Newest hunt packs. One self-contained CrowdStrike CQL playbook per threat. https://slapopotamus.github.io/HuntPack/ 2026-08-05T00:00:00Z HuntPack https://slapopotamus.github.io/HuntPack/hunts/DOUBLECUP-ClickFix-LaaS-Hunt.html 2026-08-05T00:00:00Z 2026-08-05T00:00:00Z

Steganographic browser-cache delivery, IP-keyed in-memory decryption, CountLoader 4.5p and the DeviceManager Python RAT

https://slapopotamus.github.io/HuntPack/hunts/SmokeScreen-ScreenConnect-FakeUpdate-Hunt.html 2026-08-05T00:00:00Z 2026-08-05T00:00:00Z

A multi-wave, multi-lure campaign that ends with a genuine ConnectWise-signed ScreenConnect agent beaconing to one of three attacker relays. Windows and macOS.

https://slapopotamus.github.io/HuntPack/hunts/CaptiveCrunch-Storm2945-Hunt.html 2026-08-04T00:00:00Z 2026-08-04T00:00:00Z

Hospitality-network captive portals manipulated to deliver the CornFlake Go RAT and the ChocoShell PowerShell infostealer, then pivot to Microsoft 365 via Entra device code phishing.

https://slapopotamus.github.io/HuntPack/hunts/STAC4749-TeamsVishing-Chaos-Hunt.html 2026-08-04T00:00:00Z 2026-08-04T00:00:00Z

Fake IT-helpdesk Teams calls into Quick Assist / RemSupp remote support, a PowerShell-staged Python and Golang implant chain, then Chaos ransomware in under 17 hours.

https://slapopotamus.github.io/HuntPack/hunts/N-able-N-central-CVE-2026-18577-Hunt.html 2026-08-03T00:00:00Z 2026-08-03T00:00:00Z

CVE-2026-18556 → CVE-2026-18577 (incomplete patch) · exploited in the wild · fixed in build 2026.3.1.7 (2026-08-02)

https://slapopotamus.github.io/HuntPack/hunts/Joyfill-npm-SupplyChain-Hunt.html 2026-08-02T00:00:00Z 2026-08-02T00:00:00Z

Malicious 2773 beta builds of @joyfill/components and @joyfill/layouts ship a five-stage chain: obfuscated in-bundle loader → blockchain C2 resolver → two staged downloaders → Socket.IO RAT with worm-like self-propagation → Python credential stealer. The payload runs on import , so npm install --ignore-scripts does not stop it.

https://slapopotamus.github.io/HuntPack/hunts/HollowFrame-Matryoshka-Hunt.html 2026-08-01T00:00:00Z 2026-08-01T00:00:00Z

Go-based modular loader framework delivering a two-variant Rust backdoor family via LNK phishing, Defender tampering and a chained DLL side-load. Reported by Blackpoint Cyber APG, 2026-07-30.

https://slapopotamus.github.io/HuntPack/hunts/MacSync-Stealer-macOS-Hunt.html 2026-08-01T00:00:00Z 2026-08-01T00:00:00Z

A malvertised Google Ads result pushes victims to a weaponised claude.ai/share conversation badged "Shared by Apple Support" that tells them to paste a curl -k … | zsh one-liner into Terminal. Six stages follow: a polymorphic zsh loader, a server-side AppleScript stealer, a native Mach-O RAT, a separately signed Screen Recording TCC helper, and in-place trojanisation of Ledger and Trezor wallet apps that phish the recovery seed phrase.

https://slapopotamus.github.io/HuntPack/hunts/GitHubActions-cPanel-CVE-2026-41940-Hunt.html 2026-07-31T00:00:00Z 2026-07-31T00:00:00Z

Poisoned .github/workflows turn ephemeral GitHub-hosted runners into an internet-scale scanner for CVE-2026-41940, then harvest cloud, payment and source-control credentials from compromised hosting servers.

https://slapopotamus.github.io/HuntPack/hunts/WebDAVDeliveryLab-SearchMS-PureRAT-Hunt.html 2026-07-31T00:00:00Z 2026-07-31T00:00:00Z

Fileless infostealer & modular .NET RAT delivered through a phishing-triggered search-ms: URI that opens a remote WebDAV share. Documented by Rapid7 Labs from an exposed operator server (the "Simba Panel"), 2026-07-20.

https://slapopotamus.github.io/HuntPack/hunts/Arista-VeloCloud-CVE-2026-16812-Hunt.html 2026-07-30T00:00:00Z 2026-07-30T00:00:00Z

Unauthenticated OS command injection (CWE-78) in the VCO web tier, CVSS 10.0, exploited in the wild as a zero-day. CISA KEV due date 2026-07-30.

https://slapopotamus.github.io/HuntPack/hunts/Certighost-CVE-2026-54121-ADCS-Hunt.html 2026-07-30T00:00:00Z 2026-07-30T00:00:00Z

A low-privileged domain user steers the AD CS enrollment "chase" at an attacker-controlled host, is issued a certificate for a Domain Controller, and DCSyncs the krbtgt secret. Behavioral hunt pack — public PoC, no published C2 infrastructure.

https://slapopotamus.github.io/HuntPack/hunts/Cruciferra-Crypter-Hunt.html 2026-07-29T00:00:00Z 2026-07-29T00:00:00Z

Hunting the loader, not the customer: BYOVD EDR termination, indirect syscalls, API/IAT unhooking, COM Elevation Moniker UAC bypass, and a tweaked Process Ghosting chain shared across a dozen unrelated commodity-malware crews.

https://slapopotamus.github.io/HuntPack/hunts/NimbusManticore-NightLedger-Hunt.html 2026-07-29T00:00:00Z 2026-07-29T00:00:00Z

Iranian state-aligned espionage against aerospace, aviation, defence, telecom, government and financial targets across the Middle East and Africa. The implants invert the C2 direction and turn the victim endpoint into an operator relay.

https://slapopotamus.github.io/HuntPack/hunts/AgentBaiting-SmartLoader-Hunt.html 2026-07-28T00:00:00Z 2026-07-28T00:00:00Z

Roughly 7,600 malicious GitHub repositories, 800+ posing as AI Skills or Model Context Protocol servers, funnelling a LuaJIT-based loader and the StealC infostealer into developer and agent workflows.

https://slapopotamus.github.io/HuntPack/hunts/LaundryBear-Zimbra-CVE-2025-66376-Hunt.html 2026-07-28T00:00:00Z 2026-07-28T00:00:00Z

Russian state-supported email collection via the Ulej / ZimReaper browser-resident stealer, DNS + HTTPS dual-channel exfiltration, and a “ZimbraWeb” app-specific password that survives a password reset.

https://slapopotamus.github.io/HuntPack/hunts/APT42-TAMECAT-SpearSpecter-Hunt.html 2026-07-27T00:00:00Z 2026-07-27T00:00:00Z

IRGC-IO espionage against senior defense & government officials: AI-assisted relationship phishing, search-ms/WebDAV delivery, and a fileless modular PowerShell implant with Telegram, Discord and Cloudflare Workers C2.

https://slapopotamus.github.io/HuntPack/hunts/GoldenChickens-TAG195-TinyEgg-Hunt.html 2026-07-27T00:00:00Z 2026-07-27T00:00:00Z

ClickFix-delivered OCX implants executed via regsvr32, WinComCtl Run-key persistence, WebSocket C2, Chrome App-Bound-Encryption bypass and live CDP browser-session hijack.

https://slapopotamus.github.io/HuntPack/hunts/SourTrade-BrowserAssembled-Malvertising-Hunt.html 2026-07-26T00:00:00Z 2026-07-26T00:00:00Z

Cloaked landing pages make the victim's browser assemble a unique Windows PE in memory from a clean Bun runtime, so no finished malware ever crosses the network and every victim gets a different hash.

https://slapopotamus.github.io/HuntPack/hunts/TELESHIM-MiddleEast-Gov-Hunt.html 2026-07-26T00:00:00Z 2026-07-26T00:00:00Z

Multi-stage DLL-sideloading intrusion set against Middle East government entities, using the Telegram Bot API as a command-and-control dead drop. East Asia-linked, unattributed.

https://slapopotamus.github.io/HuntPack/hunts/TrickBot-DNSTunnel-Hunt.html 2026-07-25T00:00:00Z 2026-07-25T00:00:00Z

Modular Windows loader that abandons HTTP C2 for a custom DNS tunnelling transport · FortiGuard Labs, 2026-07-22

https://slapopotamus.github.io/HuntPack/hunts/UAC0099-LunchPoke-Notepad-Hunt.html 2026-07-25T00:00:00Z 2026-07-25T00:00:00Z

