urlscan.io

🇵🇭 68 GB stolen from a Philippine government agency, exposed by the thief’s own open directory An operator copied 68 GB out of a government agency, logged every byte, then left that log open on the internet. We captured the directory while it was still serving. The log is an rclone transfer record: 68.837 GiB across 27 SQL Server backups, finished in under 24 minutes on 6 September 2026. What else sat in the open directory: - A GodPotato privilege-escalation tool rebuilt and renamed "Wrqsnx," with the pipe, namespace and metadata changed and internal identifiers left intact - A PowerShell stager that rebuilds the payload in memory from base64 fragments, so no DLL touches disk - Two builds from two compilers, plus the full source tree - A complete Impacket environment with LDAP/MSSQL relay checks and a Windows Server 2025 DC filter What we did not find: the initial access vector, a C2 channel, or any confirmed payload execution. The log establishes a completed transfer and the staging of the tooling, nothing past it. Full report + IOCs here 👇 hunt.io/blog/philippine-gove…

🚨 #PHP2Shell (CVE-2026-109618, CVE-2026-109619): everyone is staging the leaked PHP RCE, no one has landed it 🫠 We mapped the exposed PHP footprint and went into the attacker open directories after the Oct 21 leak. What we found: → 683,922 IPs leaking a PHP version in one day of scans, mostly end-of-life builds → ~a dozen open-dir workspaces staging php2shell tooling, zero victims or shells in any of them → one mass operator sprayed up to 123 servers via a ~97-proxy farm, zero shells → scanning started ~20 min after the patch, driven by an existing Mirai-style botnet → no public PoC lands code exec on x86-64 yet (OOM corruption vs ASLR) Patch now: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Full research + network observables: hunt.io/blog/php2shell-cve-2…

🤖𝗡𝗲𝘄 𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵: 𝗜𝗻𝘀𝗶𝗱𝗲 𝗮 𝗣𝗮𝗽𝗲𝗿𝗖𝘂𝘁 𝗔𝘁𝘁𝗮𝗰𝗸𝗲𝗿’𝘀 𝗔𝗜 𝗧𝗼𝗼𝗹𝗸𝗶𝘁: 𝗔𝗴𝗲𝗻𝘁 𝗜𝗻𝘀𝘁𝗿𝘂𝗰𝘁𝗶𝗼𝗻𝘀, 𝗘𝘅𝗽𝗹𝗼𝗶𝘁 𝗖𝗼𝗱𝗲, 𝗮 𝗦𝗲𝗰𝗼𝗻𝗱 𝗥𝗖𝗘, 𝗮𝗻𝗱 𝗩𝗶𝗰𝘁𝗶𝗺𝘀 𝗔𝗰𝗿𝗼𝘀𝘀 𝟰𝟱+ 𝗖𝗼𝘂𝗻𝘁𝗿𝗶𝗲𝘀 After GreyNoise and Blackpoint Cyber published on the PaperCut campaign, our team used AttackCapture to dig into the infrastructure and recovered new intelligence from the operator’s own files. Three open directories on the attacker’s server were still in use when we pulled them What we found: ➜ A second RCE path through PaperCut’s XML-RPC API, independent of the Tapestry vulnerability chain ➜ The full AI agent instructions (19KB, Russian and English) directing a DeepSeek model through OpenAI Codex with up to 25 concurrent subagents ➜ Custom Rust credential collectors targeting Windows LSA secrets, plus chisel/cron persistence for reverse SOCKS5 tunnels ➜ Packaged victim kits covering 46 Active Directory domains, ready for reuse ➜ 1,005 hosts in the recon pool across 45+ countries, with 45 targets confirmed to have live internal pivots at time of capture This wasn’t a smash-and-grab... The operator’s own journal entries show an iterative process: batching targets, retrying failures, debugging tooling, and reorganizing victim lists with minimal human intervention. Our research reconstructs the full pipeline from the attacker’s own files 👇 hunt.io/blog/inside-papercut…

🇧🇷 𝗠𝗮𝗽𝗽𝗶𝗻𝗴 𝗕𝗿𝗮𝗭𝗲𝘁𝘀𝘂 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 𝗕𝗲𝘆𝗼𝗻𝗱 𝘁𝗵𝗲 𝗣𝘂𝗯𝗹𝗶𝘀𝗵𝗲𝗱 𝗜𝗢𝗖𝘀 On 31 August, Group-IB published research on BraZetsu, a Nuitka-compiled Python framework it attributes to the Brazilian actor Exilware. The tool feeds a shop that sells access to compromised Windows hosts. We ran the published indicators against our certificate inventory. Here's what came back: → c2.installscenter[.]com was already serving TLS on a second VPS, 80.78.27[.]252 (Njalla), from 4 April. That's almost five months before the disclosure → The same host presented painel.installscenter[.]com on ports 8083 and 8443, so panel and C2 shared one apex and one IP → The original seed IP switched to a Hestia Control Panel certificate named painel.seu-dominio[.]com in February, seen 17 times through mid-March → From 26 March the C2 hostname resolved to Cloudflare, but the origin kept presenting the same certificates to our scans until June → Hashes rotated across five versions in four months. The painel. and c2. naming on non-standard ports held from February to June The post includes four HuntSQL queries, a timeline, new IOCs, ATT&CK mapping and detection logic. Read the full research 👇 hunt.io/blog/brazetsu-access…

