🕵️‍♂️ 🏴󠁧󠁢󠁥󠁮󠁧󠁿 𝗨𝗞 𝗰𝗼𝘂𝗻𝗰𝗶𝗹 𝗯𝗿𝗲𝗮𝗰𝗵 𝘁𝗿𝗮𝗰𝗲𝘀 𝘁𝗼 𝗺𝗮𝘀𝘀 𝗦𝗼𝗻𝗶𝗰𝗪𝗮𝗹𝗹 𝗦𝗠𝗔𝟭𝟬𝟬𝟬 𝗲𝘅𝗽𝗹𝗼𝗶𝘁𝗮𝘁𝗶𝗼𝗻 On 17 July, King's Lynn and West Norfolk Borough Council went public with a cyberattack on its services. The @BBC covered it. We assess with moderate confidence it connects to something much larger. Two days after @SonicWall disclosed CVE-2026-15409, an operator was already scanning and exploiting SMA1000 appliances at scale. We found the whole operation in an open directory, captured by AttackCapture the same day it was still in use. The interesting part is what they did with the appliances. Instead of pivoting to a Windows host, they dropped a standalone Linux build of Impacket's secretsdump straight onto the SonicWall box and ran credential theft from there. Most orgs watch their EDR-covered endpoints closely and their firewall and VPN appliances barely at all. That gap is the whole point. What the recovered data showed: - 250 targets identified as exploitable, LDAP config pulled from 168 of them - 534 config records covering 160 unique AD domains and 255 internal LDAP servers - SAM and LSA secrets recovered from at least 9 Active Directory domains - Full DCSync against 7 domain controllers across 5 environments - Confirmed credential theft spanning France, India, Italy and the US Targeting was opportunistic, not sector-specific. Local government, healthcare, universities, finance and manufacturing all showed up in the target list, they picked victims because the appliance was vulnerable. Full writeup, IOCs and MITRE mapping here 👇 hunt.io/blog/sonicwall-sma10…

🚨 𝗥𝗲𝗱𝗶𝘀 𝗖𝗿𝘆𝗽𝘁𝗼𝗺𝗶𝗻𝗶𝗻𝗴 𝗕𝗼𝘁𝗻𝗲𝘁: 𝟯,𝟱𝟲𝟮 𝗦𝗲𝗿𝘃𝗲𝗿𝘀 𝗖𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲𝗱, 𝗘𝘅𝗽𝗼𝘀𝗲𝗱 𝗯𝘆 𝘁𝗵𝗲 𝗢𝗽𝗲𝗿𝗮𝘁𝗼𝗿'𝘀 𝗢𝘄𝗻 𝗙𝗶𝗹𝗲𝘀 An open directory on a Hetzner box left the whole operation sitting in plain view. Not just a payload, the operator's entire working toolkit: exploit source, campaign logs, a bundled Python runtime, even two exported Windows registry hives. We parsed their own campaign logs instead of trusting the summaries their scripts print. Here is what the numbers actually say: → 3,562 distinct Redis servers compromised, out of 12,966 targeted, across two separate runs → Only one technique worked at scale: rogue replication (SLAVEOF/RDB) into a cron entry that pulls XMRig → SSH key injection and MongoDB sandbox escape returned zero across 2,810 attempts → Victims run everything from Redis 2.8.17 (2015) to 7.2.0 (2023), so the weakness is missing auth, not a version bug → The same Monero wallet links this campaign to a separate February 2026 directory in Moldova, pushing known activity back at least five months Check out the full breakdown 👇 hunt.io/blog/redis-cryptomin…