A Russia-aligned cluster that has previously handed initial access to APT44 / Sandworm now ships a complete, legitimate copy of Notepad++ 8.8.3 to the victim and lets the editor's own plugin loader run the malware. There is no exploit and no supply-chain compromise in this chain: the trust boundary being crossed is "a signed application loaded a DLL that happened to be sitting in its plugins folder". Detection therefore has to live in process lineage, write location and scheduled-task shape, not in a CVE.

https://slapopotamus.github.io/HuntPack/hunts/JadeProx-TriBack-Loader-Hunt.html 2026-07-24T00:00:00Z 2026-07-24T00:00:00Z

China-nexus espionage cluster running DLL-sideloading loaders against government, healthcare and education targets in South-East Asia and Latin America. Hunt, detect and harden.

https://slapopotamus.github.io/HuntPack/hunts/wp2shell-CVE-2026-63030-Hunt.html 2026-07-24T00:00:00Z 2026-07-24T00:00:00Z

CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (WP_Query author__not_in SQL injection) · exploited in the wild since 2026-07-17

https://slapopotamus.github.io/HuntPack/hunts/ChaosMsaRAT-BrowserC2-Hunt.html 2026-07-24T00:00:00Z 2026-07-24T00:00:00Z

A Rust implant that never touches the network. It launches its own headless Chrome or Edge, drives it over the Chrome DevTools Protocol, and lets the browser carry the C2 out through Cloudflare Workers and a Twilio TURN relay.

https://slapopotamus.github.io/HuntPack/hunts/FakeAgent-ClaudeArtifact-SectopRAT-Hunt.html 2026-07-24T00:00:00Z 2026-07-24T00:00:00Z

Malvertising campaign documented by Huntress on 2026-07-22: a Bing sponsored ad for "Claude Desktop app" pointed at a malicious public Claude Artifact hosted on the legitimate claude.ai domain (7,100 views before Anthropic removed it) → redirect to a fake installer → ClaudeDesktop.exe , which is a renamed JetBrains jcef_helper.exe CEF host used purely as a DLL-sideloading vessel for a VMProtect-packed libcef.dll → second-stage IBM SPSS sslconf.exe + tempdir.dll staged in an EdgeUpdate\Install path with a GPU/DXGI anti-VM gate and a DirectX-shader AES-256-CTR decryptor → SectopRAT (ArechClient2) with EtherHiding C2 resolution off BNB Smart Chain. 29 organizations compromised 2026-07-21 to 2026-07-22. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/Interlock-CORNFLAKE-Hunt.html 2026-07-24T00:00:00Z 2026-07-23T00:00:00Z

ClickFix → in-memory CORNFLAKE (Node.js persistence) → RHYSIDA-linked hands-on-keyboard → offline ntds.dit theft → Interlock ransomware & extortion. GTI campaign CAMP.26.095.

https://slapopotamus.github.io/HuntPack/hunts/Spirals-Ransomware-Hunt.html 2026-07-23T00:00:00Z 2026-07-23T00:00:00Z

Break-in to network-wide encryption in under 24 hours. IIS/ASP.NET web shell, redundant tunneling, PsExec-as-SYSTEM deployment.

https://slapopotamus.github.io/HuntPack/hunts/AzureCLI-ROPC-PasswordSpray-Hunt.html 2026-07-22T00:00:00Z 2026-07-22T00:00:00Z

A large-scale, automated identity password-spray campaign (reported by Huntress, surfaced 2026-07) that abuses the deprecated OAuth 2.0 Resource Owner Password Credentials (ROPC) flow via the Microsoft Azure CLI public client to validate previously-breached credential pairs against Entra ID / Microsoft 365. ROPC sends the password straight to the /token endpoint with no interactive MFA prompt , slipping past Conditional Access policies that don't cover the ROPC / Azure-CLI path. 81M+ login attempts, 78 accounts compromised across 64 organizations. This is an identity / IdP hunt — distinct from device-code phishing. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/GoSerpent-Hunt.html 2026-07-22T00:00:00Z 2026-07-22T00:00:00Z

A previously undocumented Go-based backdoor and integrated toolset (GoSerpent → ThumbcacheService → Stowaway → TmcLoader/TmcPayload) used against government and diplomatic entities in Southeast Asia. Active since ~2021, evolved through 2025–2026. Disclosed by Kaspersky / Securelist on 2026-07-16; possible overlap with the TetrisPhantom actor.

https://slapopotamus.github.io/HuntPack/hunts/Mistic-Backdoor-Hunt.html 2026-07-22T00:00:00Z 2026-06-25T00:00:00Z

Stealthy Windows backdoor masquerading as Microsoft endpoint-security tooling, deployed by ransomware initial-access broker Woodgnat / KongTuke .

https://slapopotamus.github.io/HuntPack/hunts/Daxin-Stupig-PreLogin-Hunt.html 2026-07-21T00:00:00Z 2026-07-21T00:00:00Z

China-linked espionage resurfaces in Taiwan: a 13-year-dormant Daxin kernel rootkit alongside "Stupig," a trojanized keyboard-layout DLL that runs commands as SYSTEM from the Windows logon screen — before any user signs in.

https://slapopotamus.github.io/HuntPack/hunts/HollowGraph-M365Calendar-Hunt.html 2026-07-21T00:00:00Z 2026-07-21T00:00:00Z

A .NET NativeAOT DLL implant that uses a compromised M365 mailbox calendar (via Graph API) as a two-way dead drop, with a DNS AAAA-record credential-refresh channel to cloudlanecdn[.]com. High-confidence code overlap with the Cavern framework; Group-IB does not confidently attribute.

https://slapopotamus.github.io/HuntPack/hunts/GoldenEyeDog-DigiCert-Hunt.html 2026-07-20T00:00:00Z 2026-07-20T00:00:00Z

Stolen DigiCert EV code-signing certificates used to sign Golden Gh0st Loader / Golden Gh0st RAT (Gh0st RAT / Farfli lineage) · disclosed 2026-07-17

https://slapopotamus.github.io/HuntPack/hunts/UAC0145-ClickFix-Hunt.html 2026-07-20T00:00:00Z 2026-07-20T00:00:00Z

Compromised-website fake-CAPTCHA lures delivering GHETTOVIBE, SCOUTCURL, FLUIDLEECH, LOADLOOP, FREAKYPOLL, SMARTAXE and COWARDDUCK

https://slapopotamus.github.io/HuntPack/hunts/StarlandRAT-UAT11795-Hunt.html 2026-07-19T00:00:00Z 2026-07-19T00:00:00Z

Trojanized software installers deliver a Python RAT, a bespoke in-memory PowerShell C2 agent, CastleStealer and Remcos RAT — credential and cryptocurrency theft against US and European targets.

https://slapopotamus.github.io/HuntPack/hunts/DEBULL-DeviceCodePhishing-Hunt.html 2026-07-19T00:00:00Z 2026-07-19T00:00:00Z

Phishing-as-a-Service tooling that abuses the OAuth 2.0 Device Authorization Grant to take over M365 / Entra ID accounts — no password stolen, MFA bypassed.

https://slapopotamus.github.io/HuntPack/hunts/OperationDragonReturn-Hunt.html 2026-07-19T00:00:00Z 2026-07-11T00:00:00Z

aka the fake Indian ITR notice / DcRAT dual-RAT campaign — Seqrite Labs named it Operation DragonReturn ; Cyderes Howler Cell and The Hacker News reported the same activity as the fake Income Tax Return notice chain. One campaign, two vendor names A signed Indian tax-utility executable side-loads nvdaHelperRemote.dll , driving a six-stage in-memory chain that injects a Gh0st/DcRAT derivative and an AsyncRAT/Quasar-family .NET implant into svchost.exe across every logged-in session, over two separate C2 channels.

https://slapopotamus.github.io/HuntPack/hunts/ACR-Stealer-ClickFix-Hunt.html 2026-07-18T00:00:00Z 2026-07-18T00:00:00Z

Infostealer-as-a-service delivered by ClickFix lures · WebDAV + rundll32 chain and MSHTA + steganography chain · Browser token and Microsoft 365 document theft

https://slapopotamus.github.io/HuntPack/hunts/NadMesh-Botnet-AI-Infra-Hunt.html 2026-07-24T00:00:00Z 2026-07-18T00:00:00Z

Go-based mesh botnet harvesting cloud keys and Kubernetes service-account tokens from exposed AI/dev services · Linux & container-centric hunt pack

https://slapopotamus.github.io/HuntPack/hunts/ADFS-CVE-2026-56155-GoldenSAML-Hunt.html 2026-07-24T00:00:00Z 2026-07-17T00:00:00Z

Over-permissive DKM container ACL lets an authorized attacker recover the AD FS token-signing key and forge SAML tokens accepted by every federated service. Actively exploited in-the-wild.

https://slapopotamus.github.io/HuntPack/hunts/SharePoint-CVE-2026-58644-Deserialization-Hunt.html 2026-07-24T00:00:00Z 2026-07-17T00:00:00Z

