Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Unearthing New Infrastructure by Revisiting Past Threat Reports

hunt.io | blog | #phishing | #seo-poisoning | #open-directories | #gh0st | #silver-fox | #valleyrat

Summary

Hunt revisited a report on Silver Fox phishing against Chinese users and pivoted on its IPs to surface new servers and open directories, linking SEO-poisoned ads to Gh0st, ValleyRAT and Sainbox RATs.
Published
Collected

original ↗

Related coverage

blog · hunt.io
The Complete Guide to Hunting Cobalt Strike – Part 1: Detecting in Open Directories
Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.
blog · hunt.io
630K gov.br Subdomains Abused in SEO Poisoning Attack
Over 630,000 hijacked .gov.br URLs funnel search traffic to gambling and scam pages in a black hat SEO campaign run from a single server with templated HTML and automation scripts.
blog · hunt.io
Uncovering Threat Actor Tactics: How Open Directories Provide Insight into XWorm Delivery Strategies
Using open directories, Hunt.io shows how XWorm RAT samples masquerade as browsers, security tools and file-transfer apps—including a lone SecurityHealthService.exe on a Thai-hosted server.
blog · hunt.io
RunningRAT’s Next Move: From Remote Access to Crypto mining For Profit
Hunt.io spots RunningRAT—previously an access and data-theft tool linked to 2018 Olympics campaigns—now staging crypto-mining payloads via open directories and a separate staging VPS.
blog · hunt.io
Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight
A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.
blog · hunt.io
Rekoobe Backdoor Discovered in Open Directory, Possibly Targeting TradingView Users
Hunt.io unearths APT31-linked Rekoobe backdoor samples in an open directory, pivoting via shared SSH keys to TradingView-lookalike domains that suggest the trading community is in the crosshairs.
back