9 McNuggets & a McChicken burger helped us link a Russian hacker to 🇷🇺 government😅
Denis Obrezko was put on the international wanted listed by Russia, following an FBI arrest in Phuket last November.
Our independent investigation shows Obrezko has closes ties to the Moscow👇
Establishing persistence via creation a SSH tunnel on port 80
Using @Huntio intelligence, we can see the port 80 SSH has been active since July 7th
SSH-80-B28C99448F18AC8DC35214910E0BE900
Interesting reporting on APT28/Fancy Bear by @symantec
"Russian Espionage Group Targets Defense Firms in Two NATO Countries"
security.com/threat-intellig…
👇
Ctrl-Alt-Intel retweeted
A gang stole more than 1,600 logins from Western trucking companies through a phishing website. 🚛
@ctrlaltintel and @beensquatted used OSINT Industries to trace it back to Russian logistics firms.
Read how 👇
ctrlaltintel.com/research/Di…
More information can be found here including some source code:
portal.hunt.io/attackcapture…
⚙️ Persistence
Rootkit: klogd.ko → /etc/bL6qMsQz, loaded by /etc/init.d/bL6qMsQz + /etc/rc3.d/S55bL6qMsQz
Miner: cron */50 runs /etc/kworker/kworker (/etc/cron.d/javae, /etc/crontab) → /etc/javae/javae
Files chattr +ia, ps/top/pstree wrapped to grep out javae
💳 Skimmer: order_custom.js loads a PNG, decodes JS appended after IEND (XOR 0xA7, +0x35), replaces the ps_checkout card form (Woo selectors too), sends form data in gtm= of a fake Google Ads beacon, sets cookie wcpay_session and reloads so the victim re-enters on the real form
On @Huntio OpenDir 144.172[.]118[.]80:443
⛏️ XMRig + ftrace rootkit src
🐚 PHP webshells (Magento paths)
💳 Skimmer hidden in a PNG
🦀 Rust implants posing as systemd-*
Implant C2: update[.]ssl-certificate-verify[.]com
Exfil: google-ad-analytics[.]com, gfhiko[.]xyz
Ctrl-Alt-Intel retweeted
Have I Been Squatted registered аррӏө.com.
It looks like Apple’s website address, but it’s a completely separate domain using different characters.
We registered 20 lookalike .com domains in total as part of our latest research. Here’s what we found.
1/5 ⬇️
Ctrl-Alt-Intel retweeted
Crosshair X RCE: SVG Injection via crosshair-x:// URI and Steam Workshop
Fixed in 15.5.4 by the GOAT Graham from @CenterPointG fixed on the same day on a weekend while moving house 👑
Case 3: A threat actor attempted to exploit Roundcube CVE-2025-49113 against Kyrgyz National Security Service (mail.gknb.gov.kg)
Other known CVEs and public POCs were used by this threat actor to target
Found via 89.124.123[.]216:8080 - @Huntio
Link to full article 👇
Case 2: Kyrgyz Ministry of Foreign Affairs (mfa.gov.kg) web app was compromised to upload VShell and run post-exp
C2 database logs revealed extensive compromise of internal network of Syrian Customs (customs.gov.sy)
Found via 207.148.64[.]94:8083 @Huntio
Case 1: 🇷🇺 Ministry of Emergency Situations (EMERCOM) has previously come up in a previous Ctrl-Alt-Intel blog due to links to YUTEK-NN & Void Blizzard.
In this blog they are being targeted, amongst various other Russian organisations
Found via 45.151.139[.]249:8765 - @Huntio
New blog: Russian and Allied Government Systems Compromised in Targeted Campaigns ❗️
Notable victims include:
- Russian Ministry of Emergency Situations
- Kyrgyz Ministry of Foreign Affairs
- Syrian Government Customs dept.
🧵👇