Deserialization of untrusted data (CVSS 9.8) lets a Site-Owner-authenticated attacker execute arbitrary code on on-prem SharePoint. Exploited as a zero-day; post-ex = IIS machine-key theft & ViewState persistence.

https://slapopotamus.github.io/HuntPack/hunts/MODBEACON-SilverFox-Hunt.html 2026-07-24T00:00:00Z 2026-07-16T00:00:00Z

China-nexus "Silver Fox" (SwimSnake / UTG-Q-1000 / Void Arachne). Rust, memory-resident, gRPC-over-HTTP/2 TLS C2 fronted through public CDN. Delivered by SEO-poisoned counterfeit installers.

https://slapopotamus.github.io/HuntPack/hunts/SharePoint-CVE-2026-56164-Hunt.html 2026-07-24T00:00:00Z 2026-07-16T00:00:00Z

Unauthenticated network privilege escalation → RCE on on-prem SharePoint. Actively exploited in-the-wild; IIS machine-key theft & deserialization persistence.

https://slapopotamus.github.io/HuntPack/hunts/Joomla-iCagenda-Balbooa-FileUpload-Hunt.html 2026-07-24T00:00:00Z 2026-07-15T00:00:00Z

CVE-2026-48939 (iCagenda) & CVE-2026-56291 (Balbooa Forms) — two CVSS 10.0 unauthenticated file-upload zero-days exploited to drop PHP webshells on public Joomla sites. CISA KEV.

https://slapopotamus.github.io/HuntPack/hunts/SonicWall-SMA1000-CVE-2026-15409-Hunt.html 2026-07-24T00:00:00Z 2026-07-15T00:00:00Z

Unauthenticated SSRF chained to code injection for admin-level command execution on internet-facing SMA 1000 SSL-VPN appliances — exploited in the wild, CISA KEV.

https://slapopotamus.github.io/HuntPack/hunts/LiteLLM-CVE-2026-42271-Hunt.html 2026-07-14T00:00:00Z 2026-07-14T00:00:00Z

CVE-2026-42271 (MCP stdio test-endpoint command injection) chained with CVE-2026-48710 (Starlette "BadHost" host-header bypass) → pre-auth RCE on the proxy host · combined CVSS 10.0 · CISA KEV 2026-06-08

https://slapopotamus.github.io/HuntPack/hunts/PaymentSDK-npm-PyPI-SupplyChain-Hunt.html 2026-07-14T00:00:00Z 2026-07-14T00:00:00Z

21 malicious packages impersonating PaySafe / Skrill / Neteller SDKs harvest CI/CD and cloud secrets from developer & build hosts, exfiltrating to an ngrok tunnel · published 2026-07-07 · detected by Socket within ~6 min

https://slapopotamus.github.io/HuntPack/hunts/GodDamn-Ransomware-PoisonX-BYOVD-Hunt.html 2026-07-13T00:00:00Z 2026-07-13T00:00:00Z

Hands-on-keyboard intrusion by the Hyadina RaaS crew (Monster 2022 → Beast 2024 → GodDamn 2026): AnyDesk staged in the user Music folder for unattended remote access → NirSoft + Mimikatz credential sweep → a Microsoft-signed malicious kernel driver (PoisonX, g11.sys ) that terminates AV/EDR and strips kernel callbacks to blind the sensor → a fake symantec.exe masquerade → PsExec lateral movement → the encrypter-windows-gui-x86.exe locker appending .God8Damn . Disclosed by Symantec 2026-07-09. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/Vidar-XMRig-Malvertising-Hunt.html 2026-07-13T00:00:00Z 2026-07-13T00:00:00Z

Financially-motivated dual-payload campaign (operator "X3D MINER") documented by Palo Alto Unit 42 on 2026-07-09: malvertising for cracked software → a password-protected .bin archive → a Factory-v3 (UpdateFactory) Go loader, rogue code-signed and file-inflated to ~491 MB to evade sandboxes → fake MpClient.dll sideloaded by a legitimate Windows Defender binary → AMSI patch → drops Vidar stealer ( MicrosoftUpdate.exe ) and XMRig ( MicrosoftEdgeUpdate.exe --config=mgwthmc2.dat + WinRing0x64.sys ) → persistence as SystemAgentService masquerading as NisSrv.exe . Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/CVE-2026-48908-SPPageBuilder-Hunt.html 2026-07-12T00:00:00Z 2026-07-12T00:00:00Z

CVSS 10.0 · exploited as a zero-day · unauthenticated asset.uploadCustomIcon drops a PHP web shell into the web root → OS command execution & hidden Super Admin. Linux web-server telemetry hunt.

https://slapopotamus.github.io/HuntPack/hunts/JADEPUFFER-AgenticRansomware-Langflow-Hunt.html 2026-07-12T00:00:00Z 2026-07-12T00:00:00Z

Autonomous LLM-agent extortion operation: Langflow RCE (CVE-2025-3248) → credential sweep → Nacos/MySQL pivot → database encryption & destruction. Linux/container telemetry hunt.

https://slapopotamus.github.io/HuntPack/hunts/InjectiveLabs-npm-SupplyChain-Hunt.html 2026-07-24T00:00:00Z 2026-07-11T00:00:00Z

A trusted maintainer's identity was used to publish a backdoored @injectivelabs/sdk-ts@1.20.21 (plus 17 scoped packages) that steals crypto wallet mnemonics and private keys — a ~49-minute window on 2026-07-08.

https://slapopotamus.github.io/HuntPack/hunts/QuimaRAT-Hunt.html 2026-07-24T00:00:00Z 2026-07-10T00:00:00Z

Modular Java/JNA remote access trojan sold as malware-as-a-service ($150/mo–$1,200 lifetime); runs on Windows, Linux, and macOS with per-OS persistence, AES-256 C2, and a Pastebin-based C2-rotation channel.

https://slapopotamus.github.io/HuntPack/hunts/TinyRCT-CL-STA-1062-Hunt.html 2026-07-24T00:00:00Z 2026-07-10T00:00:00Z

Chinese-speaking espionage cluster against Southeast Asian government & state-owned energy / critical infrastructure — C# RAT delivered via AppDomainManager injection, PerfWatson2.exe masquerade, and ASPX web shells.

https://slapopotamus.github.io/HuntPack/hunts/CVE-2026-56290-Joomla-PageBuilderCK-Hunt.html 2026-07-24T00:00:00Z 2026-07-09T00:00:00Z

CVSS 10.0 unauthenticated arbitrary file upload in the Joomlack Page Builder CK extension (com_pagebuilderck). Attackers drop PHP webshells into web-served folders and execute them — actively exploited, CISA KEV (due 2026-07-10).

https://slapopotamus.github.io/HuntPack/hunts/PolinRider-Hunt.html 2026-07-24T00:00:00Z 2026-07-09T00:00:00Z

108 packages / 162 malicious release artifacts across npm, Packagist, Go modules and Chrome — JS loaders hidden in config files and VS Code folderOpen tasks pull an XOR-encrypted stage-2 from blockchain RPC dead-drops, delivering the DEV#POPPER RAT and OmniStealer.

https://slapopotamus.github.io/HuntPack/hunts/ColdFusion-CVE-2026-48282-Hunt.html 2026-07-24T00:00:00Z 2026-07-08T00:00:00Z

Maximum-severity arbitrary file write in the ColdFusion Remote Development Services (RDS) FILEIO handler, exploited in the wild within ~2 hours of disclosure. Hunt for webshell drops and ColdFusion-JVM-spawned command execution.

https://slapopotamus.github.io/HuntPack/hunts/TeamPCP-SupplyChain-Hunt.html 2026-07-24T00:00:00Z 2026-07-08T00:00:00Z

Trojanized developer & security tooling (Trivy, KICS, LiteLLM, Telnyx Python SDK) delivering credential-stealing malware — CanisterWorm, SANDCLOCK, Mini Shai-Hulud, Miasma — that harvests cloud tokens, SSH keys, and Kubernetes secrets from CI/CD and developer hosts.

https://slapopotamus.github.io/HuntPack/hunts/CavernManticore-Hunt.html 2026-07-24T00:00:00Z 2026-07-07T00:00:00Z

MOIS-affiliated espionage cluster deploying a modular .NET C2 (Cavern Agent = trojanized uxtheme.dll) against Israeli government & IT-services orgs · analysed by Check Point Research, July 2026

https://slapopotamus.github.io/HuntPack/hunts/ChocoPoC-RAT-Hunt.html 2026-07-24T00:00:00Z 2026-07-07T00:00:00Z

Trojanized "proof-of-concept" repos for hot CVEs pull in a compiled payload (skytext → gradient.so / gradient.pyd) that steals credentials and beacons via a Mapbox dataset dead-drop · targets vulnerability researchers & pentesters · YesWeHack + Sekoia, July 2026

https://slapopotamus.github.io/HuntPack/hunts/BusySnake-ArmoredLikho-Hunt.html 2026-07-06T00:00:00Z 2026-07-06T00:00:00Z

