intelligence—certificate issuers, validity and reuse patterns—exposes malicious infrastructure; Hunt.io cites KeyPlug/GhostWolf and Cyberhaven cases where certificate history revealed C2 servers.
blog · hunt.io
Unmasking SparkRAT: Detection & macOS Campaign Insights
Hunt.io details how to spot SparkRAT servers via default port 8000 and HTTP Basic auth banners, and examines a suspected DPRK macOS campaign tied to the Golang RAT's WebSocket C2 traffic.
blog · hunt.io
Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity
Hunt.io finds Cobalt Strike 4.10 team servers carrying a rare watermark (688983459) seen on only five other IPs, with brand-impersonating domains suggesting phishing-focused operations.
blog · hunt.io
Uncovering Threat Actor Tactics: How Open Directories Provide Insight into XWorm Delivery Strategies
Using open directories, Hunt.io shows how XWorm RAT samples masquerade as browsers, security tools and file-transfer apps—including a lone SecurityHealthService.exe on a Thai-hosted server.
back