🚩 𝗧𝗵𝗮𝗶 𝗯𝗿𝗼𝗮𝗱𝗯𝗮𝗻𝗱 𝗽𝗿𝗼𝘃𝗶𝗱𝗲𝗿 𝘁𝗮𝗿𝗴𝗲𝘁𝗲𝗱 𝘃𝗶𝗮 𝗙𝗼𝗿𝘁𝗶𝗚𝗮𝘁𝗲 𝗦𝗦𝗟-𝗩𝗣𝗡 𝗮𝗻𝗱 𝗠𝗲𝘀𝗵𝗖𝗲𝗻𝘁𝗿𝗮𝗹 An operator left their staging server open on Thai infrastructure. AttackCapture caught it while the intrusion was still live. Inside was the full picture of an attack against one of Thailand's largest fixed-line broadband providers. 298 files, 30 subdirectories, 19 MB. Recon scripts, exploits, brute-force tooling, a live MeshCentral config, and an inventory of machines the operator already controlled. What the toolkit shows: - CVE-2024-21762 used against a FortiGate 60F SSL-VPN, from fingerprinting to full RCE - MeshCentral set up as a backdoor, agents pointed at the operator's own management server under a dedicated device group - devices.json confirms multiple hosts were enrolled and connected at capture time, agents running as root - The provider's RADIUS databases targeted to pull subscriber credentials - A valid OpenVPN certificate from the provider's own PKI, giving persistent access to the network - A cleanup script staged to wipe logs and exploit files while leaving the MeshCentral agent in place Active session cookies for a second, linked provider point to a parallel operation, so this was not a single-org hit. Full breakdown, IOCs, and MITRE mapping here 👇hunt.io/blog/thai-broadband-…

🇨🇳 🤖 𝗡𝗘𝗪 𝗥𝗘𝗦𝗘𝗔𝗥𝗖𝗛: 𝗖𝗵𝗶𝗻𝗲𝘀𝗲-𝗦𝗽𝗲𝗮𝗸𝗶𝗻𝗴 𝗢𝗽𝗲𝗿𝗮𝘁𝗼𝗿 𝗨𝘀𝗲𝘀 𝗔𝗜 𝗔𝗴𝗲𝗻𝘁𝘀 𝘁𝗼 𝗧𝗮𝗿𝗴𝗲𝘁 𝗚𝗼𝘃𝗲𝗿𝗻𝗺𝗲𝗻𝘁 𝗮𝗻𝗱 𝗘𝗱𝘂𝗰𝗮𝘁𝗶𝗼𝗻 𝗦𝘆𝘀𝘁𝗲𝗺𝘀 𝗔𝗰𝗿𝗼𝘀𝘀 𝗔𝘀𝗶𝗮 Our research team identified five exposed open directories revealing a campaign that used an orchestration framework called SecFlow to coordinate Claude, Qwen, and DeepSeek AI workers across intrusions targeting government, education, consular, and healthcare systems in Asia. Key observations: - A shared SOCKS endpoint connected all five workspaces, confirmed through 120 code-search matches on our platform - The deepest compromise hit a Fengtai District government OA environment: command execution, LSASS dumps, registry hives, 822 account records extracted, and a Go implant called SecBox deployed - A Chinese education AI platform was compromised, exposing 23 agent configurations, production credentials, and student profile data across 169 conversations - SecFlow split reconnaissance, exploitation, and reporting across specialist AI workers, with the runtime swapping between Claude, Qwen, and DeepSeek without changing the task interface - GLUTTON webshells transported executable bytecode inside PNG image pixels using XOR encryption, loading directly into memory while the visible server file remained a generic decoder - A fake MySQL deserialization service delivered Linux second-stage payloads to vulnerable Java clients that connected to it - Eight CVEs in active workflows, including Shellshock, Spring4Shell, Ghostcat, Log4Shell, Shiro deserialization, Grafana and Nexus path traversals, and Nacos authentication bypass - The AI's shared context amplified a false positive: an unsupported Shiro success claim persisted and drove 27+ follow-up tasks that produced nothing This is the second separate campaign we've tracked where commercial AI models were used as operational components in intrusions. Different infrastructure and tooling from our July report, but the same pattern. Read the full report here👇 hunt.io/blog/chinese-operato…

🎥 Operation CameraSwarm: over 14,000 Dahua cameras compromised across Ukraine and Russia NEW RESEARCH: A single operator left their entire working directory exposed on an open HTTP server. We crawled it and recovered 2,616 files, 407 MB, the full toolkit behind a 35-day camera-compromise campaign. The scanning ran global, but the confirmed compromises landed in 🇺🇦 Ukraine and 🇷🇺 Russia, with Ukraine holding the largest share. What we found: → 14,530+ devices compromised in 35 days, the brute-force engine alone reaching 12,324 unique addresses → 1,923 cameras carrying a persistent backdoor account installed over RPC, surviving a password change and, on most firmware, a factory reset → 283 cameras reached by serial number alone through the cloud relay, most requiring no authentication to open a channel → A separate Windows stealer staged on the same host, unrelated to the camera activity → The toolkit assembled from at least six upstream developers' work, not authored from scratch We assess with moderate confidence the toolkit was built to hand access to a third party, based on its transferable recovery-code design and enterprise-format export pipeline. Full breakdown, indicators, and mitigations 👇 hunt.io/blog/operation-camer…