A Python-based information stealer (Kaspersky Securelist, July 2026) deployed by the espionage actor Armored Likho against government agencies and electric-power operators in Russia, Kazakhstan and Brazil. Spear-phishing delivers a decoy-laden NSIS EXE dropper (or a ZDI-CAN-25373 LNK variant) that injects into pnx.exe , pulls a Python 3.12 runtime + module.pyw payload from GitHub into %APPDATA%\WindowsHelper , and persists via a WindowsHelper scheduled task. BusySnake loots Chromium/Firefox credentials, cookies, Telegram tdata , crypto wallets and 2FA secrets, then opens a reverse SSH tunnel + RustDesk for hands-on access. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/RustDuck-Botnet-Hunt.html 2026-07-06T00:00:00Z 2026-07-06T00:00:00Z

A two-stage DDoS botnet (QiAnXin XLab, June 2026) that has been rewritten from C into Rust — a small loader decrypts and unpacks a heavier Rust core with ChaCha20-Poly1305/AES-GCM channels, Curve25519 key exchange, 10-minute key rotation, and aggressive sandbox/analysis evasion. It spreads by weak/default Telnet & SSH credentials and by exploiting known bugs in routers, DVRs and Linux server software ( ThinkPHP, Jenkins, Hadoop YARN, Apache CouchDB ) to enlist routers, IP cameras, Android boxes and poorly-secured servers into a DDoS swarm. C2 rides duckdns.org dynamic DNS; 20+ delivery IPs are active, busiest at 176.65.139[.]204 . Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/CVE-2026-8451-NetScaler-SAML-Hunt.html 2026-07-24T00:00:00Z 2026-07-05T00:00:00Z

Unauthenticated out-of-bounds read in the NetScaler ADC / Gateway SAML IDP path leaks appliance memory — including session material — via the NSC_TASS response cookie. Exploited in the wild within 24 hours of disclosure.

https://slapopotamus.github.io/HuntPack/hunts/Edgecution-EdgeExtension-Backdoor-Hunt.html 2026-07-24T00:00:00Z 2026-07-05T00:00:00Z

A ClickFix/Teams social-engineering chain sideloads an Edge extension ("Edge Monitoring Agent") that abuses the Chrome Native Messaging protocol to break the browser sandbox and drive an embedded-Python backdoor. Deployed by an initial-access broker linked to the Payouts King ransomware operation.

https://slapopotamus.github.io/HuntPack/hunts/Avalon-CrownX-Hunt.html 2026-07-24T00:00:00Z 2026-07-04T00:00:00Z

Multi-stage phishing → ISO/LNK → MSBuild loader delivering an all-in-one credential-theft + lateral-movement + ransomware framework · disclosed by The Hacker News, July 2026

https://slapopotamus.github.io/HuntPack/hunts/ToddyCat-Umbrij-STRD-Hunt.html 2026-07-24T00:00:00Z 2026-07-04T00:00:00Z

Asia-nexus espionage actor stealing Gmail / Google Workspace mail by driving a headless browser's remote-debugging port to mint OAuth tokens · analysed by Kaspersky Securelist, July 2026

https://slapopotamus.github.io/HuntPack/hunts/ScreenConnect-AsyncRAT-SEO-Hunt.html 2026-07-24T00:00:00Z 2026-07-03T00:00:00Z

Fake software installers (OBS Studio, Bandicam, DS4Windows) side-load a rogue DLL, deploy a rogue ScreenConnect instance, then process-hollow RegAsm.exe with AsyncRAT.

https://slapopotamus.github.io/HuntPack/hunts/SharePoint-CVE-2026-45659-Hunt.html 2026-07-24T00:00:00Z 2026-07-03T00:00:00Z

Deserialization-of-untrusted-data RCE in on-prem SharePoint. Added to CISA KEV 2026-07-01 (federal deadline 2026-07-05). Site-Member auth is enough to run code as the SharePoint app pool.

https://slapopotamus.github.io/HuntPack/hunts/KempLoadMaster-CVE-2026-8037-Hunt.html 2026-07-24T00:00:00Z 2026-07-02T00:00:00Z

Uninitialized-heap OS command injection in the LoadMaster API — unauthenticated root code execution on the load balancer appliance.

https://slapopotamus.github.io/HuntPack/hunts/MustangPanda-ZOHOMURK-Hunt.html 2026-07-24T00:00:00Z 2026-07-02T00:00:00Z

China-aligned espionage: DLL side-loading through signed binaries, a Toneshell-lineage backdoor, and a Zoho WorkDrive cloud C2 that hides in normal SaaS traffic.

https://slapopotamus.github.io/HuntPack/hunts/ScatteredSpider-Hunt.html 2026-07-01T00:00:00Z 2026-07-01T00:00:00Z

Financially-motivated intrusion set that weaponizes the help desk. Initial access comes from vishing, SIM-swaps, MFA push-bombing and AiTM phishing rather than malware — so the highest-value hunt angles are identity abuse, legitimate remote-access tooling, and BYOVD EDR tampering, not signatures. Culminates in cloud/SaaS data theft and DragonForce ransomware (frequently ESXi-targeting).

https://slapopotamus.github.io/HuntPack/hunts/Oracle-EBS-CVE-2026-46817-Hunt.html 2026-07-24T00:00:00Z 2026-07-01T00:00:00Z

Unauthenticated RCE in the Oracle Payments File Transmission component ( /OA_HTML/ibytransmit ) via crafted iPayment XML → local file read / code execution on the EBS app tier · CVSS 9.8 · exploitation observed 2026-06-27/28

https://slapopotamus.github.io/HuntPack/hunts/PTC-Windchill-CVE-2026-12569-Hunt.html 2026-07-24T00:00:00Z 2026-07-01T00:00:00Z

Unauthenticated deserialization of untrusted data in the Windchill PDMLink component → remote code execution → persistent JSP web shells for command execution and data exfiltration · KEV-listed 2026-06-25

https://slapopotamus.github.io/HuntPack/hunts/BlueHammer-CVE-2026-33825-Hunt.html 2026-07-24T00:00:00Z 2026-06-30T00:00:00Z

A TOCTOU race in Defender's threat-remediation engine, abused with oplocks + NTFS junctions to write into System32 as SYSTEM and reach the SAM database. Now used by ransomware crews for privilege escalation and credential access.

https://slapopotamus.github.io/HuntPack/hunts/SimpleHelp-CVE-2026-48558-Djinn-Hunt.html 2026-07-24T00:00:00Z 2026-06-30T00:00:00Z

OIDC authentication bypass in SimpleHelp RMM (CVSS 10.0) abused to push a Node.js loader and a cross-platform credential stealer onto managed endpoints.

https://slapopotamus.github.io/HuntPack/hunts/STOCKSTAY-Turla-Hunt.html 2026-07-24T00:00:00Z 2026-06-29T00:00:00Z

Russia-nexus espionage implant against Ukrainian government/military and European foreign-policy targets · disclosed by Google Threat Intelligence Group (GTIG), June 2026

https://slapopotamus.github.io/HuntPack/hunts/SharkLoader-StrikeShark-Hunt.html 2026-07-24T00:00:00Z 2026-06-29T00:00:00Z

Espionage-oriented intrusion set exploiting internet-facing apps to side-load a stealthy loader that deploys Cobalt Strike Beacon · tracked by Kaspersky (Securelist), June 2026

https://slapopotamus.github.io/HuntPack/hunts/Phexia-Stealer-macOS-ClickFix-Hunt.html 2026-06-29T00:00:00Z 2026-06-26T00:00:00Z

Fake-CAPTCHA "ClickFix" lure → pasted Terminal command → dig-TXT dead-drop C2 → osascript/JXA implant with LaunchAgent persistence, credential theft, and reverse-shell tasking

https://slapopotamus.github.io/HuntPack/hunts/CVE-2026-9862-Fortra-BoKS-Hunt.html 2026-06-28T00:00:00Z 2026-06-28T00:00:00Z

An unauthenticated, network-reachable OS command-injection flaw (CVSS 9.8) in the boks_autoregisterd autoregistration service on TCP 6507 . A crafted registration request injects shell commands that run with the service's privileges on the BoKS server — the Unix/Linux access-control hub. Compromise of a PAM appliance is a keys-to-the-kingdom event. Defensive hunt & harden pack — no offensive code / no exploit.

https://slapopotamus.github.io/HuntPack/hunts/PrinzEugen-Ransomware-Hunt.html 2026-06-28T00:00:00Z 2026-06-28T00:00:00Z

