Threat Researcher at @Huntio eCTHP | CTIA | CRTO | CRTA DM me for Collaboration on Threat Intel & Hunting 🤝 All Views are my Own⚠️
Joined November 2024
- Tweets936
- Following59
- Followers1.6K
- Likes326
Pinned Tweet
🚨 New #threatintel research using @Huntio🔥
#Three open directories. One #Malaysian VPS. A live breach of #Brazil Federal Botanical Research Institute, plus an intrusion kit already sitting inside a #state #government network.
Blog Link: infrahunter.com/research/a-l…
🚨 #APT #Sidewinder Targets #Nepal Ministry Of Foreign Affairs (MOFA) 🇳🇵
Tracked by @Huntio
🔗https://newnepalmofa-production[.]up[.]railway[.]app/?dnfbnds64438mddnncmxnc=0
cc: @500mk500 @MichalKoczwara @malwrhunterteam
#Malware #ioc
2/ Beyond the known #Tapestry #bypass (CVE-2026-81578 / CVE-2026-82078), the actor’s own notes document a second #RCE path by abusing PaperCut’s XML-RPC API when token/network controls are weak.
Almost 9 hosts from different #countries were targeted in #undocumented Exploit.
3/
A full post-exploitation pipeline: Windows credential/#LSA #harvesting, #PaperCut servers converted into internal network pivots via reverse #SOCKS5, automated #Metasploit exploitation at scale, and ready-to-redeploy “kits” for confirmed victims.
🚨 #APT #Sidewinder Targets #Pakistan #Ordnance #Factories (POF)
Tracked by @Huntio
⚠️https://mail-pof-gov-pk[.govtpak[.workers[.dev
⚠️http://acc0unts-pof-gov-pk-bhisdwhh9hwuwbwdbwd-c0m[.shazad-gids[.workers[.dev
cc: @500mk500 @MichalKoczwara @malwrhunterteam
#APT #Sidewinder second attempt on #Pakistan #Navy
Tracked by @Huntio
https://mail-paknavy-gov-pk-chi[.]vercel[.]app/home/?dgkjshfskdjhghgrehjhvjshdfoerowiuifg=ZG5vMUBwYWtuYXZ5Lmdvdi5waw==
ref: xitter.cf/volrant136/status/2022…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
#APT #Sidewinder Targets #Pakistan #Navy
Interesting!
Using icewarp[.]com ?
Tracked by @Huntio
🔗https://navy-pk-dils-maint213-ifwcnxl4[.]leapcell[.]dev/home/?dgkjshfskdjhghgrehjhvjshdfoerowiuifg=ZG5vMU8wYWtuYXZ5Lmdvdi5waw==
cc: @500mk500 @MichalKoczwara @malwrhunterteam
Excited to share that #InfraHunter is now sponsored by @Huntio 🤝
Independent APT infrastructure hunting and malware research runs on good data, and Hunt.io has been a key part of that toolkit.
Thanks for backing the work.
🔗infrahunter.com
Hunt.io Attack Capture flagged 3 open dirs on a Kuala Lumpur VPS (AS45839) between Aug 27–29.
111.90.145[.]92
@500mk500 @malwrhunterteam @MichalKoczwara
🚨 #APT #Sidewinder Targets #Pakistan National Telecom Corporation (#NTC)
Tracked by @Huntio
hxxps://ntc-net-pk-ochre[.]vercel[.]app/login/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo=1
ref: xitter.cf/volrant136/status/2105…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
🚨 #APT #Sidewinder Targets #Pakistan National Telecom Corporation (#NTC)
Tracked by @Huntio
hxxps://email-pmsa-gov-pk[.]httpx[.]sbs/
ref: xitter.cf/volrant136/status/2088…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
Demon retweeted
🔥 New blog drop! My research introduces UAT-11587, a China-nexus group targeting government and policy organizations in 8 countries with the Antino backdoor. After a preview at @labscon_io, full technical analysis, campaign details & IoCs are now live:
blog.talosintelligence.com/c…
🚨 #APT #Sidewinder Targets #Pakistan National Telecom Corporation (#NTC)
Tracked by @Huntio
hxxps://email-pmsa-gov-pk[.]httpx[.]sbs/
ref: xitter.cf/volrant136/status/2088…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
🚨 #APT #Sidewinder Targets #Pakistan National Telecom Corporation (#NTC)
Tracked by @Huntio
https://ntccc[.]vercel[.]app/login/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo=1
ref:xitter.cf/volrant136/status/2085…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
🚨#Fake Website impersonating #Dhaka North City Corporation (#DNCC) of #Bangladesh
Tracked by @Huntio
⚠️http://erevenue-dncc-gov-bd[.]xyz/
cc: @500mk500 @MichalKoczwara @malwrhunterteam
🚨 #APT #Sidewinder Targets #Nepal Government
Tracked by @Huntio
https://www-nepalgovernment-genz-agendapdf[.]netlify[.]app/
⚠️Exfil:
https://drive-nepal-gov[.]com/pref/pref.php
ref: xitter.cf/volrant136/status/1949…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
#Huntio #Threathunting #Phishing | Possible #APT #Sidewinder targets Nepal Government.
Page Title: "Zimbra Web Client Sign In"
IoCs:
https://mail-mod-gov-np-account-file-data[.]netlify[.]app/bof.html
@500mk500 @Cyberteam008 @ginkgo_g @MichalKoczwara @malwrhunterteam
🚨 #APT #Sidewinder targets #Nepal Ministry of #Finance
🔗https://mail-mof-gov-np[.]netlify[.]app
🕵️Tracked by @Huntio
cc: @500mk500 @MichalKoczwara @malwrhunterteam
Demon retweeted
'PDF20260923_2244 zip' seen from India @abuse_ch
43ab0e61da5313fa1892b203e591342df2b9686cce3d55a42cfc38a1beb1b743
bazaar.abuse.ch/sample/43ab0…
URL: hxxps://gdnkdl.eu(.)cc/files/zjouad.eu.cc.bin
Demon retweeted
Found another Microsoft given cert signed sample that uses Microsoft Azure for C2 communication and fakes traffic as CrowdStrike's "CsAgent/7.04.18110.0". The name is now "Brittany Ann Martin".
asiioasdjasiojasodijasa.eastus.cloudapp\.azure.com
🤷♂️
Demon retweeted
There is a SideWinder APT detected malware sample that is signed using a cert given by Microsoft ("Alysen Mendez"), uses Microsoft Azure for storage & C2 communication, and fakes traffic as CrowdStrike's "CsAgent/7.04.18110.0".
fgjdikfhngkdfngf.eastus.cloudapp\.azure.com
🤷♂️
🚨 Phishing Alert 🚨
Identified a phishing clone impersonating Bangladesh's official govt services portal (mygov.bd).
🔗 mygovt-bd[.]co
🕵️ Tracked by @Huntio
cc: @500mk500 @MichalKoczwara @malwrhunterteam
