BlueShell: Four Years On, Still A Formidable Threat

An exposed open directory tied to The Gentlemen ransomware revealed EtherRAT, a Node.js backdoor that resolves rotating C2 domains from an Ethereum smart contract, plus Sliver tunnels.

A step-by-step infrastructure hunting walkthrough: from an AsyncRAT-linked IP, pivoting through ASN data, ports, services and TLS certificates to uncover a wider cluster of systems.

Hunt.io dissects DinDoor, a Tsundere-variant backdoor abusing the Deno runtime: MSI-delivered obfuscated JavaScript, a hardcoded JWT leaking campaign data, and a pivot to 20 active C2 servers.

Hunt 2.5 adds a Pivots table tying IPs to certificate subjects, hashes, and TLS fingerprints, 50+ certificate fields in HuntSQL, an Add to Query button, and a downloadable phishing feed.

A briefly exposed Japanese server hosted a Rust-compiled loader delivering Cobalt Strike 'Cat', plus sqlmap, dirsearch, and Web-SurvivalScan, in attacks on South Korean organizations.

A newly seen LightSpy server shows an expanded command list targeting Facebook and Instagram database files, as Hunt tracks eight active servers via TLS certificates.