Compromised RDP access → Chrome-staged payload in the Music folder → RemotePC RMM + PowerShell stagers from a hardcoded C2 → rogue local admin (admin/germania) → hands-on-keyboard data theft → ChaCha20-Poly1305 encryptor (servertool.exe) that hits recently-modified files first, drops no note, and self-deletes. New June-2026 Go encryptor attributed to actor ROOTBOY. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/Lantronix-EDS5000-CVE-2025-67038-Hunt.html 2026-06-27T00:00:00Z 2026-06-27T00:00:00Z

OT serial-to-Ethernet converter — unauthenticated root command injection via LuCI JSON-RPC auth endpoint. CISA KEV, exploited in the wild.

https://slapopotamus.github.io/HuntPack/hunts/TonRAT-PhotoZIP-Hospitality-Hunt.html 2026-07-24T00:00:00Z 2026-06-27T00:00:00Z

Microsoft-reported multi-stage intrusion delivering a Node.js implant (TonRAT) with TON-blockchain C2 resolution — targeting hotels & hospitality across Europe and Asia.

https://slapopotamus.github.io/HuntPack/hunts/macOS-Gaslight-Hunt.html 2026-06-27T00:00:00Z 2026-06-27T00:00:00Z

aarch64 ad-hoc-signed Rust implant that masquerades inside Apple's LaunchAgent namespace, exfils over Telegram Bot API, and embeds a prompt-injection blob aimed at LLM-assisted triage. Reported ~2026-06-25.

https://slapopotamus.github.io/HuntPack/hunts/AryStinger-Botnet-Hunt.html 2026-06-26T00:00:00Z 2026-06-26T00:00:00Z

4,300+ legacy D-Link routers & QNAP NAS turned into "Executor" proxy/recon nodes via decade-old N-day exploits · DNS hijacking, internal scanning, traffic tunneling · QiAnXin XLab

https://slapopotamus.github.io/HuntPack/hunts/Cisco-CUCM-CVE-2026-20230-Hunt.html 2026-06-26T00:00:00Z 2026-06-26T00:00:00Z

Unauthenticated SSRF in the WebDialer service chains to arbitrary file-write, an Apache Axis2 JSP webshell, and root on the call-control appliance · exploited in the wild

https://slapopotamus.github.io/HuntPack/hunts/CitrixBleed3-CVE-2026-3055-Hunt.html 2026-06-25T00:00:00Z 2026-06-25T00:00:00Z

Citrix NetScaler ADC / NetScaler Gateway out-of-bounds memory read (SAML IdP) → session-token disclosure → session hijacking. Companion: CVE-2026-4368.

https://slapopotamus.github.io/HuntPack/hunts/ContagiousInterview-BeaverTail-Hunt.html 2026-07-24T00:00:00Z 2026-06-25T00:00:00Z

DPRK recruitment-themed phishing → actor GitHub repos → cross-platform loaders → crypto-wallet & credential theft. Aliases: Famous Chollima, Void Dokkaebi, HexagonalRodent (Lazarus cluster).

https://slapopotamus.github.io/HuntPack/hunts/DroppingElephant-Fondue-Hunt.html 2026-07-24T00:00:00Z 2026-06-24T00:00:00Z

India-nexus espionage actor (APT-C-17 / Patchwork) abuses the signed Microsoft binary Fondue.exe to side-load a malicious APPWIZ.cpl and run a Donut-staged in-memory RAT, persisting via a one-minute "GoogleErrorReport" scheduled task.

https://slapopotamus.github.io/HuntPack/hunts/FlutterShell-FlutterBridge-Hunt.html 2026-07-24T00:00:00Z 2026-06-24T00:00:00Z

CL-CRI-1089 spreads a Flutter-built macOS backdoor through Google/YouTube malvertising fronted by Google-verified shell companies; apps masquerade as AI PDF/podcast tools, hijack Chrome traffic, and exfiltrate browser and credential data.

https://slapopotamus.github.io/HuntPack/hunts/OXLOADER-CastleStealer-Hunt.html 2026-07-24T00:00:00Z 2026-06-24T00:00:00Z

Russian-speaking, financially-motivated malvertising crew loads a heavily-obfuscated Windows loader (OXLOADER) via fake Node.js installers, dropping the CastleStealer .NET infostealer.

https://slapopotamus.github.io/HuntPack/hunts/ClickFix-Loaders-Hunt.html 2026-06-23T00:00:00Z 2026-06-23T00:00:00Z

A June 2026 ClickFix surge tricks users into copy-pasting attacker PowerShell from fake CAPTCHA / "verify you are human" / fake browser-update pages, then drops THREE distinct loaders (BabaDeda, Lorem Ipsum, Potemkin) that fan out to .NET backdoors, infostealers, RATs and Rhysida-linked ransomware. Defensive hunt & harden pack — no malicious code.

https://slapopotamus.github.io/HuntPack/hunts/LiteSpeed-cPanel-CVE-2026-54420-Hunt.html 2026-06-23T00:00:00Z 2026-06-23T00:00:00Z

A low-privileged shared-hosting tenant (FTP or web-shell access) plants a symbolic link inside a docroot; the privileged LiteSpeed plugin process follows it and performs a file operation as root , escaping the CageFS tenant boundary and taking over the whole server. Actively exploited (CISA KEV). Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/WhatsApp-VBScript-ManageEngine-RMM-Hunt.html 2026-06-23T00:00:00Z 2026-06-23T00:00:00Z

Compromised WhatsApp accounts DM heavily-obfuscated .vbs "documents" → WhatsApp.Root.exe (Desktop) spawns wscript.exe → secondary VBScript payloads (UAC tamper + ZIP fetch) → a legitimate ManageEngine RMM Central agent is installed as a covert backdoor. Infrastructure overlaps prior Gh0st RAT / ValleyRAT activity. Defensive hunt & harden pack — no malicious code.

https://slapopotamus.github.io/HuntPack/hunts/AMOS-Stealer-macOS-Hunt.html 2026-07-24T00:00:00Z 2026-06-22T00:00:00Z

ClickFix-style fake-app / Terminal-paste lures deliver a curl|sh loader that copies the macOS Keychain, harvests Chrome/Edge secrets and developer keys, then exfiltrates via chunked HTTP PUT. macOS endpoints; actively distributed.

https://slapopotamus.github.io/HuntPack/hunts/SHEETCREEP-TransparentTribe-Hunt.html 2026-07-24T00:00:00Z 2026-06-22T00:00:00Z

Diplomatic-themed ISO phishing lure delivers a ~20 KB C# RAT (vaultsvc.exe) that abuses the Google Sheets API as its C2 — one victim tab per host, Base64 traffic, XOR-obfuscated config, and PowerShell executed in-process to leave no child process. Pakistan-aligned espionage; Securonix continuation of the Zscaler-documented family.

https://slapopotamus.github.io/HuntPack/hunts/UniFi-OS-RCE-Chain-Hunt.html 2026-07-24T00:00:00Z 2026-06-22T00:00:00Z

Three chained CVSS-10.0 flaws in the UniFi OS Server auth gateway + package-update service → unauthenticated root command execution via a single crafted HTTP request. Active exploitation reported; forged sessions persist after patching.

https://slapopotamus.github.io/HuntPack/hunts/GentleKiller-Hunt.html 2026-07-24T00:00:00Z 2026-06-22T00:00:00Z

In-house EDR-killer suite (8+ variants) · kernel-level process termination via vulnerable drivers · pre-encryption defense teardown

https://slapopotamus.github.io/HuntPack/hunts/TrapDoor-Hunt.html 2026-07-24T00:00:00Z 2026-06-22T00:00:00Z

npm + PyPI + Crates.io coordinated campaign · developer-machine credential & wallet theft · AI-assistant config poisoning

https://slapopotamus.github.io/HuntPack/hunts/VoidStealer-Hunt.html 2026-07-24T00:00:00Z 2026-06-22T00:00:00Z

MaaS infostealer · first ITW weaponization of a debugger + hardware-breakpoint bypass of Chrome Application-Bound Encryption · no injection, no SYSTEM

https://slapopotamus.github.io/HuntPack/hunts/FortiBleed-CVE-2026-24858-Hunt.html 2026-07-24T00:00:00Z 2026-06-21T00:00:00Z

CVE-2026-24858 · FortiCloud SSO SAML authentication bypass · ~75,000 FortiGate appliances with leaked admin/SSL-VPN credentials & config exports (mid-June 2026)

https://slapopotamus.github.io/HuntPack/hunts/Miasma-RedHat-npm-SupplyChain-Hunt.html 2026-06-21T00:00:00Z 2026-06-21T00:00:00Z

Shai-Hulud-family self-propagating npm worm · "Phantom Gyp" install-time execution via weaponized binding.gyp · multi-cloud secret theft (GitHub / npm / AWS / Azure / GCP / Vault / Kubernetes)

https://slapopotamus.github.io/HuntPack/hunts/TwillTyphoon-FDMTP-Hunt.html 2026-07-24T00:00:00Z 2026-06-21T00:00:00Z

