Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Tales from the Hunt: A Look at Yakit Security Tool

hunt.io | tool | #china | #red-team-tools | #tls-certificates | #open-directories | #yakit | #yaklang

Summary

Hunt scanned for Yakit's default TLS certificates and found 34 instances of the Yaklang-based platform, mostly on port 8087 and often co-hosted with Viper, SuperShell and Cobalt Strike.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Geacon and Geacon_Pro: A Constant Menace to Linux and Windows Systems
Hunt tracked Geacon_Pro, a Golang Cobalt Strike implementation, via its default 'foren.zik' TLS certificate, surfacing servers and open directories used against Linux and Windows hosts.
blog · hunt.io
A Practical Guide to Uncovering Malicious Infrastructure With Hunt.io
A step-by-step infrastructure hunting walkthrough: from an AsyncRAT-linked IP, pivoting through ASN data, ports, services and TLS certificates to uncover a wider cluster of systems.
blog · hunt.io
Inside China’s Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs
Host Radar found 18,000+ active malware C2 servers across 48 Chinese providers, China Unicom, Alibaba Cloud and Tencent dominating; Mozi, Mirai and Cobalt Strike drive most framework-based abuse.
blog · hunt.io
The Complete Guide to Hunting Cobalt Strike – Part 1: Detecting in Open Directories
Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.
blog · hunt.io
Announcing Hunt 2.5
Hunt 2.5 adds a Pivots table tying IPs to certificate subjects, hashes, and TLS fingerprints, 50+ certificate fields in HuntSQL, an Add to Query button, and a downloadable phishing feed.
blog · hunt.io
LightSpy Malware Now Targets Facebook & Instagram Data
A newly seen LightSpy server shows an expanded command list targeting Facebook and Instagram database files, as Hunt tracks eight active servers via TLS certificates.
back