Spotting SparkRAT: Detection Tactics & Sandbox Findings

Hunt.io details how to spot SparkRAT servers via default port 8000 and HTTP Basic auth banners, and examines a suspected DPRK macOS campaign tied to the Golang RAT's WebSocket C2 traffic.

Hunt examines current infrastructure for two RATs: the long-lived Gh0st, detected via its 'Gh0st' packet flag, and the newer Go-based Pantegana, which uses customized certificates to evade scanners.

Hunt explains how it identifies, tracks and 'burns' malicious C2 servers using TLS certificates, HTTP headers, SSH keys, JARM/JA4x hashes and TCP banners, seen in Gh0st and ShadowPad cases.

Hunt announces its C2 Feed, covering how the team identifies and tracks malicious command-and-control servers and packages this intelligence to help defenders block adversary infrastructure.

How open directories aid threat hunting and incident response: exposed C2 executables, configs, bash history and RAT logs can reveal victims; Hunt automates finding and pivoting on them.

The launch of Hunt.io: a threat-hunting platform with feeds of active C2 servers across 125+ malware families, open-directory counterintelligence and malicious-infrastructure data.