Chinese APT espionage campaign: DLL side-loading of legitimate binaries (Sogou Pinyin, Visual Studio, ClickOnce) to launch a modular .NET RAT (FDMTP) over CDN-impersonating C2. Aliases: Earth Preta · Stately Taurus · Bronze President · Mustang Panda · TA416. APAC/Japan, late Sep 2025–Apr 2026.

https://slapopotamus.github.io/HuntPack/hunts/Exchange-OWA-CVE-2026-42897-Hunt.html 2026-07-24T00:00:00Z 2026-06-20T00:00:00Z

Actively exploited stored/reflected XSS in Outlook Web Access — weaponized email drives JavaScript execution in the OWA session. On-prem Exchange only.

https://slapopotamus.github.io/HuntPack/hunts/JetBrains-Marketplace-AIPlugin-SupplyChain-Hunt.html 2026-07-24T00:00:00Z 2026-06-20T00:00:00Z

15 DeepSeek-themed IDE plugins covertly exfiltrate developer OpenAI / DeepSeek / SiliconFlow API keys to a plaintext-HTTP C2. ~70,000 installs.

https://slapopotamus.github.io/HuntPack/hunts/Splunk-CVE-2026-20253-RCE-Hunt.html 2026-06-20T00:00:00Z 2026-06-20T00:00:00Z

PostgreSQL sidecar unauthenticated file-write chains to remote code execution on the Splunk host · CISA KEV, exploited in the wild

https://slapopotamus.github.io/HuntPack/hunts/CryptoBandits-Clipper-Hunt.html 2026-06-19T00:00:00Z 2026-06-19T00:00:00Z

A Windows cryptocurrency clipper (Trojan:Win32/CryptoBandits) that swaps attacker wallet addresses into the clipboard, harvests seed phrases / private keys, captures screenshots, and exfiltrates over a bundled portable Tor client via a local SOCKS5 proxy (127.0.0.1:9050). It self-propagates through malicious LNK shortcuts on USB media and runs an EVAL-driven backdoor. Active since February 2026; disclosed by Microsoft Threat Intelligence on 2026-06-17. This is a Falcon-side endpoint behavioral + IOC hunt pack. Defensive hunt & harden pack — no malware code.

https://slapopotamus.github.io/HuntPack/hunts/DragonForce-BackdoorTurn-Hunt.html 2026-06-19T00:00:00Z 2026-06-19T00:00:00Z

DragonForce affiliates deploy a custom Go-based RAT, Backdoor.Turn, that hides its command-and-control inside legitimate Microsoft Teams/Skype infrastructure: it obtains an anonymous Teams visitor token, relays through a real Microsoft TURN server, then runs a QUIC session to the attacker C2 — so defenders see only outbound traffic to Microsoft. The RAT is injected into the legitimate Sysinternals DbgView64.exe process after ransomware is staged. First known in-the-wild abuse of TURN-relay infrastructure for C2 (technique = Praetorian "Ghost Calls"). Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/F5-NGINX-CVE-2026-42530-Hunt.html 2026-06-19T00:00:00Z 2026-06-19T00:00:00Z

Two critical (CVSS v4 9.2) remote, unauthenticated memory-corruption flaws in NGINX. CVE-2026-42530 is a use-after-free in the HTTP/3 (QUIC) module; CVE-2026-42055 is a heap overflow in the HTTP/2 proxy & gRPC modules. Both can crash NGINX workers (DoS) and yield arbitrary code execution where ASLR is disabled or bypassed. F5 shipped out-of-band patches ~17–18 Jun 2026. This is a Falcon-side endpoint hunt for post-exploitation off the NGINX worker plus a vulnerable-version inventory. Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/CVE-2026-48907-Joomla-JCE-Hunt.html 2026-07-24T00:00:00Z 2026-06-18T00:00:00Z

Chained authorization + file-validation failure in the JCE profile-import workflow → webshell upload → arbitrary PHP execution on Linux web servers. Actively exploited; CISA KEV.

https://slapopotamus.github.io/HuntPack/hunts/Fortinet-FortiSandbox-CVE-2026-39813-Hunt.html 2026-06-18T00:00:00Z 2026-06-18T00:00:00Z

CVE-2026-39813 (auth-bypass path traversal) · CVE-2026-39808 & CVE-2026-25089 (OS command injection) — unauthenticated RCE on the FortiSandbox appliance management plane

https://slapopotamus.github.io/HuntPack/hunts/Mastra-npm-easy-day-js-SupplyChain-Hunt.html 2026-07-24T00:00:00Z 2026-06-18T00:00:00Z

144 @mastra packages backdoored via a typosquat dependency that drops a detached crypto-stealing RAT through an obfuscated postinstall hook.

https://slapopotamus.github.io/HuntPack/hunts/APT37-NarwhalRAT-Hunt.html 2026-06-17T00:00:00Z 2026-06-17T00:00:00Z

A DPRK-nexus espionage campaign (Genians Security Center, June 2026) that opens with spear-phishing emails impersonating Microsoft account-security / OTP-abuse alerts , designed to alarm the recipient into opening a ZIP archive disguised as a Microsoft security advisory . The ZIP carries a malicious LNK that launches a multi-stage, largely in-memory chain — env-var-obfuscated batch scripts that download and run NarwhalRAT , a compiled-Python RAT with keylogging, screen capture, audio recording and data collection. C2 is a dead-drop resolver abusing legitimate Korean websites plus pCloud storage. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/SprySOCKS-Windows-Hunt.html 2026-06-17T00:00:00Z 2026-06-17T00:00:00Z

ESET (June 16, 2026) documented two previously unseen Windows ports of the China-nexus SprySOCKS backdoor — historically a Linux-only implant — attributed to FishMonger (linked to the I-Soon contractor). WIN_PLUS loads via the Print Spooler (a print-processor loader injecting svchost.exe ); the stealthier WIN_DRV ships a kernel-mode driver acting as a rootkit — hiding files, processes, registry keys, and network connections, and rerouting traffic from any open port to the backdoor's hidden port when a packet marker appears (port-knocking covert channel). Both retain the Linux C2 protocol/encryption over TCP, UDP, and WebSocket, and run 30+ espionage commands. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/UNC5221-Brickstorm-M365-Hunt.html 2026-06-17T00:00:00Z 2026-06-17T00:00:00Z

A long-dwell Chinese espionage campaign (June 2026 reporting) that lived inside victim Microsoft 365 / Entra ID environments for roughly 18 months . UNC5221 plants its signature Brickstorm backdoor on internet-facing edge/appliance devices that don't run EDR, proxies through them to defeat Conditional Access, then deploys two newer families — Plenet (.NET cross-platform backdoor) and AgentPSD (Python reverse-shell backup) — and also compromises the victim's MSP for onward access. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/AtomicArch-AUR-SupplyChain-Hunt.html 2026-06-16T00:00:00Z 2026-06-16T00:00:00Z

Attackers seized abandoned / maintainer Arch User Repository (AUR) packages and rewrote their PKGBUILD build scripts to deploy malware at build/install time . A Rust-compiled Linux ELF infostealer (sample "deps") harvests developer secrets — SSH keys, cloud/dev tokens, browser & Electron sessions — and, with root, loads an eBPF rootkit to hide. 408 packages compromised in the first wave (Jun 11), >1,500 by Jun 12. Sonatype-2026-003775 · CVSS 8.7. Linux endpoint hunt & harden pack — defensive only, no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/AwesomeMotive-CDN-WordPress-SupplyChain-Hunt.html 2026-06-16T00:00:00Z 2026-06-16T00:00:00Z

A compromised Awesome Motive CDN API key let attackers inject malicious JavaScript into three popular WordPress plugins served from the vendors' official CDNs. The tampered JS runs in a logged-in administrator's browser and abuses that authenticated session to silently create hidden rogue admin accounts ( developer_api1 / dev_* ) and install self-hiding backdoor plugins ( content-delivery-helper , database-optimizer ); new credentials are exfiltrated to the typosquat C2 domain tidio.cc . ~1.2M WordPress sites exposed. First activity 2026-06-12; PushEngage CDN nodes served the payload through 2026-06-14. Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/Ivanti-Sentry-CVE-2026-10520-Hunt.html 2026-06-16T00:00:00Z 2026-06-16T00:00:00Z

Unauthenticated OS command injection (CWE-78) in the Sentry web app's ConfigServiceController : an unauthenticated POST to /mics/api/v2/sentry/mics-config/handleMessage reaches handleExecute() and runs attacker-supplied OS commands as root . CVSS 10.0 · CISA KEV (~2026-06-12, 3-day remediation deadline 2026-06-14) · mass-exploited within 24h of patch with a public PoC; Shadowserver observed most internet-exposed gateways backdoored. Fixed in 10.5.2 / 10.6.2 / 10.7.1 (patched 2026-06-10). Companion flaw CVE-2026-10523 disclosed alongside. Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/CVE-2026-11645-Chromium-V8-Hunt.html 2026-06-15T00:00:00Z 2026-06-15T00:00:00Z

