Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2025-04-01 ⋅ Hunt.io ⋅ Hunt.io
Same Russian-Speaking Threat Actor, New Tactics: Abuse of Cloudflare Services for Phishing and Telegram to Filter Victim IPs
Pyramid
2025-03-31 ⋅ WithSecure ⋅ Jeremy Ong
CrazyHunter: The Rising Threat of Open-Source Ransomware
CrazyHunter
2025-03-25 ⋅ SpyCloud ⋅ James
On the Hunt for Ghost(Socks)
GhostSocks
2025-03-11 ⋅ Hunt.io ⋅ Hunt.io
JSPSpy and ‘filebroser’: A Custom File Management Tool in Webshell Infrastructure
2025-03-04 ⋅ Hunt.io ⋅ Hunt.io
Exposing Russian EFF Impersonators: The Inside Story on Stealc & Pyramid C2
Pyramid Stealc
2025-02-27 ⋅ Hunt.io ⋅ Hunt.io
Uncovering Joker’s C2 Network: How Hunt’s SSL History Exposed Its Infrastructure
Joker
2025-02-20 ⋅ Hunt.io ⋅ Hunt.io
LightSpy Expands Command List to Include Social Media Platforms
lightSpy
2025-02-13 ⋅ Intel 471 ⋅ Intel 471
Threat hunting case study: SocGholish
FAKEUPDATES
2025-02-13 ⋅ Symantec ⋅ Threat Hunter Team
China-linked Espionage Tools Used in Ransomware Attacks
PlugX
2025-02-12 ⋅ Hunt.io ⋅ Hunt.io
Tracking Pyramid C2: Identifying Post-Exploitation Servers in Hunt
Pyramid
2025-02-06 ⋅ Hunt.io ⋅ Hunt.io
SmokeLoader Malware Found in Open Directories Targeting Ukraine’s Auto & Banking Industries
SmokeLoader
2025-02-04 ⋅ Hunt.io ⋅ Hunt.io
GreenSpot APT Targets 163.com Users with Fake Download Pages & Spoofed Domains
GreenSpot
2025-01-28 ⋅ Hunt.io ⋅ Hunt.io
SparkRAT: Server Detection, macOS Activity, and Malicious Connections
SparkRAT
2025-01-25 ⋅ Sophos ⋅ Anthony Bradshaw, Colin Cowie, Daniel Souter, Hunter Neal, Mark Parsons, Sean Baird, Sean Gallagher
Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing”
ReedBed STAC5143 UNC4393
2025-01-23 ⋅ Hunt.io ⋅ Hunt.io
Mapping Suspected KEYPLUG Infrastructure: TLS Certificates, GhostWolf, and RedGolf/APT41 Activity
KEYPLUG
2025-01-16 ⋅ Validin ⋅ Efstratios Lontzetidis
Lazarus APT: Techniques for Hunting Contagious Interview
2025-01-07 ⋅ Hunt.io ⋅ Hunt.io
Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure
Cobalt Strike
2024-12-30 ⋅ Intrinsec ⋅ CTI Intrinsec
CryptBot: Hunting for initial access vectors
CryptBot Lumma Stealer PrivateLoader
2024-12-12 ⋅ Hunt.io ⋅ Hunt.io
Oyster’s Trail: Resurgence of Infrastructure Linked to Ransomware and Cybercrime Actors
Broomstick
2024-12-10 ⋅ Hunt.io ⋅ Hunt.io
“Million OK !!!!” and the Naver Facade: Tracking Recent Suspected Kimsuky Infrastructure
Kimsuky