Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SolarMarker: Hunt Insights and Findings

hunt.io | blog | #phishing | #infostealer | #ssh-keys | #m247 | #malware-infrastructure | #solarmarker

Summary

Following Recorded Future's report, Hunt identified 20 SolarMarker tier-1 servers on the M247 network, plus SSH keys reused across 100+ hosts and domains spoofing Interac and a payment provider.
Published
Collected

original ↗

Related coverage

blog · hunt.io
APT34-Like Threat Infrastructure Uncovered Before Activation
Dormant APT34-like infrastructure impersonating an Iraqi academic institute and fake UK tech firms reused SSH keys and port 8080 decoy 404s on M247 servers, offering early warning.
blog · hunt.io
Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure
A macOS ClickFix campaign uses fake security prompts to push victims into running AppleScript via Terminal, stealing browser data, crypto wallets, and documents without any download.
blog · hunt.io
Shared SSH Keys Expose Phishing Infrastructure Targeting Kuwait
An ongoing campaign staging 100+ domains on Aeza servers, linked by reused SSH keys and shared ASN, phishes Kuwaiti fisheries, telecom, and insurance organizations via cloned portals.
blog · hunt.io
‘JustJoin’ Landing Page Linked to Suspected DPRK Activity Resurfaces
Hunt.io resurfaces a suspected TA444/BlueNoroff cluster: a server hosting a fake 'JustJoin' macOS app landing page, plus two IPs sharing SSH keys pointing to coordinated DPRK-linked infrastructure.
blog · hunt.io
Rekoobe Backdoor Discovered in Open Directory, Possibly Targeting TradingView Users
Hunt.io unearths APT31-linked Rekoobe backdoor samples in an open directory, pivoting via shared SSH keys to TradingView-lookalike domains that suggest the trading community is in the crosshairs.
blog · hunt.io
WarmCookie Infrastructure Update: Uncovering New C2 Servers and Threats
Hunt.io expands on a WarmCookie C2 server flagged by Gen Threat Labs, using certificate history, HTTP response patterns and shared SSH keys to surface additional hosts tied to the updated backdoor.
back