An out-of-bounds read AND write in V8, Chrome's JavaScript/WebAssembly engine. A crafted HTML page yields arbitrary code execution inside the browser renderer/sandbox. Exploit confirmed in the wild; CISA KEV 2026-06-09. Fixed in Chrome 149.0.7827.102/.103. This is a Falcon-side endpoint hunt for post-exploitation from a browser parent plus a vulnerable-version inventory. Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/CVE-2026-45247-Magento-MirasvitCacheWarmer-Hunt.html 2026-07-24T00:00:00Z 2026-06-15T00:00:00Z

PHP Object Injection via attacker-controlled CacheWarmer cookie → unserialize() → Monolog gadget chain → remote code execution. Hunt the web host running Falcon.

https://slapopotamus.github.io/HuntPack/hunts/CVE-2026-7473-Arista-EOS-Hunt.html 2026-07-24T00:00:00Z 2026-06-15T00:00:00Z

Unverified tunnel protocol type lets a switch decapsulate & forward unexpected tunneled packets — bypassing network segmentation. Exploited as a zero-day; no patch planned.

https://slapopotamus.github.io/HuntPack/hunts/Cisco-SD-WAN-Manager-CVE-2026-20245-Hunt.html 2026-07-24T00:00:00Z 2026-06-14T00:00:00Z

Authenticated netadmin → root command injection via crafted CLI file upload (vconfd) — zero-day, no patch, config pushed to edge devices · suspected UAT-8616

https://slapopotamus.github.io/HuntPack/hunts/PAN-OS-GlobalProtect-CVE-2026-0257-Hunt.html 2026-07-24T00:00:00Z 2026-06-14T00:00:00Z

Unauthenticated attacker bypasses portal/gateway auth to establish a VPN session — actively exploited (Unit 42)

https://slapopotamus.github.io/HuntPack/hunts/PeopleSoft-CVE-2026-35273-Hunt.html 2026-07-24T00:00:00Z 2026-06-14T00:00:00Z

ShinyHunters / UNC6240 unauthenticated PSEMHUB exploitation → MeshCentral RMM, SSH fan-out, data theft & extortion

https://slapopotamus.github.io/HuntPack/hunts/CVE-2026-20131-Interlock-CiscoFMC-Hunt.html 2026-06-13T00:00:00Z 2026-06-13T00:00:00Z

Insecure deserialization of a user-supplied Java byte stream on the Cisco Secure FMC web-management interface lets an unauthenticated attacker execute arbitrary Java code as root via crafted HTTP requests. CVSS 10.0. Exploited as a zero-day by the Interlock ransomware group since 2026-01-26 — 36 days before Cisco's 2026-03-04 disclosure. Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/CVE-2026-50751-CheckPoint-VPN-Hunt.html 2026-06-13T00:00:00Z 2026-06-13T00:00:00Z

Improper authentication (CWE-287) in the deprecated IKEv1 key exchange: an unauthenticated remote attacker bypasses Remote Access / Mobile Access certificate validation and establishes a VPN tunnel without a valid user password. CVSS 9.3 · CISA KEV (2026-06-08) · actively exploited since 2026-05-07 with a Qilin ransomware affiliate linked to post-compromise activity. Fixed by hotfix sk185033. Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/NeedleStealer-Hunt.html 2026-06-13T00:00:00Z 2026-06-13T00:00:00Z

A modular Golang infostealer / MaaS that lands via a fake AI-trading site ( tradingclaw[.]pro ) and via Amadey / GCleaner / CountLoader. Its chain sideloads iviewers.dll and process-hollows into RegAsm.exe , installs a malicious browser extension under %LOCALAPPDATA%\Packages\Extensions that intercepts MetaMask / Phantom seed phrases, and exfiltrates browser creds, wallets, Telegram/FTP data and clipboard over HTTP C2. Documented April 2026, active build observed 2026-06-03. Defensive hunt & harden pack — no malware code.

https://slapopotamus.github.io/HuntPack/hunts/RemusStealer-Hunt.html 2026-06-12T00:00:00Z 2026-06-12T00:00:00Z

A large malware-distribution ecosystem (Check Point Research, June 2026) that runs 100+ SEO-poisoned sites impersonating open-source developer/security tools (Ghidra, dnSpy, SpiderFoot, ILSpy, grpcurl, mqttexplorer, mfcmapi, CrystalDiskMark…). A CloudFront-hosted JavaScript layer turns a "Download" click into a handoff to a gated Traffic Distribution System (TDS) that delivers RemusStealer (20+ browsers, wallets, password managers, 2FA), AnimateClipper (clipboard wallet-address swapper), and SessionGate (heavily-obfuscated multi-stage loader). Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/ConsentFix-Hunt.html 2026-06-12T00:00:00Z 2026-06-12T00:00:00Z

Lure → legit first-party-app sign-in → victim pastes the localhost auth-code URL → attacker redeems it for access + refresh tokens and operates from their own infra. MFA & most Conditional Access bypassed. Identity-log hunt — detection lives in Entra, not the endpoint.

https://slapopotamus.github.io/HuntPack/hunts/RoguePlanet-Hunt.html 2026-06-12T00:00:00Z 2026-06-12T00:00:00Z

TOCTOU race in Defender's file-processing path → NTFS junction redirect → MsMpEng.exe (SYSTEM) writes/executes attacker content on fully-patched Windows 10/11. Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/WinRAR-CVE-2025-8088-Hunt.html 2026-06-12T00:00:00Z 2026-06-12T00:00:00Z

Path-traversal via NTFS ADS (patched WinRAR 7.13, Jul 2025, still exploited) → Startup-folder LNK → cmd → PowerShell → GIFTEDCROOK, plus Gamaredon's HTA→VBScript GammaLoad/GammaSteel. Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/TheGentlemen-Ransomware-Hunt.html 2026-06-11T00:00:00Z 2026-06-11T00:00:00Z

FortiOS exploit (CVE-2024-55591) → AD recon → BYOVD EDR-kill → self-propagating Go encryptor ( .i8p14s ). Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/CVE-2026-41091-Hunt.html 2026-06-12T00:00:00Z 2026-06-11T00:00:00Z

Improper link resolution (CWE-59) in the Microsoft Malware Protection Engine: an unprivileged user writes a crafted file to a privileged location, MMPE follows the symlink/junction and writes it back as SYSTEM. KEV-listed, exploited in the wild (Nightmare Eclipse). Patched in MMPE v1.1.26040.8. Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/INC-Ransom-Hunt.html 2026-06-10T00:00:00Z 2026-06-10T00:00:00Z

RaaS double-extortion operation clustering attacks on legal & professional-services firms in 2026. Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/Salt-Typhoon-UAT-9244-Hunt.html 2026-06-10T00:00:00Z 2026-06-10T00:00:00Z

China-nexus telecom espionage toolkit. Windows backdoor (TernDoor), cross-arch ELF P2P backdoor (PeerTime), and a GoLang edge-device brute-force ORB (BruteEntry). Defensive hunt & harden pack — no offensive tradecraft.

https://slapopotamus.github.io/HuntPack/hunts/CVE-2026-41089-Netlogon-Hunt.html 2026-06-09T00:00:00Z 2026-06-09T00:00:00Z

Unauthenticated 0-click stack overflow in netlogon.dll → SYSTEM on any Domain Controller. Defensive hunt & harden pack — no exploit code.

https://slapopotamus.github.io/HuntPack/hunts/ShaiHulud-Hades-PyPI-Hunt.html 2026-06-12T00:00:00Z 2026-06-09T00:00:00Z

Self-propagating credential-stealing worm trojanizing scientific & developer-tooling PyPI packages. A .pth Python startup hook pulls the Bun runtime and runs an obfuscated payload that harvests cloud/CI tokens, then re-publishes via stolen credentials. Cross-ecosystem (npm + PyPI). Defensive hunt & harden pack — no malicious code.

https://slapopotamus.github.io/HuntPack/hunts/IronWorm-Hunt.html 2026-06-12T00:00:00Z 2026-06-05T00:00:00Z

An evolved Shai-Hulud-family worm (JFrog, 3 Jun 2026). A malicious npm install hook drops a ~976 KB Rust ELF that harvests ~86 env vars + 20+ credential files, steals Exodus wallet seeds, ships an eBPF kernel rootkit (process/socket hiding), beacons over Tor , and self-propagates using stolen npm Trusted-Publishing creds. Targets Web3/crypto developers. Defensive hunt & harden pack.

https://slapopotamus.github.io/HuntPack/hunts/UNC3753-Hunt.html 2026-06-12T00:00:00Z 2026-06-05T00:00:00Z