🇨🇳 🤖 𝗡𝗘𝗪 𝗥𝗘𝗦𝗘𝗔𝗥𝗖𝗛: 𝗖𝗵𝗶𝗻𝗲𝘀𝗲-𝗦𝗽𝗲𝗮𝗸𝗶𝗻𝗴 𝗢𝗽𝗲𝗿𝗮𝘁𝗼𝗿 𝗨𝘀𝗲𝘀 𝗔𝗜 𝗔𝗴𝗲𝗻𝘁𝘀 𝘁𝗼 𝗧𝗮𝗿𝗴𝗲𝘁 𝗚𝗼𝘃𝗲𝗿𝗻𝗺𝗲𝗻𝘁 𝗮𝗻𝗱 𝗘𝗱𝘂𝗰𝗮𝘁𝗶𝗼𝗻 𝗦𝘆𝘀𝘁𝗲𝗺𝘀 𝗔𝗰𝗿𝗼𝘀𝘀 𝗔𝘀𝗶𝗮 Our research team identified five exposed open directories revealing a campaign that used an orchestration framework called SecFlow to coordinate Claude, Qwen, and DeepSeek AI workers across intrusions targeting government, education, consular, and healthcare systems in Asia. Key observations: - A shared SOCKS endpoint connected all five workspaces, confirmed through 120 code-search matches on our platform - The deepest compromise hit a Fengtai District government OA environment: command execution, LSASS dumps, registry hives, 822 account records extracted, and a Go implant called SecBox deployed - A Chinese education AI platform was compromised, exposing 23 agent configurations, production credentials, and student profile data across 169 conversations - SecFlow split reconnaissance, exploitation, and reporting across specialist AI workers, with the runtime swapping between Claude, Qwen, and DeepSeek without changing the task interface - GLUTTON webshells transported executable bytecode inside PNG image pixels using XOR encryption, loading directly into memory while the visible server file remained a generic decoder - A fake MySQL deserialization service delivered Linux second-stage payloads to vulnerable Java clients that connected to it - Eight CVEs in active workflows, including Shellshock, Spring4Shell, Ghostcat, Log4Shell, Shiro deserialization, Grafana and Nexus path traversals, and Nacos authentication bypass - The AI's shared context amplified a false positive: an unsupported Shiro success claim persisted and drove 27+ follow-up tasks that produced nothing This is the second separate campaign we've tracked where commercial AI models were used as operational components in intrusions. Different infrastructure and tooling from our July report, but the same pattern. Read the full report here👇 hunt.io/blog/chinese-operato…

☢️ 𝗣𝗵𝗶𝗹𝗶𝗽𝗽𝗶𝗻𝗲 𝗡𝘂𝗰𝗹𝗲𝗮𝗿 𝗔𝗴𝗲𝗻𝗰𝘆 𝗮𝗻𝗱 𝗡𝗮𝘃𝗮𝗹 𝗖𝗼𝗻𝘁𝗿𝗮𝗰𝘁𝗼𝗿 𝗧𝗮𝗿𝗴𝗲𝘁𝗲𝗱 𝗯𝘆 𝗦𝘂𝘀𝗽𝗲𝗰𝘁𝗲𝗱 𝗖𝗵𝗶𝗻𝗲𝘀𝗲-𝗦𝗽𝗲𝗮𝗸𝗶𝗻𝗴 𝗢𝗽𝗲𝗿𝗮𝘁𝗼𝗿 𝗨𝘀𝗶𝗻𝗴 𝗞𝗻𝗼𝘄𝗻 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 Hunt.io AttackCapture flagged an open directory on August 13 staging exploit scripts, offensive tooling, and exfiltrated data from two Philippine orgs. - Nuclear research body compromised via CVE-2023-49105 - empty signing secret on ownCloud, default state on new installs, allowing unauthenticated WebDAV file retrieval - 176 files, ~372 MB recovered: reactor core component DB, fuel inventories, radiation safety docs, employee PII, BitLocker keys, KeePass databases - A CSV on the server references ~9 GB marked as exfiltrated - most not visible in the directory - Naval contractor hit via CVE-2024-28000 (LiteSpeed Cache) and XML-RPC brute force with rockyou.txt - both produced unauthorized access - 192 MB ZKTeco BioTime SQL dump with references to multiple affiliated Philippine science and research organizations - Simplified Chinese in docstrings, log markers, and folder names: 核材料账目, 辐射安全, 财务 - Separate, possibly unrelated EtherHiding compromise on the same WordPress site - 174 unique IPs found with the same NoChain loader strings via HuntSQL Full research, IOCs, and MITRE ATT&CK mapping 👇 hunt.io/blog/chinese-speakin…

🎥 Operation CameraSwarm: over 14,000 Dahua cameras compromised across Ukraine and Russia NEW RESEARCH: A single operator left their entire working directory exposed on an open HTTP server. We crawled it and recovered 2,616 files, 407 MB, the full toolkit behind a 35-day camera-compromise campaign. The scanning ran global, but the confirmed compromises landed in 🇺🇦 Ukraine and 🇷🇺 Russia, with Ukraine holding the largest share. What we found: → 14,530+ devices compromised in 35 days, the brute-force engine alone reaching 12,324 unique addresses → 1,923 cameras carrying a persistent backdoor account installed over RPC, surviving a password change and, on most firmware, a factory reset → 283 cameras reached by serial number alone through the cloud relay, most requiring no authentication to open a channel → A separate Windows stealer staged on the same host, unrelated to the camera activity → The toolkit assembled from at least six upstream developers' work, not authored from scratch We assess with moderate confidence the toolkit was built to hand access to a third party, based on its transferable recovery-code design and enterprise-format export pipeline. Full breakdown, indicators, and mitigations 👇 hunt.io/blog/operation-camer…