A financially-motivated, ex-Conti cluster that calls employees posing as IT/help-desk, talks them into a screen-share or installing a remote-access tool , then searches, stages, and exfiltrates data — often in under an hour — and extorts (no encryption). 2026 escalations added physical office intrusions. Defensive hunt & harden pack — the front line here is people + RMM governance.

https://slapopotamus.github.io/HuntPack/hunts/MuddyWater-Hunt.html 2026-06-12T00:00:00Z 2026-06-05T00:00:00Z

Iran's Ministry of Intelligence & Security cyber-espionage group. 2026 campaigns deliver the Rust implant RustyWater and lean on a custom PowerShell-C2 lineage (POWERSTATS → MuddyC3 → PhonyC2 → MuddyC2Go → DarkBeatC2) plus heavily-abused RMM tools (Atera, ScreenConnect, SimpleHelp, N-able). Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/SocGholish-Hunt.html 2026-06-12T00:00:00Z 2026-06-05T00:00:00Z

Compromised legitimate sites serve fake browser-update prompts → ZIP with an obfuscated JS loader run by wscript.exe → system profiling, WebDAV/SCF NTLM coercion, a Python backdoor, and hand-off to RansomHub affiliates. Defensive hunt & harden pack — no malicious code.

https://slapopotamus.github.io/HuntPack/hunts/Qilin-Hunt.html 2026-06-12T00:00:00Z 2026-05-26T00:00:00Z

Edge-VPN / Veeam access → AD recon → Mimikatz cred theft → defense evasion (log clearing, service kill, symlink-eval) → PsExec/vCenter self-propagation → backup destruction → Rust/C double-extortion encryptor. The most active RaaS of 2026 (~500 victims YTD). Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/LummaC2-Hunt.html 2026-06-12T00:00:00Z 2026-05-26T00:00:00Z

ClickFix / fake-CAPTCHA "paste-and-run" → mshta/PowerShell IEX → loader → process hollowing into OpenWith.exe / more.com → browser creds, cookies, 2FA, wallets & CLI tokens exfiltrated to TeslaBrowser/5.5 C2. Activity dropped after the May-2025 takedown but the ClickFix delivery chain remains pervasive. Defensive hunt & harden pack.

https://slapopotamus.github.io/HuntPack/hunts/NetSupportManager-Hunt.html 2026-06-12T00:00:00Z 2026-05-26T00:00:00Z

A legitimate commercial RMM (NetSupport Manager) weaponized as a RAT via fake browser updates, ClickFix, malvertising, and phishing (LNK/PDF). The tell-tale signal: client32.exe + client32.ini running from %ProgramData% / %AppData% instead of Program Files. Defensive hunt & harden pack — no malicious code.

https://slapopotamus.github.io/HuntPack/hunts/ScarletGoldfinch-Hunt.html 2026-06-12T00:00:00Z 2026-05-26T00:00:00Z

Red Canary-tracked activity cluster: compromised sites push a fake browser-update ( updateinstaller.zip ) running malicious JavaScript — or, since 2025, a ClickFix fake-CAPTCHA paste-and-run — that installs NetSupport Manager RAT (and, since late 2025, Remcos). Defensive hunt & harden pack — no malicious code.

https://slapopotamus.github.io/HuntPack/hunts/PayoutsKing-Hunt.html 2026-06-12T00:00:00Z 2026-05-26T00:00:00Z

GOLD ENCOUNTER runs the PayoutsKing ransomware operation by hiding tradecraft inside a QEMU virtual machine : a TPMProfiler scheduled task launches a hidden Alpine VM as SYSTEM (disks disguised as .db / .dll ), forwards ports over a reverse-SSH tunnel, and runs AdaptixC2 / Chisel / Rclone inside the VM to evade endpoint security. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/TamperedChef-Hunt.html 2026-06-12T00:00:00Z 2026-05-26T00:00:00Z

A global malvertising operation distributing code-signed fake productivity apps (AppSuite PDF, Calendaromatic, OneZip, CrystalPDF) via fake download sites. The Electron apps look legitimate and stay dormant — payloads (infostealers, RATs, browser hijackers) often activate ~56 days after install to evade analysis. Defensive hunt & harden pack — no malicious code.

https://slapopotamus.github.io/HuntPack/hunts/Mini-Shai-Hulud-Hunt.html 2026-06-12T00:00:00Z 2026-05-23T00:00:00Z

TeamPCP's self-propagating credential-stealing worm. It hijacks GitHub OIDC tokens to re-publish across 170+ npm/PyPI packages (@tanstack/*, @mistralai/*, @uipath/*, @opensearch-project/*), forges SLSA provenance, scrapes OIDC tokens from CI-runner memory, hooks AI coding agents/IDEs, and arms a dead-man's-switch that wipes $HOME if tokens are revoked before it's removed. Sibling of the later "Hades" wave. Defensive hunt & harden pack.

https://slapopotamus.github.io/HuntPack/hunts/DriftToken-SalesforceOAuth-Hunt.html 2026-06-12T00:00:00Z 2026-05-19T00:00:00Z

UNC6395 stole OAuth tokens from the Salesloft Drift integration and used that trusted API access to bulk-export data from 700+ orgs' Salesforce instances (Aug 8–18, 2025) — then secret-scanned the loot for AWS keys, Snowflake & VPN credentials. A SaaS supply-chain breach: detection lives in Salesforce/SaaS audit logs, not the endpoint. Defensive hunt & harden pack.

https://slapopotamus.github.io/HuntPack/hunts/AmberAlbatross-Hunt.html 2026-06-12T00:00:00Z 2026-05-18T00:00:00Z

Red Canary-tracked activity cluster: installers masquerading as free utilities (PcAppStore, Bit Driver Updater, Malware Crusher) drop an InnoSetup payload that, through an obfuscated, anti-analysis chain, unpacks a Pyarmor-protected PyInstaller executable launched via cmd.exe / powershell.exe — a stealer that runs a familiar reconnaissance burst. Defensive hunt & harden pack.

https://slapopotamus.github.io/HuntPack/hunts/Medusa-BYOVD-Hunt.html 2026-06-12T00:00:00Z 2026-05-17T00:00:00Z

The Medusa RaaS operation (Spearwing / FROZEN SPIDER / Storm-1175) deploys ABYSSWORKER , a malicious kernel driver ( smuol.sys and rotating names) that mimics CrowdStrike's CSAgent.sys and disables EDR via BYOVD before encryption. Delivered by a HEARTCRYPT -packed loader and signed with revoked, stolen certificates (POORTRY lineage). Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/APT28-PRISMEX-Hunt.html 2026-06-12T00:00:00Z 2026-05-16T00:00:00Z

Russia's APT28 (Fancy Bear) exploits a Microsoft Office RTF security-feature-bypass (CVE-2026-21509) in phishing against Central/Eastern European & Ukrainian government targets. The RTF drops MiniDoor (an Outlook email stealer, a stripped NotDoor variant) and PixyNetLoader , which deploys a Covenant Grunt implant. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/QEMU-Hunt.html 2026-06-12T00:00:00Z 2026-05-13T00:00:00Z

Threat actors (Sophos clusters STAC4713 and STAC3725 ) deploy a portable QEMU hypervisor on a compromised Windows host and run a hidden virtual machine — a lightweight Linux/backdoor guest that proxies C2 and runs tooling outside the host EDR's visibility. The same VM-as-evasion playbook cross-links the PayoutsKing activity. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/MimiCRAT-Hunt.html 2026-06-12T00:00:00Z 2026-05-12T00:00:00Z

A multi-stage intrusion chain (Elastic Security Labs) that starts with a ClickFix social-engineering lure, runs an obfuscated PowerShell downloader, bypasses ETW/AMSI, then uses a Lua-based in-memory loader to stage Meterpreter-style shellcode and a native C++ remote-access trojan, MIMICRAT (a.k.a. AstarionRAT) — with token theft, a SOCKS5 proxy, and malleable C2 over HTTPS. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/PhantomVault-Hunt.html 2026-06-12T00:00:00Z 2026-05-12T00:00:00Z

An intrusion set (Elastic REF6598 ) that abuses the legitimate Obsidian note-taking app — via DLL side-loading — to launch PHANTOMPULSE , a modular RAT whose C2 configuration is resolved from a public blockchain (smart-contract / EtherHiding-style resilient C2) rather than a fixed domain. Defensive hunt & harden pack — no offensive code.

https://slapopotamus.github.io/HuntPack/hunts/SilentCanvas-Hunt.html 2026-06-12T00:00:00Z 2026-05-12T00:00:00Z

A fileless intrusion chain that hides obfuscated PowerShell inside a fake image ( sysupdate.jpeg with no JPEG magic bytes ), compiles a custom launcher on-host via csc.exe , performs a fileless ComputerDefaults.exe UAC bypass , then installs a trojanized ConnectWise ScreenConnect client as a service masquerading as OneDriveServers for persistent remote access. Defensive hunt & harden pack — no offensive code.